How to Run a Quarterly Backup Audit Using Only Built-In Windows Tools

Backup management is one of the most important responsibilities of MSPs, but many organizations lack the budget or justification to invest in dedicated third-party backup auditing tools.

The good news is that there are no-cost frameworks you can use each quarter to confirm that backups are working successfully, meeting data retention policy requirements, and can be restored when needed.

In this guide, we’ll show you how to conduct quarterly backup audits using only native utilities and basic scripts. Keep reading to learn more about the importance of conducting backup audits. This approach supports compliance, cyber insurance readiness, and verification of your 3-2-1 backup strategy without additional software.

A practical guide to performing quarterly backup audits using native tools and basic scripting

Although third-party auditing tools can be helpful, you don’t necessarily need them to conduct backup audits. You can use built-in Windows tools and basic scripts to validate backup health, retention, and off-site protection.

Step 1: Create a quarterly backup audit checklist

Start by creating a quarterly backup audit checklist that covers each major validation area:

• Backup Job Success: Review backup logs from the past 90 days and note any failed or missed jobs.
• Retention Policy Compliance: Check if the backup’s data retention periods match their respective policy (for example, 30, 90, or 365 days).
• Off-site & Immutable Copies: Make sure the backups adhere to the 3-2-1 rule:
  • 3 copies of data
  • 2 different media types
  • 1 off-site or immutable copy supported by off-site backup solutions
• Manual Restore Test: Test the usability of the backups by performing at least one manual restore.
• Exception Logging: Note any anomalies or deviations from your backup policies.

Use tools like Excel and Notion to create a templated checklist you can use every quarter.

Step 2: Use built-in tools to extract backup status

Collecting backup logs can be time-consuming, so to speed up the process, you can use command-line tools or native PowerShell commands to automate the extraction.

Examples

(A) Windows Server Backup

Get-WinEvent -LogName Application |

Where-Object {$_.ProviderName -eq "Microsoft-Windows-Backup"} |

Select TimeCreated, Message |

Export-Csv "C:\BackupAudit\EventLog.csv" -NoTypeInformation

This script collects Windows backup-related events from the local machine and saves them into a CSV file, which you can consolidate for a centralized review or audit.

Automating this step improves audit consistency and frees up time to strengthen backup coverage and off-site backup solutions.

⚠️Important: You must execute this script on all endpoints that use Windows Backup.

📝 Editor’s Note on Performance: When writing or running extraction scripts for the Windows Application Log, ensure the script is optimized to filter events before loading them into the server’s local memory. Standard filtering can heavily tax system resources on older or busy production servers. Remember that native Windows logging only tracks built-in features like Windows Server Backup; if your fleet uses separate platforms, your tracking methods will need to target those specific software log channels instead.

Step 3: Perform a manual restore validation

Aside from ensuring that your backup jobs are running, you must also verify that they’re usable. You can do this by restoring a few files or directories for each quarter:

1. Restore a file or folder to a sandbox VM or isolated environment.
2. Measure the restore time and check the file’s integrity.
3. Document any errors or complications you encounter. Take screenshots and attach them to your quarterly audit summary.

Step 4: Validate retention and off-site compliance

Use scripts or manual inspection to comply with your data retention policy:

Get-ChildItem "\\backupserver\archive" -Recurse |

Where-Object {$_.LastWriteTime -lt (Get-Date).AddDays(-90)}

This PowerShell command scans the \\backupserver\archive directory and filters out all the files and folders that haven’t been modified in the last 90 days. The result is a list of outdated items you can use to determine which files can be archived or deleted.

To check off-site backup solutions, verify the availability of cloud backups (e.g., Azure and AWS), offsite NAS, or external drives.

🔒 The Immutability Reality Check: While native Windows tools are excellent for verifying file creation dates and matching them against your retention schedules, standard Windows network shares and file systems cannot create true, un-deletable “immutable storage.” To fully satisfy the “1” in your 3-2-1 strategy against modern ransomware, these native Windows checklist audits should eventually point toward hardware-isolated or cloud-object-locked repositories that prevent administrative deletion.

Mark which systems meet the 3-2-1 backup strategy using a dashboard and highlight any gaps you find.

Step 5: Track trends and exceptions in a spreadsheet

Once you’ve gathered all the necessary backup logs and validation results, you can begin creating a centralized audit log to monitor backup health. It should include separate tabs for a system’s:

• Backup Job Status: Indicate the system’s name, the last completed backup job, and success/failure results.
• Retention Compliance: Compare target data retention to actual retention to ensure compliance.
• Restore Test Results: Include the test time, success rate, and any issues encountered during the test.
• Trend Analysis: Use conditional formatting to highlight trends over time (for example, ✅ = Passed, ⚠️ = Warning, ❌ = Failed) and small line charts to demonstrate backup health per client or site.

Step 5b: Secure your audit evidence

An audit log is only useful if it can be trusted. If a cyberattacker compromises a network, their first move is often to delete backup infrastructure and wipe event logs to hide their tracks.

• Do not leave your exported audit CSV files sitting on the local drive of the production servers you just scanned.
• Do automate the transfer of these audit summaries to a secure, write-once directory, an off-site repository, or ingest them directly into your central MSP documentation platform so the evidence is tamper-proof.

Step 6: Deliver client-friendly summary reports

Finally, present your audit findings to your clients in the form of a summary report.

The document should include:

• A one-page executive summary highlighting key findings, risks, and recommendations
• A chart showing backup job success rates by system
• A brief note on the restore test outcome
• Any remediation or follow-up actions (such as retention updates and schedule adjustments)

These reports can be a valuable addition to your Quarterly Business Reviews (QBRs), allowing you to reinforce the value your MSP delivers.

What are backup audits?

Backup audits objectively examine an organization’s data backup and recovery strategies. They help ensure that the organization’s backup procedures are aligned with its policies and compliant with industry standards and regulations.

More importantly, backup audits assess the effectiveness of your backup strategies against threats such as ransomware and hardware failure.

There are three types of data backup audits:

• First-party Audit: An internal audit review conducted by the firm’s IT or security team
• Second-party Audit: An external audit performed by a party connected to the organization, such as a client
• Third-party Audit: An independent audit done by an external firm with no ties to the organization

Quarterly data backup audits play a crucial role in ensuring the effectiveness of an organization’s backup and recovery systems. It allows you to identify gaps in their backup coverage and ensure compliance with data retention policies.

While conducting regular audits alone cannot fully prevent data loss, they provide reassurance that you have valid, restorable backups that you can use when it matters most.

Quarterly backup audits made easier with NinjaOne

NinjaOne Backup can help streamline the audit process by:

• Using monitoring alerts to flag backup job failures ahead of audits
• Exporting activity logs from backup tools integrated with NinjaOne
• Building snapshot dashboards of backup health over time for QBRs

This enables MSPs to validate retention, restore capability, and off-site backup solutions without investing in separate auditing software.

Conduct comprehensive backup audits without third-party auditing tools

Just because you don’t have paid auditing tools at hand doesn’t mean you can’t conduct recurring backup audits anymore.

By creating a low-cost auditing framework and leveraging native tools like PowerShell, you can improve your MSP’s data protection strategies and enhance client trust without investing in additional software.

Related topics:

• Best Data Backup Recovery Software: 10 Solutions for 2026
• Common Business Data Loss Causes and How to Mitigate Them
• 8 Tips on Keeping Your Data Backups Secure