This page needs a newer browser to run its tools. You can still read everything here.

IT Support & Help Desk Fundamentals Module 5

Windows client administration interview questions

Interview questions on windows client administration: short warm-ups, then what each harder question tests, the first step of a good answer and its follow-ups.

18 questions: 6 warm-ups and 12 with model answers · Levels: Fresher to senior

Warm-up questions

Short questions with short answers, each answered in full.

Fresher

For a technician on a call, how are Settings and Control Panel different?

Answered in the lesson Windows admin tools: Settings, MMC, msinfo32
Fresher

What does ipconfig /flushdns actually change, and what does it leave alone?

Answered in the lesson Windows command line for support work
Fresher to mid

On a Windows PC, how does a Microsoft account differ from a work or school account?

Answered in the lesson Windows accounts, UAC and user profiles
Fresher

A device shows Code 28 in Device Manager — what does that tell you, and what is your first move?

Answered in the lesson Windows apps, drivers and Device Manager
Fresher to mid

What does Kernel-Power event 41 prove, and what does it not prove?

Answered in the lesson Slow PCs, crashes and Event Viewer
Fresher to mid

When SmartScreen warns about a download, what has it checked, and what should the user do next?

Answered in the lesson Windows Security: Defender, firewall, BitLocker

Questions with model answers

What each question tests, the first step of a good answer and the follow-ups to expect.

Mid to senior

A vendor's support article says to set a REG_DWORD value under HKLM\SOFTWARE\ExampleCo\Agent on every PC that runs their agent, 40 office PCs in all, to stop a crash at sign-in. How do you plan the change, and what do you do before the first PC is touched?
What it tests

Treating one registry value on 40 machines as a controlled change: checking the source, preferring a supported setting, backing up every PC, piloting, deploying centrally and keeping a way back.

First step

Read the article on the vendor's own site and check that it names the agent version installed here. Then ask the vendor for a supported way to set the same thing, such as an agent setting or a policy template, because a policy is applied, reported and removed in one place. Only then plan the registry route, starting with one pilot PC whose key you export before anything changes.
Follow-ups
- The agent is a 32-bit program on 64-bit Windows. Where does it read its key?
- How do you keep a way back on all 40 PCs, not only on the pilot?
- Three PCs still crash after the change. What do you do next?
From the lesson Windows admin tools: Settings, MMC, msinfo32
Model answer, Pro. Model answers open with any pass; prices are in the notice on this page.
Opening the model answers with your pass…
Model answers open with any MySmartCoPilot pass.
Pro pass · 1 week₹79$2.99
30 days₹179$5.99
1 year₹1,699$45
One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.
Passes can’t be bought right now, so the model answers can’t be opened at the moment. If you have a pass, enter your licence key.
Choose a pass I have a licence key
It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Fresher to mid

On a managed office PC running Windows 11 Enterprise, the office manager types eventvwr.msc: a console window opens, but Event Viewer is not in it, and mmc on its own does not open at all. Both work when you sign in on the same PC. What is going on, and what do you do?
What it tests

Reading a symptom that follows the user rather than the PC, knowing that snap-ins can be restricted per user by policy, and fixing access through the policy owner instead of working round the control.

First step

Compare the two sign-ins. The same console files work for you on the same PC, so Windows and the files are fine and the difference is the user. On a managed PC that points at user policy, so read which policies reach the office manager's account, for example with gpresult /r run as that user, before you change anything.
Follow-ups
- The office manager needs Event Viewer for their job. How do they get it?
- Why not remove the restriction from the registry on this PC?
- How would the case differ on a PC running Windows 11 Home?
From the lesson Windows admin tools: Settings, MMC, msinfo32
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A help desk runs sfc /scannow on a shared PC that must stay available during working hours. The scan ends with "Windows Resource Protection found corrupt files but was unable to fix some of them." What do you do next, and in what order?
What it tests

Rebuilding the component store with DISM first, re-running sfc, reading the CBS log for the file names, and the trade-off between an online scan and a scheduled offline repair on a busy PC.

First step

Run DISM /Online /Cleanup-Image /RestoreHealth from an elevated prompt so that sfc has a clean store to copy from; without that step the second sfc hits the same files it could not replace the first time.
Follow-ups
- Which file in the CBS log tells you which files sfc could not repair, and how do you make a readable copy?
- How would you let the users keep working while this runs?
- When would you move from an online repair to an offline one, booted from media?
- What is the chkdsk step on the same PC, and when do you add it?
From the lesson Windows command line for support work
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Fresher to mid

Two users share one Windows PC. Z:\, mapped by net use at sign-in to \\fileserver\share, is there for one and missing for the other. Both sign in with their own domain accounts. Where do you look first, and what do you check in order?
What it tests

That mapped drives are per-user, how Group Policy or a script writes the mapping, the credential cache and DNS, and how to tell a mapping problem from a permissions one.

First step

Sign in as the user whose drive is missing and run net use with no switches; if Z:\ is not there, the mapping never applied for this account, which is a different problem from a mapping that applied but shows an access error.
Follow-ups
- Which Group Policy report confirms whether a Preferences Drive Map applied for this user?
- How do you tell a credential problem from a permissions one at the share?
- When would you refresh the mapping with gpupdate /force and sign out, rather than deleting and remapping?
- What does Test-NetConnection -ComputerName fileserver -Port 445 rule out before you touch the share permissions?
From the lesson Windows command line for support work
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A developer on a standard account asks you to make their daily account a local administrator, because they install a tool most weeks and the UAC credential prompt slows them down. What do you do, and what would you offer instead?
What it tests

Keeping the daily account standard, offering a separate admin account or a managed install path, weighing Administrator protection and LAPS, and refusing a standing local-admin daily account without a safer alternative.

First step

Do not convert the daily account. Confirm what they actually install and how often, then offer the least-privilege path that still unblocks them: a separate admin account they elevate with, or a managed way to install the few tools they need, so routine work stays on the medium-integrity standard token.
Follow-ups
- When is a separate admin account better than elevating the daily one?
- How does Administrator protection change this request?
- If they do get local admin, how do you limit the blast radius?
From the lesson Windows accounts, UAC and user profiles
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

On a shared counter PC, several users now sign in to a blank desktop with a temporary profile, after the system drive filled up overnight. Get them working again without losing data, and stop it recurring.
What it tests

Warning users that temporary-profile work is lost at sign-out, testing the full drive before rebuilding, rescuing data into a working profile with the old folder kept, and preventing recurrence on a shared machine.

First step

Tell anyone on a temporary profile that work saved there is lost at sign-out, and copy anything new to external storage. Then test the change that came before the symptom: free space on the full drive, have one user sign out and in, and read the User Profile Service events before you rebuild anything.
Follow-ups
- The real profile still will not load after space is freed; what next?
- How do you copy the data across safely?
- What stops a shared PC from filling up again?
From the lesson Windows accounts, UAC and user profiles
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 5 minutes
Mid to senior

A label printer works on every Intel laptop in the office but does nothing on a new Windows on Arm laptop, where a colleague's x64 apps run fine. How would you work out why, and what would you do about it?
What it tests

Knowing that emulation runs user-mode apps but not drivers, so a kernel-mode driver must be Arm64, and checking the maker's driver downloads before promising the hardware will work.

First step

Separate apps from drivers. The x64 apps run because Windows on Arm emulates user-mode code with Prism. A printer needs a kernel-mode driver, which emulation does not cover, so confirm whether the maker ships an Arm64 driver for that model before anything else.
Follow-ups
- Why do the x64 apps run when the printer driver does not?
- What exactly would you check on the maker's site or tool?
- If no Arm64 driver exists, what are the options for the user?
- How would you stop this surprising the team on the next Arm rollout?
From the lesson Windows apps, drivers and Device Manager
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

An overnight "winget upgrade --all" on 40 PCs updated a line-of-business app to a version that crashes on launch. Staff start work in two hours. What do you do, and how do you stop it happening again?
What it tests

Restoring a known-good version fast across many PCs, pinning the app so it stops auto-upgrading, and moving app updates to a staged, controlled process instead of a blanket upgrade-all.

First step

Stop the bleeding: get a known-good version back on the PCs before staff arrive. Identify the last working version, install it with winget install and its exact version, and pin the app so the next run leaves it alone, then fix the process.
Follow-ups
- How do you get the working version back on 40 PCs quickly?
- How do you keep WinGet from upgrading this app again?
- What should the update process have looked like instead?
- How would you confirm every one of the 40 PCs is back to working?
From the lesson Windows apps, drivers and Device Manager
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

Ten PCs in your organisation blue-screen with the same stop code after a Windows Update installs a new graphics driver. What do you do?
What it tests

Isolating the driver as the cause, rolling back at scale, and preventing the update from reinstalling.

First step

Check the stop code and any driver file it names. If all ten PCs have the same driver version installed by the same update, the driver is the likely cause. Roll back the driver on one PC first to confirm.
Follow-ups
- How do you roll back the driver on all affected PCs efficiently?
- How do you prevent the update from reinstalling the driver?
- What if some PCs cannot boot to roll back the driver?
- How do you report this to your organisation and to Microsoft?
From the lesson Slow PCs, crashes and Event Viewer
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

Users in one branch office report that sign-ins fail every morning for the first hour, then start working. What do you check?
What it tests

Considering clock drift, network issues, and scheduled tasks that affect authentication.

First step

Clock skew is the most common cause of intermittent Kerberos failures. Check whether the branch office PCs are syncing time correctly with w32tm /query /status. If the NTP server is unreachable overnight, clocks can drift past the 5-minute tolerance by morning.
Follow-ups
- What if the clocks are correct but the domain controller is unreachable in the morning?
- How do you fix the NTP configuration for the branch?
- What logs would you check on the domain controller?
- Could a scheduled task or backup be causing the issue?
From the lesson Slow PCs, crashes and Event Viewer
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 3 minutes
Mid to senior

A user's laptop shows real-time protection off again every morning, although you turned it back on the day before. How do you find out what keeps turning it off, and what do you fix?
What it tests

Knowing that real-time protection does not stay off by itself, and checking for another antivirus, a policy and tamper protection before blaming the user, reinstalling or scanning blindly.

First step

Read the state before changing anything: Get-MpComputerStatus for AMRunningMode and RealTimeProtectionEnabled, and Windows Security for the antivirus that is registered. Another antivirus or a management policy explains most cases; a change that neither explains is treated as a possible infection.
Follow-ups
- What does it tell you if another antivirus is registered, or Defender is not in Normal mode?
- How would a Group Policy or management setting show up, and who owns the change?
- What does tamper protection change in this case?
- When do you treat it as a possible infection and escalate?
From the lesson Windows Security: Defender, firewall, BitLocker
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes
Mid to senior

A team manager asks you to turn BitLocker off on the team's laptops, because after a firmware update three people sat at the recovery screen for an hour. What do you do?
What it tests

Keeping encryption on while fixing what actually went wrong: why the update triggered recovery, how planned updates avoid it, and how stored keys make a recovery take minutes.

First step

Do not turn encryption off: it is what keeps a lost laptop's data unreadable, and removing it is not a decision for the manager or the help desk alone. Find out why recovery was triggered and why finding three keys took an hour, because both can be fixed.
Follow-ups
- Why can a firmware update make BitLocker ask for the recovery key?
- How do you keep the next planned update from triggering recovery?
- What makes a recovery take minutes instead of an hour?
- Who has to agree if encryption on these laptops really must change?
From the lesson Windows Security: Defender, firewall, BitLocker
Model answer, Pro.
In the answer:
- Model answer
- Follow-up answers
- Common mistakes
- Rubric
- Variants
- about 4 minutes

The lessons of this module

Windows admin tools: Settings, MMC, msinfo32 Free lesson, Pro answers: 25 minutes
Windows command line for support work Free lesson, Pro answers: 20 minutes
Windows accounts, UAC and user profiles Free lesson, Pro answers: 25 minutes
Windows apps, drivers and Device Manager Free lesson, Pro answers: 20 minutes
Slow PCs, crashes and Event Viewer Free lesson, Pro answers: 20 minutes
Windows Security: Defender, firewall, BitLocker Free lesson, Pro answers: 25 minutes

All IT Support & Help Desk Fundamentals interview questions · The IT Support & Help Desk Fundamentals track

Warm-up questions

For a technician on a call, how are Settings and Control Panel different?

What does ipconfig /flushdns actually change, and what does it leave alone?

On a Windows PC, how does a Microsoft account differ from a work or school account?

A device shows Code 28 in Device Manager — what does that tell you, and what is your first move?

What does Kernel-Power event 41 prove, and what does it not prove?

When SmartScreen warns about a download, what has it checked, and what should the user do next?

Questions with model answers

A vendor's support article says to set a REG_DWORD value under HKLM\SOFTWARE\ExampleCo\Agent on every PC that runs their agent, 40 office PCs in all, to stop a crash at sign-in. How do you plan the change, and what do you do before the first PC is touched?

On a managed office PC running Windows 11 Enterprise, the office manager types eventvwr.msc: a console window opens, but Event Viewer is not in it, and mmc on its own does not open at all. Both work when you sign in on the same PC. What is going on, and what do you do?

A help desk runs sfc /scannow on a shared PC that must stay available during working hours. The scan ends with "Windows Resource Protection found corrupt files but was unable to fix some of them." What do you do next, and in what order?

Two users share one Windows PC. Z:\, mapped by net use at sign-in to \\fileserver\share, is there for one and missing for the other. Both sign in with their own domain accounts. Where do you look first, and what do you check in order?

A developer on a standard account asks you to make their daily account a local administrator, because they install a tool most weeks and the UAC credential prompt slows them down. What do you do, and what would you offer instead?

On a shared counter PC, several users now sign in to a blank desktop with a temporary profile, after the system drive filled up overnight. Get them working again without losing data, and stop it recurring.

A label printer works on every Intel laptop in the office but does nothing on a new Windows on Arm laptop, where a colleague's x64 apps run fine. How would you work out why, and what would you do about it?

An overnight "winget upgrade --all" on 40 PCs updated a line-of-business app to a version that crashes on launch. Staff start work in two hours. What do you do, and how do you stop it happening again?

Ten PCs in your organisation blue-screen with the same stop code after a Windows Update installs a new graphics driver. What do you do?

Users in one branch office report that sign-ins fail every morning for the first hour, then start working. What do you check?

A user's laptop shows real-time protection off again every morning, although you turned it back on the day before. How do you find out what keeps turning it off, and what do you fix?

A team manager asks you to turn BitLocker off on the team's laptops, because after a firmware update three people sat at the recovery screen for an hour. What do you do?