Operating Systems Administration

Introduction

Operating systems administration is the practical work of keeping computers and servers available, secure, correctly configured, recoverable, and useful for their users. As an apprentice, trainee, or vocational student, you need more than command knowledge. You also need a method: understand the system, make controlled changes, check the result, document what you did, and know how to recover when something goes wrong.

An operating system manages hardware resources and provides services to applications. A system administrator works with that operating system to manage users, processes, services, storage, networks, updates, security settings, logs, backups, and automation.

Datei:Computer abstraction layers.svg

The diagram shows a useful layered view of a computer. Hardware is at the bottom. The operating-system kernel and system software manage that hardware, while applications and users work at higher layers. Administration connects these layers: a storage fault may appear as an application error, a network setting may prevent a service from working, and a permissions problem may stop a user from opening a file.

Who This Course Is For

This aiMOOC is designed for apprentices, trainees, and vocational students who are learning IT support, system integration, server administration, network administration, or related technical professions. It uses Linux and Windows examples because real workplaces often contain more than one platform.

You should carry out practical exercises in a lab, virtual machine, training network, or other authorized environment. Do not experiment on production systems unless your instructor or responsible administrator has approved the work and a recovery plan exists.

Learning Goals

After completing the course, you should be able to explain the role of an operating system and a system administrator, inspect a running system, manage accounts and permissions, work with processes and services, interpret logs, check storage and networking, plan updates, apply basic security principles, verify backups, use virtualization safely, automate routine checks, and document troubleshooting work.

A competent administrator does not simply make a system work once. You aim to make it repeatable, supportable, secure, and recoverable.

The Administrator's Working Method

Observe Before You Change

Before changing a system, collect evidence. Identify the operating-system version, hostname, network configuration, available storage, running services, recent errors, current users, and the purpose of the machine. This creates a baseline.

A useful administration cycle is:

Observe: Collect facts about the current state.
Analyze: Decide what the evidence means and form a testable hypothesis.
Change: Make the smallest justified change.
Verify: Confirm both the intended result and important side effects.
Document: Record what changed, why, when, by whom, and how to reverse it.

Good administrators avoid changing several unrelated settings at the same time. Small, controlled changes make faults easier to understand and rollback easier to perform.

Command-Line and Graphical Tools

Administration can be performed with graphical tools, command-line interfaces, remote-management systems, scripts, and configuration-management platforms. The command line is especially valuable because commands can be documented, repeated, automated, and used over remote connections.

Datei:Linux command-line. Bash. GNOME Terminal. screenshot.png

The following table gives common examples. Exact commands can vary by distribution, Windows version, installed modules, and organizational policy.

Administrative task	Linux example	Windows PowerShell example	Purpose
Show processes	`ps` or `top`	`Get-Process`	Identify running programs and resource use
Inspect services	`systemctl`	`Get-Service`	Check service state
Read logs	`journalctl`	`Get-WinEvent`	Investigate events and errors
Inspect networking	`ip addr` and `ip route`	`Get-NetIPConfiguration` and `Get-NetRoute`	Check addresses, interfaces, and routes
Inspect storage	`lsblk` and `df -h`	`Get-Disk` and `Get-Volume`	Check devices, volumes, and free space

Commands should be treated as tools, not magic formulas. Before running a command with administrative privileges, understand its scope and likely effect.

Users, Groups, and Permissions

Identity and Authentication

A multi-user operating system must distinguish one identity from another. User accounts normally have a name, an identifier, authentication information, group memberships, a home or profile location, and permissions.

Administrative accounts require special care because they can change important system settings. Use an ordinary account for routine work and elevate privileges only when needed. This supports the security principle of least privilege.

Service accounts are identities used by applications or background services. They should receive only the permissions necessary for their function. Shared administrator accounts make accountability difficult and should be avoided where individual accounts are available.

Groups and Authorization

Groups simplify permission management. Instead of assigning rights separately to every person, you can place users in groups that represent job roles or technical responsibilities.

For example, a vocational training company might create groups for help-desk staff, web administrators, backup operators, and database administrators. A learner who changes departments can be moved between groups rather than having dozens of individual permissions edited manually.

Linux Permission Model

Traditional Unix-like file permissions distinguish the owner, the group, and others. Each category can receive read, write, and execute permissions. Commands such as chmod, chown, and chgrp can change permissions and ownership.

Datei:Linux file permissions.png

Permissions must match the task. Giving every user full access may appear convenient, but it increases the risk of accidental modification, data leakage, and malicious activity.

Windows Permissions

Windows commonly uses access-control lists for files, folders, registry objects, and other resources. Entries can grant or deny specific rights to users or groups. In organizational environments, local accounts may be combined with directory services such as Active Directory.

When troubleshooting access, identify the user, group memberships, resource permissions, inherited permissions, and the context in which the application runs. Avoid solving every permission problem by granting full control.

Processes, Services, and Logs

Processes

A process is a running instance of a program. The operating system schedules processes, allocates memory, and controls access to resources. Administrators inspect processes when a system is slow, an application stops responding, or unexpected software appears.

Useful questions include: Which process is using CPU time? Which process is using large amounts of memory? Which user owns it? When did it start? Is it expected? What other service depends on it?

Datei:Htop Linux screenshot.png

Do not terminate a process simply because it uses many resources. High use may be normal during backup, indexing, compilation, updates, or data processing. Collect context before acting.

Services and Startup

A service is a long-running component that provides a function such as web hosting, name resolution, printing, remote access, or database access. On many Linux systems, systemd manages services and other units. Windows provides the Service Control Manager and administrative interfaces such as PowerShell.

Typical service questions are: Is the service running? Is it configured to start automatically? Did it fail during startup? Does it listen on the expected interface and port? Can it access its configuration files? Are dependencies available?

Datei:Systemd-on-fedora.svg

Logs as Evidence

Logs record events generated by the operating system, services, applications, and security components. They help you reconstruct what happened.

A useful log entry often contains a timestamp, source, severity, event identifier, user or process context, and message. Administrators correlate log events with other evidence instead of reading one isolated line as the complete explanation.

Good log practice includes correct system time, enough storage for retained logs, appropriate access controls, and a retention policy that matches operational and legal requirements.

Filesystems, Storage, and Data Protection

Filesystems and Mounting

A filesystem organizes data on a storage device or logical volume. Different systems use different filesystems, but administrators always need to understand capacity, mount points or drive letters, permissions, health, and recovery options.

Datei:Linux File System Structure.png

On Linux and other Unix-like systems, many resources appear inside one directory tree beginning at the root directory. On Windows, storage is often presented through volumes with drive letters or mounted folders.

Before resizing, formatting, partitioning, or replacing storage, verify device identity and backup status. A correct command aimed at the wrong disk can still destroy data.

Capacity and Performance

Free space is not the only storage metric. Administrators also consider input and output activity, latency, filesystem errors, inode availability on relevant filesystems, device health, and growth trends.

A server that reaches full capacity may fail in unexpected ways. Applications may stop writing data, databases may refuse transactions, updates may fail, and logs may disappear. Capacity monitoring should therefore provide warning before a critical threshold is reached.

RAID and Availability

RAID combines multiple disks in ways that can improve availability, performance, or both. RAID 1 mirrors data across drives.

Datei:RAID 1.svg

RAID is not a backup. Mirroring can protect against some disk failures, but it does not normally protect you from accidental deletion, ransomware, corrupt data that is replicated, or loss of the whole system.

Backups and Restore Tests

A backup is useful only if you can restore from it. A responsible backup plan answers: What is protected? How often? Where is the copy stored? How long is it retained? Who can access it? How quickly must recovery work? How is restoration tested?

A common guideline is the 3-2-1 approach: keep multiple copies, use more than one storage type, and keep at least one copy in a separate location or failure domain. The exact design must match the organization.

Define a recovery point objective for acceptable data loss and a recovery time objective for acceptable downtime. These values help determine backup frequency and recovery architecture.

Networking for System Administrators

Addressing, Routes, and Name Resolution

A system administrator should be able to inspect an interface address, subnet, default route, and name-resolution settings. If a user says, "the network is down," separate the problem into layers.

Useful tests progress from local to remote: Is the interface enabled? Does the machine have the expected address? Is a route present? Can it reach the local gateway? Can it reach a remote IP address? Can it resolve a hostname? Can the required application port be reached?

Datei:Internet layering.svg

DNS translates names into information such as IP addresses. A DNS failure can make an application appear offline even when basic IP connectivity still works.

Ports, Firewalls, and Listening Services

Servers expose network services through protocols and ports. A firewall decides which traffic is allowed or blocked according to policy.

When a service is unreachable, check whether the service is running, whether it is listening on the expected address and port, whether the host firewall allows the traffic, whether an upstream firewall or network policy blocks it, and whether DNS sends users to the correct address.

Do not disable a firewall merely to make troubleshooting easier. Instead, test the relevant rule and document any required change.

Software, Updates, and Configuration

Package Management

Linux distributions commonly use package managers to install, update, verify, and remove software. Windows systems use Windows Update, application installers, package tools, and enterprise software-management platforms.

Package management is more than installation. Administrators also track approved repositories, dependencies, versions, security updates, licenses, and configuration changes.

Patching Safely

Security updates reduce known risk, but careless patching can cause service interruption. A practical patch workflow includes identifying affected systems, reading relevant release information, testing when practical, scheduling the change, ensuring recovery options exist, applying the update, rebooting if required, and verifying important services afterward.

Emergency security issues may justify faster action, while high-availability systems may require staged deployment. The goal is controlled risk reduction, not delay for its own sake.

Configuration and Change Control

Configuration files, registry settings, policies, and service parameters determine system behavior. Before editing them, know the current state and keep a recoverable copy when appropriate.

In a workplace, changes should normally be linked to a ticket, work order, maintenance window, or other approved process. Documentation should include the reason for the change, affected systems, commands or settings used, verification results, and rollback method.

Security Administration

Least Privilege and Secure Defaults

System security begins with reducing unnecessary access. Remove or disable unused accounts, avoid excessive administrative rights, restrict services to required networks, use secure authentication, protect secrets, and keep software supported and updated.

Security is not a single product. It is a combination of identity management, secure configuration, patching, network controls, logging, backups, monitoring, and user awareness.

Administrative Access

Remote administration should use protected protocols and strong authentication. Administrative interfaces should not be exposed more broadly than necessary.

For Linux, SSH is commonly used for remote command-line administration. Windows environments may use PowerShell remoting, Remote Desktop under organizational controls, management servers, or endpoint-management systems.

Record privileged changes when policy requires it. Good accountability protects both the organization and the administrator.

Security Events and Incident Handling

If you suspect compromise, preserve evidence and follow the organization's incident-response process. Do not immediately delete files or "clean up" every suspicious item, because doing so can destroy useful evidence.

Your role may include isolating a system, collecting logs, recording times, identifying affected accounts, preserving relevant data, and escalating to security specialists. The exact response depends on authorization and organizational policy.

Virtualization, Containers, and Test Environments

Virtual Machines

A virtual machine behaves like a computer implemented in software. A hypervisor provides and manages virtual hardware resources for guest systems.

Virtual machines are especially useful for vocational training because you can install operating systems, change configurations, take snapshots, simulate faults, and rebuild a lab without risking production infrastructure.

A snapshot can be useful for short-term lab rollback, but it should not automatically be treated as a complete backup strategy. Understand what your virtualization platform includes in a snapshot and how long snapshots should be retained.

Containers

Containers isolate applications while generally sharing the host operating-system kernel. They are lighter than full virtual machines in many use cases, but they create different administration responsibilities involving images, registries, persistent data, network configuration, secrets, resource limits, and updates.

For this course, the key distinction is: a virtual machine normally includes a guest operating system, while a container normally shares the host kernel.

Monitoring, Automation, and Troubleshooting

Monitoring What Matters

Monitoring should answer questions that are meaningful to users and services. CPU percentage alone is not enough.

Useful categories include system availability, service status, response time, CPU and memory pressure, storage capacity, storage errors, network reachability, backup results, update status, certificate expiry, and security events.

A good alert should be actionable. Too many low-value alerts train people to ignore warnings.

Automation

Automation reduces repetitive manual work and improves consistency. Small scripts can collect inventory, check disk space, test service status, rotate files, or generate reports.

Before automating a task, understand it manually. Add error handling, logging, safe defaults, and clear output. Test scripts in a lab before wider deployment.

Examples of common administration scripting environments include Bash and PowerShell. Configuration-management systems can extend automation across many machines.

A Structured Troubleshooting Method

When a fault is reported, first define the expected behavior and the actual behavior. Determine the scope: one user, one machine, one site, or many systems. Reproduce the issue safely if possible.

Collect evidence from configuration, service state, processes, logs, networking, storage, permissions, and recent changes. Form a hypothesis and test the smallest change that can confirm or reject it.

After restoring service, verify the result from the user's point of view, remove temporary troubleshooting changes, document the cause and fix, and consider how recurrence can be prevented.

Example Vocational Scenario

A web application is reported as unavailable after a planned update. Do not immediately reinstall the software.

First check whether the server itself is reachable. Then verify DNS, the web service state, listening ports, firewall rules, application logs, free storage, file permissions, and the update history. If the service starts but the application still fails, inspect application dependencies such as a database connection.

This method demonstrates an important principle: symptoms at one layer can be caused by faults at another layer.

Professional Practice

Documentation and Tickets

Technical work is part of a team process. A useful service ticket states the problem, scope, evidence, actions performed, result, and next step. Avoid vague entries such as "fixed server."

System documentation can include hostnames, roles, network addresses, operating-system versions, responsible teams, backup policy, maintenance windows, service dependencies, and recovery instructions. Sensitive information such as passwords and private keys belongs in approved secret-management systems, not ordinary documentation.

Communication

Users often describe effects rather than causes. "The internet is broken" may mean one website is unavailable. "My account is broken" may mean a file permission changed.

Ask precise questions in clear language. Explain impact and expected downtime without unnecessary jargon. When escalating, provide evidence so the next technician does not have to restart the investigation from zero.

Ethics, Authorization, and Safety

Administrative privileges create responsibility. Access only systems and data required for your authorized task. Respect privacy, licensing, organizational policy, and legal requirements.

When training, use lab systems, test accounts, sample data, and snapshots. When working in a company, follow supervision and change-control rules appropriate to your apprenticeship or role.

Interactive Tasks

Quiz: Test Your Knowledge

What is a central goal of operating systems administration? (Keep systems reliable secure and usable) (!Install as much software as possible) (!Give every user administrative rights) (!Avoid documenting changes)

Which security principle gives users only the access required for their work? (Least privilege) (!Maximum inheritance) (!Open access) (!Permanent elevation)

Which Linux command is commonly used to manage systemd services? (systemctl) (!chmod) (!ping) (!mkdir)

Which Linux tool is commonly used to read the systemd journal? (journalctl) (!useradd) (!mkfs) (!hostname)

What does RAID 1 normally do? (Mirrors data across disks) (!Encrypts every network packet) (!Replaces all backups) (!Creates user accounts)

What is the best description of a usable backup? (A recoverable copy of data) (!A second shortcut to the same file) (!A list of installed applications) (!A record of user passwords)

What should you do before a planned production patch when practical? (Test the change and prepare rollback) (!Disable all logging) (!Remove every user account) (!Delete the previous configuration)

What is a main purpose of DNS? (Resolve names to network information) (!Allocate CPU time to processes) (!Mirror files between disks) (!Change local file permissions)

What software layer manages virtual machines? (A hypervisor) (!A text editor) (!A printer driver) (!A spreadsheet)

What is a good first step in troubleshooting? (Define the problem and collect evidence) (!Change several settings at once) (!Reinstall the operating system immediately) (!Disable security controls permanently)

Memory Game

Kernel	Core software that controls CPU memory and devices
Daemon	Background service process on many Unix-like systems
Filesystem	Rules and structures used to organize stored data
Patch	Software change that fixes defects or security issues
Hypervisor	Layer that creates and manages virtual machines
Snapshot	Point-in-time state useful for quick lab rollback

Drag and Drop

Match the correct terms.	Topic
systemctl	Manage Linux services
journalctl	Inspect system logs
chmod	Change Linux file permissions
ip	Inspect Linux network configuration
df	Report filesystem space

...

Crossword Puzzle

Kernel	What core part of an operating system manages hardware resources?
Journalctl	Which Linux command reads the systemd journal?
Firewall	What control filters network traffic according to rules?
Snapshot	What point-in-time virtual-machine state can support quick lab rollback?
Package	What managed software unit can be installed or updated by a package manager?
Hypervisor	What software layer creates and manages virtual machines?

LearningApps

Cloze Text

An

manages hardware resources and provides services to applications. The principle of

limits access to what a user or service actually needs. A

organizes stored data so that files and directories can be located and managed. A running instance of a program is a

. A long-running component that provides a system function is a

. Administrators use

to reconstruct events and investigate faults. Controlled

reduces risk from known software defects and security vulnerabilities. A verified

provides data that can be restored after loss or damage. A

provides and manages virtual hardware for guest systems. Clear

helps teams repeat changes and recover from problems.

Open-Ended Tasks

Easy

System inventory: Create a one-page inventory for a lab computer showing its operating system, hostname, CPU, memory, storage, network address, and two important installed services.
Command-line interface: Produce an illustrated quick guide with your own screenshots that compares four safe inspection commands on Linux or Windows and explains what each output tells an administrator.
File-system permissions: Draw a permission diagram for a shared training folder with three user roles, then explain why each role receives or does not receive read, write, and execute rights.
Technical support: Interview an IT technician, instructor, or experienced trainee about one routine administration task and write a short summary of the preparation, risks, checks, and documentation involved.

Standard

User account management: Design an onboarding and offboarding procedure for a fictional company, including account creation, group membership, least privilege, password or authentication handling, and account removal.
System service: In a virtual machine, stop a non-critical training service, observe the symptom, identify the service state and log evidence, restore it, and document the experiment as a troubleshooting report.
Data storage: Build a small virtual storage lab, record capacity before and after creating test data, investigate how free space is reported, and explain what warning threshold you would monitor.
Network troubleshooting: Produce a short screen-recorded video that demonstrates a safe network diagnosis from local interface checks through routing, DNS, and application reachability.

Advanced

Patch management: Write a patch-management runbook for ten fictional servers that includes prioritization, testing, maintenance windows, rollback, verification, and communication with users.
Backup and restore: Perform a recovery test using non-sensitive sample data, measure the restore time, compare the result with a stated recovery objective, and recommend one improvement.
Virtualization: Design a three-machine virtual lab for a small business service, draw the architecture, allocate resources, define network segments, and justify snapshot and backup choices.
System administration: Visit or observe an authorized IT workplace, training server room, or supervised administration session and produce a professional report on monitoring, documentation, security, escalation, and change control without recording confidential information.

Learning Assessment

Troubleshooting: A user can reach a server by IP address but not by hostname. Explain which evidence you would collect, which likely layer is affected, and how you would verify a repair without changing unrelated settings.
Access control: A trainee needs to update website content but must not change server configuration. Design an account and group-permission approach that supports the task while following least privilege.
Service management: A service repeatedly fails after reboot but runs when started manually. Develop a diagnostic plan that connects startup configuration, dependencies, permissions, and logs.
Storage management: A file server is approaching full capacity even though users report deleting files. Propose an investigation that considers filesystem usage, open files, logs, backups, and growth trends before new storage is purchased.
Backup strategy: Compare RAID mirroring with an independent backup in a ransomware scenario and explain why an organization may need both availability measures and recoverable copies.
Change management: You must deploy an urgent security patch to a business-critical server. Create a risk-based plan that balances speed, testing, rollback, service impact, verification, and documentation.

Evidence of Learning

Evidence of learning should show that you can connect technical knowledge with safe workplace practice.

Area	Evidence
Knowledge	You can explain operating-system layers, identities, permissions, processes, services, logs, storage, networking, patching, backups, virtualization, and security principles in your own words.
Practical skills	You can inspect a system, interpret command output, manage a supervised lab configuration, verify service state, analyze logs, check network and storage information, and restore sample data.
Products	You produce usable inventories, diagrams, runbooks, screenshots, troubleshooting reports, recovery records, scripts, or short instructional videos.
Reasoning	You distinguish symptoms from causes, form testable hypotheses, make controlled changes, and use evidence to justify decisions.
Transfer	You can apply the same administration method to a new operating system, unfamiliar service, or workplace scenario while respecting authorization and local policy.
Professional practice	Your work is documented, reproducible, security-aware, privacy-conscious, and understandable to another technician.

OERs on the Topic

The English Wikipedia article on system administrators provides an open reference for the profession, common responsibilities, and related fields. You can also connect this course with Operating system, File system, Computer network, Information security, Virtualization, and Backup.