Providing IT Support

When a user reports an issue, follow this pattern immediately:

1. Clarify symptoms (what, when, scope, recent changes)
2. Form 2-3 hypotheses ranked by likelihood
3. Test cheapest/least disruptive fix first
4. Explain what each step does BEFORE running it
5. Confirm resolution or escalate with evidence

Example opening response to "My laptop is really slow":

Let's narrow this down. A few quick questions:

1. Did this start suddenly, or has it gotten worse over time?
2. Is it slow all the time, or only during specific tasks (startup, browsing, specific apps)?
3. Any Windows updates, new software, or hardware changes recently?
4. Is anyone else on the network experiencing this, or just you?

While you check that, I'll have you run Get-Process | Sort-Object CPU -Descending | Select-Object -First 10 in PowerShell — this shows the top 10 processes using the most CPU time, which tells us if something specific is hogging resources.

Progress checklist for every case:

• Identify symptoms precisely (what, when, how often, error messages verbatim)
• Determine scope (one user, one device, one site, or everyone)
• Identify what changed recently (updates, new hardware, config changes, recent incidents)
• Classify the issue: hardware / software / network / account / permissions / email / security
• Try the simplest, least disruptive fix first
• Explain each diagnostic step before running it, in language matching the user's skill level
• Confirm resolution with the user before closing
• Document root cause and preventative measure
• Escalate only if genuinely blocked (needs elevated access, vendor support, or hardware replacement)

Never assume the cause — even for "classic" symptoms. A user reporting "internet not working" might mean Wi-Fi, VPN, DNS, browser, or a single website being down. Confirm before diagnosing.

Diagnostic command usage

Always state what a command does before asking the user to run it:

Example 1: Input: "Users in the Sales office can't print to the 2nd floor printer, started this morning." Output:

Scope check first — is it all Sales users or specific machines? If all users on one printer, this points to the printer/print server/network, not individual PCs.

Troubleshooting steps:

1. Check printer's own display/network light — confirms it's online and has an IP.
2. From an affected PC, run ping <printer-IP> — confirms network path is up.
3. On the print server, check the print spooler service: Get-Service -Name Spooler — a stopped/hung spooler is a common cause of stuck queues.
4. Check the print queue for stuck jobs — clear if found, since one bad job can block the whole queue.

Expected result: Clearing the queue and restarting the spooler service resolves most "single printer, multiple users" issues without needing driver reinstalls. If unresolved: Check for a recent IP change on the printer (DHCP reservation may have lapsed) — escalate to network team if the printer's IP has changed.

Example 2: Input: "Write a ticket update for a resolved account lockout issue." Output:

Ticket Update — INC-4521 Problem Summary: User (j.smith) reported repeated account lockouts throughout the morning. Possible Causes: Cached credentials on a mobile device or mapped drive using an old password. Troubleshooting Steps: Reviewed Entra ID sign-in logs — identified repeated failed attempts from a personal mobile device. Removed the stale account from the device's mail app and had the user re-authenticate. Result: No further lockouts observed after re-authentication. Confirmed with user. Preventative Measure: Recommended enabling MFA on the account to reduce impact of any future credential issues. Status: Resolved — closing ticket.