Fix it on a Tuesday, not on a deadline

The failures that cost real money are almost never sudden. A drive reports its first reallocated sector in March and dies in July. A workstation starts thermal throttling in May, gets called slow in June, and blue-screens under load in August. A firewall runs firmware with a published authentication bypass for eleven months because nobody owns the update. Preventative maintenance is a schedule that makes sure someone owns each of those signals before they turn into a Tuesday morning phone call.

Patching, done in rings

We do not push every update to every machine the moment it releases, and we do not defer forever either. Endpoints sit in rings: a small pilot group takes quality updates within a couple of days, the general population follows about a week later, and servers patch in a defined maintenance window with a reboot plan and a rollback point. Feature updates get a longer deferral and a compatibility check against your line-of-business software first, because the software that breaks is never Word.

Third-party patching matters at least as much as Windows patching. Browsers, Adobe Reader, Java runtimes, Zoom, 7-Zip and the dozen small utilities on a typical desktop are a favorite entry point, and Windows Update does not touch them. We patch them centrally, report on what refused to apply, and chase the machines that keep deferring because someone never reboots.

Storage, thermals and Arizona dust

Storage health is read from the source. On spinning disks we watch reallocated sector count, pending sectors and power-on hours; on SSDs and NVMe we watch percentage used, media wear indicator, available spare and controller temperature. A drive at 90 percent of its rated endurance gets replaced on a scheduled visit for the price of a drive, not recovered at 2am for the price of a data recovery engagement.

Then there is the thing every technician in the Valley knows: our dust is different. Fine caliche dust, monsoon season, construction on every other corner, and shops in Mesa and Queen Creek where the roll-up door stays open. Dust mats a heatsink into a felt blanket, fan bearings pick up grit and start whining, and intake filters clog faster here than almost anywhere. We clean intakes and heatsinks properly with the machine open, re-paste CPUs and GPUs that are three or four years past their last service, thermal compound pump-out is real and it shows up as throttling long before it shows up as a crash, and we check that server room ambient temperature is actually being held, including what happens to that room when the building AC cycles off at night.

Firmware and drivers get their own pass, because this is where well-meaning IT causes outages. We source BIOS, chipset, storage controller and NIC drivers from vendor catalogs, Dell Command Update, HP Image Assistant, Lenovo System Update, rather than letting Windows Update install a generic driver over a working one. Firewalls, switches, access points and NAS units get firmware reviewed on a schedule with a change window and a configuration backup taken first. UPS units get a self-test and a battery age check; in Arizona heat we plan on replacing UPS batteries around the three-year mark rather than the five the datasheet suggests.

All of it rolls up into a quarterly review. We call ours a Surface Check: an hour with you and the numbers. What failed, what nearly failed, what is out of warranty, which machines are three years old and heading for replacement next budget cycle, which licenses are over-provisioned. It turns IT from a series of surprises into a line item you can plan. If you would rather have the monitoring side running continuously, that is Pod Watch, and it feeds the same reviews.

Maintenance also protects everything else you have paid for. Backups only count if the agent is healthy and the restore test passed, see our backup and disaster recovery page for how we verify that. Security tooling only counts if it is actually installed on all 43 endpoints rather than 39.