The 5 most common IT problems in small businesses and how to solve them

During a first IT review in a small business, we rarely find anything spectacular. Instead, we keep finding the same five things: a backup nobody has ever restored anything from, an active account belonging to someone who left two years ago, the provider's router with the administrator password from the sticker, computers without updates and passwords known to only one person. None of them hurts day to day. Any of them can bring the company to a standstill for several days.

The order below reflects what we would check first. For each problem we describe how to recognise it, where it comes from, what you can do yourself in an hour or two and at what point you need someone with experience.

Backups without a restore test

Symptom. Ask “do you have a backup?” and the answer is “yes, it goes to the network drive”. Ask “when did you last restore something from it?” and there is silence. Often the only copy sits on a NAS device mapped on the computers as drive Z.

Cause. The backup was set up once, when the device was bought. Since then the folders have changed, an accounting program with a database in a different location has been added, and the backup job reports an error nobody reads. A backup mapped as a network drive has one more flaw: ransomware encrypts it along with the rest of the data.

In its ransomware guide for small organisations, CERT Polska lists the questions you need to ask yourself: are the backups up to date and made regularly, are they stored in a resilient way, in particular is the backup not connected as a network share, and are restore tests carried out regularly. The guide also reminds readers of the 3-2-1 rule: at least three copies of the data, two on different media, one isolated.

What to do yourself. Pick one file and one folder from last week and try to restore them from the backup to a different location. Check the date of the last successful backup in the device or software panel. Write down exactly what is backed up and what is missing, especially databases of accounting and warehouse programs.

When you need a professional. When the backup has to cover a server, a database or an ERP system, when you need a backup isolated from the company network and when a restore test has to show how many hours it will take to bring back the whole server. We write more about how to check whether your backup really works in our article on in-house backups.

Former employees' accounts and sign-in without MFA

Symptom. The list of users in Microsoft 365 or Google Workspace is longer than the list of employees. Someone who has left still has access to email from their phone. Three people sign in to the invoices mailbox with the same password.

Cause. A small business has no procedure for when an employee leaves. The account stays “because customers send emails to it”, and the password is not changed. MFA (multi-factor authentication, meaning signing in with a password and a second factor, such as a code from a phone app) is not switched on, because it once bothered someone.

In its recommendations for authentication systems, CERT Polska advises support for two-factor authentication, and in 2025 it raised the minimum password length to 14 characters. The same recommendations advise against forcing periodic password changes and artificial complexity rules, because they lead to short, predictable passwords.

A typical scenario without MFA looks like this: an employee enters their password on a fake sign-in page from a message about a “shared document”, someone signs in to their mailbox and reads the correspondence for several days. Then they send a customer a genuine invoice with a swapped bank account number. A second sign-in factor will not stop every attack, but a password alone is then no longer enough to get into the mailbox.

What to do yourself. Print the list of accounts from the admin panel and compare it with the list of employees. Block the accounts of people who have left, and forward their email or convert the mailbox into a shared mailbox. Switch on MFA first for administrator accounts, then for everyone. Convert mailboxes used by several people into shared mailboxes with separate user accounts.

When you need a professional. When you have remote desktop or VPN reachable from the internet without a second factor, when a local Windows domain runs alongside the cloud and when you want sign-in rules that depend on device and location. This is also the point where a company password manager comes in useful; we described three ways to deploy one in our article on a password manager for business.

The provider's router and an undivided network

Symptom. Wi-Fi drops out in the meeting room, guests get the password to the same network the accounts team works on, and nobody knows how to sign in to the router. The printer is visible one moment and gone the next.

Cause. The router supplied by the internet provider was meant for a flat or a small shop, yet it serves a company with a dozen or so computers, printers, phones and cameras. Everything runs on one network, the device firmware has not been updated, and the administrator password is the factory default or known to the provider's technician.

What to do yourself. Check the router model and whether the manufacturer still releases updates for it. Change the administrator password and store it somewhere safe. Set up a separate guest Wi-Fi network if the router allows it. List what is connected to the network: computers, printers, the camera recorder, the payment terminal.

Also check the port forwarding section in the router panel. An entry directing traffic from the internet to the remote desktop port of one of the computers is a common trace left by someone who once “set up access from home”. In its ransomware guide, CERT Polska recommends making remote desktop available only through the company VPN with two-factor authentication. If you find such an entry and nobody can say what it is for, that is a sign you need to talk to a professional urgently.

When you need a professional. When you want to separate the guest, camera and accounts networks (VLAN, a logical division of one physical network), when Wi-Fi has to work across several rooms without dropping out and when you need secure remote access. We described the differences between a provider's router and a managed network in our article the provider's router vs a managed company network.

No updates and hardware without manufacturer support

Symptom. Computers show update reminders that someone has been putting off for months. The office still has computers running Windows 10. The PDF reader and the browser are versions from a year ago.

Cause. Updates need a restart, and a restart gets in the way of work. Nobody is responsible for making sure they are installed. Some of the hardware is too old to move to a newer system, so it stays on the old one.

Microsoft ended support for Windows 10 Home and Pro on 14 October 2025. Since that date the computers still work, but they receive no security fixes or technical support. Microsoft runs a paid Extended Security Updates (ESU) programme that buys time to replace hardware, but does not replace it. The CERT Polska guide reminds readers that it is not only the operating system that needs updating, but also services exposed to the internet and the applications employees use: browsers, office suites and email programs.

What to do yourself. On each computer, check the system version (Settings, System, About) and record the result in a table. Switch on automatic updates and set the restart time outside working hours. Update the browsers and PDF readers.

When you need a professional. When you have a dozen or more computers and need to know which updates have failed, when hardware does not meet the Windows 11 requirements and replacement has to be planned, and when updates are needed on a server or system the whole company depends on.

Passwords and knowledge in one person's head

Symptom. The password to the domain panel, the email administrator account, the router and the server is known to one person: an IT person who used to help, the owner or the employee who “does the computers”. Their holiday is an operational problem for the company.

Cause. The setup was done ad hoc, over the years, by different people. Nobody wrote down what is where, because there was always something more urgent. The domain is sometimes registered to the private email address of someone who no longer works with the company.

What to do yourself. Make a list of critical access: the domain registrar and DNS, the Microsoft 365 or Google Workspace administrator, the router, the NAS, the server, software licences, business banking. For each one, record whose name the account is in and who knows the password. Move the passwords into a company password manager that at least two people can access. Switch the domain registrar account to a company email address.

Starter documentation does not have to be long. One page is enough, with a list of devices and their addresses, where the backups are kept, contact details for the internet provider and software suppliers, and who in the company makes decisions in the event of a failure. Update it whenever you change hardware or a supplier.

When you need a professional. When you need to recover access to the domain or administrator account from a previous provider, when the environment has a server and a network with many devices and when you need documentation from which someone else can rebuild the configuration after a failure.

Where to start putting IT in order in a small business

If you only have time for one thing this week, do a backup restore test. The other two things for the coming month are an account review with MFA switched on and a list of critical access. Updates and the network usually need more time and purchasing decisions, so it is better to plan them than to rush them.

All five problems share a common cause: nobody in the company is responsible for them by name. You can appoint such a person internally or hand these duties to an external company as part of permanent IT support. If you want to check which of these problems apply to you, start with free IT review.

Sources

• CERT Polska, Ransomware guide (Poradnik ransomware), https://cert.pl/uploads/docs/CERT_Polska_Poradnik_ransomware.pdf (accessed 02/10/2026)
• CERT Polska, CERT Polska technical recommendations for authentication systems (Rekomendacje techniczne CERT Polska dla systemów uwierzytelniania), published 10/01/2022, updated 2025, https://cert.pl/posts/2022/01/rekomendacje-techniczne-systemow-uwierzytelniania/ (accessed 02/10/2026)
• Microsoft, Windows 10 Home and Pro - Microsoft Lifecycle, https://learn.microsoft.com/en-us/lifecycle/products/windows-10-home-and-pro (accessed 02/10/2026)
• Microsoft, Windows 10 support has ended on October 14, 2025, https://support.microsoft.com/en-us/windows/deployment/updates-lifecycle/windows-10-support-has-ended-on-october-14-2025 (accessed 02/10/2026)

As of 2 October 2026.