Taking over an unfamiliar network is mostly archaeology. The temptation is to
start fixing the thing the client is complaining about. We do not, because the
complaint is rarely the risk.
Day one: access
Who can log in, with what
rights, and which of those accounts belong to people who left. Orphaned domain admin
accounts are the single most common finding.
Day two: backups
Not
whether backups run, but whether anyone has restored from one. We restore a real file
to a real machine before we write anything down as working.
Week one:
inventory
Hardware, licences, certificates and renewal dates. An expired
certificate at 2am is an avoidable outage.
