01
What exactly is failing?
Turn “nothing works” into a specific symptom: cannot sign in, cannot open one folder, Outlook is not updating, one printer fails, one website will not load.
Everyday IT · Troubleshooting & Escalation
Stop guessing. Narrow the problem.
Good troubleshooting is less about knowing every command and more about asking the right question in the right order.Scope it. Test one layer. Make one change. Verify. Escalate when the blast radius gets bigger than the ticket.
The everyday troubleshooting framework
Use this before reaching for a random fix.
02
One user or everyone?
Scope immediately. One user points toward account, device, profile, or permission. Multiple users point toward service, server, network, policy, or shared infrastructure.
03
What changed?
Ask about passwords, device swaps, updates, moves, permission changes, ISP issues, reboots, new software, maintenance, and whether the problem ever worked.
04
Test the simplest layer first
Check identity, connectivity, service state, permissions, and client state in a logical order. Do not rebuild a profile before proving the cloud service is healthy.
Use comparison to isolate the layer
A working example is one of the fastest troubleshooting tools available.
Same user, different device
Does the account work elsewhere?
If the same user succeeds on another device, focus on the original workstation, profile, client, network path, or cached state.
Different user, same device
Does someone else work here?
If another user succeeds on the same device, focus on the affected user's account, groups, profile, license, or authentication state.
Browser vs desktop
Can the web version work?
Browser success can prove cloud identity and service access while pointing toward Outlook, OneDrive, Teams, or another desktop client.
Peer comparison
What is different from someone working?
Compare groups, licenses, client version, mapped paths, printer port, network, policy, or device state. Look for differences that explain the symptom.
Make the smallest useful change
Discovery and remediation should be separate thoughts.
Before
Capture the current state
Know what was broken and what the important settings looked like before you change them. Screenshots, commands, timestamps, and notes make rollback and escalation easier.
Change
One reason, one action
Prefer a targeted change that tests your theory. If you change password, profile, DNS, permissions, and client settings at once, you may never know what fixed it.
After
Re-test the original symptom
Do not call a ticket resolved because a command completed successfully. Verify the user can perform the thing that originally failed.
Document
Leave the next tech evidence
Record the symptom, checks, relevant findings, action taken, and verification. Good notes are part of the fix.
When to stop and escalate
Escalation is good judgment when the risk or scope changes.
Scope
Multiple users or business-wide impact
If the issue affects a department, site, server, tenant, or shared service, treat it differently from an isolated workstation ticket.
Privilege
The fix requires elevated or broad access
Domain Admin, Global Administrator, firewall, security-policy, or broad permission changes deserve review and authorization.
Data
There is a risk of loss or overwrite
Stop before deleting, resetting, mass-moving, restoring, unlinking, or overwriting data unless you understand the recovery path.
Security
The symptom may be compromise
Unexpected MFA prompts, suspicious sign-ins, mailbox rules, unknown forwarding, malware indicators, or privileged account anomalies should move into the security process.
Infrastructure
The change touches core systems
Domain controllers, DNS, DHCP, firewalls, mail connectors, Conditional Access, routing, backups, hypervisors, and production servers are not casual troubleshooting surfaces.
Uncertainty
You cannot explain the expected outcome
If you do not know what a change will affect or how to reverse it, stop and get another set of eyes.
Escalation is not failure. Uncontrolled guessing is.
The goal is to solve the problem without creating a second incident.