AI Skill Report Card
Troubleshooting IT Issues
Quick Start13 / 15
When a user reports an issue, gather information before diagnosing:
1. What exactly is happening? (error message, exact wording, screenshot if possible)
2. When did it start? What changed recently (update, new device, password change)?
3. Does it affect one user or multiple users?
4. Is it consistent or intermittent?
5. What have they already tried?
Then classify: Hardware / Software / Network / Account / Permissions — before touching any fix.
Recommendation▾
Add an example showing a genuinely hard/ambiguous case (e.g., intermittent network issue) to demonstrate handling uncertainty, not just clean two-step diagnoses.
Workflow14 / 15
Progress:
- [ ] Identify symptoms and scope (1 user vs many)
- [ ] Identify recent changes
- [ ] Classify issue type
- [ ] Try least disruptive fix first
- [ ] Explain what the fix does before running it
- [ ] Confirm resolution with the user
- [ ] Document root cause and preventative measure
- [ ] Escalate only if truly stuck
Step-by-step:
- Gather symptoms — exact error text, when it started, frequency, scope (one user/device vs many = points to account/permissions vs infrastructure/network).
- Check recent changes — Windows Update, new hardware, password reset, policy change, software install.
- Classify the domain — Hardware, Software, Network, Account, Permissions. Don't assume; verify with a quick diagnostic (e.g.,
pingfor network,Get-Servicefor a stopped service). - Work simplest fix first — restart service > restart app > restart device > reinstall > escalate to infrastructure. Never start with a reimage or account rebuild.
- Explain each step in language matching the user's skill level before running it, e.g. "I'm going to flush your DNS cache — this clears stored website addresses that might be outdated."
- Confirm resolution explicitly with the user before closing. Don't assume silence = fixed.
- Document — problem summary, cause, steps taken, preventative measure.
Recommendation▾
Include a 'bad output' contrast example (e.g., jumping straight to reimage) to reinforce the least-disruptive-first principle with a concrete before/after.
Diagnostic Commands Reference
Always explain the command before running it.
| Command | Purpose |
|---|---|
ipconfig /all | Shows full network config (IP, DNS, gateway, adapter) |
ping <host> | Tests basic reachability/latency to a host |
tracert <host> | Shows the network path and where it breaks |
nslookup <domain> | Checks DNS resolution |
netstat -ano | Lists active connections and listening ports |
sfc /scannow | Scans and repairs corrupted Windows system files |
DISM /Online /Cleanup-Image /RestoreHealth | Repairs the Windows system image (run before SFC if SFC fails) |
chkdsk /f | Checks and repairs disk errors |
gpupdate /force | Forces Group Policy to reapply immediately |
gpresult /r | Shows which GPOs are actually applied to a user/machine |
systeminfo | Full OS/hardware summary |
tasklist / taskkill /PID | Lists / kills running processes |
powercfg /energy | Diagnoses power/battery issues |
Get-Process, Get-Service | PowerShell equivalents for process/service checks |
Test-NetConnection -ComputerName <host> -Port <port> | Tests connectivity to a specific host/port |
Get-WinEvent -LogName Application -MaxEvents 50 | Pulls recent event log entries for root cause analysis |
Examples15 / 20
Example 1: Input: "One user in Accounts can't send emails, everyone else is fine. Started this morning." Output:
- Scope: single user → points to account/mailbox issue, not tenant-wide mail flow.
- Check: mailbox not over quota, no send restriction, MFA/token not expired, Outlook not in "Work Offline" mode.
- Step 1: Ask user to check Outlook status bar for "Disconnected" or "Work Offline". Explain: this tells us if Outlook is even talking to the server.
- Step 2: Check mailbox size/quota in Exchange Admin Center.
- Step 3: Have user sign out/in of Outlook (refreshes auth token) — least disruptive fix first.
- If unresolved: check message trace in Exchange Online for NDRs, check Conditional Access sign-in logs for blocked sign-in.
Example 2: Input: "Printer shows offline for the whole office." Output:
- Scope: multiple users → likely network/printer/server issue, not individual PC.
- Step 1: Ping the printer's IP. Explain: confirms if it's a network reachability issue.
- Step 2: Check printer's own network settings/display panel for IP conflict or DHCP lease expiry.
- Step 3: Check print server service (
Get-Service -Name Spooleron print server) — restart if stopped. - Step 4: If IP changed, either reserve a DHCP lease or set a static IP (recommend reservation for auditability).
- Expected result: printer shows "Ready" once IP/spooler restored.
Recommendation▾
The diagnostic command table is Windows-heavy despite the description mentioning macOS/Linux implicitly via 'cloud systems' — consider clarifying scope is Windows-centric or add cross-platform equivalents.
Best Practices
- Least disruptive first. Don't reimage a machine when restarting a service fixes it.
- Verify backups before any risky change (registry edits, disk repairs, GPO changes).
- Warn before disruption — e.g. "This will restart the print spooler, which will briefly clear the print queue."
- Least privilege — never grant admin rights as a quick fix; grant the specific permission needed.
- Document every change — what was changed, why, and by whom (for audit and rollback).
- Suggest prevention after every fix — e.g. "To stop this recurring, I'd recommend setting a DHCP reservation for this printer."
- Match language to audience — plain English for end users, precise technical detail for engineers/admins.
Documentation Templates
Troubleshooting case:
Problem Summary:
Possible Causes:
Troubleshooting Steps Taken:
Expected Result:
Next Steps if Unresolved:
Ticket update (customer-facing):
Hi [Name],
Thanks for reporting this. I've identified [plain-English cause] and applied [plain-English fix].
Please confirm this has resolved the issue on your end.
If it recurs, [preventative tip].
Best regards,
[Engineer]
Escalation summary (engineer-to-engineer):
Issue:
Scope (users/systems affected):
Diagnostics run and results:
Suspected root cause:
Attempted fixes and outcomes:
Requesting: [specific action needed from next tier]
Common Pitfalls
- Jumping to a fix before confirming scope (one user vs many) — leads to wrong diagnosis category.
- Assuming "it's the network" or "it's the user" without evidence from a diagnostic command.
- Running high-impact commands (
chkdsk /f, GPO changes, DISM) without warning about restart/downtime. - Closing a ticket without explicit user confirmation that the issue is resolved.
- Skipping documentation — makes recurring issues invisible and escalations harder.
- Granting broad permissions/admin rights as a shortcut instead of the specific fix needed.