Configuring WORM Shared Drive on ENAS

Write Once, Read Many (WORM) storage helps protect important data from ransomware, unauthorized changes, and accidental deletion. Once a file is locked in a WORM shared drive, it cannot be modified or deleted until its retention period ends.

Create a WORM Shared Drive

Only the Console Owner can create a WORM shared drive.

1. Go to your UniFi Drive > All Files. 
2. Click New Shared Drive. 
3. Enter the shared drive details and select a storage pool.
4. Enable WORM.
5. Select Enterprise or Compliance mode.
6. Optionally enable Auto Write Lock and configure its settings.
7. Click Add.

Choose a WORM Mode

Select Compliance mode only when it meets your organization's regulatory and legal requirements. Confirm your retention policy with your compliance or legal team before creating the shared drive.

Understand File Lock States

Files in a WORM shared drive can have the following states:

• Editable: The file can be edited, renamed, or deleted.
• Immutable: The file cannot be modified, renamed, or deleted until its retention period ends.
• Append-Only: Existing content cannot be changed, but new data can be added to the end of the file.
• Expired: The retention period has ended. The file remains read-only, but it can be deleted if no other restriction applies.

Lock Files Automatically or Manually

Files in a WORM shared drive remain editable until they are locked. Only the Console Owner and admins can lock files automatically with Auto Write Lock or manually with Lock Immediately.

Configure Auto Write Lock

When you enable Auto Write Lock, UniFi Drive locks files automatically according to the selected lock status and retention period.

1. Open the WORM shared drive.
2. Click Auto Write Lock Settings.
3. Select one of the following Lock Status options: Immutable or Append-Only.
4. Select when to lock files:
   • Lock After: Locks a file after it has not been modified for the specified period.
   • Lock Immediately: Locks new files immediately after they are created.
5. Select a retention period:
   • Lock Period: Retains the file for the specified period.
   • Lock Forever: Retains the file indefinitely.
6. Click Save.

When many files become eligible for locking at the same time, UniFi Drive processes the locks in the background. Some files may take longer to display as locked.

Lock a File Manually

Admins can lock an editable file manually.

1. Open the WORM shared drive and select the file.
2. Click Lock Immediately.
3. Select one of the following Lock Status options: Immutable or Append-Only.
4. Select a retention period:
   • Lock Period: Retains the file for the specified period.
   • Lock Forever: Retains the file indefinitely.
5. Click Save.

Admins can permanently convert an append-only file to an immutable file and extend a file's retention period. Retention periods cannot be shortened.

Windows ACL on Locked and Expired Files

When Windows ACL and subfolder permission control for Shared Drives is enabled in UniFi Drive > Settings > Services > File Services, UniFi Drive freezes a file's access control list (ACL) when the file becomes locked. The permissions remain unchanged after the file enters the Expired state.

• Permissions on locked and expired files cannot be changed.
• Admins and file owners cannot add, remove, or modify permissions for these files.

This prevents users from changing access permissions after data has been locked.

Recover Data from Snapshots

WORM shared drives use a forward-only recovery model to help protect retained data.

• You cannot roll back a WORM shared drive directly to a snapshot.
• To recover data, open the snapshot and use Copy to restore files to the active shared drive.
• Restored files are placed in a separate folder named Snapshot_<drive name>_<YYYY-MM-DD_HH-MM-SS> to avoid conflicts with locked files.

Snapshots on WORM shared drives can also be locked:

• A Standard lock prevents automatic snapshot rotation.
• An Immutable lock uses a ZFS hold and an extendable retention period. While the retention period is active, it prevents deletion of the shared drive and its storage pool.

Important Considerations

Move Existing Data to a WORM Shared Drive

You cannot convert an existing standard shared drive to WORM storage. To create a WORM copy of an existing shared drive:

1. Go to UniFi Drive > All Files.
2. Select the shared drive.
3. Click Duplicate as WORM Drive.
4. Configure the new WORM shared drive and click Duplicate.

Trash Is Unavailable

Trash is automatically disabled for WORM shared drives. Deleting an editable file removes it immediately.

This prevents deleted files from being retained in the Trash and becoming locked unnecessarily.

Factory Reset with Compliance WORM Drives

You can reset the consoles to factory defaults while compliance WORM drives contain locked data.

• Console settings: Network settings, user accounts, and application settings are reset to their factory defaults.
• WORM drives and protected data: Storage pools and drives containing active compliance WORM locks remain intact. Their data is not formatted, erased, or modified during the reset.

Do Not Use WORM Shared Drives for Time Machine

Do not use a WORM shared drive for macOS Time Machine backups.

Time Machine regularly updates and removes backup data. Backup tasks can fail if Time Machine attempts to modify or delete locked files.

macOS Finder Tags Are Not Supported on Locked Files

Applying or changing Finder tags or color labels modifies file metadata. As a result, macOS displays a permission error when you try to change tags on a locked WORM file.

Enable Storage Encryption When Creating the Shared Drive

If you need encryption at rest, enable it when you create the WORM shared drive. You cannot enable, disable, or change encryption later.

While an encrypted WORM shared drive exists in a storage pool, you cannot change or remove that pool's password.

Use SMB for Compliance-Critical Data

For compliance-critical WORM storage, use SMB rather than NFSv3. SMB provides stronger identity verification and more reliable lock-status synchronization.

Reconfigure Auto Write Lock After Restoring a Configuration Backup

If you restore a system configuration backup created before the WORM shared drive was added, UniFi Drive restores the shared drive and its WORM mode. However, it does not restore the Auto Write Lock settings.

Previously locked files remain protected, but an admin must configure Auto Write Lock again for new files.

Configure Backup Software for Locked Files

Backup software cannot clear the Windows Archive attribute on WORM-locked files.

Configure your backup software to detect changes by using content hashes or file timestamps instead of clearing the Archive attribute.

Exclude Locked Files from Antivirus Scans

Antivirus software may report an error or repeatedly retry an action when it attempts to modify, quarantine, or remove a WORM-locked file.

If this occurs, confirm that the affected file is locked. Then add its path to your antivirus software’s exclusion list, or wait until its retention period ends before taking an action that changes the file.

Processing Large Numbers of Files

When you lock a large number of files at the same time, UniFi Drive processes the locks in the background. Processing time varies depending on the number and size of the files, as well as available system resources.

Approximate processing times are:

• Up to 100,000 files: About 15 minutes
• About 1,000,000 files: About 2 to 3 hours
• 10,000,000 or more files: More than 24 hours

We recommend scheduling large locking operations overnight or during a maintenance window.

Encrypted WORM shared drives require additional processing time.

During processing, files remain available to read. Their lock status updates gradually until UniFi Drive finishes processing all files.

Understand WORM Protection Boundaries

WORM protects files through UniFi Drive and supported UniFi OS workflows. It does not protect data from physical access to disks or unsupported changes to the system.

The following actions are outside the scope of WORM protection:

• Physical disk and hardware operations: Removing disks, formatting them on another device, swapping disks, or making unsupported hardware changes.
• Low-level system changes: Using unauthorized root shell access, custom scripts, unverified kernel patches, or modifying system files outside the UniFi OS console and supported APIs.
• Attempts to bypass security controls: Using unsupported low-level commands to change system security settings.

To maintain WORM protection, manage storage and permissions only through supported UniFi Drive and UniFi OS features.