TL;DR: The backup-admin test is a hands-on endpoint management evaluation. Another authorized admin uses their own account and your existing documentation to complete routine tasks without help from your main admin. Score each task on completion, assistance required, permissions, and evidence of success. If they fail one, figure out whether the tool, the documentation, or the training caused it, and fix that cause before changing anything else.
On many IT teams, there's one person who knows everything. They've created the device groups and know why a certain package has an odd install flag. Everything is running smoothly until they take a week off and their phone starts buzzing at the beach.
"Easy to use" usually means easy for whoever set it up. This test checks whether someone else on your team can actually run your endpoint management tools, the way they'd have to after an IT handover. Despite the name, this has nothing to do with backing up and restoring.
What is the backup-admin test?
The backup-admin test lets you see if another authorized admin can complete routine endpoint management tasks using their own account and your existing documentation with no guidance from your main admin. If they can complete tasks and provide proof, then your setup isn't reliant on just one person.
They use their own login, not a shared one. They only use runbooks and other written documentation. Your main admin isn't present, and an observer takes notes.
They should be able to understand what's currently running without touching anything. This is the first step when inheriting a PDQ environment.
What should the backup admin be able to do?
The backup admin should be able to complete five routine tasks without any help. All changes happen within a controlled test environment.
Identify impacted devices: Ask them to list all devices using an old browser version.
Deploy to a test group: Ask them to push a low-risk package to a few test machines.
Troubleshoot deployment failure: Create a safe deployment failure on a test machine and ask them to identify the cause.
Disable automation: Ask them to disable an automation that runs on schedule and only affects test machines, then turn it back on.
Check results: Look at the deployment status and output log, and confirm the change landed on the device. Just because the deployment status shows as successful doesn't mean the new version is installed. PDQ also points this out when validating patching in a pilot.
How should you evaluate the results?
Use one scorecard to assess the backup-admin test, like any endpoint management evaluation. Score every task the same way. They should be able to complete the task with no guidance, have the correct permissions, and provide proof.
Criteria | What to look for | Score |
|---|---|---|
Task completion | Did they finish? How long did it take? How many steps? | Pass/Partial/Fail |
Assistance required | Did they need to ask your main admin questions? | None/Some/Blocked |
Permissions | Did they use their own account, with a role that fits the tasks? | Pass/Fail |
Evidence of success | Can they show the deployment status, output log, and change on the device? | Pass/Fail |
Use PDQ's method for measuring workflows to assess how long each task took. Keep permissions to the minimum the tasks require.
If they fail a task, find out why.
Tool limitations: The software doesn't allow them to do the task, or it's unclear what they need to do. Escalate this to the vendor or consider if this tool is right for your team.
Missing documentation: The tool allows them to do the task, but there's no documentation on how to do it. Create a runbook and document who has what access. CIS Control 6 covers allocating and managing admin account privileges.
Missing training: There's documentation, but they were unable to apply it. Book a walkthrough and try again.
The backup-admin test in PDQ
PDQ’s permissions, automation controls, and logs support different parts of the backup-admin test.
Permissions: PDQ uses role-based access control. There are two default roles: Admin and Member. You can create custom roles that include individual permissions such as deploying packages, managing automations, and viewing audit logs. Make sure your backup admin has the correct role.
Automation controls: Backup admins can disable an automation using the slider in the Enabled column on the Automations page.
Logs: Output logs show what happened at each stage of the deployment. Audit logs show which user carried out each recorded action in the web console.
Do it before you need to
The best time to do this test is before anyone's actually out. Choose one person, five tasks, and a test group. Once you've identified what slowed them down, fix it. To do this in a clean environment, start a free trial of PDQ.
