IT Support / Helpdesk interview questions

ITIL (IT Infrastructure Library) is a globally recognized framework of best practices for delivering IT services. It provides a structured approach to IT service management (ITSM). Why it matters for IT support: - Standardizes how incidents, problems, and changes are handled - Reduces downtime through proven processes - Improves customer satisfaction with consistent service quality - Aligns IT services with actual business needs ITIL 4 (latest version) is organized around: - Service Value System (SVS): how components work together to deliver value - Four dimensions: Organizations & People, Information & Technology, Partners & Suppliers, Value Streams & Processes - Guiding principles: focus on value, start where you are, progress iteratively, collaborate, think holistically Key ITIL processes relevant to L1/L2 support: - Incident Management: restore normal service as quickly as possible - Problem Management: find root cause to prevent recurrence - Change Management: control changes to minimize risk - Service Desk: single point of contact for users ITIL certification levels: Foundation, Practitioner, Specialist, Strategist, Leader.

This is a fundamental ITIL distinction: Incident: - An unplanned interruption or reduction in quality of an IT service - Goal: restore service as fast as possible (minimize business impact) - Example: "My laptop cannot connect to Wi-Fi right now" - Resolution: apply a workaround or known fix, get user back to work - Owned by: Service Desk / L1-L2 support Problem: - The underlying root cause of one or more incidents - Goal: find root cause and eliminate it permanently - Example: "Why do 30 laptops lose Wi-Fi every Tuesday morning?" - Resolution: Root Cause Analysis (RCA), permanent fix via Change Management - Owned by: Problem Management team / L2-L3 Key relationship: - A problem is raised when multiple incidents share the same root cause - A Known Error is a problem with identified root cause but no permanent fix yet - Workarounds manage incidents; permanent fixes close problems Real example: - Incident: user's Outlook keeps crashing (restore by restarting) - Problem: Outlook crashes for 50 users after a specific Windows update (find and roll back the bad patch)

IT support is organized in tiers, each handling increasingly complex issues: L1 - First Line Support: - First point of contact (phone, email, chat, portal) - Handles: password resets, basic connectivity, account unlocks, standard software issues - Resolution rate target: 70-80% of tickets - SLA: typically 15 min - 4 hours depending on priority - Tools: ticketing system, knowledge base, remote desktop L2 - Second Line Support: - Receives escalations from L1 that need deeper technical knowledge - Handles: OS-level issues, network config, application errors, hardware failures - More access: AD admin, server access, network tools - SLA: typically 4-8 hours - May deploy fixes, scripts, or patches L3 - Third Line Support: - Subject matter experts (DBAs, network engineers, developers) - Also vendors/manufacturers (Microsoft, Cisco, Oracle) - Handles: bugs, infrastructure failures, complex integrations - Often results in change requests or code fixes - SLA: 24-72 hours or per SLA contract Escalation triggers: - Ticket unresolved past SLA threshold - Issue affects multiple users (major incident) - Requires access/permission beyond current tier - Customer requests escalation Functional escalation = to someone with more skill Hierarchical escalation = to management (for VIP users or SLA breach)

Active Directory (AD) is Microsoft's directory service for managing users, computers, and resources in a Windows network. Core components: 1. Domain - Logical grouping of network objects (users, computers, printers) - All objects share the same AD database and security policies - Example: company.local 2. Domain Controller (DC) - Server that runs AD and handles authentication - Stores the AD database (NTDS.dit) - Every domain needs at least one DC; best practice is two for redundancy 3. Organizational Unit (OU) - Container for organizing objects within a domain - Used to apply Group Policies to specific subsets - Example: OU=Finance, OU=Sales, OU=IT 4. Group Policy Object (GPO) - Set of rules/configurations applied to users or computers - Controls: password policy, desktop settings, software deployment, firewall rules - Processed in order: Local -> Site -> Domain -> OU (LSDOU) 5. Forest and Trees - Forest: top-level container, multiple domains sharing a schema - Tree: set of domains sharing a contiguous DNS namespace 6. Security Groups vs Distribution Groups - Security groups: assign permissions to resources - Distribution groups: email lists only (Exchange) Common L1/L2 AD tasks: - Unlock user accounts: Unlock-ADAccount - Reset passwords: Set-ADAccountPassword - Add user to group: Add-ADGroupMember - Check last login: Get-ADUser -Properties LastLogonDate

Systematic troubleshooting using the OSI model (bottom up): Step 1 - Physical Layer: - Is the Ethernet cable plugged in? Are link lights on the NIC and switch port lit? - For Wi-Fi: is Wi-Fi adapter enabled? Is airplane mode off? - Try a different cable or port Step 2 - Data Link: - Run: ipconfig /all - Check if network adapter has a valid MAC address and is enabled Step 3 - Network Layer (IP): - Does the machine have an IP address? (169.254.x.x = DHCP failure) - Run: ipconfig - check for valid IP, subnet mask, default gateway - If no IP: run ipconfig /release then ipconfig /renew - Ping the default gateway: ping 192.168.1.1 - Ping loopback: ping 127.0.0.1 (tests TCP/IP stack) Step 4 - DNS: - Can they ping by IP but not hostname? - Run: nslookup google.com - Try ipconfig /flushdns then ipconfig /registerdns - Check DNS server setting in ipconfig /all Step 5 - Check further: - Ping 8.8.8.8 (Google DNS) - if this works, issue is DNS, not connectivity - Run: tracert 8.8.8.8 to find where packets stop - Check Windows Firewall, antivirus, proxy settings Step 6 - Escalate if: - Multiple users affected (switch/router issue) - VPN-specific (L2 issue) - IP conflict detected (arp -a)

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network configuration to devices on a network. What DHCP assigns: - IP address - Subnet mask - Default gateway - DNS server addresses - Lease duration The DORA process (how a device gets an IP): 1. Discover: client broadcasts "I need an IP address" 2. Offer: DHCP server responds with an available IP 3. Request: client accepts the offered IP 4. Acknowledge: server confirms the lease When DHCP fails: - The device cannot get an IP from the server - Windows automatically assigns an APIPA address: 169.254.x.x - APIPA allows local communication only — no internet, no network access - This is the #1 clue a DHCP issue exists Troubleshooting steps: 1. Run ipconfig — check for 169.254.x.x address 2. Run ipconfig /release then ipconfig /renew 3. Check if DHCP server service is running (services.msc) 4. Check if DHCP scope has available addresses (scope exhaustion) 5. Check DHCP relay agent if client and server are on different subnets 6. Check firewall — UDP ports 67 (server) and 68 (client) must be open Common causes of DHCP failure: - DHCP scope is full (all IPs leased out) - DHCP server is down - Network switch blocking DHCP broadcasts - Rogue DHCP server on the network

DNS (Domain Name System) translates human-readable domain names (google.com) into IP addresses (142.250.x.x) that computers use to communicate. DNS resolution process: 1. Browser checks local cache 2. OS checks hosts file (C:\Windows\System32\drivers\etc\hosts) 3. OS queries configured DNS server 4. DNS server checks its cache, then queries root -> TLD -> authoritative server if not cached Common DNS issues and fixes: Issue 1: Can ping IP but not hostname - DNS is broken; IP routing works - Fix: ipconfig /flushdns, check DNS server setting Issue 2: Intermittent resolution failures - DNS server overloaded or unreachable - Fix: try alternate DNS (8.8.8.8 or 1.1.1.1), check DNS server health Issue 3: Wrong IP returned (stale cache) - Fix: ipconfig /flushdns on client, clear DNS cache on server Issue 4: Internal resources not resolving - Check if internal DNS server is configured (not public DNS like 8.8.8.8) - Add missing A/CNAME records in internal DNS zone Diagnostic commands: - nslookup google.com — query DNS for a hostname - nslookup google.com 8.8.8.8 — query specific DNS server - ipconfig /flushdns — clear local DNS cache - ipconfig /displaydns — view local DNS cache - Resolve-DnsName google.com — PowerShell equivalent

A ticketing system is software that logs, tracks, and manages IT support requests from creation to resolution. Purpose: - Single source of truth for all support interactions - Track SLA compliance - Generate reports (common issues, resolution time, team performance) - Enable knowledge base creation from resolved tickets - Provide audit trail for compliance Popular ticketing tools: - ServiceNow: enterprise-grade, ITIL-aligned, workflows, CMDB integration - Jira Service Management: developer-friendly, integrates with software projects - Zendesk: popular for customer-facing support - Freshdesk, ManageEngine, Spiceworks: SMB-friendly options Effective ticket handling: 1. Categorize correctly: incident vs service request vs change request 2. Set priority accurately: based on impact (how many affected) x urgency (how time-critical) 3. Write clear subject: "User cannot log into Outlook — John Smith — Finance" 4. Document every action taken: what you tried, what worked, time taken 5. Use internal notes for team communication, not visible to user 6. Never close without user confirmation 7. Link related tickets (parent-child for major incidents) Priority matrix: - P1 Critical: major outage, all users affected — respond in 15 min - P2 High: significant impact, multiple users — respond in 1 hour - P3 Medium: single user, workaround available — respond in 4 hours - P4 Low: no immediate impact, enhancement — respond in 24 hours

Handling an escalating VIP requires balancing empathy, urgency, and process: Immediate response (first 60 seconds): 1. Acknowledge their frustration: "I completely understand this is affecting your work and I'm treating this as top priority." 2. Do NOT be defensive or make excuses 3. Confirm you own the issue: "I am personally handling this right now" Gather information quickly: - What exactly is the issue? When did it start? - What have they already tried? - What is the business impact? (meeting in 30 min? client demo?) - Are others affected? During resolution: - Give a realistic ETA — never overpromise - Provide updates every 10-15 minutes even if no resolution yet ("Still working on it, I'll update you in 10 minutes") - If you need to escalate, do it immediately and stay in the loop — don't disappear After resolution: - Confirm the fix with the user personally - Follow up 30 minutes later to confirm it's still working - Document everything in the ticket - File a problem ticket if root cause is unknown What NOT to do: - Don't argue or say "that's not our policy" - Don't transfer them without context - Don't go silent while troubleshooting without updates - Don't promise what you can't deliver

RDP (Remote Desktop Protocol) is a Microsoft protocol that allows you to remotely control another computer's desktop over a network. Key facts: - Default port: 3389 (TCP) - Client tool: mstsc.exe (Windows) or Microsoft Remote Desktop (Mac/iOS/Android) - Requires: RDP enabled on target machine, firewall allowing port 3389, valid credentials - Encryption: TLS/SSL (modern versions) How to enable RDP on target machine: - System Properties -> Remote -> Allow remote connections - Or via PowerShell: Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0 Using RDP for L1/L2 support: 1. Open mstsc.exe 2. Enter hostname or IP of user's machine 3. Log in with admin credentials (or user's credentials with permission) 4. Troubleshoot directly on their screen Remote Assistance vs Remote Desktop: - Remote Assistance: user invites you, they can see and participate — better for L1 (user stays logged in) - Remote Desktop: you take over the session, user is disconnected — better for unattended maintenance Security best practices: - Disable RDP when not needed - Use Network Level Authentication (NLA) - Change default port from 3389 - Use VPN + RDP, not RDP directly exposed to internet - Enable account lockout policy to prevent brute force Alternatives: TeamViewer, AnyDesk, Windows Quick Assist, SCCM Remote Control

Windows Event Logs are the primary source of diagnostic information for troubleshooting system and application issues. Accessing Event Viewer: - Run: eventvwr.msc - Or: Windows Logs folder in left pane Main log types: 1. Application Log - Events logged by applications/programs - Common errors: application crashes, database connection failures - Example: Event ID 1000 = application crash 2. System Log - Events from Windows OS and drivers - Common: service failures, driver errors, disk errors - Example: Event ID 7036 = service started/stopped 3. Security Log - Authentication events, policy changes, privilege use - Example: Event ID 4624 = successful login, 4625 = failed login, 4648 = explicit credentials used - Requires admin rights to view 4. Setup Log - Windows installation and update events Key Event IDs for L1/L2: - 41: Kernel-Power (unexpected shutdown/crash) - 1001: BugCheck (BSOD crash dump info) - 7034: Service crashed unexpectedly - 6008: Unexpected system shutdown - 4625: Failed login (multiple = brute force attempt) - 1102: Audit log cleared (security concern) Tips: - Filter by Event Level: Critical, Error, Warning, Information - Filter by Event ID to narrow down specific issue - Use "Find" to search by keyword - Export logs: right-click log -> Save All Events As -> .evtx

Group Policy is a Windows feature that allows administrators to centrally manage settings for users and computers in an Active Directory domain. What Group Policy controls: - Password complexity and expiration rules - Desktop wallpaper and screen saver settings - Software installation and removal - Drive and printer mappings - Internet Explorer/Edge settings - Windows Firewall and security settings - Scripts that run at login/logoff/startup/shutdown GPO application order (LSDOU - last wins): 1. Local policy (on the machine itself) 2. Site policy (based on AD site) 3. Domain policy (entire domain) 4. OU policy (most specific — applied last, takes precedence) GPO processing rules: - Computer policies apply at startup (before login) - User policies apply at login - Refresh interval: every 90 minutes by default (random offset of 0-30 min) - Run gpupdate /force to immediately apply latest policies Useful commands: - gpupdate /force — refresh all Group Policy immediately - gpresult /r — show which GPOs are applied to current user/computer - gpresult /h report.html — full HTML report of applied GPOs - rsop.msc — Resultant Set of Policy GUI (shows effective settings) Common troubleshooting: - Policy not applying: check OU placement, security filtering (user in correct group?), WMI filters - Conflicting policies: LSDOU order determines winner; use gpresult to trace