Systems administrator screening questions: Windows, Linux, Active Directory, Entra ID, patching and on-call
On this page
- Help desk, sysadmin, systems engineer or infrastructure lead: place the candidate
- The size of the environment
- Identity: Active Directory, Entra ID and an offboarding scenario
- Patching, backups and change control
- Linux, virtualization and scripting
- Certifications: Microsoft and Red Hat
- How sysadmin resumes overstate the work
- On-call, logistics, knockout checklist and scorecard
- Questions people ask
Good systems administrator screening questions find out how large an environment the candidate ran, whether they owned identity (Active Directory and Microsoft Entra ID), how they patched and backed up servers, and what on-call looked like. The fastest single test is an offboarding scenario: ask them to remove a terminated employee's access right now and count what they cover.
This page sits between two others. If the candidate mainly resolves user tickets, use the help desk technician screening questions; if the work is mostly cloud accounts and infrastructure as code, use the cloud engineer screening questions. What is left in the middle, servers, directory, patching, backups and the scripts that hold it together, is what a systems administrator does and what this page covers.
Help desk, sysadmin, systems engineer or infrastructure lead: place the candidate
Titles are unreliable here. A "systems engineer" at a 40-person company may do help desk work half the day, and a "systems administrator" at a bank may own a thousand servers. Ask: "In a normal week, what percentage of your time goes on user tickets, on servers and identity, on projects, and on on-call?" Then place them.
| Level | What they own | What confirms it |
|---|---|---|
| Tier 2 / desktop support with admin rights | User accounts, group memberships, some server restarts | Most of the week is tickets; changes follow someone else's runbook |
| Systems administrator | Servers, directory, patching, backups for an environment or part of one | Can describe the patch cycle and the backup schedule from memory |
| Systems engineer | Designs and builds: new domains, virtualization clusters, automation | Talks about projects they designed, not only ones they ran |
| Infrastructure lead | Standards, vendors, budget, other admins' work | Mentions people, contracts and priorities alongside systems |
The size of the environment
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| How many servers, and how many were yours? | "About 300 virtual servers, 70% Windows. I owned the Windows side with one other admin." | "Hundreds," with no split between the team's and theirs. |
| How many users and sites? | "2,500 users, eight offices and a data center, plus Azure." | Cannot say how many users the directory served. |
| What ran the virtual machines? | A named platform and version: VMware vSphere, Hyper-V, Proxmox, Nutanix, or cloud virtual machines. | Only ever created VMs from a template someone else maintained, described as "managed virtualization." |
| What did you use to manage devices and servers at scale? | Named tools: Microsoft Intune, Configuration Manager, Group Policy, Ansible, Red Hat Satellite. | Everything configured by hand, server by server, at a size where that no longer works. |
Identity: Active Directory, Entra ID and an offboarding scenario
Identity is where sysadmin mistakes turn into security incidents. Microsoft Entra ID is the current name for what many resumes still call Azure AD; either is fine to hear, but a candidate who manages a hybrid setup should know how changes flow between on-premises Active Directory and the cloud.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| How was your directory set up: on-premises, cloud-only or hybrid? | A clear description: "Two domains on-premises, synced to Entra ID with Entra Connect, most apps on single sign-on." | Does not know whether accounts were synced or cloud-only. |
| How were admin rights handled? | Separate admin accounts, few domain admins, just-in-time or approval-based elevation. | Their everyday account is a domain admin. |
| How did MFA and conditional access work? | Which users were covered, what was excluded and why, one policy they wrote or changed. | "Security handled that," in a role that owns identity. |
| Tell me about a Group Policy or permissions problem you fixed. | A symptom, how they traced it (resultant set of policy, group membership, inheritance) and the change. | No example, or "I rebooted it and it went away." |
Read this to the candidate
"It's 5 p.m. HR calls: an employee has just been terminated and must lose all access immediately. They work remotely with a company laptop and phone. Walk me through what you do."
Tick each item they mention:
- Confirm the request is real and in writing from HR or the manager before acting.
- Disable the account (not delete it) in Active Directory and, for a hybrid setup, make sure it reaches Entra ID now rather than on the next sync.
- Revoke active sign-in sessions so cloud apps and email stop working immediately.
- Remove or block VPN and remote access, and any MFA methods on the account.
- Lock or wipe the laptop and phone through device management, and arrange their return.
- Handle the mailbox and files as policy says (for example convert, delegate to the manager, keep for retention).
- Find access outside single sign-on: shared admin passwords they knew, service accounts, SaaS tools with local logins.
- Record everything in the ticket and confirm back to HR.
Scoring: 0–3 items is help desk level. 4–5 is a working sysadmin. 6 or more, including sessions and access outside single sign-on, is someone who has done it for real.
The two items most often missed are revoking sessions (a disabled account can keep a signed-in session alive for a while) and access outside single sign-on. You do not need to know how either is done to notice whether the candidate raised it.
Patching, backups and change control
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| Walk me through a normal patch cycle. | A rhythm tied to Microsoft's monthly Patch Tuesday or the Linux vendor's errata: test group first, then rings, then production, with a reboot window and a report of what failed. | "Windows Update is on automatic," for servers. |
| What did you do when a patch broke something? | The patch, the symptom, the rollback or workaround, and what changed in the process afterwards. | Has never had a patch go wrong, across years of patching. |
| How were servers backed up, and when did you last restore one? | The product (Veeam, Commvault, native tools), the schedule, an off-site or immutable copy, and a dated restore with how long it took. | Backups "run every night" and have never been restored on purpose. |
| How would you know if ransomware reached your backups? | Separate credentials for the backup system, immutable or offline copies, alerts on deletion. | Backup server joined to the same domain with the same admin accounts, and no concern about it. |
| How were changes approved? | A change process with a record, a rollback plan and a window, scaled to the risk. | Changes made in production at any time with no record. |
Linux, virtualization and scripting
Ask which operating system they would be comfortable being on call for alone. The answer is more honest than a list of distributions.
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| Which Linux distributions have you run in production, and for what? | Named distributions and workloads: "Red Hat Enterprise Linux 9 for app servers, Ubuntu for build agents." | Linux experience is a home lab only, in a role with Linux servers in production. |
| A Linux server is running out of disk. What do you check? | Which filesystem is full, what is growing (logs, a runaway process, old kernels), the fix, and stopping it recurring with rotation or monitoring. | Deletes files until it works, without finding the cause. |
| Tell me about a script you wrote that is still running. | What it does, the language (PowerShell, Bash, Python), what it replaced and how long it saves. | Only ever edited scripts others wrote, described as "automation." |
| Have you used configuration management? | Ansible, Group Policy, Desired State Configuration or similar, with something they defined. | Never heard of it, for a role that asks for it. |
Certifications: Microsoft and Red Hat
Sysadmins are hired on what they have run, not on exams. A certification is useful as a tiebreaker or when a client requires one, and then you should check that it is current.
- Microsoft. The Microsoft Certified: Windows Server Hybrid Administrator Associate covers Active Directory Domain Services, hybrid Windows Server, networking, storage, high availability and disaster recovery. As of September 2026 Microsoft's page lists exams AZ-800 and AZ-801 alongside a newer AZ-802, Administering Windows Server, so check the page for the current route before telling a client which exam to require. Microsoft's role-based certifications expire unless renewed, and renewal is a free online assessment on Microsoft Learn. Candidates can send a transcript share link from their Learn profile.
- Red Hat. The Red Hat Certified System Administrator (RHCSA) is earned with exam EX200, which Red Hat describes as performance-based: the candidate does the tasks on a live system rather than answering multiple-choice questions (as of September 2026). Ask for the certification ID and the date earned.
CompTIA certifications show up on many sysadmin resumes as well; the help desk page covers how much weight to give A+.
How sysadmin resumes overstate the work
| Resume says | Often means | Question that checks it |
|---|---|---|
| "Managed Active Directory" | Created users and reset passwords | "What did you change in Group Policy or the domain design?" |
| "Administered 500+ servers" | The team did; they looked after a slice | "How many were yours, and who covered the rest?" |
| "Led Microsoft 365 migration" | Moved mailboxes with a tool someone else set up | "What did you configure before the first mailbox moved?" |
| "Backup and disaster recovery" | Checked the nightly backup report | "When did you last restore a server, and how long did it take?" |
| "PowerShell automation" | Ran scripts from a shared folder | "Tell me about one you wrote from scratch." |
| "Linux administration" | Occasional SSH to restart a service | "Would you take a Linux on-call shift alone?" |
On-call, logistics, knockout checklist and scorecard
| Question | What a strong answer sounds like | Red flags |
|---|---|---|
| What did on-call look like, and how often were you called? | Rotation, team size and a typical week: "One week in five, maybe two calls, usually a stuck service or a failed backup." | Refuses any on-call for a role that requires it. |
| This role patches on the second weekend of each month. Does that work? | A direct yes, or a clear condition. | Hedging that turns into a no at offer stage. |
| The role covers two offices and some site visits. Can you travel between them? | A direct answer, with any limits (driving, distance). | Expected fully remote in a role with on-site hardware. |
| Are you legally authorized to work in the US, and will you now or in the future need visa sponsorship? | A direct answer to both. | None. Ask everyone the same two questions. |
Must-ask on every systems administrator screen
- Time split: tickets, servers and identity, projects, on-call.
- Server count (theirs and the team's), users, sites, virtualization platform.
- Directory setup: on-premises, cloud or hybrid, and how admin rights worked.
- The offboarding scenario, scored against the checklist.
- Patch cycle, one patch that broke something, last server restore.
- The operating system they would be on call for alone, and one script they wrote.
- Certifications with status, if the client requires them.
- On-call, maintenance windows, site travel, salary, notice, other processes, work authorization.
Knock out, or flag to the client before submitting, if:
- The candidate scores three or fewer on the offboarding scenario for a role that owns identity.
- The client's main platform is Linux (or Windows) and the candidate would not take on-call for it alone.
- The role owns backups and the candidate has never restored a server.
- The candidate will not work the patch windows or on-call the role requires.
| Area | 1 | 2 | 3 | 4 |
|---|---|---|---|---|
| Scope and ownership | Tickets with admin rights | Owned part of an environment | Owned an environment end to end | Designed it and set standards |
| Identity | Users and passwords | 0–3 offboarding items | 4–5 items, hybrid understood | 6+ items, admin rights and MFA design |
| Patching and backups | Watched reports | Ran a patch cycle | Handled a broken patch and a restore | Built the process and tested restores |
| Linux and scripting | None | Edited others' scripts | Wrote scripts still in use | Configuration management across the estate |
| Logistics fit | Deal-breaker | Two open questions | One open question | All aligned |
Keep the candidate's own figures: "300 servers, I owned the Windows 200 with one other admin" is what an infrastructure manager wants to read. Interview Signal attaches quotes like that to each score as the call happens. If the role leans into switching, firewalls and routing, add the network engineer screening questions; if the servers mostly host databases, add the database administrator screening questions.
Questions people ask
How is a systems administrator different from a help desk technician?
Help desk resolves users' problems one ticket at a time. A systems administrator runs the servers, identity, patching and backups those users depend on, and is usually the escalation point for help desk. Screen for ownership of systems, not ticket volume.
Should a sysadmin know both Windows and Linux?
Most know one well and the other enough to get by. Ask which they would be comfortable being on call for alone. If the client's estate is mostly one platform, depth there matters more than breadth.
Is PowerShell or Bash scripting a must-have?
For most mid-level and senior roles, yes. Ask for one script they wrote that is still running and what it replaced. Editing someone else's script is a different, lower level of skill.
Which certification matters most for a systems administrator?
It depends on the estate. Microsoft's Windows Server Hybrid Administrator Associate fits Windows-heavy shops and Red Hat's RHCSA fits Red Hat Enterprise Linux shops. Either is a tiebreaker; restore, offboarding and patching stories tell you more.