Server Maintenance Checklist for Windows Server and NAS

Server maintenance is a short list of checks done on a fixed rhythm: backups, alerts and disk space every day, logs and capacity every week, patches and a test restore every month, access and firmware every quarter, and support end dates every year. The aim is that nothing fails without warning and nothing is restored for the first time during an outage. If any server still runs Windows Server 2016, its extended support ends on 12 January 2027, so start the yearly review now. Our server AMC in Dubai covers monitoring, patching, backup checks and remote recovery for Windows servers and NAS units.

What should you check on your servers every day?

• Last night's backups. Every job finished, not just started. Look into any failed or partial job the same day, because tonight's job may fail for the same reason.
• Monitoring alerts. Stopped services, unreachable servers, high CPU or memory use and failed scheduled tasks.
• Disk space. Space left on every volume, especially the system drive and the volumes that hold databases, logs and file shares.
• Disk and RAID health. Warnings from the server's hardware management tool or the NAS console. A degraded array is running with less protection than it was built with, so replace the failed disk as a priority.
• Endpoint protection. Antivirus or EDR running and up to date on every server.

What belongs in the weekly check?

• Event logs. Repeated disk, service, backup and sign-in errors in the Windows event logs, and the same in the NAS system log.
• Accounts. New admin accounts, failed sign-ins on domain controllers, and accounts that should have been disabled.
• Capacity trend. How fast each volume grows, so you know weeks ahead when it will fill.
• Pending updates and reboots. Anything still waiting since the last patch window.
• NAS snapshots. Snapshot and replication schedules ran, and share permissions have not changed without a ticket.

What should you do every month?

Two jobs: patch, then prove that a restore works.

Microsoft schedules its security updates for the second Tuesday of each month, often called Patch Tuesday. Plan your patch window in the days after it:

• Confirm a good backup before you start.
• Patch a less critical server first. If you have two domain controllers, patch one at a time.
• Apply NAS firmware and app updates in the same window, after reading the release notes.
• Reboot, then check that services, applications and shares came back.
• Record what installed and what failed.

For speed, the UK Cyber Essentials scheme is a useful yardstick: updates that fix critical or high-risk vulnerabilities go on within 14 days of release. For tooling, Windows Server Update Services (WSUS) still works, but Microsoft lists it as no longer actively developed. Azure Update Manager can monitor update compliance for on-premises servers connected through Azure Arc, schedule updates in a maintenance window you define and apply updates published to WSUS.

Then restore something real: a folder, a database or a whole server to an isolated location, and time it. CISA's ransomware guidance is to keep offline, encrypted backups of critical data and to regularly test their availability and integrity in a disaster recovery scenario. Our business backup strategy guide explains what counts as a pass.

What goes on the quarterly list?

• Admin access review. Who holds admin rights on each server and NAS, and whether they still need them.
• Firmware and drivers. Server BIOS, RAID controller and disk firmware from the hardware vendor, applied in a planned window.
• Backup scope. New servers, shares and databases added since the last review are in a backup job.
• Alert test. Trigger a harmless alert and confirm it reaches the person who has to act on it.
• Capacity review. Storage, memory and licences against the next 12 months of growth.
• Documentation. Bring the server records described below up to date.

What should the yearly server review cover?

• Support end dates. For every operating system, NAS model and backup product, with a plan for anything that ends in the next 18 months.
• Hardware age and warranty. Replace or extend cover before the warranty lapses on a server the business depends on.
• A full recovery test. Rebuild one critical server from backup, end to end, and compare the time it took with what the business expects. CISA also advises keeping up-to-date golden images of critical systems, so a server can be rebuilt quickly.
• Renewals. Licences, support contracts and certificates that expire in the coming year.

Which Windows Server versions are still supported?

Microsoft lists these end dates for extended support:

• Windows Server 2012 and 2012 R2: support ended on 10 October 2023, and Extended Security Updates (ESUs) ran only until 13 October 2026. Both are now past.
• Windows Server 2016: 12 January 2027.
• Windows Server 2019: 9 January 2029.
• Windows Server 2022: 14 October 2031.
• Windows Server 2025: 14 November 2034.

After the end date a version gets no new security updates, apart from any Extended Security Updates Microsoft offers for it, and Cyber Essentials expects unsupported software to be removed or cut off from the internet. Start an upgrade or a move to the cloud at least a year ahead, because your applications, backup agents and hardware all have to support the new version.

Which server checks need someone on site?

Our server AMC is delivered remotely. Physical checks stay with your own site team, so give one person a short monthly round of the server room or rack:

• Cooling works, the room stays cool, and vents and fans are clear of dust with nothing blocking the airflow.
• Warning lights on servers, disks and the NAS, with a photo sent to whoever manages the servers.
• The UPS self-test passed and its batteries are within their replacement date.
• Power connections are secure and nothing is stacked on or against the equipment.
• The room or rack is locked, and only named people hold the key.

What should your server documentation include?

• Each server and NAS: name, role, location, operating system version, warranty end and support end date.
• What runs on it and who depends on it.
• Admin and service accounts, with the credentials held in a password vault rather than a spreadsheet.
• Backup jobs: what each one covers, where the copies go and how long they are kept.
• Restore steps for each critical server, stored where you can reach them when that server is down.
• Vendor and support contacts, and a change log.

To set recovery targets for each server, see our guide to RPO and RTO planning. On our server AMC, a server that is down is a P1, so an engineer is working on it remotely within 5 minutes, 24/7. If you have your own IT team and only want the servers handled, see server management. To put your servers on this rhythm, tell us what you run.