Common Scenarios
Eight tickets that cover most of L1/L2 support. For each: how to narrow it, what to check, and what to say in an interview.
1. "I can't log in"
Scope first: just this user, or everyone? If everyone, the domain controller or the network is down — do not start with the password.
net user <name> # locked? disabled? expired?
net user <name> /active:yes # unlock
net user <name> * # reset
w32tm /resync # clock skew breaks Kerberos
klist /purge # stale tickets
nltest /dsgetdc:corp.local # can it reach a DC?
If they can log in offline, the credentials are cached and the account is actually fine. The fault only appears on the network.
Full decision tree: Active Directory.
2. "The computer is slow"
Get-Process | Sort-Object CPU -Descending | Select-Object -First 10
Get-CimInstance Win32_LogicalDisk -Filter "DeviceID='C:'" |
Select-Object @{n='FreeGB';e={[math]::Round($_.FreeSpace/1GB,1)}}
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus
perfmon /rel
| Finding | Cause | Action |
|---|---|---|
| Disk at 100% | Failing disk or thrashing | Check Get-PhysicalDisk, events 7/51 |
| Free space under 10% | Windows needs headroom | Free space first |
| One process eating CPU | Malware, or a runaway app | Identify, then decide |
| Freezes, high hard-fault time | Failing RAM | MemTest |
| Slow only after boot | Startup items, AV scan, indexer | Task Manager → Startup tab |
"Slow compared to when?" An always-slow machine is a spec problem. A recently-slow machine is a change problem. That distinction halves the search space.
3. "The whole floor has no internet"
Scope says infrastructure, not user.
# On a switch, check the uplink
show interfaces status
show interfaces description
show interfaces | include error|down
| Symptom | Likely cause |
|---|---|
| All ports in one VLAN down | Switch, SVI, or the uplink |
| Link flapping | Failing cable, or a loop |
| DHCP failing across a VLAN | Relay/server, or trunk not carrying that VLAN |
| Worked, stopped, came back ~30s later | STP reconvergence |
| Only one user | Their machine, not the floor |
A switch reboot affects everyone and destroys the state that tells you what happened. Check logs, then escalate.
4. "My VPN won't connect"
ipconfig /all # is it even getting an address?
nslookup vpn.corp.local # does the name resolve?
Test-NetConnection vpn.corp.local -Port 443 # or 500/4500 for IPsec
| Cause | Test |
|---|---|
| Wrong credentials | Auth log on the VPN gateway |
| DNS not resolving the VPN host | nslookup |
| Firewall blocking 500/4500 | Test-NetConnection times out |
| Certificate expired | Gateway logs, client error |
| Saved credentials stale | Delete the profile, reconnect |
| Time skew | w32tm /resync — TLS and Kerberos both care |
SSL/TLS client VPN (usually 443), IPsec site-to-site (IKE on 500, NAT-T on 4500), L2TP over IPsec (1701 inside the tunnel), WireGuard (51820/UDP). Saying "I'd check which protocol it uses and test that port" is a strong answer.
5. "I can't open the shared drive"
net use # current mappings
net use Z: \\fileserver\Projects # try the mapping
Test-NetConnection fileserver -Port 445
Test-ADComputer -ComputerName PC-ENG-07 -Server dc01.corp.local
| Symptom | Cause |
|---|---|
System error 53 | Path not found — share name wrong or doesn't exist |
System error 67 | Share exists, path wrong |
System error 86 | Invalid password |
| Works by IP, not by name | DNS |
| Works for others, not this user | Permissions or mapping, not connectivity |
| Mapped but empty | Permissions |
With both NTFS and share permissions set, the more restrictive wins. And a domain user needs the computer account to have access to the share — the computer object, not just the user.
6. "Outlook says the server is unavailable"
Test-NetConnection mail.corp.local -Port 443
Test-NetConnection mail.corp.local -Port 587
| Symptom | Likely cause |
|---|---|
| DNS fails | Name resolution — see DNS |
| Port closed | Exchange or the mail gateway is down |
| Works in OWA only | The Outlook profile is broken, not the server |
| Works for everyone | Server side — escalate |
| Works at home only | Split DNS or VPN routing |
7. "The PC keeps crashing / blue-screening"
Get-WinEvent -FilterHashtable @{LogName='System'; Id=41,1001} -MaxEvents 20
Get-PhysicalDisk | Select-Object FriendlyName, HealthStatus
sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth
| Event | Meaning |
|---|---|
| BugCheck 1001 | The actual BSOD — read the stop code |
| Kernel-Power 41 | Unexpected shutdown |
| WHEA-Logger | Hardware error — CPU, RAM or PCIe |
| Disk 7 / 51 | Storage failing |
STOP: 0x0000007B means boot files or drivers changed incorrectly —
commonly a bad driver or a failed update. Boot to Last Known Good or Safe
Mode and roll back.
8. "Antivirus is blocking a business application"
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled
Get-MpThreatDetection | Select-Object InitialDetectionTime, Resources
| Question | Why |
|---|---|
| Is it detection or prevention? | Different fix |
| Is it quarantined, or blocked at launch? | Quarantine can be restored |
| Is it a known false positive? | Check the vendor's exclusions |
| Is the app signed and from a known source? | Risk decision |
| Has an exclusion been approved? | Must be a documented exception |
Excluding a whole folder, drive or extension is how ransomware arrives unopposed. Exclude a specific file, and record who approved it. Saying this unprompted is a strong security signal.