The guides below cover three checks worth finishing before January: a restore someone has watched work, devices that still receive security updates, and domain renewals that do not depend on one inbox. Start with the one that matches the gap you suspect, and write down what you find.

Start with one verifiable task

If you have one hour before year-end, start with the one-hour year-end IT review and pick one task you can verify. That review at alcohq.com/insights/one-hour-year-end-it-review turns that hour into three pieces of evidence for January: a successful restore, an inventory of devices still supported by their vendors, and a named owner for each open item.

Spend twenty minutes restoring and opening a sample file, twenty comparing device versions with vendor support status, and the final block giving each open item an owner and a next date. Then send the results to the person who owns the next review, including what was tested, where it failed and which action can be finished first. Keep the record short enough to update next month.

Count a task as verified only when someone has seen the result, such as a restored file that opened. A note that says "checked" is not evidence.

Check device versions against the vendor's dates

On a Windows PC, open Settings, select System, then About, and note the edition and version under Windows specifications. Both matter, because end dates differ by edition.

Microsoft's Windows 11 release information page says feature updates come with 24 months of support for Home, Pro, Pro Education and Pro for Workstations, and 36 months for Enterprise and Education. In its table as updated November 10, 2026, version 23H2 shows End of updates for every edition, and 24H2 shows End of updates for Home and Pro while Enterprise and Education continue to October 12, 2027. Version 25H2 runs to October 12, 2027 on Home and Pro, and the newest version, 26H2, runs to October 10, 2028 on those editions.

A new PC may report version 26H1, which Microsoft scopes to devices that started shipping in early 2026 and does not offer as an update to existing PCs. Its Home and Pro updates run to March 14, 2028.

Microsoft says that after October 14, 2025, a Windows 10 PC keeps working but no longer receives security updates unless it is enrolled in the Extended Security Updates (ESU) program. For organizations, ESU is a paid annual subscription that requires Windows 10 version 22H2 and lasts at most three years after end of support, so record ESU enrollment for any Windows 10 machine. For Macs, phones, firewalls and printers, use the maker's support or lifecycle page. Flag any device that shows End of updates, any whose end date falls before your next review, and any whose status you cannot find.

Review domain ownership if renewal notices go to one person

For generic top-level domains such as .com, ICANN's Expired Registration Recovery Policy requires the registrar to send at least two expiration notices, approximately one month and approximately one week before expiry, and one more within five days after expiry if the domain has not been renewed or deleted. If those notices reach only one person's inbox, a resignation or a spam filter can mean nobody sees them.

Once a domain expires, the registrar must interrupt the DNS the owner set up, to the extent the registry permits, so the website and email that depend on the name can stop working. If the registrar deletes the name within eight days of expiry, the interruption runs from expiry until deletion; if it deletes the name later, the interruption covers at least the last eight consecutive days the name can still be renewed. The policy's suggested best practices say registrars should advise registrants to provide a secondary email contact that is not associated with the domain itself, since notices sent to an address on the expired domain may not arrive.

Our guide at alcohq.com/… separates three roles that are easy to blur: the registrant of record, the account holder who controls the login and settings, and the payer whose card or invoice keeps renewals going. They can be different people or companies. The registrant matters most, because ICANN's Transfer Policy makes it the only party with the authority to approve or deny a transfer to another registrar.

Read your domain's public record first

ICANN's RDAP-based Lookup service at lookup.icann.org/en shows a domain's public record, and since January 28, 2025, RDAP has been the definitive source of registration data for generic top-level domains in place of WHOIS. The guide has you record the registrar and its IANA ID, any reseller, the created, updated and expiry dates, every status code, the nameservers and whether DNSSEC is signed, then save the results with the date. Personal details are often redacted, and a lookup is a directory record, not proof of legal ownership.

ICANN's page on EPP status codes explains the ones that matter most here:

  • clientTransferProhibited tells the registry to reject requests to move the domain to another registrar, which helps prevent unauthorized transfers resulting from hijacking or fraud. Keep it on for any domain you are not moving.
  • clientHold tells the registry not to activate the domain in the DNS, so it will not resolve. ICANN calls it uncommon and usually tied to a legal dispute, non-payment or a pending deletion.
  • redemptionPeriod means the registrar has asked the registry to delete the domain, which is held in this status for 30 days.
  • pendingDelete, when it appears on its own, means the domain spent 30 days in redemption without being restored and will be purged after several days.

Lock down the registrar account

The domain guide sets out an order. Identify the registrar for every domain, including redirects and old brand names, and find each account through card statements, accounting records and archived renewal notices. Have an authorized company representative confirm access, and if that fails, use the registrar's official recovery process rather than trying to get around anyone else's controls. Then make contact and recovery addresses company-approved, monitored and not tied to the domain itself, confirm the payer, renewal settings and billing details, turn on multi-factor authentication and confirm the transfer lock. Finish by writing down who is responsible, who the backup is and where the credentials are kept.

For the second factor, use the strongest method the registrar offers. CISA says phishing-resistant MFA is the standard all industry leaders should strive for, and that the only widely available phishing-resistant authentication is FIDO/WebAuthn. It also says any MFA is better than no MFA.

Two ICANN rules catch people after a change. Under the Registrar Accreditation Agreement, a registrar has 15 calendar days after receiving changed contact details to validate them and, where the agreement requires, verify them with a check that needs your response, such as an email; if the registrant does not respond, the registrar must verify the details manually or suspend the registration. Under the Transfer Policy, a change to the registrant's name, organization or email address, other than fixing a typo, is a change of registrant, and the registrar must then impose a 60-day lock against moving to another registrar unless it let the holder opt out beforehand.

Put each expiry date in a shared calendar with a reminder at least 60 days ahead, and name a person who watches for renewal notices and payment-failure emails, plus a backup. ICANN's expiry policy requires registrars to display their renewal, post-expiration renewal and redemption fees clearly on their website, so read them now rather than during a lapse.

If a renewal has already been missed

Registrars may delete an expired registration at any time after expiry, subject to ICANN's rules, so how long you have to renew depends on your registrar's terms. From expiry through the DNS interruption period, the registrar must let the registrant renew. If it sends visitors to a web page while the name can still be renewed, that page must say the registration has expired and give renewal instructions.

After deletion, every generic top-level domain registry except sponsored ones must offer a 30-day Redemption Grace Period, during which the registrar that deleted the name can restore it at the former registrant's request. Expect to pay the redemption fee the registrar is required to publish.

ICANN's advice for both redemptionPeriod and pendingDelete is to contact your registrar immediately. Once a domain is purged, it is available for re-registration under the registry's policies, and ICANN says it does not have the ability or authority to transfer or return a domain name to anyone.

Make a renewal list someone else can use

Our renewal-list guide at alcohq.com/… has you record the registrar, account owner, expiration date and renewal-notice address for your domain, then the same for hosting and any certificate that renews outside your hosting platform. Its test is to have a second authorized person find the renewal settings without using your credentials. Recovery instructions go in your approved password vault, and passwords stay out of the spreadsheet.

Give certificates their own rows. The CA/Browser Forum's Baseline Requirements limit publicly trusted TLS certificates issued on or after March 15, 2026 to 200 days of validity, then 100 days for those issued from March 15, 2027 and 47 days from March 15, 2029. A certificate replaced by hand now needs replacing at least every 200 days, so note who does it, or confirm that it renews automatically.

Try a restore if backup reports only show successful jobs

A successful job shows the backup ran, not that your file comes back intact. CISA's guidance on backing up business data says to perform scheduled recovery tests to verify backup integrity, make sure your team can rapidly restore data both fully and partially, and be able to roll back data at least seven days. Its 3-2-1 rule calls for three copies of important files, on two different types of storage media, with one copy stored off-site.

Our one-file restore guide at alcohq.com/insights/test-a-backup-with-one-file is the partial test. Pick a file the backup should protect, with a detail you can check, ideally one that changed on a date you know so you can ask for the version from before the change. Nobody should edit it during the test.

Record whether you used version history inside Microsoft 365 or Google Workspace or a separate backup that keeps copies elsewhere, because they answer different questions. Version history is the quickest way to undo an edit, but it does not reach back forever, and because it lives in the same service as the file, ransomware can target it. A separate backup shows whether a usable copy exists outside that system.

Restore without overwriting the original

Restore a copy into a test folder that only the people running the test can open, using actions that open or copy an older version rather than replace the current file. The vendors name them differently:

  • In Windows File History, open File Explorer, right-click the folder that held the file and select Restore previous versions. Microsoft warns that Restore replaces the current version and cannot be undone, so expand Restore, select Restore to and pick your test folder.
  • In OneDrive, Restore in the Version history pane makes the older version the current one. Use it only when you mean to roll the file back.
  • In a SharePoint library's Version history dialog, click the down arrow next to an older version and choose View rather than Restore.
  • In a Google Doc, Sheet or Slides file, click Last edit at the top right, then next to the version you want click More and Make a copy, and save the copy in your test folder.
  • For other files in Google Drive, select the file, click More, then File information and Manage versions, and download the version you want. Google says a version might be permanently deleted after 30 days or once there are 100 newer versions, unless you mark it Keep forever.

Move any downloaded copy out of your Downloads folder and into the test folder. Work from written restore instructions that name the service, the account, how to pick a version, where restored files go and who to call, and time the test from the moment someone starts looking for them. Note every point where someone had to guess or ask for help.

Check the copy and write down what happened

Open the restored copy in the app you normally use, and confirm its date and one or two details you recognize. Keep it under the same privacy controls as the original. Record the backup location, file name, version date, restore location, elapsed time and result, and put a date on the next test.

If it fails, the guide points to likely causes. A newest copy older than expected may mean the backup stopped capturing that location, a missing version usually means retention or version limits are shorter than assumed, a missing file may mean its folder was never included, and a failed sign-in means recovery depends on an account or device nobody could reach. If the copy opens damaged or incomplete, run a second test on a different file.

If the test only worked because you happened to have an administrator's login, write that down as a dependency. Next time, ask a second authorized person to follow your instructions, and change one thing per round, such as the person, the location or the age of the version.

A single-file test is a starting point. Plan separate tests for applications, permissions and larger folders the business depends on, since restored files may lose their sharing settings.

A worked example

Imagine a ten-person landscaping company with one free hour in December. The office manager restores last Tuesday's price list from the separate backup into a test folder and confirms that Wednesday's price change is not in it, so the copy really is Tuesday's. The restore takes twelve minutes, partly because the backup console sends its sign-in code to the owner's phone, so she lists the phone as a dependency.

Next she checks the office's six PCs under Settings, System, About. Four run Windows 11 Pro version 25H2, supported to October 12, 2027. One runs 24H2, which Microsoft's table shows at End of updates for Pro, and one still runs Windows 10 with no ESU enrollment, so both go on the list.

Last, an ICANN lookup shows clientTransferProhibited and an expiry date in March, but the registrant email in the registrar account still belongs to a former employee, so renewal notices go to him. She changes it to a monitored mailbox that two people read and that does not depend on the company's own domain, then answers the registrar's verification email the same day. Because the registrant email changed, the domain may now be locked against transfer for 60 days, which does not matter because no move is planned. She sets a calendar reminder 60 days before expiry, and each open item gets an owner and a date.

Common mistakes and how to spot them

Each of these has a sign that gives it away:

  • Restoring over the original. Your record shows the same folder for the original and the restore.
  • Testing a file that never changed. You cannot name the detail that proves which version came back.
  • Treating a green backup report as a test. Nobody opened a restored file.
  • Sending renewal notices to an address on the domain itself. The address ends in your own domain name.
  • Leaving the registrar login with one person. Nobody else can find the renewal settings without borrowing credentials.
  • Changing the registrant just before a planned registrar move. The move stalls on the 60-day lock.

ALCO Tools and the ALCO site

We've also included guides to the ALCO Tools library and the ALCO site. The Learning Center at alcohq.com/insights lists recent articles under Latest insights and short training videos under Training and tutorials. For the site itself, the Site Tour at alcohq.com/training/site-tour walks through alcohq.com section by section, including where the public status page and the client portal are and how to get in touch.

ALCO Tools at alcohq.com/tools groups 30 free browser-based utilities, six each in Text, Images, PDFs, Files and Calculators, with no sign-up. The launch article at alcohq.com/insights/introducing-alco-tools is precise about privacy: the pages load over the internet, an access check runs before a tool loads and tool opens are counted in aggregate, but the contents of your file or text are not sent to a server to be processed. Its checklist for judging any online tool starts with whether the page explains, in plain language, where the processing happens.

You can check the processing claim yourself, as the article describes. In Chrome, press F12 or Ctrl+Shift+I, or Command+Option+I on a Mac, choose the Network panel, check Preserve log and click Clear, then right-click the header of the Requests table and turn on the Method column. Run a harmless test file through a tool and look for any POST or PUT request during the job, since those can send data to a server.

Choose next year's email editions

Browse at your pace and use alcohq.com/newsletter to choose the email editions you want next year. The signup page describes the newsletter as one email a week. Industry News explains what vendor changes mean for small teams, Tech Tips gives you checks to try on your own systems, and Company News covers what ALCO is building, publishing and changing. You confirm your email at signup, and as our guide at alcohq.com/insights/alco-newsletter-guide explains, the preferences link in a newsletter lets you update your choices later.

What to do this week

Pick the items that fit your hour:

  • Restore one file into a test folder and record the six details from the restore guide.
  • Note the edition and version of every Windows PC and compare them with Microsoft's table.
  • Run an ICANN lookup on each domain and save the result with the date.
  • Send renewal notices to a monitored mailbox two people read, with at least one contact off the domain.
  • Put each expiry date in a shared calendar 60 days ahead, with a named backup watcher.
  • Send the results, failures included, to whoever owns the next review.

Short answers to common questions

Auto-renew does not make the notices redundant. It works only while the payment method stays current, so confirm the card on file will still be valid at the next renewal.

A privacy service and a proxy service are different. With a privacy service you remain the registrant and the provider's contact details appear in place of yours, while with a proxy service the provider is the registrant and licenses the name to you.

The expiry rules above are ICANN policy for generic top-level domains. For a country-code domain, check your registrar's terms and the registry's rules.

ALCO Tools suit one-off tasks. The launch article says client records, payroll, health information and identity documents belong only in services your organization has approved for them.

Where ALCO can help

ALCO's services include backup and disaster recovery, and domains and DNS. The backup service includes scheduled restores of real files and systems that are timed and recorded, and a written recovery runbook. The domains service includes an audit of every domain's registrar, registrant, expiry date and records, and help getting a domain registered by a former employee or agency back into the company's name. Our help desk is staffed 24 hours a day, including holidays, and calls are answered by a person.

Sources