# Duplicati v2.4.0.0_stable_2026-09-03

- Product: Duplicati (https://whatsnew.fyi/product/duplicati)
- Vendor: Duplicati
- Date: 2026-09-03
- Version: v2.4.0.0_stable_2026-09-03
- Original notes: https://github.com/duplicati/duplicati/releases/tag/v2.4.0.0_stable_2026-09-03
- Permalink: https://whatsnew.fyi/product/duplicati/releases/v2.4.0.0-stable-2026-09-03

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Require exact data folder permissions and refuse to use data folders with incorrect permissions, previously silently locked down
- **added** — Add --allow-insecure-datafolder flag, DUPLICATI__ALLOW_INSECURE_DATAFOLDER environment variable, and insecure-permissions.txt file in installation folder to opt out of permission checks
- **added** — Add secure-datafolder command to ConfigureTool to force correct permissions on data folder
- **changed** — Move insecure-permissions.txt file location from data folder to installation folder
- **removed** — Remove support for preload.json at /usr/local/share/Duplicati/preload.json and C:\ProgramData\Duplicati\preload.json
- **security** — Load preload.json only if folder passes permission check or opt-out methods are activated
- **added** — Add sync copy mode that simply copies files from source to destination with support for one-way sync and optional deletion with --sync-then-delete
- **added** — Add --sync-remote-state option with UseRemoteState, UseLocalState, and BlindlyUpload settings to control remote file tracking during sync
- **added** — Support sync jobs with remote sources, snapshots, and multiple destinations
- **added** — Add sync mode configuration via UI toggle in first step and CLI support
- **changed** — Integrate service installation and TLS certificate generation into Windows installer with simple checkboxes
- **added** — Auto-generate secure password and configure TrayIcon to connect to service when installing from regular user account
- **changed** — Configure Windows service as delay-start service to avoid startup issues on boot
- **added** — Add live-reporting module to send current progress of backups to user-specified URL for dashboards
- **added** — Support multiple activity targets and metadata in activity reports from live-reporting module
- **added** — Add pluggable parity module that produces error-correction data for remote volumes with par2
- **added** — Add --parity-module=par2 option to enable par2 error-correction data generation and upload
- **added** — Revive store-task-config option and enable it by default for encrypted backups to store backup configuration with backup data
- **added** — Add options to store none, self, or all backup configurations with or without secrets for unencrypted backups
- **added** — Update UI to allow restoring backup configuration from destination and selecting multiple configurations to restore

This release is a stable release that supersedes the 2.3.0.4 stable release. It contains all changes from the 2.3.1.0 and 2.3.1.1 beta releases.

#### Breaking change: Locked-down data folder permissions

This release hardens security around the data folder and is a **breaking change** for some setups.

_For most users, this should not be a problem as the folders should already have the correct permissions._

Duplicati now **requires** that the data folder has the exact expected permissions, or it will refuse to use it. Previously, Duplicati would silently lock down the folder if it was not already locked.

To opt out of the permission check, you need to either pass `--allow-insecure-datafolder`, set the environment variable `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true`, or place a file named `insecure-permissions.txt` in the installation folder.

Note that the previous method of placing `insecure-permissions.txt` in the data folder is no longer supported.

This change also applies to `preload.json`, such that it will only be loaded if the folder is trusted, or one of the opt-out methods are activated. Additionally, the previous trusted paths `/usr/local/share/Duplicati/preload.json` and `C:\ProgramData\Duplicati\preload.json` are no longer supported as they cannot be guaranteed to be locked down.

A `preload.json` inside the data folder is still supported, provided the folder passes the permission check.

The `ConfigureTool` has a new `secure-datafolder` command that can be used to force the correct permissions on the data folder.

For most users this should not cause any problems, as Duplicati has been locking down the folder already, but if you rely on lax folder permissions the setup needs to change. Some Docker setups may not be able to set the permissions and will need to apply `DUPLICATI__ALLOW_INSECURE_DATAFOLDER=true` in the image to run without the protections.

#### Sync copy mode

This release adds an often requested feature that enables simple copying of files from source to destination.
Where the regular backups are deduplicated, compressed, encrypted and versioned, the new sync mode will instead simply copy from source to destination.

The copy is currently a one-way sync, where the source is replicated on the destination. Files can be deleted on the destination during sync (use `--sync-then-delete`), but destination folders will not be deleted.

The option `--sync-remote-state` is by default set to `UseRemoteState` which will list the destination and figure out what to upload. The setting `UseLocalState` uses a local database, similar to how backups work, to keep track of known remote files, and reduce the amount of remote listings done. Finally, the `BlindlyUpload` setting will just copy everything as-is to the remote.

The sync jobs support remote sources, snapshots, and multiple destinations. If snapshots are enabled, the copy is done from the snapshot, ensuring reliable reads.

Configuration of such a sync job is done the same way as with backup, but using a toggle option in the first step of the UI. Note that backup and sync jobs are not compatible as they use very different storage logic, so it is not possible to change the job mode after creating a job.

CLI mode also supports sync.

#### Improved Windows installer

This change brings a major update to the Windows installers, which now integrates the ability to run as a service, as well as generate and use TLS (https). The service feature has been present for a while in the `WindowsService.exe` tool and the TLS certificates were added as part of the `Duplicati.CommandLine.ConfigureTool.exe`. With this update these things are now integrated into the installer, and exposed as simple checkboxes to toggle the features. Installing the service from a regular user account, will also auto-generate a secure password and configure the TrayIcon to connect to the service (only for the current user).

If you have installed the service manually, do not activate the new

_[Truncated at 4000 characters — full notes: https://github.com/duplicati/duplicati/releases/tag/v2.4.0.0_stable_2026-09-03]_