Rules to Better System Administrators

At some point every business will experience a catastrophic incident. At these times it is important to have a plan that explains who to contact, the priority of restore and how to restore services.

At the time of a disaster, you should have a few objectives established and measure some results - The objectives are RPO (Recovery Point Objective) and RTO (Recovery Time Objective); and the measurements to take are RPA (Recovery Point Actual) and RTA (Recovery Time Actual).

It's recommended to practice your disaster recovery at least once every 12 months. This way you make sure that you are investing in the minimum amount of required resources, and that your plan actually works.

For unplanned outages, see Outage - Do you have an unplanned outage process?

If your servers are down or have to go down during business hours you should notify the users at least 15 minutes beforehand so you will not get 101 people all asking you if the computer is down.

For short outages (under 15 minutes) that only affect only a few people (under 5 people), or are outside of business hours, then IM is the best method. If you use Microsoft Teams, a quick message will do.

Note: If they are not online on Teams, then they can't complain that they were not warned.

For extended or planned outages, or if you have a larger number of users (50+), email is the suggested method.

During your course of being a SysAdmin, you will come across many unplanned outages. Some of them will impact BAU (Business as usual) and others will just be minor service outages. Do you know what to do in the event of these outages?

For any kind of backups, it is important to log a record on success so you can check for backups that have failed.

The standard is to enforce policies based on reputable regulatory organizations (e.g. NIST, ACSC) latest recommendations.

You should protect your users and administrator accounts with more than one authentication method.

Do you have Password Writeback enabled in your Entra Connect?

Microsoft Entra Privileged Identity Management (PIM) - formerly Azure Active Directory PIM enables a more secure, manageable and monitorable approach to assigning privileged permissions in your organization.

gMSA (Group Managed Service Accounts) are a secure and practical identity solution from Microsoft where services can be configured to use the gMSA principal and password management is handled by Windows - you don't need to worry about expired passwords anymore.

In an IT industry, there should be a provision to RDP into servers or VMs to access them when needed. Within an organization, it is easier to remotely access laptops or computers connected to the same network.

To RDP, enable Remote desktop in settings How to enable Remote Desktop. Windows has Microsoft Remote desktop connection application inbuilt to RDP to another computer.

Drawbacks of using Microsoft Remote Desktop Connection

• Every time you need to RDP, you have to manually type the IP address or computer name
• List of IPs or device names is not available

❌ Figure: Bad example - Default Remote Desktop Connection

Solution

Devolution is a secure website that offers a free Remote Connection Management called "Remote Desktop Manager", which is built to centralize all remote connections on a single platform that is securely shared between users and across the entire team.

Multiple computers can be remotely accessed at the same time and have a good GUI interface

✅ Figure: Good example - Remote Desktop Manager (Devolutions)

To install the application, check devolutions.net