TL;DR for owners and office managers: the quiet weeks at the end of the year are the cheapest time to fix IT problems, because nothing is on fire and budgets for next year are still open. This list covers the ten things worth checking before January. Most of them take an afternoon. A few of them, like a backup nobody has ever restored, are the difference between a bad day and a closed business.

Find Software That Lost Support

Start here, because unsupported software stops getting security fixes and every other item on this list assumes your systems are still being patched. Microsoft’s lifecycle pages for 2025 and 2026 are the source of truth. The dates that matter most for small offices:

Windows 10. Support ended October 14, 2025. Business PCs can stay protected only through the paid Extended Security Updates program, which runs for a maximum of three years after end of support. If you enrolled, confirm every Windows 10 machine is actually receiving updates. Our guide to Windows 10 ESU enrollment errors covers the common failures.

Windows 11 versions. Version matters as much as the product name. Per Microsoft’s Windows 11 release information, Home and Pro on 24H2 stopped getting updates October 13, 2026, and Enterprise and Education on 23H2 stop November 10, 2026. Version 25H2 is supported for Home and Pro until October 12, 2027, and 26H2 has been available since September 29, 2026. Our post on the 24H2 end of updates walks through moving machines forward.

Office and Exchange. Office 2016, Office 2019, Exchange Server 2016, and Exchange Server 2019 all reached end of support October 14, 2025. Office LTSC 2021 reached its end of support date in October 2026. SharePoint Server 2016 and 2019 and SQL Server 2016 ended July 14, 2026. If any of these are still running, they belong at the top of next year’s budget.

Windows Server. Windows Server 2016 extended support ends in January 2027, so a 2016 domain controller or file server has weeks left. Windows Server 2022 left mainstream support October 13, 2026, and still gets security updates in extended support.

To check what a PC is actually running, this works in any PowerShell window:

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
  Select-Object ProductName, DisplayVersion, CurrentBuild

# Note: ProductName can still say "Windows 10" on Windows 11.
# A CurrentBuild of 22000 or higher means Windows 11.

True Up Microsoft 365 Licenses

Licenses quietly pile up on people who left, shared mailboxes that never needed one, and trials someone forgot to cancel. In the Microsoft 365 admin center, go to Billing, then Licenses, and compare assigned seats against your real headcount. Disabled accounts that still hold a license are the easiest money to recover. This pulls them with the Microsoft Graph PowerShell module:

Connect-MgGraph -Scopes 'User.Read.All'
Get-MgUser -All -Filter 'accountEnabled eq false' -Property DisplayName, UserPrincipalName, AssignedLicenses |
  Where-Object { $_.AssignedLicenses.Count -gt 0 } |
  Select-Object DisplayName, UserPrincipalName

Hunt Down Stale Accounts

An account nobody uses is an account nobody notices getting broken into. Microsoft Entra records the last sign-in for every user, and Microsoft’s guide to inactive accounts shows how to filter on it. This lists users with no successful interactive sign-in since July 1:

Connect-MgGraph -Scopes 'User.Read.All','AuditLog.Read.All'
$uri = 'https://graph.microsoft.com/v1.0/users?$filter=signInActivity/lastSuccessfulSignInDateTime le 2026-07-01T00:00:00Z&$select=displayName,userPrincipalName'
(Invoke-MgGraphRequest -Uri $uri).value | ForEach-Object { $_.userPrincipalName }

Disable what should not exist, and for the rest, find out who owns it. Former employees, old vendor logins, and test accounts are the usual finds.

Check MFA Coverage

Every account that can sign in from the internet should have MFA, with no exceptions for the owner or the shared front desk login. In the Microsoft Entra admin center, the User registration details report under Authentication methods shows who has registered a method and who has not. Fix the gaps, then look at whether you are still allowing push approvals without number matching. Our post on MFA fatigue attacks explains why that matters.

Restore Something From Backup

A backup job that reports success is not proof you can recover. Pick a real file from last month and restore it to a different location. Then pick something bigger, like a mailbox or a full server or PC image, and confirm it boots or opens. Write down how long it took, because that number is your real recovery time and it is usually longer than anyone guessed. Check that at least one copy of your backups lives somewhere ransomware on your network cannot reach or delete.

Update Firewall and Router Firmware

Edge devices are a favorite way in because they sit on the internet and rarely get touched after install. Log into the firewall, router, and any VPN appliance, check the firmware against the vendor’s current release, and apply updates during a quiet window. While you are there, confirm remote admin is not exposed to the internet and that the admin password is not the one the installer set.

Review Certificates and Domain Renewals

Public website certificates are getting much shorter lives. The CA/Browser Forum Ballot SC-081 cuts the maximum validity of public TLS certificates from 398 days down to 47 days, in steps that started in March 2026 and finish in March 2029. If anyone at your company still renews a certificate by hand once a year, that process is about to break. Switch to automatic renewal now, whether through your host, your firewall, or your certificate provider.

While you are at it, put every domain name on auto-renew, confirm the registrar account has MFA, and make sure the renewal notices go to a mailbox someone still reads. An expired domain takes your email down with it.

Clean Up Passwords and Offboarding

Go through the shared vault in your password manager and remove anyone who left this year. Then rotate the passwords they could see, starting with banking, payroll, the domain registrar, and any admin accounts. If your company does not use a business password manager yet, that is the single best January project on this list.

Prep for the Cyber Insurance Renewal

Renewal questionnaires keep getting more specific about MFA, backups, endpoint protection, and patching. Gathering the answers in December, with screenshots, beats scrambling the week the policy expires, and a wrong answer on that form can become a problem at claim time. We cover the coverage side in our cyber insurance guide for Washington businesses.

Know Washington’s Breach Notification Rules

Puget Sound businesses that hold personal information about Washington residents fall under RCW 19.255.010. If a breach is reasonably likely to put people at risk, affected residents must be notified no more than thirty calendar days after the breach was discovered, with narrow exceptions for law enforcement requests. If a single breach requires notifying more than five hundred Washington residents, the Attorney General must also be notified within thirty days.

Thirty days goes fast when you are still figuring out what happened. Use the slow weeks to write down who you would call, where your data lives, and who has authority to make decisions. Our walkthrough of the first hours of a ransomware attack is a good starting outline.

References

Want someone to run this checklist with you before the new year? Contact Rain City Techworks.