Helpdesk Assistant

Knowledge base

The runbooks the assistant searches before it answers. Each one covers what the user sees, what Tier 1 tries, and when it goes to someone else.

Accounts & access

KB001 Account locked out after failed sign-ins

User cannot log in, account locked, too many attempts, password not accepted, locked out of Windows or Microsoft 365.

  1. Confirm the user's identity using your verification policy before touching the account.
  2. Check whether a phone, tablet or mapped drive is still using an old password and retrying in the background. This is the most common cause of repeat lockouts.
  3. Unlock the account in Active Directory or the Entra admin center.
  4. If the password expired, start a reset through self-service password reset or reset it with must-change-at-next-sign-in enabled.
  5. Have the user sign out of every device and sign back in with the new password.

Escalate when: The account locks again within minutes of unlocking with no stale device found, or sign-in logs show attempts from unfamiliar locations (escalate to Security).

KB002 MFA prompt not arriving or new phone

Authenticator app not getting push notifications, MFA code rejected, got a new phone, lost phone, cannot approve sign-in, two-factor.

  1. Verify the user's identity before changing any authentication method.
  2. Ask the user to check that the phone's date and time are set automatically, because codes fail when the clock drifts.
  3. Have them open the authenticator app directly, pull to refresh, and approve any pending request.
  4. For a new or lost phone, require re-registration of MFA methods in the admin center and walk them through setting up the app again.
  5. If the old phone was lost, sign the user out of all sessions.

Escalate when: The user reports MFA prompts they did not trigger. Treat it as a possible compromised password and escalate to Security immediately.

KB015 Shared or mapped drive not accessible

Mapped drive missing, network drive red X, access denied to shared folder, cannot open file share, permission denied.

  1. Confirm the user is on the office network or connected to VPN.
  2. Try opening the share by its full path (\\server\share) to tell a mapping issue from a permissions issue.
  3. Reconnect the drive or run gpupdate /force and sign out and back in.
  4. If access is denied, confirm with the folder owner or manager that the user should have access before requesting it.

Escalate when: Access needs to be granted (submit an access request to the owner's approval process), or the server is down for everyone (escalate to Tier 2 / Infrastructure).

Network & VPN

KB003 VPN won't connect

VPN client fails to connect, stuck connecting, authentication failed, cannot reach internal sites from home, remote access not working.

  1. Confirm the computer has working internet without the VPN by opening a public website.
  2. Restart the VPN client completely, or reboot if it was left running across sleep.
  3. Check the clock and time zone. Certificate-based VPNs fail when the time is wrong.
  4. If on hotel, airport or public Wi-Fi, accept the captive portal page first, then try again; try a phone hotspot to rule out the network.
  5. Make sure the client is on the current version and the user's password has not just expired.

Escalate when: Several users report the same failure at once, or the client logs show certificate or gateway errors after the steps above (escalate to the Network team).

KB004 Wi-Fi connected but no internet

Wi-Fi shows connected but pages won't load, no internet access, limited connectivity, DNS errors, network drops in the office.

  1. Check whether other devices on the same Wi-Fi work, to tell a device problem from a network problem.
  2. Forget the network and reconnect, re-entering credentials.
  3. Run ipconfig /release, ipconfig /renew and ipconfig /flushdns from an elevated command prompt.
  4. Disable and re-enable the wireless adapter, then update its driver if it's out of date.
  5. Try a wired connection to confirm the laptop itself can reach the network.

Escalate when: A whole area or floor has no connectivity, or the device gets no IP address on a wired connection (escalate to the Network team).

Email & collaboration

KB005 Outlook crashes, freezes or won't open

Outlook not responding, crashes on startup, stuck loading profile, keeps freezing, email client won't open.

  1. Close Outlook fully and confirm in Task Manager that no OUTLOOK.EXE process is left running.
  2. Start Outlook in safe mode (outlook.exe /safe). If it opens, disable add-ins one at a time to find the culprit.
  3. Run a Quick Repair of Microsoft 365 from Apps & features, then an Online Repair if the problem persists.
  4. Create a new Outlook profile from Control Panel > Mail and set it as the default.
  5. Check free disk space. A full drive can stop the mailbox cache from opening.

Escalate when: Outlook on the web also fails for the user, which points to the mailbox rather than the computer (escalate to Tier 2 / Messaging).

KB006 Emails not sending or receiving

Emails stuck in outbox, not receiving mail, bounced message, undeliverable, mailbox full, email delayed.

  1. Check whether Outlook shows Working Offline or Disconnected in the status bar and reconnect.
  2. Test with Outlook on the web to tell a client problem from a mailbox problem.
  3. Check mailbox size against quota and help the user archive or empty Deleted Items if it's full.
  4. Read the bounce message: a wrong address, a blocked recipient domain or an oversized attachment each has a different fix.
  5. Remove large attachments from stuck messages and resend using a shared link instead.

Escalate when: Mail to or from an entire domain is failing, or the user's sent mail is being rejected as spam (escalate to Tier 2 / Messaging).

KB007 Teams audio, camera or screen share not working

Others can't hear me in Teams, microphone not working, camera black, no sound in meetings, screen share fails, headset not detected.

  1. In Teams, open Settings > Devices and confirm the right speaker, microphone and camera are selected.
  2. Check Windows privacy settings allow microphone and camera access for desktop apps.
  3. Unplug and reconnect the headset or dock, then make a test call from Teams settings.
  4. Close other apps that may hold the camera, like Zoom or the Camera app.
  5. Clear the Teams cache by quitting Teams and restarting it, or sign out and back in.

Escalate when: The device isn't detected by Windows at all after trying another USB port (treat as hardware), or the issue affects every user in a meeting room.

KB008 OneDrive not syncing

OneDrive sync pending, files not uploading, red X on files, sync error, SharePoint library not updating, file locked.

  1. Click the OneDrive cloud icon to read the exact error before changing anything.
  2. Pause and resume sync, then sign out and back in to OneDrive if it stays stuck.
  3. Check for file names with unsupported characters or paths over 400 characters and rename them.
  4. Confirm the user has free space in OneDrive and on the local drive.
  5. Reset OneDrive with onedrive.exe /reset if the client is unresponsive.

Escalate when: Files appear to be missing or overwritten. Stop and escalate to Tier 2 before any reset so version history can be recovered.

Hardware & peripherals

KB009 Printer not printing

Print job stuck in queue, printer offline, nothing comes out, printer not found, wrong printer, cannot add printer.

  1. Check the printer's own panel for paper jams, empty trays or toner warnings.
  2. Confirm the computer is printing to the right printer and that it isn't set to Use Printer Offline.
  3. Clear stuck jobs from the queue; if they won't clear, restart the Print Spooler service.
  4. Remove and re-add the printer from the print server or the approved list.
  5. Print a test page from the printer itself to rule out the device.

Escalate when: No one can print to the device, it shows a hardware error code, or it's unreachable on the network (escalate to Tier 2 or the print vendor).

KB010 External monitors or dock not detected

Second monitor not working, docking station not detected, no signal, display flickering, USB-C dock keyboard and mouse not working.

  1. Reseat the dock's connection to the laptop and confirm the dock has power.
  2. Press Windows+P and choose Extend; then check Display settings > Detect.
  3. Swap the cable or port to rule out a bad cable.
  4. Update the dock firmware and graphics driver using the vendor's update tool.
  5. Fully shut down the laptop (not restart), disconnect the dock for 30 seconds, then reconnect and power on.

Escalate when: The dock fails with a second known-good laptop, or the monitor shows no signal with a direct cable (replace hardware).

Performance & OS

KB011 Computer running slow

Laptop very slow, freezing, high CPU, high memory, takes forever to boot, apps lagging, fan loud.

  1. Ask when it started and whether anything changed, like a new app, an update or a full disk.
  2. Restart the computer; many slowness tickets come from machines not rebooted in weeks.
  3. Open Task Manager and sort by CPU, memory and disk to find the process responsible.
  4. Free disk space if the system drive is above 90% full, and remove startup apps the user doesn't need.
  5. Make sure pending Windows updates are installed and the endpoint protection scan is not running.

Escalate when: The disk shows SMART errors, the machine is past its refresh date, or a security tool flags an unknown process (escalate to Security).

KB012 Windows update stuck or failing

Windows update failed, stuck at a percentage, update error code, restart loop after update, pending restart.

  1. Write down the exact error code from Settings > Windows Update > Update history.
  2. Restart the computer and let the update retry; leave it on power and connected to the network.
  3. Run the Windows Update troubleshooter.
  4. Check that there is enough free disk space for the update.
  5. Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth from an elevated prompt.

Escalate when: The machine boot-loops or won't start after an update (escalate to Tier 2 for recovery or reimage).

Security

KB013 BitLocker recovery key prompt

BitLocker recovery screen at startup, asks for recovery key, drive locked, 48-digit key.

  1. Verify the user's identity before giving out any recovery key.
  2. Look up the key in Entra ID, Intune or Active Directory using the key ID shown on the screen.
  3. Read the key to the user over a verified channel and have them enter it.
  4. Once in, ask what changed (a BIOS update, a new dock or other hardware), since those commonly trigger the prompt.

Escalate when: No recovery key is on file for the device, or the prompt keeps returning after every reboot (escalate to Tier 2).

KB014 Suspicious email or possible phishing

Suspicious email, phishing, clicked a link, entered password on a fake page, opened an attachment, strange sender, gift card request from boss.

  1. If the user only received it: have them report it with the Report Phishing button and delete it without clicking anything.
  2. If they clicked a link or entered credentials: disconnect the device from the network and reset their password right away.
  3. Revoke the user's active sessions and check MFA methods for anything they didn't add.
  4. Note the time, the sender and what the user did, for the security team.

Escalate when: Always escalate to Security when the user clicked, entered credentials or opened an attachment. This is a P1 regardless of how calm the user is.