IT Support & Help Desk Fundamentals
IT support flashcards: method to recovery
Recall cards for each IT support lesson: the method, hardware, Windows, macOS and Linux, networks, printers, accounts, backups, the service desk and security.
452 cards. Read the question, answer it in your head, then open the card to check.
-
What are the four tiers of this track's support model, and which one should take a request?
Tier 0 is self-service through the portal. Tier 1 is the service desk, working from documented procedures. Tier 2 is the specialist teams for harder device, identity and app work, and tier 3 is engineers or the vendor. A request goes to the lowest tier that can close it.
From the lesson IT support roles, tiers and channels
-
How does functional escalation differ from hierarchical escalation?
Functional escalation hands the ticket to a team with more skill, access or tools, and the owner changes. Hierarchical escalation brings in more authority, such as a shift lead or a manager who can raise the priority, add people or press a supplier. Both carry the evidence with them.
From the lesson IT support roles, tiers and channels
-
What makes a password reset or an MFA move safe to carry out for a caller?
An identity check based on something the caller cannot invent or look up, such as contact details already on file or a device that is already registered. A caller who knows an employee number and a manager's name has proved nothing.
From the lesson IT support roles, tiers and channels
-
What do a NOC, a SOC and an MSP each do?
A NOC watches network and service monitoring and fixes outages of shared links, Wi-Fi and VPNs. A SOC watches security alerts and looks into possible attacks. An MSP is a company that runs IT services, at any tier, for other organisations under a contract.
From the lesson IT support roles, tiers and channels
-
A request looks like it could be part of an attack. Where does it go first?
To the security team, before any other routing. Category and impact route most requests, and facts such as a supplier contract, a remote site or damage can change that route.
From the lesson IT support roles, tiers and channels
-
Why does a follow-the-sun handover write each time with its UTC offset?
Because a zone name alone can be read three ways: IST may mean +05:30, +01:00 or +02:00. A time written with its offset names one moment for every desk that reads it.
From the lesson IT support roles, tiers and channels
-
What are the six steps of the troubleshooting method?
Restate the symptom, scope it, list the likely and cheap causes, test one change at a time, fix and verify that the whole task works, then document it. When the fix falls short, go back to the list of causes.
From the lesson A troubleshooting method that holds under pressure
-
Which three questions scope a fault before you guess at its cause?
Who has it, since when, and what changed. A fault shared by many users is fixed at its source rather than one PC at a time.
From the lesson A troubleshooting method that holds under pressure
-
Which troubleshooting strategy suits which clue?
Top-down when there is an error message, bottom-up when nothing works at all, half-splitting when there are many similar suspects, and a known-good swap when a spare part is at hand.
From the lesson A troubleshooting method that holds under pressure
-
How many restarts does half-splitting need to find one bad startup item among 64?
Six. Each yes-or-no test halves what is left, and 2 to the power 6 is 64. Twice as many suspects, 128, need only one restart more.
From the lesson A troubleshooting method that holds under pressure
-
Why make only one change per test and write each test down?
So that a result points at one cause, and so that another technician can repeat or continue the work. Undo every change that did not help.
From the lesson A troubleshooting method that holds under pressure
-
When does a step you cannot undo come, and what do you make before it?
After every step that can be undone, such as a restart or a disabled startup item. Before a reset, a reimage or a registry edit, make a way back: a backup, an exported key or a snapshot.
From the lesson A troubleshooting method that holds under pressure
-
Why does a new 1 TB drive show 931 GB in Windows?
The maker counts 1 TB as 1,000,000,000,000 bytes. Windows divides by 1,024 three times and still writes GB, which gives 931. No byte is missing; a Mac, which divides by 1,000, shows the same drive as 1.0 TB.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
How many bytes are 1 GB and 1 GiB?
1 GB, a decimal prefix, is 1,000,000,000 bytes. 1 GiB, a binary prefix named by the IEC, is 1,073,741,824 bytes, which is 1,024 to the power 3.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
About how much file data can a 100 Mbps link move each second?
At most about 12.17 MB. Divide the bits by 8 for 12.5 MB, then allow for at least 40 bytes of headers in every 1,500-byte packet.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
How many hexadecimal digits does one byte take, and why?
Two. One hex digit stands for exactly 4 bits, so the 8 bits of a byte run from 00 to FF.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
Which bit shows that a MAC address was set by software, as private Wi-Fi addresses are?
The local bit, the second-lowest bit of the first byte. When it is 1, the address is locally administered rather than given by the maker. The lowest bit of that byte is the group bit.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
A file name shows garbled characters. What went wrong, and what fixes it?
The bytes are right but were decoded with the wrong character table. Reopen the file as UTF-8 instead of typing the name again.
From the lesson Bits, bytes and units: why 1 TB shows 931 GB
-
How does a type 1 hypervisor differ from a type 2 hypervisor?
A type 2, or hosted, hypervisor such as VirtualBox or UTM is an app on a host operating system. A type 1, or bare-metal, hypervisor runs directly on the hardware with no host OS under it.
From the lesson Build a practice lab with virtual machines
-
Hyper-V is turned on as a Windows 11 feature. Is it a type 1 or a type 2 hypervisor?
Type 1. Microsoft documents it as a hypervisor that runs directly on the hardware, with Windows itself in the root, or parent, partition above it.
From the lesson Build a practice lab with virtual machines
-
Which hypervisor fits which host for a practice lab?
UTM on a Mac with Apple silicon, for arm64 guests; Hyper-V on Windows 11 Pro, Enterprise or Education; VirtualBox on Windows 11 Home, where Hyper-V cannot be installed; KVM on Linux.
From the lesson Build a practice lab with virtual machines
-
What does a Windows 11 virtual machine need to install?
The same as a Windows 11 PC: UEFI with Secure Boot, a TPM 2.0 (a virtual one), 4 GB of memory, two virtual processors and 64 GB of disk.
From the lesson Build a practice lab with virtual machines
-
How long do the Windows evaluation copies of a practice lab last, and what happens after?
Windows 11 Enterprise is a 90-day evaluation and Windows Server 2025 a 180-day one, used under their terms. When one runs out, rebuild it from its ISO. Ubuntu costs nothing.
From the lesson Build a practice lab with virtual machines
-
Why is a VM snapshot not a backup?
It is a saved state that lets you take a risky step back, but it stays with the VM and keeps whatever the VM held. Name it for the state it holds, make one change, test, then keep it or restore.
From the lesson Build a practice lab with virtual machines
-
Which virtual networks keep a practice lab off the real network?
NAT, host-only and private networks. On NAT the VMs reach the internet through the host's address, and outside machines cannot connect to them unless a port is forwarded. Only made-up data and lab-only passwords go in the lab.
From the lesson Build a practice lab with virtual machines
-
What should a support contact open with, so that a dropped call costs little?
Your name, the ticket number, a callback number, the fault said back in one sentence and the next step you will take. If the line drops, the user reaches the same work again in minutes.
From the lesson Support conversations: listen, ask, explain
-
When does an open question work better than a closed one?
While you have no theory yet. An open question cannot be answered yes or no, so it brings back a story with facts you did not know to ask about. A closed question has two or three answers and tests a theory you already hold.
From the lesson Support conversations: listen, ask, explain
-
What do you do before you change anything on the user's device?
Say the fault back in one sentence for the user to correct. Let the answer finish, note the facts in the user's own words, then restate them.
From the lesson Support conversations: listen, ask, explain
-
What makes an instruction to a user plain language?
It names what the user can see rather than what the system does, gives one instruction at a time, and asks for the error text to be read back exactly.
From the lesson Support conversations: listen, ask, explain
-
The fix time is uncertain. What do you promise the user?
The next contact, not the fix: a time you can keep and a named next update. Make that call even when there is nothing new to report.
From the lesson Support conversations: listen, ask, explain
-
How do the channel and the wording follow the user?
Name controls and keyboard paths instead of colours, offer chat or e-mail where a call is a barrier, and keep passwords, codes and recovery codes away from any translation box.
From the lesson Support conversations: listen, ask, explain
-
Which sequence calms an angry caller?
Let them finish without interrupting, acknowledge the impact in their own words, apologise for the experience without blaming anyone, then offer two options with honest times and agree on the next step. Never argue.
From the lesson Difficult calls, VIPs and clean escalations
-
Does acknowledging a caller's impact mean admitting fault?
No. Saying the impact back in their words, such as a deck due at three that will not open, shows that you heard them. It says nothing about who caused the problem.
From the lesson Difficult calls, VIPs and clean escalations
-
How is abuse handled differently from anger?
Give one warning, end the call if the abuse continues, and log it. Helping never means putting up with abuse, and a desk that accepts it shows callers that abuse gets results.
From the lesson Difficult calls, VIPs and clean escalations
-
A senior executive demands an urgent password reset. What can rank change, and what can it not?
Where the policy allows, rank and urgency can raise the ticket's priority and how soon it reaches a manager. They never change the identity check, because rank and urgency are the very levers an attacker pulls.
From the lesson Difficult calls, VIPs and clean escalations
-
For which four reasons does a ticket leave your hands?
A skill, an access or an authority that you lack, or a clock that is at risk of running out.
From the lesson Difficult calls, VIPs and clean escalations
-
What is a workaround, and why is it logged?
A safe, temporary way for the user to keep working before the real fix. It leaves the cause in place, so it is logged as a known issue until the cause is fixed.
From the lesson Difficult calls, VIPs and clean escalations
-
After a warm handoff, what do you still own?
The duty to communicate: tell the user who holds the ticket now and when they will hear next, and confirm the outcome before the ticket is closed. The handoff moves the work, not that duty.
From the lesson Difficult calls, VIPs and clean escalations
-
Which seven questions does a useful ticket answer?
Who is affected and how many, what they were doing, what they expected, what happened with the exact error text, where, since when, and the impact on the business.
From the lesson Ticket notes and handoffs people can use
-
How is each line of a ticket's action log written?
One action per line, with its result and a timestamp that carries a UTC offset, such as 09:40+05:30, or the UTC time with a Z. A clock time with no offset is ambiguous once the ticket leaves your desk.
From the lesson Ticket notes and handoffs people can use
-
What never goes into a ticket or a screenshot?
Passwords, one-time codes, recovery keys, card numbers and ID numbers. Record only what the work needs, and that a check was done rather than the value it saw.
From the lesson Ticket notes and handoffs people can use
-
How do you make a screenshot safe to attach to a ticket?
Crop it to the error, cover names and numbers with solid boxes rather than a blur, and strip its metadata before attaching it.
From the lesson Ticket notes and handoffs people can use
-
Who is a resolution note written for, and what does it hold?
A stranger searching for the same fault later. It gives the symptom in the user's words, the root cause, the fix, and the error code in the text so the ticket is found and reused.
From the lesson Ticket notes and handoffs people can use
-
A closed ticket says only "laptop issue, sorted". What is wrong with it?
It records neither the problem nor the fix, so nobody can act on it or find it by searching. Rewrite it around the seven questions a ticket answers, with the fix that worked.
From the lesson Ticket notes and handoffs people can use
-
Which three readings does a hardware ticket come down to?
What the machine has fitted now, what the exact model's specification allows, and the arithmetic that joins the two into a plan.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
Which three facts describe a CPU in a ticket?
Its family, x86-64 or Arm64, its physical cores and its logical processors, written together, as in Arm64, 18 cores, 18 threads, rather than a bare 18-core.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
What do 8 cores and 16 threads mean on a specification sheet?
Eight physical processing units, each running two hardware threads through simultaneous multithreading, which Intel calls hyperthreading. Windows shows the 16 threads as logical processors. Two threads share one core, so the gain is less than double.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
What does instruction-set emulation cover on an Arm64 computer, and what does it not?
It translates apps built for x86-64 so that they run, as Windows on Arm does for x64 apps and Rosetta does for Intel apps on a Mac. Drivers are not covered: they must be built for the processor family itself.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
What has to match when memory is added to a computer?
The form, DIMM or SO-DIMM, since soldered memory cannot be changed at all, and the type, since DDR4 and DDR5 do not mix. Matched modules across two channels move about twice the data, and ECC works only when processor, board and modules all support it.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
A PCIe card and its slot differ in generation and width. How fast does the pair run?
At the lower generation and the narrower width of the two.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
Why can a 32-bit AdapterRAM reading never show more than 4 GiB of video memory?
A 32-bit value cannot count past 4 GiB. Read the requirement's wording too: integrated graphics share main memory, while a graphics card brings its own VRAM.
From the lesson Inside a computer: CPU, RAM, board and GPU
-
About how fast are an HDD, a SATA SSD and an NVMe SSD?
An HDD, with moving parts, tops out near 200 MB/s. A SATA SSD reaches about 550 MB/s on the same interface, and an NVMe SSD 3,000 to 7,000 MB/s over PCIe.
From the lesson Storage drives, drive health and RAID
-
A new M.2 SSD fits its slot but is not detected. What is the likely cause?
M.2 is a shape, not a protocol. A SATA M.2 drive, often notched B+M, fits a Key M slot that may speak only NVMe. The board's manual says which protocols the slot supports.
From the lesson Storage drives, drive health and RAID
-
Where is drive health read, and in what order do you act on a suspect drive?
SMART on HDDs and SATA SSDs, the NVMe health log on NVMe drives. Back up first, then read the health data, then decide.
From the lesson Storage drives, drive health and RAID
-
How many failed disks can RAID 0, 1, 5, 6 and 10 survive?
RAID 0 none, RAID 1 one of its two, RAID 5 one, RAID 6 two, and RAID 10 one in each mirror pair.
From the lesson Storage drives, drive health and RAID
-
Why does a RAID array still need a backup?
RAID protects against a disk failing, not against losing data. A delete, a ransomware encryption or a corruption is written to every disk of the array at once.
From the lesson Storage drives, drive health and RAID
-
Why test a suspect drive connected directly rather than inside its external enclosure?
An enclosure can hide the drive's SMART data, so a health check through it may show nothing useful.
From the lesson Storage drives, drive health and RAID
-
Why is a failed desktop power supply replaced rather than opened?
Its primary capacitors hold mains voltage for several minutes after it is unplugged. The unit turns mains into +12 V, +5 V and +3.3 V rails and stays sealed.
From the lesson Power supplies, UPS sizing and battery safety
-
How do standby, line-interactive and double conversion UPS designs differ?
Standby is the cheapest. Line-interactive trims a brownout back into range without touching the battery. Double conversion feeds the load from its inverter all the time, so the load sees no gap when the mains fail.
From the lesson Power supplies, UPS sizing and battery safety
-
When does a load fit a UPS?
Only when its watts are under the UPS's watt limit and its volt-amperes under its VA limit, both at once. Watts equal volt-amperes times the power factor.
From the lesson Power supplies, UPS sizing and battery safety
-
A user says a 1,000 VA UPS fits a 600 W PC because 1,000 is more than 600. What do you check?
The UPS's watt rating as well: most 1,000 VA units are 600 W. At a power factor of 0.9 the PC draws about 667 VA and fits both limits; at 0.6 it draws the full 1,000 VA, with no room for any extra load. Also check the real draw, not the PSU label.
From the lesson Power supplies, UPS sizing and battery safety
-
What cuts a UPS's runtime below the battery energy divided by the load?
About 15 % lost in the inverter, about 20 % for a 3-year-old battery and about 40 % for the Peukert effect, so a 650 VA unit at 357 W lasts under 6 minutes, not 14.
From the lesson Power supplies, UPS sizing and battery safety
-
What does a surge protector do, and what can it not do?
It clamps mains spikes with a varistor until its joule rating is used up. It has no battery, so it does nothing for a power cut.
From the lesson Power supplies, UPS sizing and battery safety
-
What do you do with a swollen lithium-ion battery?
Stop work: shut the device down, isolate it in a non-flammable container, never prise it open, and send it to a registered recycler.
From the lesson Power supplies, UPS sizing and battery safety
-
Why can two laptops with the same USB-C port behave differently with one monitor?
USB-C is only the connector shape. Each maker wires what the port carries: USB data, DisplayPort Alt Mode video, Thunderbolt or USB4, and power up to 240 W. The icon or the specification says which, never the shape.
From the lesson Ports, cables, displays and docking stations
-
How do you work out the data rate a display mode needs?
Multiply width by height by refresh by the bits per pixel. 4K at 60 Hz needs about 11.94 Gbps and 4K at 144 Hz about 28.67 Gbps, a floor that blanking and line coding push higher.
From the lesson Ports, cables, displays and docking stations
-
What lets 4K at 144 Hz fit on a DisplayPort 1.4 link?
Display Stream Compression, which VESA rates as visually lossless at up to 3:1.
From the lesson Ports, cables, displays and docking stations
-
Why does a passive video adapter work on one laptop and not on another?
A passive adapter only re-wires pins, so the laptop's port must already output the target signal. An active adapter converts the signal itself.
From the lesson Ports, cables, displays and docking stations
-
In what order do you work a dock that gives no picture?
Confirm the port carries video, cut down to one display, update firmware and drivers (a DisplayLink dock needs its driver), swap in a rated cable, then connect directly to tell a dock fault from a display fault.
From the lesson Ports, cables, displays and docking stations
-
What does each panel type do best: IPS, VA, TN, OLED and Mini-LED?
IPS gives colour and viewing angles, VA contrast and TN speed. OLED gives true black but risks burn-in from static images, and Mini-LED gives bright HDR without burn-in.
From the lesson Ports, cables, displays and docking stations
-
Why does reinstalling a driver rarely fix a standard keyboard, mouse, headset or webcam?
Devices that follow a standard class run on the class driver built into the operating system, so there is seldom a vendor driver to repair.
From the lesson Keyboards, mice, webcams, headsets, Bluetooth
-
A Bluetooth device will not connect to its new computer. What is the usual cause?
A stale pairing. Pairing stores keys on both sides, so the device stays tied to its old host until that pairing is removed and the device is put back into pairing mode.
From the lesson Keyboards, mice, webcams, headsets, Bluetooth
-
Why does a Bluetooth headset sound worse as soon as its microphone starts?
It switches from A2DP, the high-quality one-way audio profile, to the two-way HFP mode, which shares its limited bandwidth with the microphone. A separate microphone keeps the headset on A2DP.
From the lesson Keyboards, mice, webcams, headsets, Bluetooth
-
A webcam works in one app but not in another. What do you check?
The privacy settings: the device's own camera switch, the app's switch, and the single switch for all desktop apps.
From the lesson Keyboards, mice, webcams, headsets, Bluetooth
-
A key types the wrong symbol. What usually fixes it?
Switching the keyboard layout, because the active layout, not the keyboard, decides which character a key gives. Indian scripts are typed with InScript or a phonetic input.
From the lesson Keyboards, mice, webcams, headsets, Bluetooth
-
Which four firmware settings decide how a PC starts?
The boot order, UEFI or Legacy (CSM) mode, Secure Boot and the TPM. UEFI setup opens from a startup key or from Advanced startup in Windows.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
Confirm-SecureBootUEFI answers False. Does the PC still meet Windows 11's minimum?
Yes: Windows 11 needs firmware that is Secure Boot capable and a TPM 2.0, not Secure Boot turned on. An answer of not supported, or a missing TPM, sends you to the firmware settings.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
Why are the Secure Boot and TPM checks run in a window opened as administrator?
Because an access-denied message is not a reading of the setting.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
Why is clearing a TPM a last resort?
It deletes every key the TPM holds. When it has to be done, it is done from Windows.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
What happens to the 2011 Secure Boot certificates from Microsoft?
Windows Update replaces them with 2023 ones, and one extra restart is expected. A PC that misses the change keeps starting but stops getting new start-up protections.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
What do you do before a firmware update on a PC protected by BitLocker?
Confirm the recovery key, keep the PC on mains power and suspend BitLocker for the restarts the update needs, then check that protection has resumed. The update changes what BitLocker measured at start-up.
From the lesson UEFI, Secure Boot, TPM and firmware updates
-
What do you do before opening a PC or a laptop?
Put on ESD protection clipped to bare metal, not paint, shut the device down fully and disconnect its power.
From the lesson Upgrade and repair PCs and laptops safely
-
What do you check before ordering a part for an upgrade?
The memory type, the form factor, the capacity and the interface the device takes.
From the lesson Upgrade and repair PCs and laptops safely
-
What must you confirm before you touch an encrypted drive?
That the encryption recovery key is at hand.
From the lesson Upgrade and repair PCs and laptops safely
-
When do you clone the old drive, and when do you install fresh?
Clone when the old drive is healthy; install fresh when it is not.
From the lesson Upgrade and repair PCs and laptops safely
-
How do you check a laptop battery's health before promising a fix?
On Windows, run powercfg /batteryreport; on a Mac, System Information shows the cycle count and the condition under Hardware, Power.
From the lesson Upgrade and repair PCs and laptops safely
-
What do you verify before handing an upgraded device back?
That the new capacity shows, that a memory test runs clean and that temperatures are normal.
From the lesson Upgrade and repair PCs and laptops safely
-
A computer shows no sign of power at all. Where do you start?
At the outlet, then inward: the cable, the switch, the charger, the battery and the button, before you suspect the power supply or the board.
From the lesson Hardware faults: no power, no display, heat
-
The fans spin but POST never finishes. What comes next?
Strip the machine to one RAM stick and the parts it needs to start, reseat them, clear CMOS and look up the beep codes in the maker's manual.
From the lesson Hardware faults: no power, no display, heat
-
Which two swaps find the cause of a black screen on a computer that is running?
A known-good display on this computer, and this display on another computer.
From the lesson Hardware faults: no power, no display, heat
-
What does a Kernel-Power 41 event tell you?
That Windows did not shut down cleanly, not why. Its BugcheckCode and PowerButtonTimestamp say whether a Stop error, a held power button or a power or hardware fault is the lead.
From the lesson Hardware faults: no power, no display, heat
-
Which tools turn a hardware suspicion into evidence?
Apple Diagnostics, Windows Memory Diagnostic and Memtest86+. Their codes and results go into the ticket.
From the lesson Hardware faults: no power, no display, heat
-
Which signs mean power off and escalate, rather than repair at the bench?
A burning smell, a swollen battery, liquid inside or a cracked board. Power the device off, label it and escalate.
From the lesson Hardware faults: no power, no display, heat
-
What does a Windows edition decide, and what does a version decide?
The edition, Home, Pro, Enterprise or Education, decides which features exist on the machine. The version decides how long its updates keep coming. A support date needs both.
From the lesson Operating systems, editions and support dates
-
Which features need Windows Pro, Enterprise or Education rather than Home?
BitLocker Drive Encryption, Client Hyper-V and hosting a Remote Desktop session. Home gets Device Encryption instead, and it is the only edition with S mode.
From the lesson Operating systems, editions and support dates
-
How long does a Windows 11 version get updates on each edition?
24 months on Home and Pro, 36 months on Enterprise and Education. Security updates arrive on the second Tuesday of each month.
From the lesson Operating systems, editions and support dates
-
How do macOS, Ubuntu and Android state their support windows?
Apple publishes no end dates and patches the newest macOS and the two releases before it. Ubuntu gives an LTS release five years and an interim release nine months. An Android phone's window is its maker's promise.
From the lesson Operating systems, editions and support dates
-
What are the four honest options for a Windows 10 PC at the end of its support?
Upgrade it in place, enrol it in Extended Security Updates until that programme ends, replace it, or take it off the network with the exception written down.
From the lesson Operating systems, editions and support dates
-
Which file system suits a drive shared by Windows and a Mac, and what does FAT32 refuse?
exFAT, which both systems read and write. FAT32 refuses any single file of 4 GiB or more.
From the lesson Operating systems, editions and support dates
-
Clean install, in-place upgrade or reset: what does each do to a Windows PC?
A clean install erases the disk. An in-place upgrade reinstalls over the running system and keeps apps and files. A reset rebuilds Windows from the PC itself and lets you keep or remove the files.
From the lesson Install Windows 11: clean, upgrade and setup
-
Which partitions does a clean UEFI install of Windows lay out on its GPT disk?
An EFI System partition, a Microsoft Reserved partition, the Windows partition and a recovery partition.
From the lesson Install Windows 11: clean, upgrade and setup
-
Windows setup lists no drives to install on. What is the usual cause?
A missing storage driver, not a dead disk. Use Load driver before you suspect the hardware, and confirm the disk number twice before you clean any disk with diskpart.
From the lesson Install Windows 11: clean, upgrade and setup
-
In what order does the first hour go once Windows reaches the desktop?
Update it with its drivers, confirm activation, find the recovery key, make the daily account a standard user, apply the managed settings, then record the asset.
From the lesson Install Windows 11: clean, upgrade and setup
-
A new Windows 11 Home laptop will not finish setup without the internet and a Microsoft account. Is that a fault?
No. Microsoft's specifications say Home, and Pro for personal use, need the internet and a Microsoft account during setup, and how strictly depends on the build. Organisations join devices with Autopilot, provisioning packages or answer files instead.
From the lesson Install Windows 11: clean, upgrade and setup
-
What do you read first on a Mac you are about to reinstall or erase?
The macOS version with sw_vers and the chip with uname -m. The chip decides the Recovery keys, the one-pass erase and whether a second Mac can revive its firmware.
From the lesson Install, reinstall and erase macOS
-
How is macOS Recovery started on Apple silicon and on an Intel Mac?
On Apple silicon, shut down, hold the power button until Loading startup options appears, then click Options. On an Intel Mac, press the power button and at once hold Command-R until a logo or a spinning globe appears.
From the lesson Install, reinstall and erase macOS
-
What does Reinstall macOS from Recovery keep?
Every account, document and setting, because it replaces only the system files. That makes it the first fix for damaged software and the wrong tool for a handover.
From the lesson Install, reinstall and erase macOS
-
What does Erase All Content and Settings need, and where does it leave the Mac?
macOS Monterey 12 or later on an Apple silicon or T2 Mac, the login password and then the Apple Account password. It leaves the Mac at the setup assistant, with nothing to download.
From the lesson Install, reinstall and erase macOS
-
A Mac brought to the desk is locked to someone else's Apple Account. What happens to it?
It goes back to its owner, or to Apple's support request, never to a workaround. Activation Lock needs the owner's password or passcode before anyone can turn off Find My, erase the Mac or reactivate it.
From the lesson Install, reinstall and erase macOS
-
How is a Mac with no sign of life brought back?
From a second Mac on macOS 14 or later, over a USB-C data cable, with the dead Mac in DFU mode. Revive it first; restore it, which erases it, only if reviving fails.
From the lesson Install, reinstall and erase macOS
-
Which three futures does an ageing PC have, and what picks one?
The user's work picks: ChromeOS Flex for browser work on a listed model, Ubuntu Desktop for a full desktop, and replacement when a Windows-only application must keep running.
From the lesson Linux desktops and ChromeOS Flex for old PCs
-
What does a PC need before ChromeOS Flex is a good answer for it?
An x86-64 processor no older than 2013, 4 GB of memory and 16 GB of storage, and a row on Google's models list whose certification year has not yet arrived.
From the lesson Linux desktops and ChromeOS Flex for old PCs
-
How much does Ubuntu Desktop need here, and must Secure Boot be turned off for it?
At least 6 GB of RAM and 25 GB of storage. Secure Boot can stay on, because Ubuntu's boot loader and the drivers its own tools offer are signed.
From the lesson Linux desktops and ChromeOS Flex for old PCs
-
How does a live USB session copy files off a disk without writing to it?
Read the disks with lsblk -f, then mount the volume read-only. For ext4, the options ro,noload also stop the journal from being replayed.
From the lesson Linux desktops and ChromeOS Flex for old PCs
-
A rescue reaches an encrypted volume. Where does the rescue stop?
The rescue stops there. The recovery key comes from the owner or the organisation through their own process, and the ticket records that the volume stayed locked.
From the lesson Linux desktops and ChromeOS Flex for old PCs
-
Which four kinds of Windows update are there?
The required second-Tuesday security release (B), the optional preview later in the month (D), the out-of-band fix (OOB) and the yearly feature update that changes the version.
From the lesson Updates, patches and drivers without surprises
-
Why does a desk roll the second-Tuesday release out to every machine?
It is the month's security update and it is cumulative, holding every earlier fix. The D preview carries non-security fixes and stays optional.
From the lesson Updates, patches and drivers without surprises
-
What do you do before rolling a Windows update out?
Read the release-health known issues and the message center, then go to a pilot ring before a broad one. Keep automatic security updates on.
From the lesson Updates, patches and drivers without surprises
-
Windows Update says up to date. How do you confirm the device is current?
Compare its build number with the latest build listed for its version, because a safeguard may be holding an update back.
From the lesson Updates, patches and drivers without surprises
-
A Mac shows the newest macOS. How can it still be behind on security?
Background Security Improvements arrive between full updates, and they need the Automatically Install setting on. Check that setting as well as the version.
From the lesson Updates, patches and drivers without surprises
-
Where do drivers come from, and how is a bad one undone?
From Windows Update or the maker's own tool. A bad driver is rolled back in Device Manager, and winget upgrade lists and updates apps one change at a time.
From the lesson Updates, patches and drivers without surprises
-
What decides which recovery tool to try first for a PC that will not start?
The stage of the boot path where it fails: firmware, the boot manager, the loader, the kernel and drivers, or sign-in.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
Why might a laptop open its blue recovery menu by itself?
Windows sets a flag as a boot starts and clears it before sign-in, so two failed starts in a row open WinRE on their own. A power cut during a healthy start can trigger it too.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
What must be retrievable before a PC goes into recovery?
Its BitLocker recovery key, because most WinRE options ask for it.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
In WinRE, in what order are the tools tried?
From the least disruptive: point-in-time restore on 24H2 or later, then Uninstall updates, then Reset this PC or recovery media. Safe mode is a way to look around.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
What does quick machine recovery do, and where is it on by default?
After repeated failed starts, it lets a Windows 11 PC fetch a fix from Windows Update. It is on by default for Home and unmanaged Pro, and off on managed devices.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
What is the order for a Mac that will not start, and where does a Linux desktop look first?
Safe mode, then Recovery with First Aid, then a reinstall that keeps the files. A Linux desktop starts from the GRUB menu and reads the last boot's log with journalctl -b -1.
From the lesson Fix boot problems: WinRE, Safe Mode, Recovery
-
Why does a laptop ask for its BitLocker recovery key after a firmware update?
The TPM releases the key only when start-up measures as it did when the key was sealed. A firmware update changes a measured part, so the TPM keeps the key: a security decision, not a disk fault.
From the lesson BitLocker and FileVault recovery keys
-
How does a planned firmware update avoid the recovery prompt?
Suspend BitLocker before it. Resuming reseals the key to the new measurements, so nobody types a recovery key.
From the lesson BitLocker and FileVault recovery keys
-
How do you find the right recovery key for a device?
Take the first 8 digits of the ID that the recovery screen prints and match them against the keys stored in the Microsoft account, the directory, Active Directory or a printout.
From the lesson BitLocker and FileVault recovery keys
-
What comes before a recovery key is read out to a caller?
Their identity: call back on a number on record, check the device and the story, release the key once by voice, then rotate it.
From the lesson BitLocker and FileVault recovery keys
-
What goes into the ticket when a recovery key is released?
The key ID and the cause, never the key itself. Keys stay out of tickets and chat; a masking pattern is only a safety net for slips.
From the lesson BitLocker and FileVault recovery keys
-
Which three things open a FileVault disk, and what if none of them is kept?
The login password, a personal recovery key and an institutional recovery key. A lost key with nothing stored cannot be recovered, so escrow is audited by lookup before an incident.
From the lesson BitLocker and FileVault recovery keys
-
How do you choose between repair, reset or reimage, and replacement?
By the cause: repair a known, contained fault; reset or reimage a system that is unstable, compromised or quicker to rebuild; replace failing or unsupported hardware, which no software can cure.
From the lesson Reset, reimage or repair: choose and do it
-
In which order do DISM and the System File Checker run?
DISM first, with a repair source that matches the PC's patch level, then sfc. Only a scan that still reports unfixed files is a reason to go further.
From the lesson Reset, reimage or repair: choose and do it
-
What comes before Reset this PC on Windows 11 22H2 or later when the PC's updates are not managed?
The reinstall of the current Windows version, which keeps apps, files and settings.
From the lesson Reset, reimage or repair: choose and do it
-
What does Reset this PC always remove, and what is your choice?
Apps and settings, every time. You choose whether personal files stay, after a backup and with the BitLocker key and mains power at hand.
From the lesson Reset, reimage or repair: choose and do it
-
How does a managed fleet return a PC to a known state?
With Autopilot Reset or a reimage, depending on what the organisation has set up. Autopilot Reset removes personal files and apps but keeps the device's Entra ID and Intune connection.
From the lesson Reset, reimage or repair: choose and do it
-
What is the sequence before a phone or a Mac goes to its next owner?
Sign out, back up, erase, then check the first setup screen. Otherwise Activation Lock or factory reset protection locks the next owner out.
From the lesson Reset, reimage or repair: choose and do it
-
Why did the faulty content update cause a boot loop rather than one crash?
The sensor's driver runs in the kernel and loads early, and the faulty content stayed on disk, so every restart reached the same out-of-bounds read and the same blue screen.
From the lesson Case study: recovering from a mass boot failure
-
Which chain of conditions led to the crash?
A template defined 21 inputs while the code supplied 20, the tests used a wildcard for the missing input, and one content update then used it for real.
From the lesson Case study: recovering from a mass boot failure
-
What did each of Microsoft's two recovery routes need?
Both removed the faulty channel files. The WinPE route could need a BitLocker key for each encrypted device, and the safe mode route needed a local administrator.
From the lesson Case study: recovering from a mass boot failure
-
In the model of 500 PCs, what was bulk key export worth?
About 2,000 technician minutes, the work of about three technicians, while keys that were never stored left 40 PCs with no key route at all.
From the lesson Case study: recovering from a mass boot failure
-
What limits the damage a bad update can do across a fleet?
Staged rollouts, which keep the blast radius small, and escrow of recovery keys. A support team owns its own update rings, key audit and tested recovery media.
From the lesson Case study: recovering from a mass boot failure
-
What does a mass-incident runbook hold, and how are its gaps found?
Roles, a communication cadence, where keys come from, prepared media, a check of each PC and a single closing change. A tabletop exercise finds its gaps while they are cheap to fix.
From the lesson Case study: recovering from a mass boot failure
-
How do Settings and Control Panel differ for a technician on a call?
Settings is the main app, and most of its pages have an ms-settings address, one exact line to dictate instead of a menu path. Control Panel keeps the older applets that have not moved, such as Programs and Features and Credential Manager.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
How do you open Device Manager, Event Viewer or Services directly?
As snap-ins of the Microsoft Management Console, by file name: devmgmt.msc, eventvwr.msc and services.msc. A missing tool, such as gpedit.msc on Home, is a clue to the edition.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
Which tools read a PC's exact facts without changing anything?
The About page, winver and System Information. msinfo32 /report saves the System Information facts as a text file under the name you type.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
What does a clean boot prove when the fault survives it?
That no app or service added by other software is the cause, since only Microsoft's services stay on. Return the PC to a normal start afterwards.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
What are the steps of a safe registry change?
Only when no setting covers the job: export the key, change one value, test, note it in the ticket and keep the .reg file so that reg import can undo the change.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
Which four questions choose the right Windows admin tool?
Whether a Settings page exists for the job, whether you will change something or only read, whether you are on the phone, and whether an administrator is at hand.
From the lesson Windows admin tools: Settings, MMC, msinfo32
-
How do you look up the switches of a classic command and of a PowerShell cmdlet?
Type /? after a classic command such as ipconfig, and use Get-Help for a cmdlet.
From the lesson Windows command line for support work
-
What does ipconfig /flushdns change, and what does it leave alone?
It clears the PC's DNS client cache, so the next lookup asks the configured DNS servers again. It leaves the servers, the hosts file, the adapter's IP settings, open connections and the DHCP lease alone; the lease is ipconfig /release and /renew.
From the lesson Windows command line for support work
-
What is the order of the connectivity ladder at the command line?
ipconfig /all for the PC's state, a ping to the gateway, a name lookup with nslookup or Resolve-DnsName, a port test with Test-NetConnection, then the path with tracert or pathping.
From the lesson Windows command line for support work
-
Which commands show whether a policy change reached a user, and apply it again?
gpresult /r lists the policies that applied, and gpupdate /force reapplies every setting rather than only the changed ones.
From the lesson Windows command line for support work
-
In what order do DISM, sfc and chkdsk run for a damaged Windows?
DISM first to refresh the component store, then sfc /scannow, then a second sfc after a restart to confirm. chkdsk C: /f is booked for the next restart, and only when there are file-system errors to fix.
From the lesson Windows command line for support work
-
How does a destructive command run safely?
Its listing form runs first, such as robocopy /L, dir before del, or diskpart's selected line read aloud. The list shows exactly what the real run will touch.
From the lesson Windows command line for support work
-
WMIC is gone from Windows 11, version 24H2. What replaces wmic bios get serialnumber?
Get-CimInstance, which reads the same classes: (Get-CimInstance Win32_BIOS).SerialNumber.
From the lesson Windows command line for support work
-
What does the type of a Windows account decide?
Local, Microsoft, or work or school: where settings sync, who manages the device and how a forgotten password is reset. Find it out before changing anything.
From the lesson Windows accounts, UAC and user profiles
-
How does a Microsoft account differ from a work or school account?
A Microsoft account is a personal identity the person owns, reset online with the phone number or spare address they added. A work or school account belongs to an organisation, which creates and manages it in Microsoft Entra ID or Active Directory.
From the lesson Windows accounts, UAC and user profiles
-
How do you tell whether a window holds an administrator's full token?
Read the Mandatory Label line of whoami /groups: medium integrity is the filtered standard-user token, high means elevated. The group list does not tell you.
From the lesson Windows accounts, UAC and user profiles
-
What does Administrator protection change for administrators?
They stay deprivileged, and each elevation is a just-in-time grant after a Windows Hello check, made through a hidden, profile-separated account. It is off by default.
From the lesson Windows accounts, UAC and user profiles
-
Why does a Windows Hello for Business PIN set up on one laptop do nothing on another?
The PIN releases a key held on that one device only, so it reaches no key on any other.
From the lesson Windows accounts, UAC and user profiles
-
A user signs in to a temporary profile. What do you do first?
Warn them that work saved there is lost at sign-out, restart and read the profile events before rebuilding anything, and keep the old folder until the user confirms their data was copied.
From the lesson Windows accounts, UAC and user profiles
-
What does Windows LAPS give each PC?
Its own local administrator password, rotated and backed up to Entra ID or Active Directory, so a technician retrieves one device's password instead of sharing one across PCs.
From the lesson Windows accounts, UAC and user profiles
-
In what order are the sources for installing an app preferred?
The company portal, then the Store, then WinGet, so that updates and clean removal stay possible. A vendor MSI, MSIX or .exe is the last resort.
From the lesson Windows apps, drivers and Device Manager
-
How does a Windows on Arm PC run x64 apps, and what can it never emulate?
Prism, from version 24H2, emulates x86 and x64 apps. Emulation covers user-mode code only, so a driver must be built for Arm64.
From the lesson Windows apps, drivers and Device Manager
-
What do Device Manager codes 10, 22, 28 and 43 mean?
10, the device cannot start; 22, it is disabled; 28, no driver is installed; 43, Windows stopped it. pnputil /enum-devices /problem lists every stuck device.
From the lesson Windows apps, drivers and Device Manager
-
A device shows Code 28. What is your first move?
Get it a driver. The hardware is present and detected but has no working driver, so let Windows Update search or install the maker's driver pack; reseating or enabling it will not help.
From the lesson Windows apps, drivers and Device Manager
-
In what order is a driver problem fixed?
Roll back a bad update, then update the driver, then uninstall and rescan, reading the code again after each step. Escalate only if the code stays.
From the lesson Windows apps, drivers and Device Manager
-
How do you check an unknown installer before it runs?
Confirm its publisher signature, match its SHA-256 with Get-FileHash, then try it in Windows Sandbox, which throws everything away when it closes.
From the lesson Windows apps, drivers and Device Manager
-
What do you do before changing anything on a slow PC?
Measure it while it is slow: the Processes tab names the busy program and the Performance tab the busy resource. Only then disable, update or clean.
From the lesson Slow PCs, crashes and Event Viewer
-
How does Resource Monitor turn a disk at 100 per cent into an answer?
Tick a process and every tab filters to it, naming the process behind the disk activity and, on the Network tab, the remote address it talks to.
From the lesson Slow PCs, crashes and Event Viewer
-
Where do you look for the cause of an unexpected restart?
In the System and Application logs, filtered to the minutes before the shutdown time that event 6008 names.
From the lesson Slow PCs, crashes and Event Viewer
-
Which fields of event 41 tell a stop error, a held button and a lost power supply apart?
A nonzero BugcheckCode means a stop error and a nonzero PowerButtonTimestamp a held power button; zeros in both point to lost power. The event itself says only that the shutdown was not clean.
From the lesson Slow PCs, crashes and Event Viewer
-
A blue screen shows stop code 0x7A. Where do you look first?
At the disk and the memory, before any reinstall. A stop code that names a driver sends you to Device Manager instead.
From the lesson Slow PCs, crashes and Event Viewer
-
Why can a laptop whose clock runs 7 minutes fast not sign in to the domain?
Kerberos stamps every request with the time, and the domain allows 5 minutes of difference by default. w32tm /query /status shows the time source and the last sync, and w32tm /resync asks for a new one.
From the lesson Slow PCs, crashes and Event Viewer
-
What does Get-MpComputerStatus show for an antivirus that is really working?
The engine on, real-time protection on and security intelligence at most a day old. An age of 65535 days means it was never updated.
From the lesson Windows Security: Defender, firewall, BitLocker
-
Which Defender scan comes first, and when is Defender Offline used?
A quick scan first, as Microsoft recommends, or a custom scan for one USB drive. Defender Offline restarts the PC and scans from outside Windows for malware that hides from a running system.
From the lesson Windows Security: Defender, firewall, BitLocker
-
SmartScreen warns about a download. What has it checked?
The file against Microsoft's list of programs reported as unsafe and its list of well-known, often downloaded files. A file missing only from the second list has no reputation yet. Stop and ask before it runs.
From the lesson Windows Security: Defender, firewall, BitLocker
-
What does the Public network profile do, and when may a network be set to Private?
Public, the start for every new network, hides the PC and turns sharing off. A trusted home network can be set to Private, and the firewall stays on either way.
From the lesson Windows Security: Defender, firewall, BitLocker
-
When does a BitLocker drive count as protected?
When manage-bde -status reads Protection On and its 48-digit recovery key is stored off the PC, where the user or the organisation can reach it.
From the lesson Windows Security: Defender, firewall, BitLocker
-
What does a security baseline add to a ticket?
The same readings, checked the same way every time, turned into a list of gaps. Every fix restores a protection rather than removing one.
From the lesson Windows Security: Defender, firewall, BitLocker
-
Which three tools answer a Mac user's first questions on a call?
The search field of System Settings finds a setting by name, Spotlight, opened with Command-Space bar, finds apps and files, and sw_vers gives the version and build that the ticket needs.
From the lesson macOS essentials: Settings, Finder, accounts
-
Why does a fix on a Mac go into /Library or a user's Library, never into /System?
macOS runs from a sealed, read-only system volume and keeps everything that changes on a writable data volume.
From the lesson macOS essentials: Settings, Finder, accounts
-
Where does a Mac app keep one person's settings, caches and support files?
In that person's hidden Library, in three places named after the app's bundle ID, such as com.example.notes: Caches for data it can rebuild, Preferences for its .plist settings file, and Application Support, which often holds the user's own data.
From the lesson macOS essentials: Settings, Finder, accounts
-
Finder hides the user Library. How do you open it?
Hold Option in Finder's Go menu, or use Go to Folder.
From the lesson macOS essentials: Settings, Finder, accounts
-
Who signs in with a user's personal Apple Account during a support call?
Only the user: it is never shared, not even with the help desk, so the technician guides them through it. A Managed Apple Account belongs to the organisation, which decides what it can reach.
From the lesson macOS essentials: Settings, Finder, accounts
-
Which kinds of local account does a Mac have, and how does IT keep its own access?
Administrator, standard and Sharing Only, each with different rights. A managed administrator account lets IT keep its access without sharing a password.
From the lesson macOS essentials: Settings, Finder, accounts
-
How do apps reach a Mac, and how does an installer package leave?
From the App Store, a disk image, an installer package or device management. A package can place files anywhere, so it leaves through the vendor's uninstaller, and its receipt shows what it installed.
From the lesson macOS apps, Gatekeeper and software updates
-
What does a Developer ID signature prove, and what does notarisation add?
The signature proves who made the software and that nobody has altered it since. Notarisation adds Apple's scan of the software for known malicious content, with a ticket that Gatekeeper reads.
From the lesson macOS apps, Gatekeeper and software updates
-
Why does spctl reject an app with an ad-hoc signature?
An ad-hoc signature names nobody, and Gatekeeper accepts only software from an identified developer that Apple has notarised and nobody has altered.
From the lesson macOS apps, Gatekeeper and software updates
-
Why does a script fetched with curl never meet Gatekeeper's first-open question?
A file downloaded with curl in Terminal carries no quarantine attribute, so it has to be checked by hand before it runs.
From the lesson macOS apps, Gatekeeper and software updates
-
Where do you see what runs on a Mac without anyone opening it?
In Login Items & Extensions: Open at Login lists the login items and App Background Activity the background items. An item nobody can name is checked like an unknown app.
From the lesson macOS apps, Gatekeeper and software updates
-
What does softwareupdate in Terminal offer a technician?
It lists macOS updates without an administrator, installs them, and keeps a history of each install.
From the lesson macOS apps, Gatekeeper and software updates
-
How long will an Intel-only app keep working on a Mac?
As long as Rosetta runs it, which is up to macOS 27. Read the app's Kind or lipo -archs now, and replace it with a Universal or Apple silicon version before macOS 28.
From the lesson macOS apps, Gatekeeper and software updates
-
How do you find the process behind a busy Mac, and how do you stop it?
Sort the CPU tab of Activity Monitor by % CPU. Try Quit before Force Quit, because Force Quit can lose the files the app has open.
From the lesson macOS troubleshooting: Activity Monitor to logs
-
Does a Mac with almost no unused memory need more RAM?
Not on that alone, because macOS uses spare memory on purpose, for caches and compression. Memory pressure, shown green, yellow or red, says whether it needs more.
From the lesson macOS troubleshooting: Activity Monitor to logs
-
How do you narrow the unified log to the messages that matter?
By time first, with --start and --end or --last, then by a predicate on the process or subsystem, such as process == "Mail".
From the lesson macOS troubleshooting: Activity Monitor to logs
-
In what order does First Aid check a Mac's storage, and what happens to a disk said to be failing?
Each volume, then each container, then the device. A disk that Disk Utility says is about to fail is backed up and replaced, and Apple Diagnostics tests the rest of the hardware.
From the lesson macOS troubleshooting: Activity Monitor to logs
-
How do you start Apple Diagnostics?
From the startup options with Command-D on Apple silicon, or by holding D at start-up on an Intel Mac.
From the lesson macOS troubleshooting: Activity Monitor to logs
-
Which report goes with the escalation of a Mac problem?
The smallest one that answers the question asked: a version, a window of the log or one process. A sysdiagnose, which gathers much of the Mac's state, goes only to someone who asked for it.
From the lesson macOS troubleshooting: Activity Monitor to logs
-
Which four commands read whether a Mac is protected?
fdesetup status for FileVault, csrutil status for SIP, spctl --status for Gatekeeper and socketfilterfw --getglobalstate, from /usr/libexec/ApplicationFirewall, for the firewall.
From the lesson macOS security: FileVault, SIP, permissions
-
What does System Integrity Protection protect, in words a user would follow?
It stops the files macOS depends on from being changed while the Mac is running, using kernel permissions that users cannot override. It is on by default.
From the lesson macOS security: FileVault, SIP, permissions
-
Who lets a Mac app reach the camera or a folder, and how is that decision cleared?
The person at the Mac, in Privacy & Security. The privacy database keeps each decision until tccutil reset clears it for one service and one app.
From the lesson macOS security: FileVault, SIP, permissions
-
A meeting app cannot share the screen on a Mac. What does it need?
Screen & System Audio Recording access and a restart of the app; in a browser, also the browser's permission and the site's permission.
From the lesson macOS security: FileVault, SIP, permissions
-
Can device management give a Mac app the camera, the microphone or screen recording?
No. A management payload can allow many kinds of access in advance, but for those three it can only deny them, so the user grants them.
From the lesson macOS security: FileVault, SIP, permissions
-
What do Lockdown Mode and Find My mean for a support technician?
Lockdown Mode is an extreme protection that also blocks configuration profiles and enrolment. Find My turns on Activation Lock, which needs the owner's Apple Account password to lift.
From the lesson macOS security: FileVault, SIP, permissions
-
Which Linux commands tell you where you are, what is there and what a file says?
pwd, ls -a, cd, cat, head, tail and grep -n. grep matches capital letters exactly unless -i is added.
From the lesson Linux commands every support tech needs
-
Why use cp -i, mv -i and rm -i on Linux?
They ask before they overwrite or remove anything, and nothing rm removes goes to the Trash.
From the lesson Linux commands every support tech needs
-
What does chmod 750 on a folder let the owner, the group and everyone else do?
7 (4, 2 and 1) lets the owner list it, change its entries and enter it. 5 (4 and 1) lets the group list it and enter it, but not add, rename or delete. 0 gives everyone else nothing.
From the lesson Linux commands every support tech needs
-
What does a folder need before it can be entered, and before it can be listed?
x to be entered and r to be listed. A mode is three sets of read, write and execute worth 4, 2 and 1, so 770 prints as rwxrwx---.
From the lesson Linux commands every support tech needs
-
How is software installed on Ubuntu and on Fedora?
Through sudo and the distribution's own tool: apt on Ubuntu, dnf on Fedora, with Snap or Flatpak for apps that are published only there.
From the lesson Linux commands every support tech needs
-
Why does a Linux DNS ticket check resolvectl status rather than /etc/resolv.conf?
On Ubuntu, /etc/resolv.conf usually lists only the 127.0.0.53 stub of systemd-resolved, while resolvectl status shows the real DNS servers of each link.
From the lesson Linux commands every support tech needs
-
How do you find what fills a Linux disk, and what must never run on a mounted file system?
df -h says which file system is full, and du and find say what fills it. e2fsck never runs on a mounted file system; journalctl -b -1 -p err shows the errors of the start before the current one.
From the lesson Linux commands every support tech needs
-
A phone's work mailbox keeps failing although the password is right. Why?
Exchange Online refuses Basic authentication for phone mail, so an account added by hand with a bare password cannot sign in. Delete that account from the phone and set it up again through Sign In, or use the Outlook app.
From the lesson Support phones and tablets from setup to sync
-
A phone's hotspot cannot be seen by a laptop. What do you check first?
The phone that shares the connection: that the hotspot is switched on and that the carrier plan includes it, then restart. Reset network settings last, because it erases saved networks and VPN settings.
From the lesson Support phones and tablets from setup to sync
-
In what order do you fix a misbehaving phone app?
From the cheapest step up: close and reopen it, check storage, update it, clear its cache or offload it, and only then delete and reinstall it.
From the lesson Support phones and tablets from setup to sync
-
A phone is full. What do you do before deleting anything?
Sort what fills it by what clearing it would cost, and first back up any data that exists only on the device.
From the lesson Support phones and tablets from setup to sync
-
Which phone faults need a repair shop rather than a restart?
A swollen battery, red liquid indicators, a liquid alert and cracked glass. Finish the backup, and release Find My or confirm the Google Account, before the phone leaves.
From the lesson Support phones and tablets from setup to sync
-
How does a phone number move to a new phone that uses an eSIM?
By a transfer: the carrier activates the built-in SIM over the air or with a QR code, so there is no card to swap.
From the lesson Support phones and tablets from setup to sync
-
What does mobile device management keep doing after a phone is enrolled?
It sends configuration profiles and apps, and checks the phone against a compliance policy for the rest of its life. Conditional Access can use that result to refuse mail to a phone that falls behind.
From the lesson MDM, BYOD and lost or stolen devices
-
How far does IT's reach go on a company phone and on a personal one?
On a company phone, the whole device. On a personal phone, only the work profile or the managed work apps, and a wipe follows the same line.
From the lesson MDM, BYOD and lost or stolen devices
-
How does a full wipe differ from a selective wipe?
A full wipe resets the whole phone to factory settings, which suits a phone the organisation owns. A selective wipe removes only the work profile or managed apps and their data, and leaves personal apps, photos and files.
From the lesson MDM, BYOD and lost or stolen devices
-
What does device compliance check, and what follows when a phone fails it?
Rules such as a minimum OS version, a passcode and no jailbreak. A noncompliant device can be kept away from mail and other work data.
From the lesson MDM, BYOD and lost or stolen devices
-
In what order is a lost phone contained?
Confirm it is lost, lock it with a message, locate it if that is allowed, revoke its access, wipe it, and record every step for the security team.
From the lesson MDM, BYOD and lost or stolen devices
-
What must happen before a managed phone goes to its next user?
Release Activation Lock and factory reset protection while the owner or the organisation's tools still can, then check that setup asks for no previous owner's account.
From the lesson MDM, BYOD and lost or stolen devices
-
What does a DHCP lease give a client, and what happens when the scope runs out?
An IPv4 address, a subnet mask, a default gateway and DNS servers, for a fixed time, after four messages. A scope with no address left hands out nothing at all.
From the lesson How a device gets online: IP, DHCP and DNS
-
A user's PC shows a 169.254 address. What does it mean, and what do you try first?
The PC gave itself a link-local address because no DHCP server answered, so it reaches only its own link: DHCP failed, not the internet. Release and renew first, then look at the DHCP server or the link to it.
From the lesson How a device gets online: IP, DHCP and DNS
-
Why does a network printer get a DHCP reservation?
A reservation always offers the same address to one hardware address, so the printer keeps its IP across restarts and the queues that point at it keep working.
From the lesson How a device gets online: IP, DHCP and DNS
-
Which four kinds of IPv4 address do you tell apart before working on traffic?
Private (10/8, 172.16/12 and 192.168/16), link-local (169.254/16), carrier-grade NAT (100.64/10) and public. A router whose WAN side sits in 100.64.0.0/10 cannot accept connections from the internet, whatever it forwards.
From the lesson How a device gets online: IP, DHCP and DNS
-
Where do an IPv6 interface's addresses come from?
Each interface forms its own fe80:: link-local address. A global address comes from SLAAC, built from the prefix a router announces, or from a DHCPv6 server. Unique local addresses in fc00::/7 are the private counterpart.
From the lesson How a device gets online: IP, DHCP and DNS
-
Which commands show a device's address settings on Windows, macOS and Linux?
ipconfig /all on Windows, ipconfig getpacket and networksetup on macOS, and ip address show with nmcli device show on Linux.
From the lesson How a device gets online: IP, DHCP and DNS
-
In what order does a device resolve a name?
The hosts file, the OS cache, the configured resolver, then the authoritative server. The first that answers wins, so a wrong line in the hosts file beats everything after it.
From the lesson DNS for support: resolve, flush and fix names
-
Which commands query DNS on each desktop system?
nslookup or Resolve-DnsName on Windows, dig on macOS and Linux, and resolvectl query where systemd-resolved runs. The answer printed comes from the resolver, not from the authoritative server.
From the lesson DNS for support: resolve, flush and fix names
-
Why compare the configured resolver's answer with a public resolver's?
Two resolvers that agree point you away from DNS; two that disagree point at the side that is wrong, usually the one nearer the user. On a VPN with split DNS, a public resolver cannot see internal names.
From the lesson DNS for support: resolve, flush and fix names
-
When does flushing the DNS cache help, and when does it change nothing?
It helps when the cache holds an answer older than the real record while the TTL still runs. A wrong record at the authoritative server, a dead resolver and a bad hosts line all survive a flush.
From the lesson DNS for support: resolve, flush and fix names
-
A name works for some users and not for others. Which two causes are usual?
A VPN with split DNS, where internal names resolve only while connected, or a browser using DNS over HTTPS, which skips the system resolver and can get different answers.
From the lesson DNS for support: resolve, flush and fix names
-
What does NXDOMAIN mean, and why can it linger after a fix?
The authoritative server says the name does not exist. Resolvers may remember that answer for a while, which is called negative caching.
From the lesson DNS for support: resolve, flush and fix names
-
Why is a strong Wi-Fi signal no proof that a device is on the right band?
One network name can sit on three bands: 2.4 GHz reaches furthest and overlaps itself, 5 GHz has room for wide channels, and 6 GHz needs a new radio and a country that allows the band.
From the lesson Wi-Fi: bands, channels, security and fixes
-
A visitor's new phone cannot see the office's 6 GHz network. Why might that be?
The phone's radio may not be built for the band, which needs the Wi-Fi 6E or Wi-Fi 7 label, or the band may not be allowed in that country. Check your own access points first: do they broadcast on 6 GHz, with the same name on every band?
From the lesson Wi-Fi: bands, channels, security and fixes
-
Why are channels 1, 6 and 11 the plan for 2.4 GHz?
Their centre frequencies are 25 MHz apart, so they do not overlap one another.
From the lesson Wi-Fi: bands, channels, security and fixes
-
How do you turn the signal percentage Windows prints into dBm?
Take -100 and add half the percentage, so 32 % is about -84 dBm, a weak signal.
From the lesson Wi-Fi: bands, channels, security and fixes
-
A guest network's sign-in page never appears. What does that tell you?
Under RFC 8910 the network announces the portal's address through DHCP or a router advertisement, so a missing page means the device never learnt that address or cannot reach it. Opening a plain http address gives the gateway a request it can redirect.
From the lesson Wi-Fi: bands, channels, security and fixes
-
One user's Wi-Fi password prompt keeps returning, while elsewhere a whole floor fails within an hour. What is each?
In office Wi-Fi the access point only relays and the RADIUS server decides. One user with a returning prompt is an account problem; a floor failing at once points to an expired certificate.
From the lesson Wi-Fi: bands, channels, security and fixes
-
What is the chain of a small-office network, and which fact do you need before changing anything?
The ONT or modem, then the router that hands out addresses and does NAT, then a switch, then the devices. Know which box runs DHCP first.
From the lesson Wired networks, switches and SOHO routers
-
A gigabit link is stuck at 100 Mbps. What is the usual cause?
A damaged cable pair: 1000BASE-T needs all four pairs, while 100BASE-TX uses only two. Check the cable and the port settings at both ends, and try a patch cord known to work.
From the lesson Wired networks, switches and SOHO routers
-
What do the PoE amendments 802.3af, at and bt change?
Each raises the power a switch port can deliver, and 802.3bt is the first to use all four pairs. The device receives less than the switch measures, because some power is lost in the cable.
From the lesson Wired networks, switches and SOHO routers
-
How is a SOHO router hardened?
A strong admin password, current firmware, WPA3 or WPA2-AES (never WEP or TKIP), a guest network, UPnP and remote management off, narrow port forwarding, and DHCP reservations for devices that must stay reachable.
From the lesson Wired networks, switches and SOHO routers
-
What does each wiring tool prove: a cable tester, a certifier, a toner probe and a loopback plug?
A cable tester proves continuity and the wire map; a certifier, that the installed link meets a category standard; a toner probe traces a cable through walls; a loopback plug tests a network card's own port.
From the lesson Wired networks, switches and SOHO routers
-
How is a no-internet ticket worked on the connectivity ladder?
Bottom-up through seven rungs, from the link to the application, stopping at the first rung that fails and noting what it printed.
From the lesson The connectivity ladder: link to application
-
Which three rungs come first when a user has no internet?
The link: is the adapter up? The address: does ipconfig /all show a real one, or 169.254? The gateway: does a ping to the default gateway come back in a few milliseconds?
From the lesson The connectivity ladder: link to application
-
A server does not answer ping. Is it down?
That is not proven, because many networks drop echo on purpose. Test the port the work needs with Test-NetConnection -Port 443, nc -vz or curl -v: a completed TCP connection is stronger evidence than any ping.
From the lesson The connectivity ladder: link to application
-
A trace shows loss at one middle hop. Is that the fault?
Only if the loss carries on to the destination; otherwise that router is just rate-limiting its replies. pathping measures loss at every hop over time.
From the lesson The connectivity ladder: link to application
-
What do you measure first on a ticket that says the network is slow?
Latency, jitter and loss before bandwidth: take 50 pings on a cable and on Wi-Fi, because calls need steady spacing more than speed.
From the lesson The connectivity ladder: link to application
-
What is bufferbloat, and how do you see it?
A deep queue on a busy link: delay climbs while throughput stays good. It shows only when you ping while the link is loaded.
From the lesson The connectivity ladder: link to application
-
What do you decide before changing anything on a network ticket?
Whether the fault belongs to one user, one site or everyone, because the scope says where to start and whom to call.
From the lesson The connectivity ladder: link to application
-
Something fails only while the VPN is connected. What is it usually?
DNS, routing or MTU inside a working tunnel, not the tunnel itself. The evidence is in the routes, the resolver and the packet size.
From the lesson VPNs, proxies, file shares and remote work
-
The intranet works only on the VPN and the internet only off it. What kind of VPN is that?
A full tunnel, which sends all traffic, DNS included, through the organisation. While it is up, public names fail when the internal resolver cannot reach or forward them.
From the lesson VPNs, proxies, file shares and remote work
-
One app cannot connect through the proxy while others can. Why?
A PAC file returns DIRECT or a proxy for every URL, and the failing app is probably ignoring or misreading the system proxy settings.
From the lesson VPNs, proxies, file shares and remote work
-
What do drive-mapping errors 1326, 53 and 67 point to?
1326, wrong sign-in details; 53, an unreachable server or a DNS failure; 67, a share name that does not exist.
From the lesson VPNs, proxies, file shares and remote work
-
An old device can no longer save to a Windows share. Why, and what is the fix?
Recent Windows requires SMB signing, Windows Server 2025 on the connections it makes and Windows 11 24H2 Pro and Enterprise in both directions, so a device that cannot sign is refused. Update or replace the device; never disable SMB signing.
From the lesson VPNs, proxies, file shares and remote work
-
What do the Public, Private and Domain network profiles decide?
What the device shares: Public hides it, Private allows sharing on a trusted network, and Domain follows the policies the domain controller pushes.
From the lesson VPNs, proxies, file shares and remote work
-
Which stages does a print job pass through, and why does that matter on a ticket?
From the app to a queue, through a driver or filter, to the printer. The stage where the job stops tells you where to look first.
From the lesson How printing works: queues, IPP and drivers
-
Why does a print job wait in a queue instead of going straight to the printer?
A printer takes one job at a time and may be off, asleep or out of paper. The Print Spooler on Windows, or cupsd on macOS and Linux, keeps each job as a numbered file and sends it on when the printer can take it.
From the lesson How printing works: queues, IPP and drivers
-
How can a laptop print to a printer with no vendor driver?
IPP Everywhere, AirPrint and Mopria all rest on IPP: the laptop finds the printer with multicast DNS, asks what it supports and sends a standard file such as PDF or PWG Raster.
From the lesson How printing works: queues, IPP and drivers
-
How do you learn what a printer supports without guessing?
Ask it. ipptool reads the printer's state, its state reasons, the formats it takes and whether it prints two-sided.
From the lesson How printing works: queues, IPP and drivers
-
What is a page description language, and why does it matter?
The language that tells a printer what each page looks like, such as PDF, PWG Raster, PCL or PostScript. A printer prints a job only in a language it understands.
From the lesson How printing works: queues, IPP and drivers
-
What is Microsoft changing about printer drivers on Windows?
It is ending servicing of third-party printer drivers in steps, and its Windows protected print mode allows only Mopria-compliant printers.
From the lesson How printing works: queues, IPP and drivers
-
How does adding a printer by IPP differ from adding it on raw port 9100?
IPP is a conversation: the computer can ask about capabilities and state, list and cancel jobs, and encrypt the exchange with ipps. Port 9100 only carries print data, so the computer must already know the printer's language.
From the lesson Add, share and secure printers and scanners
-
A newly added printer queue does not respond. Which four parts do you test?
The scheme, the address, the port and the resource path, with an IPP request, before you blame a driver.
From the lesson Add, share and secure printers and scanners
-
A standard user cannot connect to a shared printer that needs a driver. What are the safe fixes?
Point and Print, by default, asks for an administrator before a driver goes in, so deploy the driver centrally or move the queue to IPP rather than handing out administrator rights.
From the lesson Add, share and secure printers and scanners
-
How should a multifunction device send scan-to-email?
Without a stored Basic password: with OAuth, or through an SMTP relay with a connector, and Direct Send only for internal mail from a device that can do neither.
From the lesson Add, share and secure printers and scanners
-
Why can a scanner fail to save to a file share that PCs use without trouble?
Scan to folder needs an SMB version and a signing setting that the file server accepts, and a device that cannot sign cannot save to a server that requires signing.
From the lesson Add, share and secure printers and scanners
-
How is a multifunction device secured?
With a new admin password, current firmware, unused protocols switched off, secure print release and audit logs.
From the lesson Add, share and secure printers and scanners
-
A computer shows its printer as offline. What do you do before changing anything?
Ask the printer itself at its current address. Offline is the computer's opinion: if the printer answers, the fault is in the queue.
From the lesson Fix printers: offline, stuck queues, bad prints
-
What usually makes a printer show as offline, and what fixes it for good?
A queue that points at an old address. Re-add the queue by its IPP address and reserve that address on the router.
From the lesson Fix printers: offline, stuck queues, bad prints
-
Why read printer-state and printer-state-reasons together?
The state says what the printer is doing and the reasons say what is wrong, so an idle printer can still report an empty tray. Match the keyword, not a guess, to the fix.
From the lesson Fix printers: offline, stuck queues, bad prints
-
A cancelled job sits in processing-to-stop-point. What do you do?
Wait, or restart the printer, until it lets the job go, before you clear the queue on the computer.
From the lesson Fix printers: offline, stuck queues, bad prints
-
How do you clear a stuck Windows print queue without losing other people's jobs?
Remove only the stuck job with Remove-PrintJob first. Delete spool files only while the Print Spooler service is stopped.
From the lesson Fix printers: offline, stuck queues, bad prints
-
Where do you start with a bad print?
With the printer's technology: toner, drum or fuser on a laser, the printhead on an inkjet. The first suspect is a starting point, not a verdict.
From the lesson Fix printers: offline, stuck queues, bad prints
-
How does authentication differ from authorisation?
Authentication proves who the user is. Authorisation decides what that user may reach and what they may do.
From the lesson Passwords, MFA and passkeys for support
-
What makes a sign-in multi-factor?
At least two independent factors of different types: something you know, something you have and something you are.
From the lesson Passwords, MFA and passkeys for support
-
What does NIST SP 800-63B-4 ask of a password used without MFA?
At least 15 characters and a check of the whole password against a blocklist of common and breached passwords. It forbids composition rules and forced rotation.
From the lesson Passwords, MFA and passkeys for support
-
A new password with upper and lower case, digits and a symbol was rejected. Why can that be right?
Current guidance values length over mixed characters: an 11-character complex password is under the 15-character minimum for a password used without MFA, and the mix does not make up for it. A long, randomly generated passphrase is the better answer.
From the lesson Passwords, MFA and passkeys for support
-
How do SMS codes, TOTP codes and passkeys compare as second factors?
SMS codes are the weakest, because of SIM swaps. TOTP codes are better but can be phished within their time window. Passkeys and security keys stand up to phishing: each credential works only for the origin it was made for.
From the lesson Passwords, MFA and passkeys for support
-
What is MFA fatigue, and what stops it?
A flood of push prompts sent until the user accepts one out of frustration, also called push bombing. Number matching stops it.
From the lesson Passwords, MFA and passkeys for support
-
What makes a help-desk MFA recovery safe?
Checking the person's identity through a channel the attacker cannot control. A code the caller reads aloud, or a reset link sent to a mailbox that may be taken over, verifies nothing.
From the lesson Passwords, MFA and passkeys for support
-
Why do systems ask the directory rather than keep their own user lists?
The directory is the one place an organisation keeps its users, computers and groups, so a change made there reaches every system once the domain controllers have copied it.
From the lesson Directory services and Active Directory basics
-
How do you read the distinguished name CN=Asha Rao,OU=Finance,DC=example,DC=in?
From the entry upwards: Asha Rao's account, in the Finance OU, in the domain example.in. A comma after a backslash belongs to the value, as in CN=Iyer\, Vikram.
From the lesson Directory services and Active Directory basics
-
What do an Active Directory group's type and scope decide?
The type decides access: a security group can be given permissions, while a distribution group only sends email. The scope, domain local, global or universal, decides who can join the group and where it can be given access.
From the lesson Directory services and Active Directory basics
-
What does a userAccountControl of 514 mean, and what does memberOf list?
userAccountControl is a sum of bits, and 514 is a disabled normal account. memberOf lists only the groups an account belongs to directly.
From the lesson Directory services and Active Directory basics
-
What does a domain join need?
A DNS server that knows the domain, open ports to a domain controller, a clock within 5 minutes of it, and an account allowed to create the computer object in the right OU.
From the lesson Directory services and Active Directory basics
-
Kerberos sign-in fails with the right password. What do you check before the password?
The name and the clock. Kerberos issues a ticket per service name, so connecting by IP address falls back to NTLM, and clocks more than 5 minutes apart in UTC stop Kerberos whatever the password.
From the lesson Directory services and Active Directory basics
-
How does a Group Policy object reach a PC?
Only through a link to a site, a domain or an OU. A GPO is a container in Active Directory plus a template on SYSVOL, so where it is linked matters as much as what it sets.
From the lesson Group Policy for support: apply, check, fix
-
In what order does Windows apply Group Policy, and which level has the last word?
Local, then site, then domain, then OUs from parent to child, with computer settings at start-up and user settings at sign-in. By default the OU closest to the object wins.
From the lesson Group Policy for support: apply, check, fix
-
Several GPOs set the same thing. Which one wins?
The closest container wins, and inside one container the lowest link order wins. An enforced link beats both and gets through Block Inheritance, which stops only the unenforced links from above.
From the lesson Group Policy for support: apply, check, fix
-
Which gpresult and gpupdate switches does a technician use?
gpresult /r summarises the applied and filtered GPOs and the sign-in's groups, and /user keeps the report on the caller. gpupdate /force reapplies everything, with /logoff or /boot for extensions that work only at sign-in or start-up.
From the lesson Group Policy for support: apply, check, fix
-
A mapped drive disappeared after a team move. Where do you look first?
At targeting: find the GPO that delivers the drive map and read the item's target, before you touch the share or the password.
From the lesson Group Policy for support: apply, check, fix
-
Sign-in has been slow since a GPO change. What points at the cause?
An extension that must finish before the desktop appears. Its 4016 and 5016 events time how long it ran.
From the lesson Group Policy for support: apply, check, fix
-
Is Microsoft Entra ID simply Active Directory in the cloud?
No. Active Directory runs on domain controllers inside the network and uses Kerberos and LDAP. Entra ID runs in Microsoft's cloud and uses OAuth 2.0, OpenID Connect and SAML. Neither replaces the other.
From the lesson Cloud identity: Entra ID, SSO and device join
-
In which three ways does a device get an identity in Microsoft Entra ID?
Entra joined, cloud only; hybrid joined, in Active Directory and Entra ID at once; and Entra registered, a personal device with a work account on it. Who owns the device and what on-premises resources it needs decide which.
From the lesson Cloud identity: Entra ID, SSO and device join
-
Which fields of dsregcmd /status show a PC's join type and whether single sign-on works?
AzureAdJoined, DomainJoined and WorkplaceJoined for the join type, and AzureAdPrt for single sign-on. Run it as the signed-in user.
From the lesson Cloud identity: Entra ID, SSO and device join
-
Teams will not sign in, but Outlook on the web works. Where do you look first?
At the device: read the SSO State of dsregcmd /status. If AzureAdPrt is NO on a joined device, sign out of Windows and back in before you reset any password.
From the lesson Cloud identity: Entra ID, SSO and device join
-
What carries single sign-on from a Windows PC to cloud apps?
The primary refresh token, issued at Windows sign-in, bound to the device by keys its TPM protects, and presented silently by the token broker to Entra ID.
From the lesson Cloud identity: Entra ID, SSO and device join
-
How does Conditional Access decide a sign-in?
After the password it reads signals: the user, device compliance, location, risk and the app. Every control a matched grant policy requires must be met, and a single block ends the sign-in. The sign-in log names the policy that decided.
From the lesson Cloud identity: Entra ID, SSO and device join
-
Where should a joiner's access come from?
From a role template, a list of groups and a licence agreed with the department that owns the role. A copy of a colleague's account carries every project that colleague ever joined.
From the lesson Joiners, movers, leavers and access requests
-
Which credential does a joiner use for the first sign-in?
One that ends by itself, such as a single-use Temporary Access Pass handed over in person. In the same sitting, the joiner registers two independent sign-in methods and self-service reset.
From the lesson Joiners, movers, leavers and access requests
-
Why is a move two changes in one ticket?
Add the new role's groups and remove every group the new template does not list, so the account ends with the new template and nothing more. Old access stays only for a handover with an end date.
From the lesson Joiners, movers, leavers and access requests
-
What is privilege creep?
The access an account gathers over years of moves and projects, because new access is added and old access is never taken away. Whoever later takes over the account inherits all of it.
From the lesson Joiners, movers, leavers and access requests
-
In what order is a leaver's account handled?
Stop access first: disable sign-in, revoke sessions, wipe devices. Move the mailbox and files next. Delete the account last, because deleting it starts both the 30-day window for restoring it and the clock on OneDrive retention.
From the lesson Joiners, movers, leavers and access requests
-
What does every access request need?
The resource owner's agreement, a reason and an end date. Ordinary access comes through an access package, administrator rights through just-in-time activation, and emergency access accounts stay out of daily use.
From the lesson Joiners, movers, leavers and access requests
-
Why does the desk ring a caller back on the number in the HR directory?
The number on the screen is the caller's choice and can be spoofed; the directory's number is not. Personal details prove nothing either, since attackers gather them in advance.
From the lesson Safe password resets and account lockouts
-
What does a help-desk social-engineering attempt usually look like?
A script of several calls using urgency, rank, true details and a switch of channel. The desk never describes its checks to an unknown caller, and an MFA change gets the same check as a password reset.
From the lesson Safe password resets and account lockouts
-
What does a safe password reset hand over?
A random temporary password that must change at the next sign-in, or a single-use Temporary Access Pass for new MFA, given on the verified channel and followed by a notice to the owner on a second channel.
From the lesson Safe password resets and account lockouts
-
An account keeps locking out. How do you find what is doing it?
Event 4740 on the domain controllers names the caller computer, and the Logon Type of the failed sign-ins from it says whether a drive, a task, a service or a session holds the old password. Remove that source before you clear the lockout.
From the lesson Safe password resets and account lockouts
-
How does Microsoft Entra smart lockout count failed sign-ins?
Each new wrong password counts once, familiar and unfamiliar places keep separate counters, and the first lockout lasts a minute.
From the lesson Safe password resets and account lockouts
-
With pass-through authentication, how is the Active Directory lockout threshold set against Entra's?
Two or three times higher than the Entra smart lockout threshold.
From the lesson Safe password resets and account lockouts
-
How does Windows combine a user's NTFS entries on a folder?
Explicit entries before inherited ones, and deny before allow in each. Allow entries add up across the user's groups until a matching deny ends the walk, and a right that no entry grants is denied.
From the lesson File permissions and sharing that make sense
-
What do (I), (OI) and (CI) mean in icacls output?
(I) marks an inherited entry; (OI) and (CI) say that files and subfolders inherit it. The rights follow as letters such as F, M, RX, R, W, D or N. Save the list with /save before you change it.
From the lesson File permissions and sharing that make sense
-
The share permission allows Change and NTFS allows Read. What can a user do over the network?
Read only, because over a share the more restrictive of the two wins. A user signed in at the server meets the NTFS entries alone.
From the lesson File permissions and sharing that make sense
-
How do ACLs differ on macOS and on Linux?
macOS adds ordered allow and deny entries on top of the file mode, set with chmod +a and shown by ls -le. A Linux ACL has no deny entries, lets the first matching class decide and is capped by its mask.
From the lesson File permissions and sharing that make sense
-
In what order do you check an access-denied ticket?
The account and its groups with whoami, a fresh sign-in if a group was added since the last one, the share, the item's entries and inheritance, then error 32 for a file that is in use.
From the lesson File permissions and sharing that make sense
-
Why do confidential files go to Specific people rather than an Anyone link?
An Anyone link opens for whoever holds it and cannot be traced. Administrators can make Anyone links expire, keep them view only and set a safer default.
From the lesson File permissions and sharing that make sense
-
How do full, incremental, differential and synthetic full backups trade off?
A full copies everything every run. An incremental run is small, but a restore reads the last full and every incremental after it. A differential grows each run but restores in two reads. A synthetic full gives a one-step restore without reading the source again, at the storage cost of a full.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
What is the 3-2-1 rule, and what does current ransomware guidance add to it?
Three copies, on two kinds of media, with one offsite, as a planning minimum. Current guidance adds one copy that is offline or immutable.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
Why keep a rotation of backups rather than only the newest one?
So that a corruption noticed late can still be rolled back. Grandfather-father-son keeps daily, weekly and monthly tiers, and Time Machine keeps hourly, daily and weekly points.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
Where do the RPO and the RTO of a backup plan come from?
The RPO, the oldest change you accept to lose, comes from the schedule: a nightly backup gives one day. The RTO, how long you can stay down, comes from the restore. Both are agreed with the business.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
A user says their files are safe because the folder is in OneDrive. What do you tell them?
OneDrive syncs; it is not a backup. A delete, a wrong save or ransomware on one device syncs to all the others, and its recycle bin helps only for a while, so a loss noticed late needs a real backup.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
When does a backup count as real?
Only once a restore from it has been tried, has worked and has been recorded. Test often enough that each change to the plan is proven before anyone relies on it.
From the lesson Backup strategy: 3-2-1, versions and restore tests
-
What does Windows Backup copy, and what does it leave out?
It syncs Desktop, Documents, Pictures, Videos and Music to a personal account's OneDrive and saves the settings and the app list. It copies neither Windows nor the programs.
From the lesson Back up Windows PCs, Macs and phones
-
What is Known Folder Move?
The organisation's folder backup: OneDrive policies, set with Group Policy or Intune, that move the Desktop, Documents and Pictures folders of work PCs into each user's OneDrive.
From the lesson Back up Windows PCs, Macs and phones
-
What disk does Time Machine want, and what does tmutil read?
A disk of its own with at least twice the Mac's storage. tmutil reads its destinations, its latest backup and its exclusions from Terminal.
From the lesson Back up Windows PCs, Macs and phones
-
Why does restic warn about the repository password when a repository is created?
The password is the only way in: restic encrypts every piece of data and keeps the keys in files that only that password opens. Lose it and the backup is lost, with no reset and no recovery question.
From the lesson Back up Windows PCs, Macs and phones
-
How do you bring back one file from a restic snapshot?
Restore it into a new folder, then prove it against its hash before anything is replaced. Each snapshot holds a whole version, while the repository stores only what changed.
From the lesson Back up Windows PCs, Macs and phones
-
What do you do before a phone is repaired, reset or upgraded?
Run its backup now, and copy the date of that backup, from the phone or the backup's own list, into the ticket.
From the lesson Back up Windows PCs, Macs and phones
-
Why restore a file beside the current one rather than over it?
So that the user can compare the two and confirm before anything is replaced. Only a file taken out of a bin goes straight back to its folder.
From the lesson Restore files and recover data safely
-
Where does a deleted file wait, in order?
In the Recycle Bin or the Trash, then in File History or Time Machine, then in OneDrive's recycle bin: 30 days on a personal account, 93 on a work one.
From the lesson Restore files and recover data safely
-
Why is a failing drive imaged before any recovery?
It is read once, by ddrescue, and every attempt then works on the image, because a repair or a scan on the original can destroy sectors that were still readable. The map file lets the rescue resume.
From the lesson Restore files and recover data safely
-
When is a data-recovery lab the right call?
For failed hardware whose data exists nowhere else. Never for a deleted file on a healthy drive, or for encrypted files.
From the lesson Restore files and recover data safely
-
In what order does the desk respond to ransomware?
Isolate the device, keep it running, report at once, preserve the evidence, and restore last, from offline backups. Official guidance advises against paying.
From the lesson Restore files and recover data safely
-
When is a restore complete?
When the restored files' hashes match the manifest and the user confirms that the file is the one they need.
From the lesson Restore files and recover data safely
-
Why is a quick format not enough before a laptop goes to a buyer?
It only builds an empty file table, so the files' contents stay on the drive for recovery tools to find. On an SSD even an overwrite cannot reach the spare blocks.
From the lesson Wipe, destroy and dispose of devices properly
-
What are the three sanitisation methods of NIST SP 800-88?
Clear defeats simple recovery tools. Purge defeats a laboratory and keeps the device usable. Destroy defeats a laboratory and ends the device.
From the lesson Wipe, destroy and dispose of devices properly
-
What does cryptographic erase destroy, and when does it fail?
The key rather than every block, so all the data, spare blocks included, becomes ciphertext nobody can read. It fails if another copy of the key survives in a backup or an escrow.
From the lesson Wipe, destroy and dispose of devices properly
-
Why encrypt every device from its first day?
So that at the end of its life, destroying the key purges every block at once, including spare blocks that no overwrite can reach.
From the lesson Wipe, destroy and dispose of devices properly
-
What comes before and after a built-in erase on a Mac, a PC or a phone?
Before it, a backup and removing the owner's accounts. After it, a check of the setup screen.
From the lesson Wipe, destroy and dispose of devices properly
-
When is a drive destroyed instead of wiped, and what closes the disposal?
When it has failed, or when policy rates it too sensitive: a vendor destroys it and issues a certificate listing serial numbers. The disposal closes when the record is filed and the device and its battery have gone to a registered recycler or the producer's take-back.
From the lesson Wipe, destroy and dispose of devices properly
-
Which six states does a ticket move through, and what happens when the fault returns?
New, assigned, in progress, pending, resolved and closed. A related fault that comes back reopens the ticket instead of starting a new one, so the history travels with the work.
From the lesson Tickets, priority and SLAs that hold up
-
A VIP closes their own ticket and the error is back ten minutes later. Why reopen it rather than open a fresh one?
A duplicate loses the error text, the actions tried and the contact notes. It also makes the fault look rarer and counts the second contact as first-contact resolution, which flatters the dashboard without helping the user.
From the lesson Tickets, priority and SLAs that hold up
-
How is a ticket's priority set?
From two readings, impact and urgency, looked up on the matrix the organisation has published. Changing the priority is a decision with its reason in the ticket, not a judgement about the caller.
From the lesson Tickets, priority and SLAs that hold up
-
How does an SLA clock count toward a resolution target?
In business minutes only, against the published hours and the holiday calendar. On a desk open 09:00 to 18:00 on weekdays, 60 minutes from Thursday 17:30+05:30, with the Friday a holiday, end on Monday at 09:30+05:30.
From the lesson Tickets, priority and SLAs that hold up
-
A customer gives a time with no offset. What do you do before adding SLA minutes to it?
Treat it as a question, not a start. Once the zone is known, convert the time to the desk's clock with a time-zone library, because the UK, Europe and most of the US move their clocks.
From the lesson Tickets, priority and SLAs that hold up
-
Why read service desk metrics together rather than one at a time?
Each one can be gamed alone, and a split ticket or an early close moves several at once. Read first-contact resolution, mean time to resolve, reopen rate and backlog age together, beside the ticket count.
From the lesson Tickets, priority and SLAs that hold up
-
What do an incident, a service request, a problem and a change each do?
An incident restores a service, a service request delivers something normal, a problem owns the cause behind incidents, and a change alters the live service.
From the lesson Incidents, problems and major incidents
-
One user asks for access to a reports folder; another says the folder is empty for the whole department. Which is which?
The access is a service request: raise it on the standard route and ask who authorises the folder, never grant it yourself. The empty folder is an incident, and a wide one, so scope who is affected first and check the major-incident trigger.
From the lesson Incidents, problems and major incidents
-
How is a major incident run?
It is declared on a trigger agreed in advance, owned by one named incident manager, worked on one bridge call, filed as one parent with its duplicates linked, and updated on a fixed clock even when there is no news.
From the lesson Incidents, problems and major incidents
-
Why are major-incident updates published on a fixed cadence, even with nothing new?
Because silence is read as nobody working on it. An interval of half an hour is common.
From the lesson Incidents, problems and major incidents
-
What is a known error, and what alone removes its cause?
A problem whose cause is understood and whose workaround is written down. Only a change, made through change management, removes the cause.
From the lesson Incidents, problems and major incidents
-
What does a blameless post-incident review ask, and what must every action carry?
What let the fault happen, rather than who caused it. Every action names an owner and a date, so it can be checked later.
From the lesson Incidents, problems and major incidents
-
A ticket turns out to be a suspected security incident. What changes?
It leaves the normal path at once: preserve the device and the logs, tell the named contact, and hand over rather than investigate.
From the lesson Incidents, problems and major incidents
-
What are the three kinds of change, and how does each get authorised?
A standard change is pre-authorised and repeatable, run from its template. A normal change is assessed and cleared by the change-advisory board. An emergency change gets fast authorisation now and its full documentation afterwards.
From the lesson Change management for support teams
-
What does a change request record?
Its purpose, scope, affected systems, risk, test evidence, implementation steps, rollback plan, responsible people, window, authorisations and verification plan. The empty fields are where the risk hides.
From the lesson Change management for support teams
-
Why is the rollback plan written before a change runs?
It separates a change you can try from a change you can only hope works, so it is written, and tried, before anything runs.
From the lesson Change management for support teams
-
Which three Windows measures give a change a way back?
Suspend BitLocker before firmware work (-RebootCount 1 resumes it after the next restart), roll out to a pilot ring before a broad one, and take a restore point or an image before a risky configuration change.
From the lesson Change management for support teams
-
Which changes may run inside a change freeze?
Only emergency changes. Every other change moves to the next open maintenance window.
From the lesson Change management for support teams
-
When is a change closed?
Only after the user accepts it and monitoring stays clean, with the result recorded. A failed change becomes an incident that feeds problem management.
From the lesson Change management for support teams
-
Which lifecycle states does a hardware record move through, and what does each move change?
Requested, procured, received and tagged, deployed, maintained and repaired, retired, and sanitised and disposed. Each move changes the owner, the location or the state, and a record that lags makes the next ticket harder.
From the lesson Asset inventory, licences and the CMDB
-
Which built-in commands collect hardware inventory on Windows, macOS and Linux?
Get-CimInstance on Win32_BIOS and Win32_ComputerSystem on Windows, system_profiler SPHardwareDataType -json on macOS, and hostnamectl with dmidecode on Linux.
From the lesson Asset inventory, licences and the CMDB
-
Which six licence models does a register track, and which proofs does it keep?
Per user, per device, subscription, perpetual, OEM and volume. The register keeps proof of purchase and proof of assignment, so a renewal bill never comes as a surprise.
From the lesson Asset inventory, licences and the CMDB
-
What can an open-source licence ask for when a tool ships to a customer?
A notice that lists the library and its licence text, and, for copyleft licences such as the GPL, sharing the source.
From the lesson Asset inventory, licences and the CMDB
-
Why keep both an inventory row and a CMDB item for one laptop?
They answer different questions. The inventory row is about the thing: serial, model, purchase and warranty. The configuration item is about where it fits: its service, its room, its switch and its users.
From the lesson Asset inventory, licences and the CMDB
-
What makes a CMDB worth more than a list of devices?
The links between its configuration items. With them, an incident on one switch names the two services and the 20 users it reaches without a second lookup.
From the lesson Asset inventory, licences and the CMDB
-
Why does the assigned-user column of an asset register need care?
It is personal data, so the register follows the same minimisation rule as a ticket: write only what is needed, and keep it only while the device is in use.
From the lesson Asset inventory, licences and the CMDB
-
Which seven fields does a knowledge-base article in this track have?
Title, Environment, Symptoms, Cause, Resolution, Verification and When to escalate, for one task, with a named owner who takes a flag when a reader cannot change the article.
From the lesson Knowledge bases and self-service that work
-
When is a knowledge-base article written, and when is it improved?
It is captured while the ticket is being solved and improved every time it is reused, so a stale step flagged and fixed in minutes stays fixed for every later reader.
From the lesson Knowledge bases and self-service that work
-
An article is titled "spool woes", and the next user searches for 0x000006ba. Why does the search miss?
The article's words and the user's words do not overlap. Put the exact error code and text, and the words users type, such as spooler, in the title and the symptoms.
From the lesson Knowledge bases and self-service that work
-
How readable should a knowledge-base article be?
At or below Flesch-Kincaid grade 10, with no internal jargon, and with a version on every article.
From the lesson Knowledge bases and self-service that work
-
When do a self-service portal and a request catalogue really cut calls?
When every catalogue item has an owner, a fulfilment path and a target time, and an article answers the common questions about it.
From the lesson Knowledge bases and self-service that work
-
How do you measure deflection honestly?
A view is not a resolution. Count the readers who said the article solved their problem, treat those few answers as a floor, and watch for tickets opened right after a view.
From the lesson Knowledge bases and self-service that work
-
What is the rule for an assistant's suggestions at the help desk?
It produces drafts, not answers. Every step it suggests is checked against the vendor documentation and tried on one device before it reaches a user.
From the lesson Use AI assistants safely at the help desk
-
Which five tasks can an assistant take on safely, and what check does each need?
Summarise a thread, then compare with the original; draft a reply, then read it aloud; translate, then have a colleague who reads the language confirm it; list possible causes, then test each against the vendor's documentation; explain an error code, then confirm it in the vendor's list.
From the lesson Use AI assistants safely at the help desk
-
What must never go into an AI tool the organisation has not permitted?
Personal data, passwords and recovery keys. Mask them first, and share only the data the task needs.
From the lesson Use AI assistants safely at the help desk
-
Why can a confident assistant answer still be false?
A hallucination sounds right because the words fit, not because the fact is true. Treat every registry key, error code and command as invented until the vendor documentation shows it.
From the lesson Use AI assistants safely at the help desk
-
What one defence covers hallucination, bias and plagiarism?
Grounding: refuse any answer that lacks a reference you can check.
From the lesson Use AI assistants safely at the help desk
-
What is prompt injection, and how does a desk guard against it?
Text in untrusted input written to make a tool misbehave. Never let raw ticket content reach a tool that can act without your review.
From the lesson Use AI assistants safely at the help desk
-
Why check the Windows build before running a command an assistant suggests?
Commands are retired: WMIC is gone from Windows 11 24H2 and later, so a command that worked last year can fail on the build in front of you. Check Microsoft Learn's deprecated-features page or the vendor's documentation.
From the lesson Use AI assistants safely at the help desk
-
Why does a ticket name the malware family, not only the symptom?
Each family needs a different next step: a cryptominer runs hot, a keylogger follows the user's cards and sign-ins across devices, and fileless malware runs scripts even after a clean antivirus scan.
From the lesson Malware, phishing and social engineering
-
Which three levers does social engineering pull on every channel?
Urgency, authority and secrecy. The shape of one message, its sender, display name, link host, ask, deadline or a phone number in a warning, carries the tells to read before anything is opened.
From the lesson Malware, phishing and social engineering
-
How do vishing and smishing differ from email phishing?
Vishing is phishing by voice and smishing is phishing by SMS. The levers stay the same, and so does most of the reading: a number that does not match the organisation's known one, a link whose host differs from its text.
From the lesson Malware, phishing and social engineering
-
A warning on screen tells the user to ring Microsoft at a phone number. What do you know at once?
It is fake. Microsoft's error messages never carry a phone number, and Microsoft makes no unsolicited calls.
From the lesson Malware, phishing and social engineering
-
Which header line says whether the From address a user sees is genuine?
The topmost Authentication-Results line, the one your own provider wrote, and only its DMARC result speaks about the visible From. Even a pass names the sending domain, never whether the request is genuine.
From the lesson Malware, phishing and social engineering
-
Why can a forwarded message fail SPF and still pass DMARC?
Forwarding often breaks SPF but keeps the DKIM signature, so DMARC can still pass.
From the lesson Malware, phishing and social engineering
-
Where is financial cyber fraud reported in India, and why does speed matter?
On 1930 or at cybercrime.gov.in. Behind both, one system joins the police with banks, wallets and payment intermediaries, so a quick report gives the best chance that the money is held.
From the lesson Malware, phishing and social engineering
-
A user thinks their slow PC is infected. What do you check first?
Each symptom against an ordinary cause, so a slow PC with a full disk is not treated as an infection, while three unexplained signs together are not waved away as probably fine.
From the lesson Remove malware and recover a PC or Mac
-
Why isolate a possibly infected device before any scan runs?
Much malware calls home, downloads more parts or scans the subnet for other devices. Taking the device off the network sets a boundary, so the scan meets a fixed picture rather than a moving one.
From the lesson Remove malware and recover a PC or Mac
-
What is the order of a malware removal?
Observe, isolate, scan with updated signatures, find and remove persistence, clean the browser, and reimage when trust is gone, writing down times and actions as they happen.
From the lesson Remove malware and recover a PC or Mac
-
Where does persistence hide, and what turns the check into pass or fail?
In start-up items, scheduled tasks, services, the hosts file, the proxy, login and background items and configuration profiles. A known-good baseline turns each check into pass or fail.
From the lesson Remove malware and recover a PC or Mac
-
In what order is a hijacked browser cleaned?
Extensions, then site notifications, the home page and search engine, then proxy settings, and only then a reset, so the user's work is kept and the hijacker's is not.
From the lesson Remove malware and recover a PC or Mac
-
Which findings end the cleaning and start a reimage?
A rootkit, a boot-sector change, ransomware, reinfection after a clean removal, and anything that touched credentials. A managed device is isolated through the security console and handed to the security operations centre.
From the lesson Remove malware and recover a PC or Mac
-
When does a device count as recovered from malware?
When trust is restored, not when the latest scan is clean: through the known-good image it was rebuilt from, or a full offline scan that follows every persistence place.
From the lesson Remove malware and recover a PC or Mac
-
What does hardening a workstation take away?
Settings an attacker can meet before any bug: local admins, the guest account, AutoRun, long screen-lock times, a missing firmware password and unused services, among others.
From the lesson Harden workstations and browsers
-
What does least privilege mean for a user's daily account?
The account cannot change the system: it installs no software, changes no system settings and writes only to the user's own folders, so an attack that lands in the browser or the mail app can do only what that account can.
From the lesson Harden workstations and browsers
-
How is what a technician can do limited too?
With a separate admin account, Administrator protection, and Windows LAPS giving each PC its own local admin password.
From the lesson Harden workstations and browsers
-
What makes a browser safe as a workstation setting?
Automatic updates on, an extension allowlist, a password manager, secure DNS on, and no clicking past a certificate warning, which the office treats as a ticket.
From the lesson Harden workstations and browsers
-
What does a hardening baseline give a technician?
The long list of settings as pass or fail, with a recorded list of exceptions, so every PC is read against the same checklist. Fixes restore protections rather than remove them.
From the lesson Harden workstations and browsers
-
Which five controls come first in a small office, in order?
Patching, MFA, encryption, tested backups and no local admin. They cover the common ways in and the common losses; the baseline's other settings come after them.
From the lesson Harden workstations and browsers
-
Which three kinds of remote job decide the tool?
Attended help, which needs the user at the device; unattended administration, which needs the organisation's authority instead; and a file transfer, which needs neither a screen nor a desktop session.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
What are the two consents of a Quick Assist session?
The user submits the code and chooses Allow to share the screen, then separately allows control. The helper never has more rights than the user being helped.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
What does a Windows Remote Desktop host need?
A Professional, Enterprise, Education or Server edition. Turning it on opens a port, and Network Level Authentication makes the user authenticate before the session is created.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
What must be true before a Mac can be reached with Screen Sharing?
Screen Sharing must be turned on in that Mac's own settings first. The helper then connects from another Mac with the Screen Sharing app, by name or Apple Account.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
Which four remote-access ports belong behind a VPN or a zero-trust gateway?
RDP on 3389, SSH on 22, VNC on 5900 and WinRM on 5985 or 5986. A rule that lets any address reach them is the exposure CISA warns against.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
What keeps a remote session support rather than snooping?
Consent and care: ask first, let the user clear their screen, watch before taking control, end the session in the app, and write the ticket note that is the only record of what you did.
From the lesson Remote support tools: RDP, Quick Assist, SSH
-
How can a portable remote tool get past a rule that blocks installing software?
Nothing is installed. A self-contained copy starts in the user's own session with the user's rights, so a control that only watches installations sees nothing to stop.
From the lesson Remote support security and scam response
-
What does the joint guidance on securing remote access software give a desk?
Eight checkable controls, from auditing what is in use and allowing only named programs to run, through full logs and blocked ports, to keeping log servers out of the tools' reach.
From the lesson Remote support security and scam response
-
A process listing is read against the desk's authorised list. Which three kinds of trouble show up?
A product nobody authorised, the right product running from a user folder, and the right name with the wrong signature.
From the lesson Remote support security and scam response
-
How can a user check that a caller really is the help desk?
The desk gives a ticket number the user can look up and a number the user already has for ringing back. Only then does the desk ask the user to prove who they are.
From the lesson Remote support security and scam response
-
What does number matching stop, and what can it not stop?
It stops a blind tap on a push prompt, but not a caller who gets the user to read the number out.
From the lesson Remote support security and scam response
-
In what order does the first hour go after a scam caller got into a PC?
Network, security team, session, money, leftovers, passwords, scan. The clean-up a desk wants to start with is the only part that can safely wait.
From the lesson Remote support security and scam response
-
What is a security incident judged on, and what is the desk's part?
On access, spread and what must be told, not only on getting the service back. The desk's part is to spot it, report it, contain it as policy allows, and pass the investigation on.
From the lesson Security incidents, evidence and privacy duties
-
How does the desk protect evidence on a device?
Write times down as they happen, disconnect the device rather than power it off, and leave it untouched. When evidence is collected, the most volatile is taken first.
From the lesson Security incidents, evidence and privacy duties
-
Why is memory collected before the disk?
Memory holds running programs, open connections and traces that malware keeps nowhere else, and all of it is lost when the power goes. RFC 3227's order of volatility collects the most fleeting first.
From the lesson Security incidents, evidence and privacy duties
-
What does a chain of custody record?
Who found, held, handled and transferred the evidence, with no gap between holders. Work on a copy of the drive, and fix a hash at collection so any later change shows.
From the lesson Security incidents, evidence and privacy duties
-
A technician finds prohibited content on a device. What do they do?
Stop, secure and escalate on the policy's path. Never open, copy or investigate it.
From the lesson Security incidents, evidence and privacy duties
-
Which clocks start when an incident is noticed in India?
A listed incident goes to CERT-In within 6 hours, and logs are kept in India for a rolling 180 days. Under the DPDP Rules, which bring their duties in step by step over eighteen months, a personal data breach is told to the regulator and, without delay, to each person affected. Write down the time you noticed it, with its offset.
From the lesson Security incidents, evidence and privacy duties
-
Which program runs a .bat, .ps1, .vbs, .sh and .py script?
cmd.exe runs .bat and .cmd, PowerShell runs .ps1, Windows Script Host runs .vbs and .js on Windows, a POSIX shell runs .sh, and an installed Python runs .py.
From the lesson Scripting for support: automate safely
-
A user double-clicks a .ps1 file from IT and nothing runs. Is PowerShell broken?
No. PowerShell refuses to run a script from a double-click, or from its bare name, as a safety feature. Confirm the script really came from IT, then run it the supported way.
From the lesson Scripting for support: automate safely
-
How do scripts in different languages report one inventory the same way?
Decide the output keys first, then make every script print exactly those keys, so one ticket field or one spreadsheet column reads every machine.
From the lesson Scripting for support: automate safely
-
Why does a disk check compare exact numbers and round only for people?
Convert every reading to the same unit and compare the exact values; rounding first can let a machine with 14.6 GiB left pass a 15 GiB floor.
From the lesson Scripting for support: automate safely
-
Which lines make a copied script dangerous?
An empty variable in front of /*, a download piped into a shell, a password written into the file, and a loop without a limit. ShellCheck flags the first, where sh -n does not.
From the lesson Scripting for support: automate safely
-
How does a script move from your desk to every machine?
In widening circles: read it, lint it, dry-run it with -WhatIf, run it in a sandbox or lab VM, then on one device, a pilot ring and everyone, with a non-zero exit code on failure and a transcript of what changed.
From the lesson Scripting for support: automate safely
-
What does PowerShell's execution policy protect against?
Accidents only: it is not a security boundary. Signing, application control and standard accounts are the real controls, and .vbs logon scripts are rewritten in PowerShell because VBScript is deprecated.
From the lesson Scripting for support: automate safely
-
What do a VM, Windows Sandbox, a container and a Cloud PC each give you?
A VM isolates a whole operating system with its own kernel. Windows Sandbox is a throwaway desktop that keeps nothing. A container packages one app on a shared kernel. A Cloud PC is a hosted desktop that keeps everything, like a laptop.
From the lesson Virtual machines, VDI and cloud services
-
A colleague says the training VMs are safe because they have snapshots. Are they?
No. A snapshot lives on the same storage as the VM, so losing that disk or host loses the VM and every snapshot together. It is a way back around one risky change, deleted once the change is proven.
From the lesson Virtual machines, VDI and cloud services
-
A Cloud PC is slow. In what order do you check it?
From the user outwards: what exactly is slow, the user's own network, the client app, service health, then the licence, and only then the team that runs the service.
From the lesson Virtual machines, VDI and cloud services
-
How does NIST describe cloud services?
By five essential traits, three service models (IaaS, PaaS and SaaS) and four deployment models (public, private, hybrid and community).
From the lesson Virtual machines, VDI and cloud services
-
How many of the 10 layers does the customer look after in IaaS, PaaS and SaaS?
7 in IaaS, 4 in PaaS and 3 in SaaS. In every model the organisation keeps its data, its settings and its accounts.
From the lesson Virtual machines, VDI and cloud services
-
Where does a SaaS ticket start?
With the provider's service health page, the user's licence and the type of the sharing link, before anyone's device. In the lesson's sample morning, eight of the twelve tickets were known issues.
From the lesson Virtual machines, VDI and cloud services
-
Which ports does a mail app use to send and to read mail?
Submission on 587 with STARTTLS or on 465 with implicit TLS; reading with IMAP on 993 or POP3 on 995. Port 25 is for servers relaying mail between themselves.
From the lesson Email, calendars and meeting apps
-
What is the difference between ports 465 and 587 for sending mail?
On 587 the connection starts in clear text and the app asks for STARTTLS before it signs in. On 465 TLS starts from the first byte, which RFC 8314 calls implicit TLS.
From the lesson Email, calendars and meeting apps
-
A mail app keeps asking for an Exchange Online mailbox's password, and the right one changes nothing. What is going on?
It is using Basic authentication, which Exchange Online no longer accepts and nobody can switch back on. Use a current app, add the account again with modern sign-in, or replace the app.
From the lesson Email, calendars and meeting apps
-
How do you read a message's route and find its slowest hop?
Read the Received lines from the bottom up: each server adds one with a time, so the biggest gap between two neighbouring lines is the slowest hop. Only the Authentication-Results header written by the receiving server counts.
From the lesson Email, calendars and meeting apps
-
SPF and DKIM both pass for a sending service, yet DMARC fails. Why?
DMARC passes only when a domain that SPF or DKIM confirmed aligns with the From domain. The service needs an aligned DKIM signature or envelope sender, not an extra include in the From domain's SPF record.
From the lesson Email, calendars and meeting apps
-
Why does a recurring meeting shift for people in another country?
It keeps the local time of the zone it was created in, so when that zone's clocks change, it moves by an hour for people whose own clocks stay put.
From the lesson Email, calendars and meeting apps
-
In what order are camera, microphone and screen-sharing faults checked?
The app's settings first, then the operating system's privacy permissions and the browser's site permissions, and the hardware on its own last.
From the lesson Email, calendars and meeting apps
-
Which four formats do help desk interviews use?
A troubleshooting walk-through, a customer-service role play, a ticket-writing test and questions on the basics.
From the lesson Help desk interviews and a lab portfolio
-
Why do interviewers ask you to talk a fix through out loud?
The answer alone does not show how you work. Talking it through shows whether you scope first, test the likely and cheap causes, change one thing at a time and check the fix with the user.
From the lesson Help desk interviews and a lab portfolio
-
In what order does a strong troubleshooting walk-through go?
Scope first, then the likely and cheap test, one change at a time, a check with the user, then the note and the point where you would escalate.
From the lesson Help desk interviews and a lab portfolio
-
What do role plays and ticket-writing tests both reward?
Order. A good ticket turns each feeling in the user's message into a fact the next person can act on.
From the lesson Help desk interviews and a lab portfolio
-
What makes a lab portfolio safe to publish?
Three to five write-ups with the same five sections, published only after every name, address, serial number and public IP has been replaced with a reserved example or redacted.
From the lesson Help desk interviews and a lab portfolio
-
What do you compare between support certifications, and what do you match before booking?
The exams, pass marks, cost and how long a version lasts. Match the exam code you study for with the one you book, and read the body's own page for the current price.
From the lesson Help desk interviews and a lab portfolio
-
How do you choose your next step after this track?
From what your own write-ups keep returning to. It is the next thing to learn, not a promise of a job.
From the lesson Help desk interviews and a lab portfolio