jx: I feel this is really critical - this must be customizable. These kind of mirrors tend to blow up in size quickly. The way we have set up our servers is that there is a relatively small system partition which gets frequently imaged so that

  • you can perform the back up quickly in a time window that doesn’t interfere with productivity
  • restore the servers to a working state very fast in case of crash. Stuff like WSUS updates and similar resides on a different volume and while still backed up, it is much less frequently since it simply is not critical (we talk about daily vs. biweekly approximately). Simply because these data can be downloaded again without any information loss, at just the cost of the bandwidth. Either by replication from other LAN servers or, worst case, redownloaded from upstream ones.
  • I had an experience with Symantec Endpoint Protection which was heavily confused by workarounds such as symlinks/hardlinks/junctions. Pretty sure sloppy programing (the entire SEP thing has been an absolute nightmare) but better to avoid such design problems from the very beginning.