Troubleshooting Playbooks

70 skills in this category.

AD CS / Internal PKI Issues

Diagnose internal certificate-authority problems on AD CS — enrollment and template failures, CRL/revocation-check breakage, and expiry cascades (CA or issued certs expiring) — from the failing enrollment error and CRL validity, never by reissuing blindly.

AD Replication Issues

Diagnose Active Directory replication failures — password changes not propagating, GPO version mismatches, logon oddities on one site, repadmin errors — by reading repadmin output first and treating destructive fixes as escalations.

Adobe Creative Cloud Licensing

Diagnose Adobe Creative Cloud licensing and sign-in problems — sign-in loops, "you don't have access", named-user vs shared-device confusion, and Admin Console assignment/entitlement gaps — from the Admin Console entitlement and the exact sign-in error, never by reinstalling first.

AutoCAD / Revit Issues

Diagnose Autodesk AutoCAD and Revit problems — network-license (FlexNet) checkout failures, drawing/model file corruption, and large-file / BIM worksharing (central model) sync issues — from the license-server log and the file's own recovery tools, never by deleting the central model.

Backup Restore Request

Intake and work a restore request — deleted files, prior versions, whole mailboxes or servers — pinning down exactly what/when/where, being honest about RPO limits, and verifying the restored data with the requester.

Browser Issues

Diagnose browser problems — one site broken, SSO loops, crashes, "works in Chrome but not Edge", extension chaos — via profile isolation and extension bisect instead of the clear-everything reflex.

BSOD Analysis

Triage Windows blue screens from the stop code and faulting module — never from folklore — correlating with recent changes (patches, drivers, new hardware) to split driver vs hardware vs storage causes.

Citrix Basics

First-line ladder for Citrix (Virtual Apps and Desktops / DaaS) tickets on desks without a Citrix specialist — VDA registration, StoreFront vs Workspace confusion, sessions hanging or apps not launching — knowing exactly what a generalist can check and when to hand to the Citrix admin.

DFS Namespace and Replication

Diagnose DFS problems — DFS-N referral failures and users hitting the wrong target, DFS-R replication backlog and conflicts, and staging-quota bottlenecks — from referral order, backlog counts, and DFSR event/health evidence, never by reinitializing replication blindly.

DHCP Server Issues

Diagnose DHCP problems — machines getting APIPA 169.254 addresses, wrong-subnet leases, scope exhaustion, failover pairs stuck, a rogue device answering — starting from what address the client actually received and which server gave it.

DMARC / SPF / DKIM Setup

Diagnose email authentication failures and produce correct SPF, DKIM, and DMARC record guidance — including new sending sources, alignment problems, and honest propagation expectations.

DNS & Domain Issues

Diagnose name-resolution and domain problems — "can't reach <site> by name", intranet names failing, records not updating, or a whole domain dark — by laddering client → resolver → authoritative, including domain-expiry checks.

Entra Connect Sync Errors

Diagnose Entra Connect (Azure AD Connect) sync problems — export errors, duplicate attributes, quarantined objects, users not appearing/updating in the cloud — reading the specific sync error before acting, and never widening or forcing sync runs blind.

Exchange Hybrid Issues

Diagnose Exchange hybrid problems — mail stuck between on-prem and Exchange Online, free/busy blank across the boundary, migrations stalled, "user not found" after moves — always starting from which side owns the mailbox.

Exchange On-Prem Mail Flow

Diagnose on-premises Exchange transport problems — messages stuck in queues, send/receive connector faults, TLS/cert failures, backpressure and disk-full transport stalls — from the queue viewer and protocol logs, not guesswork. For the hybrid seam use exchange-hybrid-issues.

Fax & eFax

Work fax tickets — analog line dead, ATA-based fax failing or corrupting pages, eFax/cloud-fax not sending or receiving — across the line / ATA-settings / service-portal matrix, with healthcare-grade reliability expectations taken seriously.

File Share Permissions

Diagnose "access denied" and wrong-access tickets on file shares — laddering effective permissions through share vs NTFS vs inheritance vs group membership — and fixing with least privilege, never with Everyone.

Group Policy Troubleshooting

Diagnose "GPO not applying" — drive mappings, lock screens, software installs, security settings missing — by reading gpresult output and walking the scope/filtering/inheritance ladder before touching any policy.

Hardware Diagnostics

Work suspected hardware faults on desktops and laptops — no-boot, random shutdowns, disk noises, battery/thermal complaints — through the POST/boot-stage ladder, storage and battery health reads, and warranty routing.

Hyper-V Clustering

Work Hyper-V failover cluster problems — quorum loss, CSV going redirected or offline, live-migration failures, node drain/pause not completing — from cluster and event evidence, never by failing VMs over blindly.

IIS Web App

Diagnose IIS-hosted web application failures — app pool crashes and rapid-fail protection, binding/SSL problems, HTTP 500/502/503 decoding, and recycling behaviour — from the app pool state, HTTP.sys/FREB logs, and the exact sub-status, never from the browser error alone.

Internal DNS Server Issues

Diagnose AD-integrated DNS problems — machines resolving stale/wrong internal names, external resolution dead but internal fine (or vice versa), records vanishing overnight — distinct from public DNS/domain records, which the dns-domain-issues playbook owns.

Label and Receipt Printers

Diagnose thermal label and receipt printers — Zebra/thermal/POS units — where the print language (ZPL/EPL/ESC-POS) and driver mode, the spooler, and network/connection are the usual faults, distinct from office laser/MFP printing (printer-troubleshooting) and POS-app issues (pos-system-issues).

LOB Application Framework

The generic playbook for any line-of-business application failure — dental/legal/accounting/ERP or anything vertical — identify the vendor and version, get the log, search known issues, and build a complete vendor-escalation package.

LOB Database Locks

Clear "record is locked by another user" and stuck-session tickets in line-of-business apps — identify the locking session through the app's own admin tooling and release it by the vendor-approved method only; never kill database sessions ad hoc.

M365 Sign-in Issues

Diagnose Microsoft 365 / Entra sign-in failures — blocked sign-ins, MFA loops, "keeps asking for password", device-trust errors — starting from the sign-in log error code, never from guesswork.

Mac Support

The Windows tech's ladder for Mac tickets — keychain password prompts, MDM enrollment, app permissions (TCC), FileVault — mapping Mac-specific causes so the tech doesn't apply Windows reflexes to macOS.

Mail Flow & Delivery

Diagnose email delivery problems — bounces/NDRs, mail not arriving, mail stuck outbound, one sender blocked — by decoding the NDR and tracing the message through the client's actual mail path.

Mobile Device & MDM

Work mobile device tickets — enrollment failures, mail profiles not arriving, compliance blocks, and lost/stolen device response — with all destructive device actions gated behind explicit approval.

Mobile Email Setup

Get corporate mail working on a phone — new-device setup, "my email stopped syncing", unexpected MDM enrollment prompts, native Mail vs Outlook app choices — with the BYOD consent boundary held firmly.

NetSuite ERP

Support NetSuite tickets safely as an MSP — a cloud ERP where the fixes are roles/permissions, saved-search/report visibility, and integration (SuiteScript/REST/CSV) errors, and where the account is the client's system of record — from the exact error and role context, never by editing financial config. Escalate customization to the NetSuite admin/partner.

Network Share Slowness

Diagnose slow file shares — copies crawl, folders take forever to open, one office is fine and another isn't — by laddering SMB version negotiation, signing/encryption overhead, antivirus filter drivers, DFS referrals, and the physical path.

Office Activation & Licensing

Diagnose Office/Microsoft 365 Apps activation failures — "Product deactivated" banners, unlicensed product mode, repeated sign-in prompts for activation, shared-computer/RDS activation errors — by detecting which license type the install actually uses before touching anything.

On-Prem to Cloud File Migration

Work file-server → SharePoint Online / OneDrive migration problems — permission translation (NTFS to SharePoint), path-length and illegal-character failures, and post-migration sync (OneDrive/Known Folder Move) issues — from the migration tool's error report, honest about what doesn't translate, never by forcing structure that breaks sync.

OneDrive / SharePoint Sync

Diagnose OneDrive and SharePoint sync problems — stuck "processing changes", missing files, sync errors, red X icons — separating client-state, library-limit, and permission causes before ever suggesting a reset.

OneDrive Known Folder Move

Work the ticket wave from a Known Folder Move rollout — "where did my desktop go", sync conflicts, path-length and invalid-character legacy files, duplicate Desktop confusion — without ever "fixing" a machine by unhooking KFM.

Outlook Client Issues

Diagnose Outlook desktop problems — crashes, hangs, search broken, "profile keeps asking for password", crash-on-send — via profile, data-file, and add-in isolation branches with rebuild criteria.

Outlook Search Issues

Diagnose Outlook search returning nothing, missing recent mail, or "results may be incomplete" — determining local-index vs server search and the cached-mode window before recommending anything, with index rebuild strictly last. Broader Outlook breakage (profiles, connectivity, add-ins) belongs to outlook-client-issues.

PaperCut / PrinterLogic

Diagnose print-management platform problems — PaperCut and PrinterLogic (and similar) release stations, driver/printer deployment failures, and quota/account issues — from the platform's own logs and deployment state, not the raw print spooler alone. For plain spooler/driver faults use printer-troubleshooting.

POS System Issues

Work point-of-sale tickets — terminal frozen, "card payments not going through", back-office not syncing — by splitting terminal vs payment-gateway vs back-office, with a hard PCI boundary: no touching cardholder data flows without the processor.

Printer Troubleshooting

Work a printing problem — nothing prints, stuck queue, garbled output, wrong printer, or scan-to-email failure — through a spooler/driver/network diagnostic matrix.

QuickBooks Desktop Multi-User

Work QuickBooks Desktop multi-user problems — H202/H505 hosting errors, -6000-series company-file errors, "someone else is in single-user mode", stuck locks — through the hosting-mode / Database Server Manager / file-integrity matrix.

QuickBooks Online Issues

Diagnose QuickBooks Online (the web/browser product) problems — distinguishing QBO from Desktop first, then bank-feed failures, multi-user access/role errors, and browser-layer issues (cache, extensions, third-party cookies) — from the actual error and the browser, not by assuming Desktop. For QB Desktop multi-user use quickbooks-desktop-multiuser.

RADIUS / NPS Authentication

Diagnose 802.1X / RADIUS authentication failures via Windows NPS — Wi-Fi, wired, and VPN auth rejects, certificate and connection/network-policy mismatches, shared-secret and NPS-registration problems — from the NPS event log reason codes, never from "wifi won't connect".

RD Gateway Issues

Diagnose Remote Desktop Gateway / RD Web Access problems — external RDP connections failing through the gateway, certificate errors, CAP/RAP connection- and resource-authorization-policy mismatches, and 2FA/MFA integration failures — from the RD Gateway operational logs and the exact client error, never by opening RDP to the internet.

RDS / AVD Troubleshooting

Diagnose Remote Desktop Services and Azure Virtual Desktop session problems — can't connect, stuck at "loading profile", licensing errors, black screens, printers missing in session — by identifying the layer (broker, host, licensing, profile, redirection) before touching anything.

Roaming Profiles & FSLogix

Diagnose profile-load failures on shared/session-host environments — FSLogix "cannot attach VHD", temporary profiles, sign-in hangs, settings lost between hosts — reading the FSLogix log status code and finding the lock before touching any container. Local single-PC profile corruption belongs to windows-profile-corruption.

Sage 50 / Sage 100

Diagnose Sage 50 and Sage 100 problems — data-path and share-permission faults, the Pervasive/Actian (PSQL) database engine service, and multi-user access errors — under period-close time pressure, from the connection manager and engine state, never by touching company data blindly.

SCADA / OT Awareness

Support an OT-adjacent ticket safely — knowing the hard boundary between IT and operational technology (SCADA/PLC/HMI/ICS), never touching controllers or industrial networks, and routing to the right OT/vendor owner. A safety-and-scope playbook, not a fix-it one. Cross-reference industry-packs/manufacturing.

Scanner & Copier Fleet

Work MFP/copier tickets beyond printing — scan-to-folder failures after credential or SMB changes, address-book cleanup, firmware quirks, panel errors — with a clear line between what the desk fixes and what the lease vendor owns.

SharePoint On-Prem

Diagnose on-premises SharePoint Server problems — search crawl failures and stale results, content-database health and mounting, and permission-inheritance confusion — from ULS logs, crawl-log evidence, and the actual permission chain, never by breaking inheritance blindly. For OneDrive/SharePoint Online sync use onedrive-sharepoint-sync.

Slow Computer

Work a "computer is slow" ticket through a measured triage ladder — resource hogs, disk health and pressure, startup load, profile weight — ending with honest when-to-reimage or when-to-replace criteria.

SQL Backup and Maintenance

Diagnose SQL Server backup and maintenance problems — runaway transaction-log growth, recovery-model confusion (FULL vs SIMPLE), failed or missing log backups breaking point-in-time recovery, and VSS/app-backup interplay — from the recovery model and backup history, never by shrinking or breaking the log chain. Performance tuning lives in sql-server-performance.

SQL Server Performance

Diagnose Microsoft SQL Server slowness — blocking and deadlocks, missing or bloated indexes, stale statistics, tempdb contention, plan-cache/parameter-sniffing problems — from live wait stats and the actual query, never from "the database is slow" alone.

SSL Certificate Renewal

Handle certificate-expiry warnings and renewals — browser warnings, service cert expiry, "the cert expires next week" — including issuer-specific renewal paths and the service restarts a swap requires.

SSL Inspection Issues

Diagnose breakage caused by TLS/SSL inspection — pinned apps failing with vague network errors, certificate warnings naming the firewall, one app broken only on the corporate network — and route bypass requests as the security decisions they are.

Teams Call Quality

Diagnose choppy audio, robotic voice, frozen video, and drops in Teams calls/meetings — CQD-style layer isolation (device → machine → network path) without assuming access to CQD, and honest about which network segments the MSP can actually fix. Teams sign-in/crash/feature problems belong to teams-issues.

Teams Issues

Diagnose Microsoft Teams problems — can't join meetings, no audio/video, stuck presence, guest access failures, sign-in loops — with cache reset reserved for defined criteria.

Teams Rooms AV

Diagnose Microsoft Teams Rooms device problems — the room account sign-in, peripheral health (camera/mic/display/touch console), calendar/meeting-join failures, and the restart discipline that fixes many of them — from the device's own state and the room account, never from the user's phone-side symptom. General Teams call quality is teams-call-quality.

Ticket Research Copilot

One-pass, read-only research sweep for a ticket already being worked — similar resolved tickets (this client first, then all clients), KB, IT Glue/Hudu docs, and live RMM device state — returned as a cited brief. The mid-ticket twin of new-ticket-first-touch.

Veeam Restore Operations

Run a Veeam restore request end-to-end — choosing the right restore type (file-level vs application-item vs full-VM vs Instant Recovery), picking the correct restore point, restoring to a safe location, and verifying the data — distinct from diagnosing why a backup failed (backup-failure-triage / backup-restore-request for intake).

Vendor Outage Checker

When a ticket smells like a vendor or service outage (M365, ISP, SaaS app), check the vendor's status page and outage reports on the web and post sourced findings to the ticket — the commonly requested "is it just us or is it down for everyone?" workflow.

VMware vSAN and vMotion

Diagnose VMware vSphere problems — vSAN health warnings and resync storms, vMotion/DRS migration failures, datastore latency and APD/PDL — from vCenter health and event evidence, never by migrating or rebooting hosts blindly.

VoIP Phone Matrix

Diagnose VoIP problems — inbound calls failing, ring groups misbehaving, one-way audio, dead phones, provisioning failures — by first splitting one-phone vs site vs trunk, then working the right layer.

VPN Troubleshooting

Diagnose VPN problems — won't connect, authenticates then no traffic, drops while working from home, or can't reach internal resources by name — via a client/auth/transport/DNS matrix.

Wi-Fi & Network Troubleshooting

Diagnose wireless and LAN problems — slow/dropping Wi-Fi, can't connect, dead zones, "the internet is down" — by laddering scope from single user to AP to site before touching anything.

Windows 11 Migration Issues

Work post-upgrade tickets after a Windows 11 migration — driver regressions, default apps reset, printers vanished, features moved — with the rollback window checked first and treated as a deadline.

Windows Profile Corruption

Handle "logged in to a temporary profile" and broken-profile tickets — confirm via the profile-service event IDs, choose repair vs rebuild deliberately, and run the data-preservation checklist before anything is deleted.

Windows Update Client Failures

Diagnose a single machine failing Windows updates — 0x8024xxxx/0x800Fxxxx errors, updates that loop or roll back, "checking for updates" forever — by first identifying which update source the machine actually reports to (WU, WSUS, or Intune), then walking the component-store repair ladder in order.

WSUS Patching Infrastructure

Diagnose WSUS server-side problems — clients not checking in or stuck at 0% download, console crashes/timeouts, updates approved but never arriving, database bloat — treating fleet-wide patch failure as a server problem, not five hundred client problems.