AI Skill Report Card

Troubleshooting IT Issues

A-84·Sep 18, 2026·Source: Web
13 / 15

When a user reports an issue, gather information before diagnosing:

1. What exactly is happening? (error message, exact wording, screenshot if possible)
2. When did it start? What changed recently (update, new device, password change)?
3. Does it affect one user or multiple users?
4. Is it consistent or intermittent?
5. What have they already tried?

Then classify: Hardware / Software / Network / Account / Permissions — before touching any fix.

Recommendation
Add an example showing a genuinely hard/ambiguous case (e.g., intermittent network issue) to demonstrate handling uncertainty, not just clean two-step diagnoses.
14 / 15
Progress:
- [ ] Identify symptoms and scope (1 user vs many)
- [ ] Identify recent changes
- [ ] Classify issue type
- [ ] Try least disruptive fix first
- [ ] Explain what the fix does before running it
- [ ] Confirm resolution with the user
- [ ] Document root cause and preventative measure
- [ ] Escalate only if truly stuck

Step-by-step:

  1. Gather symptoms — exact error text, when it started, frequency, scope (one user/device vs many = points to account/permissions vs infrastructure/network).
  2. Check recent changes — Windows Update, new hardware, password reset, policy change, software install.
  3. Classify the domain — Hardware, Software, Network, Account, Permissions. Don't assume; verify with a quick diagnostic (e.g., ping for network, Get-Service for a stopped service).
  4. Work simplest fix first — restart service > restart app > restart device > reinstall > escalate to infrastructure. Never start with a reimage or account rebuild.
  5. Explain each step in language matching the user's skill level before running it, e.g. "I'm going to flush your DNS cache — this clears stored website addresses that might be outdated."
  6. Confirm resolution explicitly with the user before closing. Don't assume silence = fixed.
  7. Document — problem summary, cause, steps taken, preventative measure.
Recommendation
Include a 'bad output' contrast example (e.g., jumping straight to reimage) to reinforce the least-disruptive-first principle with a concrete before/after.

Always explain the command before running it.

CommandPurpose
ipconfig /allShows full network config (IP, DNS, gateway, adapter)
ping <host>Tests basic reachability/latency to a host
tracert <host>Shows the network path and where it breaks
nslookup <domain>Checks DNS resolution
netstat -anoLists active connections and listening ports
sfc /scannowScans and repairs corrupted Windows system files
DISM /Online /Cleanup-Image /RestoreHealthRepairs the Windows system image (run before SFC if SFC fails)
chkdsk /fChecks and repairs disk errors
gpupdate /forceForces Group Policy to reapply immediately
gpresult /rShows which GPOs are actually applied to a user/machine
systeminfoFull OS/hardware summary
tasklist / taskkill /PIDLists / kills running processes
powercfg /energyDiagnoses power/battery issues
Get-Process, Get-ServicePowerShell equivalents for process/service checks
Test-NetConnection -ComputerName <host> -Port <port>Tests connectivity to a specific host/port
Get-WinEvent -LogName Application -MaxEvents 50Pulls recent event log entries for root cause analysis
15 / 20

Example 1: Input: "One user in Accounts can't send emails, everyone else is fine. Started this morning." Output:

  • Scope: single user → points to account/mailbox issue, not tenant-wide mail flow.
  • Check: mailbox not over quota, no send restriction, MFA/token not expired, Outlook not in "Work Offline" mode.
  • Step 1: Ask user to check Outlook status bar for "Disconnected" or "Work Offline". Explain: this tells us if Outlook is even talking to the server.
  • Step 2: Check mailbox size/quota in Exchange Admin Center.
  • Step 3: Have user sign out/in of Outlook (refreshes auth token) — least disruptive fix first.
  • If unresolved: check message trace in Exchange Online for NDRs, check Conditional Access sign-in logs for blocked sign-in.

Example 2: Input: "Printer shows offline for the whole office." Output:

  • Scope: multiple users → likely network/printer/server issue, not individual PC.
  • Step 1: Ping the printer's IP. Explain: confirms if it's a network reachability issue.
  • Step 2: Check printer's own network settings/display panel for IP conflict or DHCP lease expiry.
  • Step 3: Check print server service (Get-Service -Name Spooler on print server) — restart if stopped.
  • Step 4: If IP changed, either reserve a DHCP lease or set a static IP (recommend reservation for auditability).
  • Expected result: printer shows "Ready" once IP/spooler restored.
Recommendation
The diagnostic command table is Windows-heavy despite the description mentioning macOS/Linux implicitly via 'cloud systems' — consider clarifying scope is Windows-centric or add cross-platform equivalents.
  • Least disruptive first. Don't reimage a machine when restarting a service fixes it.
  • Verify backups before any risky change (registry edits, disk repairs, GPO changes).
  • Warn before disruption — e.g. "This will restart the print spooler, which will briefly clear the print queue."
  • Least privilege — never grant admin rights as a quick fix; grant the specific permission needed.
  • Document every change — what was changed, why, and by whom (for audit and rollback).
  • Suggest prevention after every fix — e.g. "To stop this recurring, I'd recommend setting a DHCP reservation for this printer."
  • Match language to audience — plain English for end users, precise technical detail for engineers/admins.

Troubleshooting case:

Problem Summary:
Possible Causes:
Troubleshooting Steps Taken:
Expected Result:
Next Steps if Unresolved:

Ticket update (customer-facing):

Hi [Name],

Thanks for reporting this. I've identified [plain-English cause] and applied [plain-English fix].
Please confirm this has resolved the issue on your end.

If it recurs, [preventative tip].

Best regards,
[Engineer]

Escalation summary (engineer-to-engineer):

Issue: 
Scope (users/systems affected): 
Diagnostics run and results: 
Suspected root cause: 
Attempted fixes and outcomes: 
Requesting: [specific action needed from next tier]
  • Jumping to a fix before confirming scope (one user vs many) — leads to wrong diagnosis category.
  • Assuming "it's the network" or "it's the user" without evidence from a diagnostic command.
  • Running high-impact commands (chkdsk /f, GPO changes, DISM) without warning about restart/downtime.
  • Closing a ticket without explicit user confirmation that the issue is resolved.
  • Skipping documentation — makes recurring issues invisible and escalations harder.
  • Granting broad permissions/admin rights as a shortcut instead of the specific fix needed.
0
Grade A-AI Skill Framework
Scorecard
Criteria Breakdown
Quick Start
13/15
Workflow
14/15
Examples
15/20
Completeness
14/20
Format
15/15
Conciseness
13/15