Free Checklist Templates for Systems Administration

Systems Administration

OR

Quarterly Network Security Review

Identity & Access Review

Audit Entra ID conditional access policies

Verify MFA coverage on privileged accounts

Remediate MFA gaps before continuing

Run access review on Tier 0 groups

Disable accounts inactive 90+ days

Confirm legacy basic-auth is blocked

Firewall & Network Segmentation

Audit edge firewall rule base for any-any rules

Validate VLAN segmentation against network diagram

Close unused ports from last vulnerability scan

Update firmware on edge devices

Detection & Response Posture

Verify EDR agent coverage on all endpoints

Check IDS/IPS signature freshness

Confirm penetration test cycle status

Schedule penetration test with vendor

Run ransomware tabletop exercise

Review last quarter's IR tickets for patterns

Encryption & Key Management

Verify TLS 1.2+ on all public endpoints

Audit BitLocker recovery key escrow

Rotate service account credentials in PAM

Confirm backup immutability and offsite copy

Logging & SIEM Health

Validate log ingestion from critical sources

Open P1 ticket for missing log sources

Tune SIEM rules with high false-positive rate

Test alert routing through on-call tool

File quarterly review report with findings

View Workflow Use Workflow

Release Management Checklist

Change Planning and RFC

Document the change scope and business driver

Map impacted systems and downstream dependencies

Attach the rollback runbook

Classify the change type

Schedule the maintenance window

Pre-Deployment Validation

Deploy the build to the test ring

Run the smoke test suite on staging

Verify the most recent backup is restorable

Dry-run the rollback procedure on staging

Log defects and known issues for the change record

CAB Review and Communication

Submit the RFC to the CAB queue

Present the change at CAB

Send maintenance notice to affected users

Confirm on-call coverage for the window

Deployment Execution

Snapshot production hosts before cutover

Execute the deployment runbook

Run post-deploy smoke tests against production

Execute the rollback procedure

Post-Release Closure

Monitor systems through the stabilization period

Hold the post-implementation review

Update the CMDB and runbook documentation

Close the change record with outcome and artifacts

View Workflow Use Workflow

Rollback Plan Checklist

Pre-Rollback Preparation

Identify the target known-good version

Verify last successful backup and snapshot

Notify stakeholders of the rollback window

Document the trigger for rollback

Assign rollback roles and bridge

Execution of Rollback

Confirm privileged access and break-glass

Pause monitoring and automation jobs

Execute the documented rollback steps

Capture the rollback execution result

Escalate to vendor and restore from backup

Post-Rollback Verification

Run the smoke-test suite

Validate data integrity post-rollback

Re-enable monitoring and scheduled jobs

Notify stakeholders the rollback is complete

Close the change record and schedule PIR

View Workflow Use Workflow

Security Audit Checklist

Access Control and Identity Hygiene

Pull the Entra ID and AD account inventory

Review Tier 0 and privileged group membership

Confirm MFA enforcement and block legacy auth

Disable accounts inactive over 90 days

Audit sign-in logs for impossible travel

Network Security

Review firewall rule base for stale entries

Verify network device firmware versions

Audit VPN and ZTNA configurations

Scan external interfaces for open ports

Close unused ports and file an exception record

Data Protection and Backup

Verify encryption at rest on file shares

Run a backup restore drill

Open a P1 ticket with the backup vendor

Confirm the immutable offsite copy exists

Audit access to PHI and PII shares

Software and Vulnerability Management

Review patch compliance across deployment rings

Inventory installed software per endpoint

Remove unauthorized software and update SAM

Run an authenticated vulnerability scan

Triage and assign CVE remediation tickets

Incident Response Readiness

Review the incident response runbook

Run a tabletop exercise with the IR team

Verify SIEM log retention and coverage

Document audit findings and sign off

View Workflow Use Workflow

Server Backup Checklist

Pre-Backup Planning

Inventory protected workloads and RPO/RTO

Confirm 3-2-1 coverage per workload

Verify retention against compliance policy

Review storage capacity and headroom

Backup Job Configuration

Validate backup software version and patches

Configure full, incremental, and synthetic-full jobs

Set repository targets and offsite copy job

Wire alerts to PagerDuty and the PSA

Execution and Monitoring

Run the scheduled backup window

Review job results and capture status

Triage failed jobs and open tickets

Confirm offsite copy replication caught up

Restore Verification

Run a sandboxed test restore

Escalate to backup engineer for failed restore

Verify encryption keys are escrowed

Sign off the cycle and update the runbook

View Workflow Use Workflow

Server Build and Hardening Checklist

Pre-Rack Preparation

Confirm rack location and U-allocation

Verify shipment against the BOM

Confirm the server role

Reserve hostname, IP, and DNS records

Physical Install and Firmware

Rack the chassis and dress cables

Connect dual power feeds and network uplinks

Configure iLO, iDRAC, or IPMI access

Update BIOS, BMC, and RAID firmware

Build RAID volumes per the role spec

Operating System Install

Confirm OS family for the build

Provision the OS via PXE or vendor image

Apply the role-specific partitioning scheme

Install OS patches and reboot

Install vendor drivers and management agents

Network and Identity Integration

Configure static IP and VLAN tagging

Join the server to Active Directory

Verify DNS resolution and outbound reachability

Enroll the host in monitoring

Security Hardening

Apply the CIS benchmark baseline

Disable legacy protocols and unused services

Configure the host firewall ruleset

Enroll in EDR and forward logs to the SIEM

Run a vulnerability scan against the host

Remediate critical findings and rescan

Validation and Handoff

Run a test backup and verify restore

Document the build in IT Glue or Hudu

Capture system-owner sign-off

View Workflow Use Workflow

Server Decommissioning Checklist

Discovery and Dependency Mapping

Identify the server and capture its CMDB record

Map running services and listening ports

Identify upstream and downstream dependencies

Confirm whether workloads need migration

Document the migration target and cutover plan

Change Approval and Communication

Submit the change request to CAB

Notify application owners and end users

Confirm compliance and data-retention obligations

Backup and Snapshot

Take a final full backup

Test-restore a sample to confirm backup integrity

Export configuration and secrets to the vault

Decommission Execution

Stop services and disable scheduled tasks

Remove DNS records and load balancer pool members

Disable the AD computer object and service accounts

Disconnect from the network and remove monitoring

Hold the soak period to surface missed dependencies

Restore the server and reopen the dependency ticket

Media Sanitization and Disposal

Sanitize storage media per NIST SP 800-88

Remove the host from the rack or hypervisor

Hand off hardware to certified e-waste vendor

Closeout and Documentation

Update CMDB and asset management records

Reclaim software licenses and renewals

Close the change ticket with evidence

Run a brief post-mortem with the team

View Workflow Use Workflow

Server Maintenance Checklist

Pre-Maintenance Preparation

Confirm CAB-approved change record

Notify stakeholders of the maintenance window

Verify last successful backup before window

Remediate the failed backup before proceeding

Hardware Inspection

Inspect chassis and clear dust from intakes

Verify rack temperature and airflow

Inspect cabling and PDU connections

Pull diagnostic logs from iLO/iDRAC/IPMI

Test UPS battery health and runtime

Patching and Firmware

Review the patch ring assignment

Apply OS patches via WSUS or Intune

Apply firmware updates from vendor catalog

Reboot and confirm services return healthy

Execute the documented rollback plan

Security Hardening

Review firewall rules and ACL drift

Audit privileged accounts and stale logins

Run authenticated vulnerability scan

Verify EDR agent health and definitions

Performance and Capacity

Review CPU, memory, and IOPS trends

Check disk free space and growth rate

Validate monitoring and alert routing

Backup and DR Validation

Verify nightly job success in backup console

Restore a sample file to isolated environment

Confirm immutable offsite copy is current

Sign off on the maintenance run

View Workflow Use Workflow

Server Security Checklist

User and Access Management

Reconcile accounts against the HR roster

Audit privileged group membership

Verify MFA enforcement on admin accounts

Disable accounts inactive 30+ days

Rotate service account credentials

Network Security

Review firewall rules for unused entries

Verify VLAN segmentation boundaries

Patch firewall and switch firmware

Audit VPN access list against active employees

Confirm legacy authentication is blocked

System and Software Updates

Review pending CVEs in the vuln scanner

Deploy patches to the test ring

Confirm test ring stability after 48 hours

Pause rollout and file a patch exception

Promote patches to production

Document deviations and rollback plan

Backup and Recovery

Verify nightly backup job success

Confirm the immutable offsite copy is current

Run a restore drill to an isolated VM

Open an incident for restore failure

Update the DR runbook with measured RPO/RTO

Logging, Monitoring, and Sign-Off

Confirm SIEM ingestion from critical hosts

Tune alert thresholds to reduce noise

Review IOC hits from the last quarter

Verify log retention meets policy

Sign off on the quarterly security review

View Workflow Use Workflow

Software Installation Checklist

Intake and Change Approval

Capture the software request details

Verify license entitlement and EULA terms

Classify the change type

Submit the change to CAB

Package and Lab Validation

Download the installer from the vendor

Confirm code signature and publisher

Build the deployment package in Intune or RMM

Test the package on a lab VM

Pilot Ring Deployment

Assign the package to the pilot AAD group

Notify pilot users of the rollout window

Monitor pilot install success in the RMM

Triage pilot issues with the package owner

Production Rollout

Send the maintenance window announcement

Promote the package to the production ring

Watch the RMM dashboard during rollout

Execute the rollback plan

Verification and Documentation

Reconcile installs against the license count

Update the documentation runbook

Publish user-facing quick-start guidance

Close the change ticket and notify requester

View Workflow Use Workflow

Software Upgrade Checklist

Pre-Upgrade Preparation

Review the vendor release notes

Verify compatibility with dependent systems

File the change request with the CAB

Schedule the maintenance window

Notify stakeholders and end users

Run a verified backup of affected systems

Document the rollback plan

Test Ring Validation

Apply the upgrade in the test environment

Run the application owner's smoke tests

Investigate test failures before proceeding

Production Upgrade Execution

Suspend monitoring alerts and on-call paging

Disable scheduled tasks and cron jobs

Stop the application and dependent services

Take a pre-upgrade VM snapshot

Apply the upgrade package

Review the installer logs for errors

Restart application services and verify startup

Rollback (If Upgrade Failed)

Execute the documented rollback plan

Notify stakeholders of the rollback

Open a vendor support case

Post-Upgrade Validation

Run smoke tests against production

Re-enable scheduled tasks and monitoring

Watch dashboards for performance anomalies

Update IT Glue or Hudu documentation

Close the change ticket and notify stakeholders

Hold a 7-day post-upgrade health review

View Workflow Use Workflow

System Monitoring Checklist

Network Monitoring

Confirm all monitored devices are reachable

Review NetFlow for traffic anomalies

Audit firewall rule hits and denies

Check WAN bandwidth utilization

Verify VPN tunnel health

Server Performance

Check CPU utilization across hosts

Review memory pressure and ballooning

Verify disk capacity on critical volumes

Plan capacity remediation for full volumes

Confirm critical services are running

Triage Windows and Linux event logs

Security and Compliance

Confirm EDR signatures and agents are current

Review patch compliance against last Patch Tuesday

Investigate failed authentication patterns

Open an incident response ticket

Spot-check privileged group membership

Verify backup job success and immutability

Application Monitoring

Review uptime against SLA targets

Triage application error logs

Check database query performance

Validate API endpoint health

Inspect application resource consumption

Alerting and Reporting

Review the overnight alert queue

Tune noisy alert thresholds

Confirm escalation chains routed correctly

Publish the daily monitoring report

Verify monitoring tools are themselves healthy

View Workflow Use Workflow

User Access Review Checklist

Review Scoping and Data Pull

Confirm in-scope systems and frameworks

Export the active user roster from HRIS

Pull entitlement reports from each system

Reconcile system accounts against HRIS

Account Verification

Disable accounts for terminated employees

Inventory all service and shared accounts

Flag dormant accounts over 90 days

Confirm MFA enrollment for every active user

Entitlement and Role Review

Distribute manager attestation packets

Review privileged group membership

Check segregation of duties conflicts

Capture manager attestation results

Revoke flagged entitlements in source systems

Approval Process Audit

Sample new-access tickets from the cycle

Verify each ticket has documented approval

Document the bypass remediation plan

Reporting and Sign-Off

Generate the audit evidence package

Schedule the next quarterly review window

Obtain CISO and control owner sign-off

View Workflow Use Workflow

User Offboarding Checklist

Pre-Departure Coordination

Confirm departure details with HR

Pull the user's access inventory from the IdP

Determine mailbox and file disposition with the manager

Identity and Access Revocation

Disable the account in Entra ID or AD

Revoke active sessions and refresh tokens

Remove MFA methods and registered devices

Block legacy authentication and email forwarding

Revoke VPN and ZTNA access

Remove from security groups and distribution lists

Mailbox and Files Handling

Execute the mailbox disposition decision

Transfer OneDrive or Google Drive ownership

Audit and reassign shared mailbox permissions

Archive Teams and Slack DMs per retention policy

SaaS Application Deprovisioning

Deactivate non-SSO SaaS accounts from the inventory

Audit GitHub or GitLab org membership

Rotate shared credentials the user knew

Reclaim or reassign software licenses

Endpoint and Hardware Retrieval

Initiate device retrieval logistics

Confirm device received and condition

Issue remote wipe through Intune or JAMF

Archive BitLocker or FileVault recovery keys

Wipe and reimage the endpoint

Recover physical access items

Closeout and Follow-Up Audit

Notify stakeholders that offboarding is complete

Update directory, org chart, and on-call rotations

File the offboarding record in the PSA or ITSM

Run the 30-day orphan access audit

Run the 90-day final access review

View Workflow Use Workflow

User Onboarding Checklist

Pre-Day-1 Setup

Confirm hire details from HR

Map the role to security groups and license SKUs

Pull or order hardware from stock

Identity & Account Provisioning

Create the Entra ID account in the correct OU

Assign security groups per the access matrix

Provision the M365 mailbox and assign license

Block legacy auth via Conditional Access

Endpoint Provisioning

Enroll the laptop in Intune via Autopilot

Archive the BitLocker recovery key in escrow

Deploy the CrowdStrike Falcon agent

Ship the laptop to the remote employee

Access & Authentication

Configure Okta SSO and app catalog

Enroll the user in Duo MFA on Day 1

Provision privileged access via CyberArk

Verify VPN or ZTNA login from the new device

Orientation, Training & Audit

Run the Day 1 IT orientation session

Assign KnowBe4 security awareness training

Capture AUP signature and asset receipt

Schedule the 30-day access audit

View Workflow Use Workflow

User Role Management Checklist

Role Definition & Scoping

Capture the business justification and role owner

Map permissions to a least-privilege baseline

Classify the role's privilege tier

Check for segregation-of-duties conflicts

Document compensating controls for the SoD conflict

Obtain data owner approval for the role

Role Provisioning in the Identity Provider

Create the security group in Entra ID

Map app entitlements via SCIM or SAML

Scope conditional access policies to the group

Document the role in IT Glue or Hudu

User Assignment & Access Grant

Verify the user's eligibility against the HR record

Add the user to the security group

Enroll the user in CyberArk PAM

Notify the user with role description and AUP

Validate effective access via test login

Role Modification & Drift Control

File the change request with an RFC number

Assess blast radius and downstream impact

Route high-impact changes through the CAB

Push the entitlement update via SCIM

Periodic Review & Retirement

Schedule the quarterly access review

Identify stale or orphaned roles via the RMM report

Reassign active members to surviving roles

Delete the role after the disable retention period

File the access review attestation

View Workflow Use Workflow

←
1
2
3
→

Ready to take control of your recurring tasks?

Start Free 14-Day Trial

Use Slack? Sign up with one click

With Slack

Company

About
Product Roadmap
API Reference
Privacy Policy
Terms
Contact Us
Blog

Resources

Help
Getting Started Guides
Video Center
Demos
Your Account
Use Cases
Pricing

©Manifestly 2026

When you visit or interact with our sites, services or tools, we or our authorised service providers may use cookies for storing information to help provide you with a better, faster and safer experience and for marketing purposes.