Most IT incidents are preceded by a warning nobody was looking for. These are the checks worth automating, roughly in order of how much trouble they prevent.
Daily
Backups completed and are restorable
Not "the job ran". A job can complete successfully while backing up nothing useful.
Check that each expected backup exists, that its size is within a sensible range of yesterday's, and periodically that a test restore succeeds. The size check catches the common failure where a backup runs against an empty or unmounted source.
Businesses discover backup failures during a recovery, which is the worst possible time. See backups that actually restore.
Disk space
Unglamorous and responsible for a large share of unplanned outages. Alert at a threshold that leaves time to act, and report the trend rather than only the current figure — a server that has lost ten per cent a week is a different problem from one that has been at eighty per cent for two years.
Failed sign-ins and unusual authentication
A spike in failures against one account, successful sign-ins from unexpected countries, or authentication from an impossible sequence of locations. These are the earliest signals of an account compromise.
Services and scheduled tasks that should be running
Anything the business depends on that could stop quietly. The absence of an error is not evidence that something is working.
Weekly
Certificate and domain expiry
Report anything expiring within sixty days: SSL certificates, domain registrations, and any code signing or authentication certificates.
An expired SSL certificate produces a full-page browser warning that stops traffic dead. An expired domain is considerably worse. Both are entirely preventable and both still happen regularly, because renewal depends on somebody remembering a date set a year earlier.
Mail forwarding rules to external addresses
One of the most valuable security checks available and one of the least run.
When an account is compromised, a common first action is a rule forwarding mail to an external address, often combined with a rule that deletes the forwarded copies so the user notices nothing. A weekly report of every external forwarding rule catches this quickly.
It also catches legitimate rules nobody knew about, which are a data protection issue in their own right.
Accounts without multi-factor authentication
Including service accounts and any account created for a short-term purpose and forgotten. One unprotected account is the whole point of attack — see passwords, passkeys and MFA.
Dormant accounts
Accounts with no sign-in for sixty or ninety days. These are usually leavers whose accounts were never disabled, and they are both a licence cost and a security exposure.
Administrative group membership
Who holds elevated permissions, and has it changed? Administrative access accumulates. A weekly diff against the expected list catches both mistakes and the early stages of a compromise.
Monthly
Licence assignment against actual use
Licences assigned to people who have left, duplicate licences, and expensive licences assigned to users who only need a cheaper one.
This check regularly pays for the entire automation effort in its first run, particularly after any price change — see the Microsoft 365 price increase.
Devices not checking in
Machines that have not reported for a month are either unused, off the network, or lost. All three warrant a look, and the last is a data protection question.
Updates not applied
Which machines are behind, and by how much. Aggregated, so it is a report to act on rather than a list to scroll.
Shared mailboxes and sites with no recent activity
Storage costs money and unused shared resources accumulate permissions nobody reviews.
A check nobody reads is worse than no check, because it creates the impression of oversight. Send results to a person, not to a folder.
Making the output usable
The failure mode of automated checking is volume. Twelve daily emails, all saying everything is fine, will be filtered within a fortnight and then genuinely missed.
Report by exception where you can. Silence when everything is well; a message when it is not.
Except for the ones that matter. Backups should confirm success daily, because absence of a message could mean the check itself failed.
Consolidate. One weekly summary is read. Six separate reports are not.
Send to a person with a name. A shared mailbox nobody owns is where checks go to be ignored.
Alert on the check failing, not only on what it finds. A monitoring script that has been erroring since March is a silent gap.
Where to start
Backups, certificate expiry and external mail forwarding rules. Those three cover the most common outage, the most avoidable outage and the most common security incident respectively.
Add the rest as you go. Each is a small piece of work and each removes a category of unpleasant surprise.
Our maintenance team runs these checks for UK businesses as part of managed support, with results going to a named person rather than a dashboard. Start a conversation.
