Quick answer: A good system administrator works from a routine, not from panic. Daily: check backups, monitoring alerts, server health, security alerts and the ticket queue. Weekly: patch review, disk space trends, failed logons, user account changes. Monthly: patching, a test restore, stale accounts, licences, certificates and firmware. Quarterly/yearly: access reviews, DR test, vulnerability scan, hardware lifecycle and documentation review.
Use the checklist tables below as your template: copy them into Excel, SharePoint, your helpdesk tool or a wiki and tick them off.
Last updated: 29 October 2026. Written by a senior IT engineer with 10+ years of hands-on infrastructure and security work.
Most outages are not caused by sudden, unpredictable events. They are caused by things nobody checked: a backup job that failed silently for three weeks, a certificate that expired on Monday morning, a disk that filled up slowly, an admin account nobody disabled after someone left.
This system administrator checklist turns those risks into simple daily, weekly, monthly, quarterly and yearly tasks. It works for Windows Server and Active Directory environments, Microsoft 365 tenants, and hybrid setups, and it also gives you clean evidence for ISO 27001 and other audits.
Table of contents
- Daily checklist (15 to 30 minutes)
- Weekly checklist
- Monthly checklist
- Quarterly checklist
- Yearly checklist
- How to automate the checklist
- Keep evidence (for audits)
- 7 common sysadmin mistakes to avoid
- FAQ
Daily checklist (15 to 30 minutes)
Do this every morning before users start calling. Most of it can be done from dashboards and email reports.
| Task | What to check | Why |
|---|---|---|
| Backups | Last night's backup jobs: success, warnings, failures | A failed backup you don't notice is the most expensive mistake in IT |
| Monitoring alerts | Down hosts, high CPU/RAM, services stopped (Checkmk, Zabbix, PRTG etc.) | Fix problems before users report them |
| Server health | Free disk space, uptime, critical event log errors | Disk-full is a top cause of outages |
| Security alerts | Defender/EDR alerts, risky sign-ins, SIEM alerts | Early detection limits damage |
| Account lockouts | Repeated lockouts (event 4740) and failed logons | Can indicate password spraying or a stuck old device |
| Ticket queue | New, overdue and high-priority tickets | SLAs and user trust |
| Service health | Microsoft 365 Service health and Message center | Know about Microsoft outages before users do |
| Network and internet | Firewall, VPN and ISP link status | Remote workers depend on it |
Weekly checklist
| Task | What to check |
|---|---|
| Patch status | New updates released, devices missing updates, failed installations (WSUS, Intune, ConfigMgr) |
| Disk and capacity trends | Servers and storage growing fast; plan cleanup or expansion |
| User account changes | New accounts, disabled accounts, group membership changes, especially privileged groups |
| Leavers | All leavers' accounts disabled, licences removed, devices collected |
| Failed logons report | Patterns of failed sign-ins in AD and Entra ID |
| Antivirus/EDR coverage | Devices not reporting, outdated signatures |
| Backup storage | Free space on backup targets, offsite/cloud copies completed |
| Open problems | Recurring tickets that need a root-cause fix |
Monthly checklist
| Task | What to do |
|---|---|
| Patch Tuesday | Microsoft releases security updates on the second Tuesday of each month. Test on a pilot group, then deploy to servers and PCs. |
| Test restore | Restore at least one file, one mailbox or one VM from backup. A backup is only proven when a restore works. |
| Stale accounts | Find users and computers not logged in for 90 days; disable after confirmation. |
| Privileged access | Review Domain Admins, Enterprise Admins and Global Administrators; remove anyone who no longer needs it. |
| Licences | Microsoft 365 and software licences assigned vs. used; reclaim unused ones. |
| Certificates | SSL/TLS, VPN and app certificates expiring in the next 60 days. |
| Firmware and drivers | Firewall, switches, server BIOS/iDRAC/iLO, storage firmware updates. |
| Logs and storage cleanup | Old logs, temp files, old installers, orphaned VM snapshots. |
| Monthly report | Uptime, tickets, incidents, patch compliance, backup success rate for management. |
Quarterly checklist
- Access review: managers confirm who should have access to shared folders, apps and admin roles.
- Vulnerability scan: scan servers and network devices (for example with Greenbone OpenVAS or your vendor tool) and track fixes.
- Firewall rule review: remove unused and "any-any" rules, document the rest.
- Disaster recovery mini-test: restore a critical server or application in an isolated environment.
- Group Policy and Intune policy review: remove unused policies, check conflicts.
- Asset inventory: compare your asset register (for example Snipe-IT) with what is actually in use.
- Documentation update: network diagrams, IP plan, admin procedures, contact lists.
- Phishing awareness: a short user reminder or simulated phishing test.
Yearly checklist
- Full disaster recovery test with management sign-off.
- Hardware lifecycle: list servers, laptops, switches and firewalls reaching end of warranty or end of support; budget replacements.
- Software end-of-support check: Windows versions, Windows Server, SQL Server, Office/Microsoft 365 apps and other key software. For example, Office 2021 and Windows 11 version 24H2 (Home and Pro editions) reached end of support in October 2026.
- Renewals: domain names, SSL certificates, support contracts, licences.
- Policy review: password, backup, access control, acceptable use and incident response policies.
- Audit readiness: collect a year of evidence for ISO 27001 or other audits.
- Skills plan: training and certifications for yourself and the team.
How to automate the checklist
You do not need to check everything by hand. Automate the boring parts and only look at exceptions:
- Monitoring: use free tools like Checkmk, Zabbix or Uptime Kuma for alerts. See our list of 22 free open-source IT tools.
- Security logs: send Windows and Active Directory logs to a SIEM such as Wazuh, and alert on lockouts, privileged group changes and cleared logs.
- PowerShell reports: schedule scripts that email daily disk space, stale account and password-expiry reports. Ready-made examples: PowerShell automation scripts and PowerShell scripts for helpdesk.
- Microsoft 365: use alert policies, Secure Score and Message center email digests.
- Recurring tickets: create scheduled tickets in your helpdesk (for example osTicket or GLPI) for monthly and quarterly tasks, so nothing is forgotten.
Keep evidence (for audits)
For each checklist item, keep simple proof: a screenshot, exported report or ticket number with the date. Auditors (ISO 27001, SOC 2, internal audit) typically ask for:
- Backup success reports and test restore records.
- Patch compliance reports.
- Access review sign-offs and leaver checklists.
- Vulnerability scan results and remediation tickets.
- Change records for major changes.
7 common sysadmin mistakes to avoid
- Never testing restores. "Backup successful" is not the same as "restore works".
- Using a Domain Admin account for daily work. Use a normal account and a separate admin account.
- Ignoring certificate expiry dates until something breaks.
- No documentation. If only one person knows how something works, it is a risk.
- Patching without a pilot group. Test on a few machines first.
- Not disabling leavers on time. Old accounts are a favourite entry point for attackers.
- Making changes on Friday evening without a rollback plan.
FAQ
What does a system administrator do daily?
A system administrator checks backups, monitoring alerts, server health and security alerts, handles tickets and user requests, and works on planned changes such as patching, upgrades and automation.
How often should servers be patched?
Most organisations patch monthly after Microsoft's Patch Tuesday, testing on a pilot group first. Critical, actively exploited vulnerabilities should be patched as soon as possible, often within days.
How often should I test backups?
Test at least one restore every month, and run a larger disaster recovery test every quarter or year, depending on how critical your systems are.
What is the best tool to manage a sysadmin checklist?
Use what your team already has: recurring tickets in your helpdesk, a SharePoint list, Microsoft Planner or a simple Excel sheet. The important part is ownership and evidence, not the tool.
Is this checklist useful for ISO 27001?
Yes. Many items (backups, access reviews, patching, vulnerability management, logging) map to common ISO 27001 Annex A controls, and the evidence you keep supports audits.
Final words
A checklist makes you calm, consistent and audit-ready. Start with the daily list for one week, automate what you can, then add the weekly and monthly items. Your future self (and your manager) will thank you the next time something goes wrong at 9 a.m. on a Monday.
Related guides: Active Directory interview questions, 25 Conditional Access policies every Entra tenant needs and secure data wiping for ISO 27001.
Adapt this checklist to your environment, policies and compliance requirements.
){kind=link}
0 Comments