Resolving IT Helpdesk Issues

When a fault is described, triage immediately using this pattern:

1. Classify: Device / Account / Network / Application / Permissions / Email / Security
2. Scope: One user or many? Started when? Any recent change (update, password reset, new hardware)?
3. Quick diagnostics (pick relevant ones):

   POWERSHELL
   ipconfig /all
   Test-NetConnection -ComputerName <host> -Port 443
   sfc /scannow
   DISM /Online /Cleanup-Image /RestoreHealth
   Get-MsolUser / Get-MgUser -UserId <upn>     # Entra ID
   Get-Mailbox <user> | fl *Quota*             # Exchange Online
   Get-EventLog -LogName System -Newest 50

4. Fix → Verify → Document: apply fix, confirm resolution with user, write ticket note.

Progress checklist for any incident:

• Gather symptom details (error text/code, screenshots, time started, scope)
• Identify affected system/service tier (endpoint, identity, network, app, cloud service)
• Check for known issues (recent changes, outages, Microsoft 365 Service Health)
• Run targeted diagnostics (not a shotgun of every command)
• Form a hypothesis and test least-disruptive fix first
• Escalate if outside tier scope, with evidence gathered so far
• Verify resolution with the end user explicitly
• Document: ticket update, root cause, preventive action
• Offer KB article if issue is recurring/common

Triage by domain:

• Windows device: Event Viewer (System/Application logs) → sfc /scannow → DISM /RestoreHealth → driver/Windows Update status → safe mode/boot if unbootable.
• M365/Exchange Online: Check Service Health first → mailbox size/quota → mail flow rules/transport rules → Get-MessageTrace → MFA/conditional access blocking sign-in.
• Entra ID/Azure AD: Sign-in logs (Azure AD > Sign-ins) → conditional access policy hits → license assignment → group membership/sync (Azure AD Connect) delays.
• Networking: ipconfig /all, nslookup, Test-NetConnection, tracert → DHCP/DNS first, then firewall/VPN/proxy.
• Printers: Spooler service restart → driver version → port/IP config → print to file test to isolate driver vs. connectivity.
• Security: Isolate device first if compromise suspected → check sign-in anomalies → rotate credentials → preserve logs before remediation.

Example 1: Input: "User can't send emails, getting a bounce-back about mailbox full." Output:

Diagnosis: Mailbox storage quota exceeded.
Command: Get-Mailbox user@domain.com | fl ProhibitSendQuota,TotalItemSize
Fix: Increase quota (if licensing allows) or have user archive/delete items.
Verify: Ask user to send a test email after quota change propagates (~30 min).

Ticket note:
"Confirmed mailbox had reached its ProhibitSendQuota limit (2GB/2GB). Increased 
quota to 5GB via EAC. Advised user quota increase can take up to 30 mins to 
apply. Awaiting confirmation test email sent successfully before closing."

Example 2: Input: "Laptop won't connect to Wi-Fi, says 'limited connectivity'." Output:

Diagnosis: Likely DHCP/DNS issue or IP conflict — "limited connectivity" means 
no internet-reaching IP/gateway obtained.
Commands:
  ipconfig /all          # check for APIPA (169.254.x.x) address
  ipconfig /release
  ipconfig /renew
  ipconfig /flushdns
If persists: check router DHCP pool exhaustion, or disable/re-enable NIC.
Verify: Confirm ipconfig shows valid gateway + successful ping to 8.8.8.8 and a domain name.

Example 3 (documentation request): Input: "Write an RCA for yesterday's Outlook outage affecting 20 users." Output: Structured RCA with: Summary, Timeline (UTC timestamps), Root Cause, Impact (users/services affected, duration), Resolution Steps, Preventive Actions, Owner/follow-up date — written in plain, non-blaming, factual tone.