Systems & Infrastructure Support & Operations

Systems Administrator

Keep the servers, accounts and services running that everyone uses without thinking about them.

This is genuinely reachable as a first role in IT.

What you actually do

  • Create, change and remove user accounts and access
  • Apply patches and updates on a schedule, and fix what they break
  • Monitor server health and act before disks fill or services stall
  • Restore a file, a mailbox or a machine from backup
  • Handle escalations the service desk cannot resolve
  • Write down what you did so it can be repeated

Technologies you may touch

Nobody uses all of these. Which ones depends entirely on the employer.

  • Windows Server The Microsoft server platform running file, directory, application and print services in most enterprises.
  • Active Directory The Microsoft system that holds every user, group and computer account in most organisations, and decides what each can open.
  • Linux The operating system most servers, network devices and cloud workloads run on, driven from a command line.
  • PowerShell Microsoft’s scripting language — the standard way to do something to a thousand Windows machines at once.
  • Intune / SCCM Tools that configure, patch and control every laptop and phone in an organisation from one console.
  • Grafana / Prometheus / Zabbix Collects metrics from systems and shows you the graph that explains the outage.
  • DNS & DHCP The services that hand out addresses and translate names into them — when they break, everything looks broken.

Concepts you will learn

These transfer between employers and outlast any particular product.

  • Permissions and groups
  • Backup and restore
  • Patch cycles
  • Ticketing and escalation
  • Documentation

Where this work happens

Small and mid-size businesses Managed service providers Schools Non-profits Anywhere with an internal IT team

You may enjoy this if…

  • You like variety and a job where no two days are the same
  • You want to see the whole environment early in your career
  • You enjoy being the person who actually fixes it

The honest downside

In smaller organisations you are everything at once, which is great for learning and hard on focus. Interruptions are constant. Advancing means deliberately specialising rather than staying the generalist forever.

What it pays

Pay is the thing people most often get misled about, so here is where every number comes from — including the ones that are not really numbers.

Official occupation

Median for the occupation

$96,800

Network and Computer Systems Administrators (15-1244)

What you actually start on

~$45,000–$65,000 to start

Outlook

−4% projected — the on-premises version of this work is contracting toward cloud

This role maps cleanly onto a published government occupation, so the median below is a real statistic you can go and check.

Maps to Network and Computer Systems Administrators (15-1244). In smaller organisations this role covers everything, which is excellent for learning and poor for pay relative to specialists.

A median is the midpoint of everyone employed in that occupation, including people decades into their careers — so starting pay runs materially lower. Verify against the live BLS page before making a decision.

Source: U.S. Bureau of Labor Statistics · BLS OES, May 2024 release · figures are national and United States–specific; pay varies substantially by region and employer. Nothing here is adjusted for cost of living.

CertBlueprint earns affiliate commission on some study resources. It earns nothing from Systems Administrator salaries, and no role is ranked, recommended or presented more favourably because of what it pays.

Where this leads

IT careers are a graph, not a ladder. These are the moves people actually make from here — each one reuses most of what you already know.

See where Systems Administrator sits on the whole map →

Systems Engineer

The engineering step up — designing rather than maintaining.

Cloud Engineer

Where most of this work is heading.

Security Engineer

If hardening and access control is the part you like.

Often confused with

Titles overlap heavily in IT and tell you very little. Each of these puts Systems Administrator beside another role on the same dimensions, with the practical differences underneath.

vs Help Desk Technician vs Systems Engineer vs Security Engineer vs Cloud Engineer

Try it this weekend, before you spend anything

Reading about work and doing it are different. Each of these is free, runs on the machine you already have, and takes under an hour and a half. Finding out you dislike it is a genuinely useful result — and far cheaper here than after an exam voucher.

Try the work · 60–90 minutes

Make the computer do it

Free

Do a genuinely boring task by hand, then arrange never to do it by hand again.

Nothing to install · no account · open the steps

Before you start

Work on a COPY of a folder, never your only copy of anything. Every step below dry-runs first and shows you what would happen before anything changes. If a step ever refuses to show you a dry run, that is the step to be suspicious of.

PowerShell ships with Windows; bash ships with macOS and Linux. You already have everything you need.

  1. Pick a real chore

    Not a toy problem — something that genuinely annoys you. Sorting a Downloads folder full of four hundred files. Renaming photos to a consistent format. Finding every file over 500MB. It has to be real, or the payoff at the end will not land.

  2. Do it by hand once, and time it

    Actually time it. Write the number down. This is the figure you are going to beat, and it is also how you will one day justify automation work to a manager who wants to know why it is worth your afternoon.

  3. Make a copy to work on

    Duplicate the folder. Everything from here runs against the copy. This is not caution for beginners — it is what people do professionally, because the cost of being wrong is asymmetric.

    Windows
    Copy-Item -Path .\Downloads -Destination .\Downloads-copy -Recurse
    macOS
    cp -R ~/Downloads ~/Downloads-copy
    Linux
    cp -R ~/Downloads ~/Downloads-copy

  4. Ask what it WOULD do, before it does anything

    Run the operation in preview mode first. Nothing changes; it just tells you what it intends. Read that output properly. This habit is the single biggest difference between someone safe to give automation to and someone who is not.

    Windows
    Get-ChildItem .\Downloads-copy -File | Group-Object Extension | Format-Table Name, Count
    macOS
    find ~/Downloads-copy -type f | sed "s/.*\.//" | sort | uniq -c | sort -rn
    Linux
    find ~/Downloads-copy -type f | sed "s/.*\.//" | sort | uniq -c | sort -rn

  5. Now let it run

    Sort every file into a folder named after its extension. Five lines or so. It will not work first time — read the error, change one thing, run it again. That loop, repeated, is the actual job.

    Windows
    Get-ChildItem .\Downloads-copy -File | ForEach-Object { $d = ".\Downloads-copy\" + $_.Extension.TrimStart("."); New-Item -ItemType Directory -Force -Path $d | Out-Null; Move-Item $_.FullName $d }
    macOS
    cd ~/Downloads-copy && for f in *.*; do d="${f##*.}"; mkdir -p "$d"; mv "$f" "$d"/; done
    Linux
    cd ~/Downloads-copy && for f in *.*; do d="${f##*.}"; mkdir -p "$d"; mv "$f" "$d"/; done

  6. Compare it to your number

    You wrote down how long it took by hand. It now takes under a second, and it will take under a second every time from now on. Sit with that for a moment — that gap, multiplied across an organisation, is the entire economic argument for automation as a career.

This suits you if…

  • The moment it worked felt genuinely good
  • You immediately thought of a second chore to do this to
  • Fighting the syntax felt like a puzzle rather than an obstacle
  • You wanted to make it handle the awkward edge cases properly

If you disliked it

If twenty minutes of wrestling with quoting and syntax was pure frustration with no compensating satisfaction, that is a real signal. Automation, DevOps and platform roles are that experience repeatedly, and enjoying the puzzle is most of what makes them bearable. Plenty of excellent infrastructure people are not wired for it — they go deep on architecture or operations instead.

Try the work · 60–90 minutes

Fix someone’s problem

Free

Take a vague, badly-described complaint from a real human being and turn it into something you can actually diagnose — then fix it and write it down.

Nothing to install · no account · open the steps

Before you start

You are working on someone else’s device, so ask permission explicitly and stay inside the problem you were asked to fix — do not browse their files, their messages or their history. Never ask for or type their password: have them enter it themselves, every time. If a fix would delete or move their data, stop and get their agreement first, in words, before you do it. These are the same boundaries a professional support role holds you to, and practising them now is part of the trial.

Needs one other person who is not technical, and a real problem they actually have. That is the only requirement, and it is the hard part.

  1. Find a real complaint

    Ask a family member, housemate or friend what annoys them about their computer or phone. Do not accept a technical description — you want the raw version. "It's slow." "The printer never works." "It keeps logging me out." That vagueness is the actual starting condition of the job.

  2. Resist fixing it for ten minutes

    This is the discipline the whole trial is built around. Ask questions instead. When did it start? What changed around then? Does it happen every time, or sometimes? Show me. Watch them do it — you will almost always see something they did not mention, because they did not know it mattered.

  3. Reproduce it yourself

    Make the problem happen on demand, with your own hands. If you cannot reproduce it, you cannot know you have fixed it — you can only know it has stopped happening for now, which is not the same thing and will come back.

  4. Halve the problem, repeatedly

    Is it that app or all apps? That network or all networks? That account or all accounts? Each answer eliminates half of what it could be. Keep going until only one thing is left. Notice how few questions this actually takes when you choose them well.

  5. Fix it — then explain it without jargon

    Make the fix. Then tell them what was wrong in language they understand, without being condescending and without pretending it was harder than it was. Watch their face. This skill is worth more to an early IT career than any certification, and almost nobody practises it deliberately.

  6. Write the runbook

    Five lines: the symptom, how to confirm it is this and not something else, the fix, and how to tell it worked. Written so someone else could follow it at 3am without ringing you. This is the artefact that turns a fix into an asset.

This suits you if…

  • Their relief when it worked genuinely felt good
  • The ten minutes of questions was interesting rather than frustrating
  • You enjoyed narrowing it down more than you enjoyed the fix itself
  • You wanted to go and fix the three other things you noticed

If you disliked it

If the human part drained you — the vagueness, the explaining, the patience — that is important and completely legitimate. It does not mean IT is wrong for you; it means the front-line support route may not be the right door. Networking, systems and data roles all reach the same industry with far less of this, though almost all of them still involve some.

Try the work · 60–75 minutes

Audit your own access

Free

Work out exactly what your own accounts can reach, what could take them over, and how far the damage would spread if one fell — the same exercise, at smaller scale, as securing an organisation.

Nothing to install · no account · open the steps

Before you start

Your own accounts and nobody else’s — not a partner’s, not a parent’s, not an employer’s, even with informal permission. Accessing an account that is not yours is an offence in most jurisdictions regardless of intent or relationship, and "I was learning security" has never once worked as a defence.

Uses the account settings pages you already have. Nothing to install. You will likely also improve your own security materially, which is a decent side effect.

  1. Find the account that owns all the others

    Start at your main email. Now list every service that would send a password reset there. That is not a list of accounts — it is a list of things someone gets for free the moment they take that one. Security people call this blast radius, and it is the single most useful concept in identity work.

  2. Check what is actually guarding it

    Look at the security settings of that email account. Is there a second factor? Is it SMS — which is interceptable — or an app or hardware key? Now check the recovery options: an old phone number or a disused backup address is a back door that bypasses everything else you just checked.

  3. Review what you have handed out

    Find the third-party access page on your Google, Microsoft or Apple account — the list of apps you signed in to using it. Most people have twenty to eighty entries and recognise perhaps half. Read what each was granted. Some will have read access to your entire mailbox from a service you used once in 2019.

    Any
    Google:    myaccount.google.com/permissions
    Any
    Microsoft: account.microsoft.com/privacy → apps and services
    Any
    Apple:     appleid.apple.com → Sign in with Apple

  4. Revoke, and notice how that feels

    Remove everything you do not currently use. Notice the hesitation — "what if something breaks?" That exact hesitation, multiplied across ten thousand employees and twenty years, is why organisations accumulate permissions nobody dares remove. You are feeling the central problem of identity engineering firsthand.

  5. Check the sessions still open

    Most services list active sessions and signed-in devices. Look for a device you no longer own or a location you do not recognise. Sign them all out. Note how many services do not offer this at all — that absence is itself a finding.

  6. Write the one-page assessment

    What is your most valuable account? What is the weakest path into it — is it the password, the second factor, the recovery method, or an app you granted access to years ago? What would you fix first if you had one hour? That prioritised write-up is exactly the deliverable an identity or GRC role produces, and doing it for yourself is the cheapest possible practice.

This suits you if…

  • The blast-radius idea in step one genuinely landed
  • You found at least one granted permission that alarmed you
  • You enjoyed the systematic sweep more than you expected
  • You started thinking about how this would scale to ten thousand people

If you disliked it

If this felt like fussy admin — a checklist with no puzzle in it — that is a real signal about identity, access and governance work, which is substantially careful, repetitive, high-consequence bookkeeping. People who want the adversary and the chase are usually better suited to detection, response or offensive roles, where the same rigour is applied to a moving target.

Try the work · 60–90 minutes

Walk the physical layer

Free

Stop treating the network as an abstraction. Measure a real radio signal in a real building, find out where it dies and why, and put your hands on the hardware everything else runs on.

Nothing to install · no account · open the steps

Before you start

For the hardware section: shut down fully, unplug from the mains, and hold a metal part of the case before touching components. Never open a power supply or a CRT — they store lethal charge even unplugged. Do not open equipment you rent, lease, or that belongs to an employer, and be aware that opening some laptops voids warranty. If in any doubt, do the wireless half and skip the rest; it is the smaller part of the trial.

Built-in wireless tools plus your own feet. The optional hardware section needs a computer you own and are willing to open — no purchase required.

  1. Measure what you have been assuming

    Find your current signal strength, right now, where you are sitting. Note the number and the units — dBm is a negative figure where closer to zero is better, and −50 is excellent while −80 is barely usable.

    Windows
    netsh wlan show interfaces
    macOS
    Hold Option, click the Wi-Fi menu — or open Wireless Diagnostics from Spotlight
    Linux
    iw dev wlan0 link    # or: nmcli -f IN-USE,SSID,SIGNAL,CHAN dev wifi

  2. Walk the building and write numbers down

    Take a reading in every room, and at the far corner of each. Write them on a rough floor plan. You are producing a coverage survey — the same artefact, at smaller scale, that a wireless engineer produces before a hospital or a warehouse deployment.

  3. Find the wall that eats your signal

    Look for the sharp drop, not the gradual fade. A gentle decline is distance; a cliff between two adjacent readings is something physical — a wall with foil-backed insulation, a mirror, a boiler, a fridge, a chimney. Go and identify the actual object. This is the moment radio stops being theoretical.

  4. Discover you are not alone on the air

    List the networks around you and the channels they occupy. Count how many are on the same channel as yours. Wi-Fi is a shared medium in a public commons — your neighbour's router degrades yours, and no configuration on your side can fully fix it. That constraint is the defining fact of wireless work.

    Windows
    netsh wlan show networks mode=bssid
    Linux
    nmcli -f SSID,CHAN,SIGNAL dev wifi list
    macOS
    Wireless Diagnostics → Window → Scan

  5. Trace one cable end to end

    Pick any cable in your home — the one from the wall to the router. Follow it physically to both ends. Where does it enter the building, and what is on the other side of that wall? Almost nobody knows. Documenting exactly this, across a building, is a real job that real people are paid to do because the records are always wrong.

  6. Optional — open something and name every part

    Power off, unplug, ground yourself, then open a desktop or an old laptop you own. Identify: the processor and its cooler, the memory, the storage, the power supply, the fans. Trace where the air enters and leaves. Ask where the heat goes. Now imagine ten thousand of these in one room — that question of heat, power and airflow is most of what data centre design actually is.

This suits you if…

  • Finding the exact wall that killed the signal was satisfying
  • You enjoyed being on your feet with a number in your hand
  • The shared-medium constraint interested you rather than annoying you
  • You wanted to open the case more than you wanted to read about it

If you disliked it

If the physicality felt like a chore — the walking, the writing down, the fiddling with hardware — that is worth knowing before pursuing wireless, field or data centre work, all of which are substantially physical jobs in real buildings, sometimes at height, in the cold, or at 4am. Plenty of superb network engineers want nothing to do with the physical layer and work entirely in routing and policy instead.

Certifications that fit this path

These come last for a reason. A certification is evidence for a direction you have already chosen — it is not the direction itself.

Start here CompTIA A+ The recognised first credential if you have no IT experience yet. Foundation Microsoft MS-900 Cheap orientation in the Microsoft 365 estate most organisations run. Level up Microsoft AZ-104 The step that moves you from administration to engineering. Level up CompTIA Linux+ Opens the entire Linux, cloud and DevOps direction.
See the full step-by-step roadmap for this path →

Not sure whether this is actually you?

Reading about a role and enjoying the work are different things. The scenarios show you the problems instead of describing them, and tell you which ones you keep reaching for.

Try the scenarios →