IT support quick reference

38 topics, one line each, in the order Hone teaches them.

Hone is a place to practise a career, one idea a day. This sheet is the whole IT support track at a glance: every idea it covers, in the order they are taught, one line each. It is a map rather than a lesson. Read opens the full explanation of an idea; Practise gives you a question on it. Both are free, and reading needs no account at all.

From the first ticket to a closed incident · The desk

what a ticket isA ticket is one written record of one problem: who has it, what they saw, on which machine, since when, and what has been done about it so far. The number is how everyone, including the person who reported it, can find it again. Read: A ticket is a promise with a number on it · Practise what a ticket is

incident, request, problemAn incident is something that was working and is not. A service request is somebody asking for a thing that is not broken: a new account, a second monitor. A problem is the cause behind repeated incidents, and it gets its own record so somebody hunts the cause while the desk keeps restoring service. Read: Incident, service request, problem: three words for three different jobs · Practise incident, request, problem

priority from impact and urgencyImpact is how many people or how much of the business is affected. Urgency is how soon the harm arrives. Put the two on a small matrix and read off the priority: impact plus urgency minus one, with one the highest, on a desk that scores both from one (high) to three (low). Read: Priority is impact times urgency, not who is shouting · Practise priority from impact and urgency

the SLA clockA service level agreement says how fast the desk promises to respond and to resolve, by priority. The clock starts when the ticket is opened; a breach is when the promised time passes and the ticket is still open. Time remaining is the target minus the time already gone. Read: The SLA is a clock, and a breach is the clock running out · Practise the SLA clock

escalating a ticketEscalation is moving a ticket to somebody with more access, more knowledge or more authority, at the moment your own runs out. Functional escalation goes to a specialist team; hierarchical escalation goes to a manager because the clock or the impact needs a decision. Read: Escalation: handing it up, with everything you found · Practise escalating a ticket

the first replyThe first message back to a user does three things in three sentences: it says what you understood the problem to be, what you will do first, and when they will hear from you again. If you need one thing from them, ask for it in a fourth. Read: The first reply: what you understood, what you will do, when they will hear · Practise the first reply

From the first ticket to a closed incident · Troubleshooting method

the six-step methodIdentify the problem, form a theory of the probable cause, test the theory, plan the fix, implement it, verify it worked, and document everything. Six steps (the last two are one line), always in that order, so a bad morning cannot make you skip the one that mattered. Read: Six steps, in the same order every time · Practise the six-step method

ask what changedA machine that worked yesterday and not today has had something change in between: an update, a move, a new program, a new cable, a new password, a new setting. Find the change and you have usually found the cause. Read: What changed? The question that finds half of all faults · Practise ask what changed

one change at a timeChange one thing, test, and only then change the next. If you change three things and it works, you have three suspects and no answer; if you change one and it works, you have a cause, a fix note and a knowledge article. Read: One change at a time, or you will never know which one worked · Practise one change at a time

reproduce it firstReproduce the fault: do exactly what the user did and watch it fail with your own eyes. A fault you can trigger is a fault you can test a theory against; a fault you have only heard about is a story. Read: Make it happen on purpose before you try to make it stop · Practise reproduce it first

the order you checkWhen something cannot reach something, check the layers in the order they depend on each other: power, then the cable, then the link light, then the address, then the name, then the service. Each one only makes sense if the one before it passed. Read: Check from the wall outward: power, cable, link, address, name, service · Practise the order you check

when to stopStop troubleshooting and escalate when any one of three things is true: your time box is up, the next step needs access you do not have, or the next step could lose data. Stopping at the rule is not giving up; it is the rule. Read: When to stop: the time box, the access line, and the data · Practise when to stop

From the first ticket to a closed incident · Hardware and the OS

POST and the boot orderWhen power arrives, the firmware runs a power-on self-test (POST) of the memory, the processor and the basic hardware, then reads the boot order and starts the first device on the list that has something to start. The operating system is not involved in any of that. Read: POST and the boot order: what a machine does before the OS exists · Practise POST and the boot order

RAM and storageRAM (memory) holds what the machine is working on right now and empties when the power goes. Storage (the disk) holds everything the machine keeps, whether it is on or off. 'Out of memory' and 'the disk is full' are different faults with different fixes. Read: RAM is the desk; storage is the filing cabinet · Practise RAM and storage

a full diskA full disk is fixed by finding where the space went and giving the biggest, safest things back first: the recycle bin, temporary files and update leftovers, then the user's own large files moved to the file share, and only then anything that needs a second opinion. Read: The disk is full: find the big things, in order · Practise a full disk

a slow machineSlow has a cause you can see: a pending restart, a process eating the processor, RAM full, the disk at 100 percent, a nearly full disk, or a long list of programs starting with the machine. The task monitor shows which, and the fix is the one whose number is red. Read: A slow machine: measure before you blame · Practise a slow machine

safe mode and driversA driver is the small program the operating system uses to talk to one piece of hardware. Safe mode starts the operating system with only the drivers it cannot run without, and no third-party programs. If the fault is gone in safe mode, the cause is something safe mode left out: a driver or a program, not the OS itself. Read: Safe mode: the operating system with nothing extra loaded · Practise safe mode and drivers

a printer that will not printA print job leaves the program, sits in the computer's queue, is handed to the spooler service, crosses the network to the printer, and is put on paper. A printer 'that will not print' has stopped at exactly one of those places, and the checks go from the cheapest to the most invasive: the printer's own panel, the queue, the printer's own test page, the network, the spooler. Read: A printer that will not print: the queue, the panel, the wire, the spooler · Practise a printer that will not print

From the first ticket to a closed incident · Networking numbers

IP address and subnet maskAn IPv4 address is 32 bits written as four numbers, 0 to 255 each. The subnet mask says how many of those bits, from the left, name the network (the street) and how many are left to name the host (the house). A mask of 255.255.255.0 is 24 ones then 8 zeros, written /24. Read: An IP address is a street and a house; the mask says where the street ends · Practise IP address and subnet mask

usable hosts in a subnetA /n network has 32 − n host bits, so 2^(32 − n) addresses. Two of them are spoken for, the network address and the broadcast, so usable hosts = 2^(32 − n) − 2. Read: How many machines fit: two to the host bits, minus two · Practise usable hosts in a subnet

is it on my networkTake the mask's last non-255 octet away from 256 and you get the block size; the network addresses in that octet are the multiples of the block size. A host's network is the largest multiple at or below its number. Two hosts with the same network address can talk directly; two with different ones need the gateway. Read: Is this address on my network? Find the block, then the street · Practise is it on my network

DHCP and 169.254A machine usually does not know its own address; it asks, and a DHCP server answers with an address, a mask, a gateway and a DNS server, on loan for a lease time. An address beginning 169.254 is the machine's own fallback: it asked, and nobody answered. Read: DHCP: the address the network hands you, and what 169.254 means · Practise DHCP and 169.254

DNS and how a name is foundMachines talk in addresses; people type names. DNS turns the name into the address, and a name is looked up in order: the local cache first, then the hosts file, then the DNS server the machine was given, which asks upward until something knows. The first place with an answer wins, even if it is wrong. Read: DNS: a name is looked up in a fixed order · Practise DNS and how a name is found

ping, traceroute, nslookupping asks 'can I reach you, and how long does it take'. traceroute asks 'which hop stops answering on the way'. nslookup asks 'what address does this name turn into, and who told me'. Each one answers a different question, and the order you ask them is the order the fault is narrowed. Read: ping, then traceroute, then nslookup: three questions in order · Practise ping, traceroute, nslookup

how long a download takesFiles are measured in bytes and lines in bits per second, and there are 8 bits in a byte. Time in seconds = size in megabytes × 8 ÷ speed in megabits per second. Both use the same million, so no other conversion is needed. Read: How long a file takes: bytes times eight, over bits per second · Practise how long a download takes

latency and bandwidthBandwidth is how much data can move per second. Latency is how long one trip takes, there and back, whatever the size. A fast line to a far-away server can be slow for a page that needs many small round trips, and no amount of bandwidth shortens a round trip. Read: Bandwidth is how wide the pipe is; latency is how long the pipe is · Practise latency and bandwidth

From the first ticket to a closed incident · Accounts and security basics

the password resetA reset gives a stranger a way in if you do the reset before you know who is on the phone. The identity check comes first, every time, by the desk's agreed method: a call back on the number in the directory, a manager's confirmation, or an answer only the real person knows. Then a temporary password that must be changed at the next sign-in. Read: A password reset: prove who is asking before anything else · Practise the password reset

account lockoutAfter a set number of wrong passwords in a row, the account locks for a set time, so a guesser gets a handful of tries and not a million. Most lockouts are not a guesser: they are an old password still saved on a phone, a mapped drive or a scheduled task, trying again every few minutes. Read: Account lockout: why it locks, and what is usually still trying · Practise account lockout

least privilegeGive a person exactly the access their work needs and nothing more, through the group for their role rather than by hand. A user who is not an administrator cannot install the thing that would have wiped their machine; a user without the sales share cannot leak it, by accident or otherwise. Read: Least privilege: the access the job needs, and none it does not · Practise least privilege

MFAMulti-factor authentication asks for a second proof after the password: a code from a phone, a tap on an app, a hardware key. A stolen password on its own is then not enough to sign in, which is the single biggest reason phishing fails when it does. Read: MFA: something you know plus something you have · Practise MFA

spotting phishingA phishing message is one that pretends to be from somebody you trust so that you click, sign in or pay. Check the real sender address, not the display name; hover the link and read where it really goes; look for urgency or a threat; look for a request for a password, a code or a payment. Any one of those is enough to stop and report. Read: Phishing: the checks, in the order that catches it fastest · Practise spotting phishing

when a ticket is a security incidentA ticket becomes a security incident the moment there is a sign that somebody unauthorised has, or may have, access: a password typed into a fake page, a ransom note, a device nobody recognises, a sign-in from the wrong country, data sent to the wrong person. From that moment the job is to preserve, isolate and report, not to fix. Read: When a ticket stops being yours: the security incident · Practise when a ticket is a security incident

From the first ticket to a closed incident · Closing the loop

the fix noteA closed ticket carries three lines: the cause, the fix, and the verification. Not 'resolved', not 'fixed it', but the fault named, the change named, and the test that proved it, so the next person who sees the same thing has the answer in twenty seconds. Read: The fix note: what was wrong, what you did, how you know it worked · Practise the fix note

root cause and symptomA symptom is what is reported: the printer is offline every Monday. The root cause is the thing that, if changed, stops it recurring: the printer takes a new address from DHCP over the weekend and the print server still has the old one. Restore the symptom first; hunt the cause on the problem record; fix the cause through a change. Read: The symptom is what they saw; the root cause is why it keeps coming back · Practise root cause and symptom

the knowledge articleA knowledge article turns one fix into everybody's fix. It is titled by the symptom the user would type, and it has four parts: the symptom, the cause, the steps, and how to verify. It is written for the newest person on the desk, not for the person who wrote it. Read: The knowledge article: written so the next person finds it and can follow it · Practise the knowledge article

a change requestA change is anything that alters a system other people depend on. A change request writes down what will change and why, who it affects and what could go wrong, how it will be undone if it goes wrong, when it will happen, and who approved it. Then it is done in the window, verified, and closed. Read: A change request: what, why, what could go wrong, and how to put it back · Practise a change request

backups and 3-2-1A backup is a copy you can restore from. 3-2-1 is the rule that makes it survive: three copies of the data, on two different kinds of media, with one copy off-site. And a backup that has never been restored is a hope, not a backup. Read: Backups and 3-2-1: three copies, two kinds of media, one of them somewhere else · Practise backups and 3-2-1

RPO and RTORPO, the recovery point objective, is how much work, measured in time, the business can afford to lose: it is set by how often the backup runs. RTO, the recovery time objective, is how long the business can afford to be down: it is set by how long the restore takes. Both are promises, and both are numbers you can check against a clock. Read: RPO and RTO: how much you can lose, and how long you can be down · Practise RPO and RTO