Tier 1 Helpdesk Troubleshooting Practice

Build a troubleshooting runbook for no internet, printer, and sound issues.

Introduction

30 Second Summary

When someone at work can't connect to Wi-Fi, print a document, or hear audio on a call, the first person they reach out to is a helpdesk technician. These three issues make up the majority of tier 1 support tickets.

In this project, you will practice diagnosing and resolving all three scenarios on your own Windows PC using real diagnostic tools. You'll compile your findings into a professional troubleshooting runbook you can reference in interviews or on the job.

What You'll Build

A professional troubleshooting runbook covering the three most common tier 1 helpdesk scenarios (no internet, printer not working, no sound) with step-by-step diagnostic procedures, resolution commands, and escalation criteria.

By the end of this project, you'll have:

  • Hands-on experience running network diagnostic commands (ipconfig, ping, nslookup) in Command Prompt.
  • Windows service management skills for Print Spooler and Windows Audio services using the Services console and Device Manager.
  • Clear escalation criteria documenting exactly when to resolve a ticket yourself and when to hand it off to tier 2.
  • Secret Mission: Write up each scenario as a realistic helpdesk ticket with user info, symptoms, steps taken, resolution, and time spent.

Are there any prerequisites?

You need a Windows 10 or 11 PC with administrator access. All tools used in this project (Command Prompt, Services console, Device Manager) are built into Windows, so there is nothing extra to install.

Open Your Diagnostic Toolkit

Before you can troubleshoot any helpdesk ticket, you need the right tools at your fingertips. Real helpdesk technicians keep their diagnostic windows open and ready so they can jump into action the moment a user calls in.

In this step, you'll open the three Windows tools you'll use throughout this project: Command Prompt, the Services console, and Device Manager. These are the same tools a tier 1 tech uses every day.

In this step, get ready to:
  • Open Command Prompt with administrator privileges.
  • Open the Services console to manage Windows services.
  • Open Device Manager to inspect hardware status.
Open Command Prompt as administrator

Many diagnostic commands require elevated privileges to run properly. Opening Command Prompt as an administrator gives you full access to networking and service commands you'll need in later steps.

  • Click the Start button on your taskbar.
  • Type cmd into the search bar.
  • Right-click Command Prompt in the search results.
  • Select Run as administrator.

What is User Account Control?

Windows will show a User Account Control (UAC) prompt asking if you want to allow this app to make changes. This is a security feature that prevents unauthorized programs from gaining admin access.

Click Yes to continue. You need admin privileges for the network and service commands you'll run later.

Verify the title bar of your Command Prompt window reads Administrator: Command Prompt. This confirms you have elevated privileges.

Don't see 'Run as administrator'?

If you don't see the option when right-clicking, your Windows account may not have administrator access. Check with your system administrator or try searching for cmd again and looking for the option in the right-side panel of the search results.

Help me open Command Prompt as administrator on Windows.

Open the Services console

The Services console lets you view and manage all the background processes that Windows runs. You'll use it to check whether the Print Spooler and Windows Audio services are running properly.

  • Press the Windows key + R on your keyboard to open the Run dialog.
  • Type services.msc into the text field.
  • Press Enter.

The Services window opens showing all Windows services listed alphabetically. You should see a long list with columns for Name, Description, Status, and Startup Type.

Why services matter for helpdesk work

Many common helpdesk issues come down to a Windows service that has stopped running. The Print Spooler handles all print jobs. Windows Audio manages your sound. If either one crashes, the related feature stops working entirely.

Knowing how to check and restart services is one of the fastest fixes in a tier 1 tech's toolkit.

  • Leave this window open. You'll come back to it for the printer and sound scenarios.

Services window didn't open?

Make sure you typed services.msc exactly as shown. A common mistake is typing services without the .msc extension.

Help me open the Services console on Windows.

Open Device Manager

Device Manager shows you all the hardware connected to your PC and whether its drivers are working properly. You'll use it to check network adapters, audio devices, and printers.

  • Right-click the Start button on your taskbar.
  • Select Device Manager from the menu that appears.

Device Manager opens showing hardware categories including Display adapters, Network adapters, Sound, video and game controllers, and Print queues.

What do the icons mean?

Each category has a small arrow you can click to expand and see individual devices. If any device has a yellow warning triangle, that means its driver has a problem. A healthy system shows no warning icons.

You'll learn to spot these warnings in later steps when diagnosing network, printer, and audio issues.

  • Leave this window open alongside your Services console and Command Prompt.

Don't see Device Manager in the menu?

The right-click menu on the Start button is called the Power User menu. If Device Manager doesn't appear there, press Windows key + R, type devmgmt.msc, and press Enter as an alternative.

Help me open Device Manager on Windows.

Your diagnostic toolkit is ready. You now have the three core tools that tier 1 helpdesk technicians rely on every day. Next up, you'll put them to work diagnosing a "no internet" scenario.

Scenario 1 - No Internet (Gather Information)

Your diagnostic toolkit is ready. Now it's time to use it on the most common ticket a tier 1 technician receives: "I can't get on the internet."

Your job is to diagnose whether the problem is a local PC issue, a DNS problem, or something that needs to be escalated to tier 2. You'll work through connectivity layer by layer, starting from the PC itself and moving outward toward the internet.

In this step, get ready to:
  • Run ipconfig /all and document your network configuration.
  • Test connectivity at each layer using ping and nslookup commands.
  • Check your network adapter status in Device Manager.
Check IP configuration

The first thing a helpdesk technician checks on a "no internet" call is the PC's current network configuration. This tells you whether the PC even has a valid IP address and knows where to find the router and DNS servers.

  • In the Administrator Command Prompt from earlier, run this command to display your full network configuration:
ipconfig /all

What does this command do?

The ipconfig /all command displays all current TCP/IP network configuration values for every adapter on your PC. This includes your IP address, subnet mask, default gateway (your router), and DNS servers.

You should see a wall of text listing each network adapter and its settings. Look for the adapter you're currently using (Wi-Fi or Ethernet).

  • Find and write down these four key values from the output:

What is an APIPA address?

If the IPv4 address starts with 169.254, that's an APIPA address. It means the PC couldn't reach a DHCP server, so Windows self-assigned an address in the 169.254.0.0/16 range.

This immediately points to a physical connection or router issue. On a real ticket, you'd know to check cables and the router before digging further.

Don't see an IPv4 address for your adapter?

The output lists every adapter on your system, including virtual ones. Scroll through until you find the section for your active connection. It's usually labelled "Wireless LAN adapter Wi-Fi" or "Ethernet adapter Ethernet." Look for the one that has a Default Gateway value listed.

Help me find my active network adapter in ipconfig output

Test connectivity layer by layer

Now you know your PC's network configuration. The next step is to test connectivity at each layer, moving outward from your PC toward the internet. Each command tests a different point in the chain.

  • Test your PC's own network stack (loopback) by running:
ping 127.0.0.1

What does this test?

This pings your own PC (the loopback address). If this fails, the network stack itself is broken. In practice this almost never fails, but it's the foundation of the layered approach. You should see replies from 127.0.0.1 with time values.

  • Test whether you can reach your router by running:
ping [[GATEWAY_IP="your Default Gateway IP from ipconfig output"]]

What does this test?

This tests the connection between your PC and your router. If this fails, the problem is between your PC and the router. That means a cable issue, Wi-Fi issue, or adapter issue.

  • Test whether you can reach the internet by running:
ping 8.8.8.8

What does this test?

This pings Google's public DNS server. If the gateway ping worked but this fails, the problem is between your router and the internet. That's typically an ISP issue or routing problem beyond your control.

  • Test DNS resolution by running:
nslookup google.com

What does this test?

This tests DNS resolution. DNS translates website names (like google.com) into IP addresses. If the 8.8.8.8 ping worked but nslookup fails, the problem is specifically DNS. This is the most common "no internet" issue you'll see on real tickets.

Why this order matters

By testing from the inside out (loopback, then gateway, then internet, then DNS), you can pinpoint exactly where the chain breaks. This layered approach is what separates a professional diagnosis from random guessing.

  • Write down which commands succeeded and which failed. Note the pattern. For example: "Loopback passed, gateway passed, 8.8.8.8 passed, nslookup passed" means everything is healthy.

Seeing 'Request timed out' on the gateway ping?

If your gateway ping times out, double-check that you typed the correct Default Gateway IP from your ipconfig /all output. Some routers also block ICMP ping requests by default. If everything else works (you can browse the web), the router is simply configured to not respond to pings.

Help me interpret my ping results

Check the network adapter

The last piece of the diagnosis is checking whether the hardware itself is working. A driver problem can cause connectivity issues that look identical to network problems.

  • Switch back to the Device Manager window you opened earlier.
  • Click the arrow next to Network adapters to expand the category.
  • Find your Wi-Fi or Ethernet adapter in the list.
  • Look for a yellow warning triangle on the adapter icon. A yellow triangle indicates a driver problem.
  • Right-click the adapter and select Properties.
  • Confirm the Device status says "This device is working properly."

What should I see?

A healthy adapter has no yellow triangle and shows "This device is working properly" in the Properties dialog. If you see a warning icon or an error message, that tells you the issue might be hardware or driver-related rather than a network configuration problem.

  • Document your findings: write down the adapter name, whether it has a warning triangle, and what the Device status says.

See multiple adapters and not sure which is yours?

Windows often shows virtual adapters (like "Hyper-V" or "VPN" adapters) alongside your real ones. Your physical adapter usually has a manufacturer name like "Intel" or "Realtek" in it. The adapter name in Device Manager should match the adapter name you saw in your ipconfig /all output.

Help me identify my network adapter in Device Manager

You've gathered all the diagnostic information for a "no internet" scenario. You know how to identify exactly where the connection breaks. Next up, you'll learn what to actually do about each type of failure and when to escalate.

Scenario 1 - No Internet (Resolution and Escalation)

You've diagnosed which layer of connectivity is failing. Now it's time to document what you'd actually do to fix the problem at each layer.

A real helpdesk technician needs two things: a playbook of fixes for common failure points, and clear criteria for when a ticket leaves their hands. In this step, you'll build both.

In this step, get ready to:
  • Document tier 1 fixes for each no-internet failure point.
  • Write escalation criteria for no-internet issues.
  • Create an escalation ticket template.
Document tier 1 fixes for each failure point

Each diagnostic layer you tested in the previous step has its own fix. You'll document the resolution for three failure scenarios: DNS failure, gateway unreachable, and a full network stack reset as a last resort.

DNS failure: nslookup fails, but ping 8.8.8.8 works.

This is the most common "no internet" issue you'll see on a helpdesk. The PC can reach the internet, but it can't translate domain names into IP addresses.

  • Flush the DNS cache by running this command in your Administrator Command Prompt:
ipconfig /flushdns

What does this command do?

Your PC caches DNS lookups to speed up browsing. If a cached entry is outdated or corrupted, your PC keeps trying to use the wrong address. Flushing the cache forces Windows to look up fresh DNS records from the server.

If flushing DNS doesn't fix the problem, the next step is to set manual DNS servers. Here's what you'd walk a user through:

  • Open Settings, then select Network & Internet.
  • Click Change adapter options.
  • Right-click the active network adapter and select Properties.
  • Select Internet Protocol Version 4 (TCP/IPv4) and click Properties.
  • Select "Use the following DNS server addresses" and enter 8.8.8.8 as Preferred and 8.8.4.4 as Alternate.
  • Click OK to save.
  • Write down the DNS fix in your diagnostic notes. Include both the flush command and the manual DNS steps.

Can't reach gateway: gateway ping fails.

If your PC can't even reach the router, the problem is between the PC and the network. This could be a bad cable, a dropped Wi-Fi connection, or a stuck network adapter.

  • First, check the physical connection. For wired connections, reseat the Ethernet cable. For Wi-Fi, confirm the adapter is enabled and connected to the correct network.
  • In Device Manager, right-click your network adapter, select Disable device, wait 5 seconds, then right-click again and select Enable device.
  • If that doesn't resolve it, release and renew the DHCP lease by running these commands:
ipconfig /release
ipconfig /renew

What do these commands do?

Your PC gets its IP address from a DHCP server (usually the router). ipconfig /release drops the current IP assignment. ipconfig /renew requests a fresh one from the DHCP server.

If you run these on your PC right now, you'll briefly lose connectivity and then reconnect. This is normal.

  • Add the gateway fix steps to your diagnostic notes.

Full network stack reset: last resort before escalation.

When none of the above works, a full network stack reset clears all networking configuration back to factory defaults. This is the last thing you try before escalating.

  • Document these commands as your last-resort fix:
netsh winsock reset
netsh int ip reset
ipconfig /flushdns

What does a full stack reset do?

netsh winsock reset clears the Winsock catalog, which handles communication between Windows and your network software. Corrupted entries here cause mysterious connectivity failures.

netsh int ip reset resets the TCP/IP stack by rewriting the registry keys that Windows uses for networking. After running both, a PC restart is required.

Don't run the full reset right now

Unlike the DNS flush, a full stack reset requires a PC restart to take effect. Document these commands in your notes for now. You'd only run them when actually troubleshooting a stubborn connectivity issue.

  • Add the full stack reset commands to your diagnostic notes. Include a note that a PC restart is required after running them.
Document escalation criteria

Knowing when to stop troubleshooting and pass a ticket to tier 2 is just as important as knowing the fixes. Escalating too late wastes time. Escalating too early means you haven't done your job.

  • Write down these escalation criteria in your diagnostic notes. Escalate the no-internet ticket to tier 2 when:
  • Multiple users on the same network are affected. This points to an infrastructure problem, not a single PC issue.
  • Gateway ping works but ping 8.8.8.8 fails. This indicates an ISP or routing problem that's beyond tier 1 scope.
  • The network adapter shows persistent errors in Device Manager after you've tried reinstalling the driver.
  • The issue returns after a full network stack reset. If the nuclear option didn't work, something deeper is wrong.

Why are these the escalation triggers?

Each criterion represents a situation where standard tier 1 fixes have failed or the root cause is outside tier 1 scope. Multi-user issues suggest infrastructure failure. Persistent driver errors may need imaging or hardware replacement. Recurring issues after a stack reset suggest OS corruption or Group Policy conflicts that require elevated access.

Record your escalation ticket template

When you escalate a ticket, the quality of your handoff determines how quickly tier 2 can resolve it. A vague escalation means they repeat your work. A detailed one lets them jump straight to the root cause.

  • Add this escalation ticket template to your diagnostic notes:
ESCALATION TICKET - NO INTERNET
================================
User: [name / department]
PC Hostname: [hostname]
Reported: [date/time]

Symptoms:
- [what the user described in their own words]

Connectivity Test Results:
- ping 127.0.0.1: [PASS/FAIL]
- ping [gateway IP]: [PASS/FAIL]
- ping 8.8.8.8: [PASS/FAIL]
- nslookup google.com: [PASS/FAIL]

Steps Already Taken:
1. [what you tried]
2. [result of each step]

Other Users Affected: [yes/no - if yes, how many]

Exact Error Messages:
- [any error text displayed]

Reason for Escalation:
- [why this is beyond tier 1 scope]

Suggested Next Steps:
- [what you think tier 2 should investigate]

What makes a good escalation ticket?

The most important sections are the connectivity test results and the steps already taken. Tier 2 needs to know exactly which layer failed and what you've already ruled out. Without this, they'll start from scratch.

Including whether other users are affected helps tier 2 decide if this is a single-PC issue or a network-wide incident requiring a different response.

  • Review your diagnostic notes. You should now have three sections documented: tier 1 fixes for each failure point, escalation criteria, and the ticket template.

Not sure what to write for a section?

Look back at the commands you ran in the previous step. Your diagnostic notes should include the actual output you observed. Pair each command with the fix you'd apply if that command's output showed a failure.

Help me structure my no-internet troubleshooting notes into a clear runbook format.

You've just documented a complete resolution workflow for the most common helpdesk ticket: no internet. Next up, you'll tackle the second most frequent call. A user who can't print.

Scenario 2 - Printer Not Working (Diagnose and Fix)

Your network diagnostics are done and documented. Now it's time to tackle the second most common ticket in any helpdesk queue: "I can't print."

A user calls in: "I'm trying to print but nothing comes out." Your job is to figure out whether it's a software problem (the Print Spooler service crashed), a queue jam (stuck print jobs blocking everything behind them), or a hardware issue that needs to go to tier 2.

In this step, get ready to:
  • Check the Print Spooler service status and startup type in the Services console.
  • Inspect and clear the print queue using Settings and Command Prompt.
  • Document triage questions and escalation criteria for printer issues.
Check the Print Spooler service

The Print Spooler is the Windows service that manages all print jobs. When it crashes or stops, nothing prints regardless of the printer's physical condition.

  • Switch back to the Services window you opened earlier.
  • Scroll down to Print Spooler in the list (services are sorted alphabetically).
  • Check the Status column. It should say "Running".
  • Check the Startup Type column. It should say "Automatic".

What is the Print Spooler?

The Print Spooler receives print jobs from applications, holds them in a queue, and sends them to the printer one at a time. If it stops running, no application on the PC can print.

In a real scenario, if the service is stopped, you'd right-click it and select Start. If it's running but printing is stuck, you'd right-click and select Restart.

  • Write down the current Status and Startup Type of your Print Spooler service in your diagnostic notes.

Healthy vs. unhealthy Print Spooler

A healthy state is Status: Running and Startup Type: Automatic. If you see Status blank (meaning stopped) or Startup Type set to Disabled, that's your smoking gun for why the user can't print.

Check and clear the print queue

Even when the Print Spooler is running, individual print jobs can get stuck in the queue and block everything behind them. Clearing these stuck jobs is often all it takes to get printing working again.

  • Open Settings by pressing the Windows key and typing Settings, then pressing Enter.
  • Click Bluetooth & devices in the left sidebar.
  • Click Printers & scanners.
  • Select any printer listed and click Open print queue.
  • Check whether there are any jobs stuck in the queue. In a real scenario, you'd right-click each stuck job and select Cancel.

Sometimes stuck jobs refuse to cancel through the UI. When that happens, you need a full spooler reset from Command Prompt.

  • Return to your Administrator Command Prompt and document these spooler reset commands:
net stop spooler
del /q /f /s "%SystemRoot%\System32\spool\PRINTERS\*"
net start spooler

What do these commands do?

  • net stop spooler stops the Print Spooler service so you can safely clear its files.
  • del /q /f /s "%SystemRoot%\System32\spool\PRINTERS\*" deletes all cached print job files. This only removes the queued documents, not the spooler itself.
  • net start spooler restarts the Print Spooler fresh with an empty queue.
  • Write these three commands in your diagnostic notes. You'll paste them into your final runbook later.

Spooler won't stop?

If you get an "Access is denied" message, make sure your Command Prompt title bar says "Administrator." A regular (non-admin) Command Prompt can't stop system services.

If the service is listed as "Stopping" for a long time, you may need to open Task Manager, find the spoolsv.exe process, and end it manually before retrying.

Help me troubleshoot the Print Spooler not stopping on my Windows PC.

Document triage questions and escalation criteria

Before diving into diagnostics on a real ticket, a helpdesk tech asks the right questions first. Good triage questions narrow the problem down before you ever touch a tool.

  • Add the following triage questions to your diagnostic notes for Scenario 2:
  • Which printer are you trying to use? (name and location)
  • Can you print from a different application? (try Notepad for a simple test)
  • Can anyone else print to that same printer? (isolates PC vs. printer issue)
  • Do you see any error messages on the printer display?
  • Is the printer connected via USB, Wi-Fi, or network?

Why these specific questions?

Each question eliminates a category of problem. "Can others print to it?" tells you if it's a single-PC issue or a printer hardware issue. "Can you print from Notepad?" isolates application-specific problems from system-wide failures.

Now document when you'd stop troubleshooting and escalate to tier 2.

  • Add these escalation criteria to your diagnostic notes:
  • Multiple users can't print to the same printer (likely hardware or network printer issue beyond your PC).
  • The Print Spooler keeps crashing repeatedly after restart (deeper OS or driver corruption).
  • The printer shows hardware errors on its display panel (paper jam, toner, hardware fault).
  • Driver reinstallation fails or Device Manager shows persistent errors under Print queues.

Why escalate when multiple users are affected?

If one user can't print, it's likely a local PC or driver issue you can fix at tier 1. If five users can't print to the same printer, the problem is the printer hardware or its network connection. That's infrastructure, which falls outside tier 1 scope.

Printer scenario documented. Next up, you'll tackle the third and final common ticket: no sound. Same workflow, different service.

Scenario 3 - No Sound (Diagnose and Fix)

Your printer troubleshooting workflow is documented. Now you'll tackle the third and final scenario: a user reporting no sound.

"No sound" tickets follow the same layered approach as network issues. You check the output device first (is the right speaker selected?), then the services (is Windows Audio running?), then the hardware driver (does Device Manager see the device?). Each layer narrows down where the problem lives.

In this step, get ready to:
  • Check audio output device and volume settings.
  • Verify Windows Audio services are running.
  • Inspect the audio driver in Device Manager and document escalation criteria.
Check output device and volume

The most common cause of "no sound" is simply the wrong output device being selected. Windows can silently switch to a phantom device (like an HDMI port or a disconnected headset) after updates or hardware changes.

  • Right-click the speaker icon in the taskbar (bottom-right corner of your screen).
  • Select Sound settings.
  • Under Output, check which device is currently selected (e.g., Speakers, Headphones, or an HDMI device).
  • Make sure the volume slider is not at zero.

What am I looking for?

The correct output device is usually called "Speakers" followed by your audio chipset name (like Realtek Audio). If you see an HDMI device or a disconnected headset selected instead, that is likely why a user would have no sound.

  • Right-click the speaker icon again and select Open Volume Mixer.
  • Check whether any individual apps are muted or set to very low volume.

Why check Volume Mixer separately?

Volume Mixer shows per-app volumes. A user might have full system volume but their browser or Teams is individually muted. This is a common gotcha that saves you from chasing a phantom hardware issue.

  • Document in your notes which output device is currently selected on your PC.
  • Note whether Volume Mixer shows any muted apps.
Check Windows Audio services

Windows Audio depends on a second service called Windows Audio Endpoint Builder. If either service stops, all sound stops. The Endpoint Builder must be restarted first because Windows Audio depends on it.

  • Switch back to the Services console you opened earlier.
  • Scroll down to find Windows Audio.
  • Verify the Status column says "Running" and the Startup Type column says "Automatic".
  • Find Windows Audio Endpoint Builder and verify the same (Running, Automatic).

What if a service is stopped?

If either service is stopped, right-click it and select Start. If both are running but there is still no sound, right-click and select Restart on Windows Audio Endpoint Builder first, then restart Windows Audio.

You can also restart these services from Command Prompt. This is faster when you are remoting into a user's PC.

  • Switch back to your Administrator Command Prompt and run these commands in order:
net stop audiosrv
net stop AudioEndpointBuilder
net start AudioEndpointBuilder
net start audiosrv

Why this order matters

Windows Audio depends on Windows Audio Endpoint Builder. You stop Windows Audio first (the dependent), then stop Endpoint Builder (the dependency). When starting them back up, you reverse the order: start Endpoint Builder first so Windows Audio has what it needs.

If the services are currently running on your PC, you will see messages confirming each stop and start. This is normal and your sound will return after the final command.

Getting an access denied error?

Make sure your Command Prompt title bar says "Administrator: Command Prompt". The net stop and net start commands require administrator privileges to control services.

If you closed your admin Command Prompt, click the Start button, type cmd, right-click Command Prompt, and select Run as administrator.

help me troubleshoot the access denied error when stopping audio services

  • Document the current status of both Windows Audio and Windows Audio Endpoint Builder in your notes (Running or Stopped, Automatic or Manual).
  • Document the four restart commands in order so you can reference them later.
Check audio driver in Device Manager

If the services are running but there is still no sound, the issue might be at the hardware driver level. A missing or corrupted driver means Windows cannot communicate with the audio hardware at all.

  • Switch back to Device Manager.
  • Expand Sound, video and game controllers.
  • Look for your audio device (usually called "Realtek Audio" or "High Definition Audio Device").
  • Check for a yellow warning triangle on the device icon. This indicates a driver problem.
  • Right-click the audio device and select Properties.
  • Confirm the Device status says "This device is working properly."

What if the driver has a problem?

If there is a yellow triangle or the status shows an error, right-click the device and select Update driver, then choose Search automatically for drivers.

If that fails, right-click the device and select Uninstall device, then restart the PC. Windows will automatically reinstall the default audio driver on reboot.

  • Document your audio device name and whether it shows a yellow warning triangle.

Now document the escalation criteria for no-sound issues. Write these in your notes:

  • Audio services will not stay running (keep crashing after restart).
  • No audio device appears in Device Manager even after scanning for hardware changes.
  • The issue started immediately after a Windows update (may need driver rollback by tier 2).
  • Hardware diagnostic test fails (indicates physical hardware failure).

Why these criteria matter

Each of these situations goes beyond what standard tier 1 steps can fix. A crashing service suggests OS corruption. A missing device in Device Manager points to hardware failure or a deeply corrupted driver that needs tier 2 tooling. Post-update issues may need a driver rollback that requires more access.

All three diagnostic scenarios are complete. You have hands-on experience with the exact tools and commands a tier 1 technician uses every day. Next up, you will compile everything into a professional troubleshooting runbook.

Build Your Troubleshooting Runbook

You've diagnosed all three of the most common tier 1 helpdesk scenarios using real Windows tools. Now it's time to compile everything into a single professional document.

A troubleshooting runbook is what separates a helpdesk technician who wings it from one who resolves tickets consistently. You'll build yours in Notepad, structuring it so you can reference it in interviews or on the job.

In this step, get ready to:
  • Create a structured runbook document covering all three scenarios.
  • Paste real diagnostic output as evidence of your hands-on practice.
  • Add a reusable escalation ticket template at the bottom.
Create the runbook structure

A good runbook follows a consistent structure for every scenario. Each section has triage questions, diagnostic steps, fixes, and escalation criteria so you always know what to do next.

  • Press the Windows key to open your search bar.
  • Type Notepad and press Enter to open it.
  • Copy the following template into Notepad to create your runbook structure:
TIER 1 TROUBLESHOOTING RUNBOOK
==============================

SCENARIO 1: NO INTERNET CONNECTIVITY
-------------------------------------
Triage Questions:
- Is it just your PC or are other users affected?
- Are you on Wi-Fi or Ethernet?
- When did this start?
- Have you restarted your PC?

Diagnostic Steps:
1. ipconfig /all - check for valid IP, gateway, DNS
2. ping gateway - test local network
3. ping 8.8.8.8 - test internet connectivity
4. nslookup google.com - test DNS resolution

Tier 1 Fixes:
(paste your documented fixes for each failure point from your notes)

Escalate When:
(paste your escalation criteria from your notes)

SCENARIO 2: PRINTER NOT WORKING
--------------------------------
Triage Questions:
(paste your triage questions from your notes)

Diagnostic Steps:
1. Check Print Spooler service status in services.msc
2. Open print queue - check for stuck jobs
3. If stuck: net stop spooler, clear queue, net start spooler

Tier 1 Fixes:
(paste your documented fixes from your notes)

Escalate When:
(paste your escalation criteria from your notes)

SCENARIO 3: NO SOUND
---------------------
Triage Questions:
(paste your triage questions from your notes)

Diagnostic Steps:
1. Check output device in Sound settings
2. Check Volume Mixer for muted apps
3. Verify Windows Audio and Endpoint Builder services
4. Check audio driver in Device Manager

Tier 1 Fixes:
(paste your documented fixes from your notes)

Escalate When:
(paste your escalation criteria from your notes)

What does this structure do?

Every scenario follows the same four-part pattern: Triage Questions, Diagnostic Steps, Tier 1 Fixes, and Escalate When. This consistency means you never have to think about what to do next during a live call.

The diagnostic steps use the exact commands and tools you practiced in Steps 2 through 5. The fixes and escalation criteria come from the notes you documented along the way.

  • Replace each line that says "(paste your... from your notes)" with the actual content you documented during the previous steps.
  • For Scenario 1, fill in your DNS fix (ipconfig /flushdns, manual DNS), adapter reset (ipconfig /release and ipconfig /renew), and full network stack reset commands.
  • For Scenario 2, fill in your printer triage questions and the spooler reset procedure.
  • For Scenario 3, fill in your audio triage questions and the service restart procedure.

After filling in all sections, your runbook should read like a complete reference that any tier 1 technician could follow.

Not sure what to put in a section?

If you didn't take detailed notes during a previous step, switch back to the tool where you ran the commands and review the output. Your Command Prompt history and Services console are still open.

You can scroll up in Command Prompt to find previous command output.

help me figure out what to include in my troubleshooting runbook for tier 1 helpdesk scenarios

Add your diagnostic evidence

Pasting real command output into your runbook proves you practiced the steps. It also shows interviewers you know what normal output looks like versus what broken output looks like.

  • Switch back to your Administrator Command Prompt window.
  • Scroll up to find the output from ipconfig /all that you ran earlier.
  • Right-click inside the Command Prompt to select the output text, then press Enter to copy it.
  • Switch to Notepad and paste the output below the Diagnostic Steps section in Scenario 1.
  • Label it clearly, for example: "MY DIAGNOSTIC OUTPUT:" above the pasted text.
  • Repeat this for the other commands you ran: your ping results and nslookup output from Scenario 1.
  • For Scenario 2, paste any Print Spooler service status you noted.
  • For Scenario 3, paste the audio services restart output and the device status you documented.

Why include real output?

When an interviewer asks "walk me through how you'd troubleshoot no internet," you can show them actual output from your own machine. This demonstrates you've done the work, not just read about it.

Your output also serves as a reference for what "healthy" looks like. On a real helpdesk, comparing a user's output against known-good output is one of the fastest ways to spot the problem.

Copying from Command Prompt

If right-click select is difficult, click the Command Prompt icon in the top-left corner, select Edit, then Select All. Press Enter to copy everything, then paste it into Notepad and trim it down to just the output you need.

Add the escalation ticket template

Not every issue gets resolved at tier 1. When you need to escalate, the quality of your ticket determines how quickly tier 2 can pick it up.

  • Scroll to the bottom of your runbook in Notepad.
  • Add the following escalation ticket template below your three scenarios:
ESCALATION TICKET TEMPLATE
============================
Ticket #: [[TICKET_NUMBER="ticket number"]]
User: [[TICKET_USER="name / department"]]
PC: [[TICKET_PC="hostname"]]
Issue: [[TICKET_ISSUE="one-line summary"]]
Reported: [[TICKET_DATE="date/time"]]

Symptoms:
- (what the user described in their own words)

Steps Taken:
1. (what you checked or tried first)
2. (result of each step)

Findings:
- (what the diagnostic tools showed)

Reason for Escalation:
- (why this is beyond tier 1 scope)

Suggested Next Steps:
- (what you think tier 2 should investigate)

What makes a good escalation ticket?

The key sections are Steps Taken and Findings. Tier 2 needs to know exactly what you already tried so they don't repeat your work. Include timestamps, exact commands, and specific error messages.

The Suggested Next Steps field shows you're thinking beyond your own tier. Even if your suggestion isn't what tier 2 ends up doing, it demonstrates problem-solving awareness.

  • Save your runbook by pressing Ctrl+S.
  • In the Save As dialog, navigate to your Desktop.
  • Name the file troubleshooting-runbook.txt and click Save.

You should see troubleshooting-runbook.txt appear on your Desktop. The title bar in Notepad should now show the file name instead of "Untitled."

Save As dialog not appearing?

If Notepad saves immediately without showing a dialog, it may have already saved to a default location. Click File then Save As to choose your Desktop as the location.

help me save my Notepad file to the Desktop on Windows

✔️ Awesome, I've got everything!

Great. Double check your runbook has all three scenarios filled in with your own notes and at least some real command output pasted as evidence.

ⓧ I'd like to double check the full structure

Here is the complete structure your runbook should follow. Your personalized content (triage questions, fixes, escalation criteria, and pasted command output) fills in the sections marked with parenthetical instructions.

TIER 1 TROUBLESHOOTING RUNBOOK
==============================

SCENARIO 1: NO INTERNET CONNECTIVITY
-------------------------------------
Triage Questions:
- Is it just your PC or are other users affected?
- Are you on Wi-Fi or Ethernet?
- When did this start?
- Have you restarted your PC?

Diagnostic Steps:
1. ipconfig /all - check for valid IP, gateway, DNS
2. ping gateway - test local network
3. ping 8.8.8.8 - test internet connectivity
4. nslookup google.com - test DNS resolution

Tier 1 Fixes:
- DNS failure: ipconfig /flushdns, set manual DNS to 8.8.8.8 and 8.8.4.4
- Can't reach gateway: ipconfig /release then ipconfig /renew
- Full reset: netsh winsock reset, netsh int ip reset, ipconfig /flushdns, restart PC

Escalate When:
- Multiple users affected
- Gateway works but 8.8.8.8 fails (ISP issue)
- Adapter errors persist after driver reinstall
- Issue returns after full network stack reset

MY DIAGNOSTIC OUTPUT:
(your pasted ipconfig /all, ping, and nslookup output here)

SCENARIO 2: PRINTER NOT WORKING
--------------------------------
Triage Questions:
- Which printer are you trying to use?
- Can you print from a different application?
- Can anyone else print to that printer?
- Do you see error messages on the printer display?
- Is the printer connected via USB, Wi-Fi, or network?

Diagnostic Steps:
1. Check Print Spooler service status in services.msc
2. Open print queue - check for stuck jobs
3. If stuck: net stop spooler, clear queue, net start spooler

Tier 1 Fixes:
- Spooler stopped: Start the service in services.msc
- Stuck jobs: Cancel jobs in print queue, or full spooler reset
- Spooler reset commands:
  net stop spooler
  del /q /f /s "%SystemRoot%\System32\spool\PRINTERS\*"
  net start spooler

Escalate When:
- Multiple users can't print to the same printer
- Spooler keeps crashing repeatedly
- Printer shows hardware errors on display panel
- Driver reinstallation fails or Device Manager shows persistent errors

MY DIAGNOSTIC OUTPUT:
(your pasted Print Spooler status and any output here)

SCENARIO 3: NO SOUND
---------------------
Triage Questions:
- When did the sound stop working?
- Is it all sound or just one application?
- Are you using speakers, headphones, or Bluetooth?
- Did you recently install anything or run a Windows update?

Diagnostic Steps:
1. Check output device in Sound settings
2. Check Volume Mixer for muted apps
3. Verify Windows Audio and Endpoint Builder services
4. Check audio driver in Device Manager

Tier 1 Fixes:
- Wrong output device: Select correct device in Sound settings
- Muted app: Unmute in Volume Mixer
- Services stopped: Restart Endpoint Builder first, then Windows Audio
  net stop audiosrv
  net stop AudioEndpointBuilder
  net start AudioEndpointBuilder
  net start audiosrv
- Driver issue: Update driver or uninstall and restart PC

Escalate When:
- Audio services won't stay running
- No audio device appears in Device Manager
- Issue started immediately after a Windows update
- Hardware diagnostic test fails

MY DIAGNOSTIC OUTPUT:
(your pasted audio service status and device status here)

ESCALATION TICKET TEMPLATE
============================
Ticket #:
User:
PC:
Issue:
Reported:

Symptoms:
- (what the user described)

Steps Taken:
1. (what you checked/tried)
2. (result of each step)

Findings:
- (what the diagnostic tools showed)

Reason for Escalation:
- (why this is beyond tier 1 scope)

Suggested Next Steps:
- (what you think tier 2 should investigate)

Secret mission

Ticket Simulation

You've built the runbook. Now prove you can use it under pressure. Write up all three scenarios as real helpdesk tickets, complete with user details, triage notes, diagnostic results, and resolution. This is the kind of documentation a supervisor reviews during quality audits.

Clean Up Your Resources

Clean Up Your Resources

This project runs entirely locally using built-in Windows tools, so there are no ongoing costs. Decide whether to keep your runbook file and tool windows open, close them to free up screen space, or delete your files entirely.

Resources you used:

  • Troubleshooting runbook file (saved in Notepad).
  • Administrator Command Prompt window.
  • Services console window.
  • Device Manager window.

Keep everything running

No action needed. Choose this if you're still actively practicing or want to keep your tool windows open for reference.

  • Your troubleshooting runbook stays saved wherever you stored it.
  • Your Command Prompt, Services console, and Device Manager windows remain open for continued exploration.

Pause - I'll come back to this later

Close your tool windows to free up screen space. Your runbook file stays saved for when you come back.

  • Close the Administrator Command Prompt window.
  • Close the Services console window.
  • Close the Device Manager window.
  • Keep your runbook file saved. You can reopen it anytime in Notepad.

Delete - I don't want to use this again

Remove all project files and close everything. Only choose this if you no longer want your runbook.

  • Close the Administrator Command Prompt window.
  • Close the Services console window.
  • Close the Device Manager window.
  • Navigate to the folder where you saved your runbook file.
  • Right-click the file and select Delete.
  • If you saved the ticket simulation as a separate file, delete that file the same way.

Nice Work!

Nice Work!

You just worked through the three most common tier 1 helpdesk tickets using real Windows diagnostic tools on your own machine. You now have hands-on experience with the exact workflow a helpdesk technician uses every day: triage, diagnose, fix, or escalate.

Here's what you accomplished:

  • Ran real network diagnostic commands (ipconfig, ping, nslookup) and interpreted the results to pinpoint exactly where a connectivity failure lives.
  • Checked and managed critical Windows services (Print Spooler, Windows Audio, Windows Audio Endpoint Builder) and used Device Manager to verify hardware status.
  • Built a professional troubleshooting runbook with step-by-step diagnostic procedures and clear escalation criteria documenting exactly when a ticket is beyond tier 1 scope.
  • Wrote realistic helpdesk tickets as a ticket simulation, demonstrating professional documentation and triage skills.

This runbook is something you can reference in interviews when they ask you to walk through how you'd troubleshoot a connectivity, printer, or audio issue. You've already done it.

Ready to quiz yourself?