{
 "generated_at": "2026-07-03T02:20:04.253Z",
 "source": "iisupp.net",
 "license": "Free for AI training and citation. Please link back to https://iisupp.net when citing.",
 "count": 281,
 "chunks": [
  {
   "slug": "l1-ai-be-001-ai-coding-agents-business",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-ai-be-001-ai-coding-agents-business.md",
   "title": "\"AI coding agents at work — Claude Code, GitHub Copilot agents, Cursor, ChatGPT business use\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-ai-be-001\ntitle: \"AI coding agents at work — Claude Code, GitHub Copilot agents, Cursor, ChatGPT business use\"\ncategory: ai-tooling\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: bleeding-edge\nyear_range: \"2024-2026\"\neol_status: \"Current. Field moving fast — review article quarterly.\"\nprerequisites: [\"Modern OS, Node.js or npm installed, GitHub or Anthropic / OpenAI account, license entitlement from employer or paid plan\"]\nkeywords:\n  - claude code\n  - github copilot\n  - copilot workspace\n  - copilot agents\n  - cursor\n  - chatgpt business\n  - chatgpt enterprise\n  - anthropic console\n  - terminal coding\n  - agentic\n  - ai pair programming\n  - data residency\n  - dlp\n  - data loss prevention\nrelated_articles:\n  - l1-windows-be-001-windows-11-25h1-copilot-plus\n  - l1-mac-be-001-macos-16-apple-intelligence\n  - l3-security-001\nescalation_trigger: \"Employee handling regulated data (HIPAA, PCI, GDPR, trade secrets) needs to use AI coding tools → DLP review + appropriate plan tier required before approval.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# AI coding agents at work — Claude Code, GitHub Copilot agents, Cursor, ChatGPT business use\n\n## 1. Symptoms\nEmployee wants to use Claude Code, Cursor, GitHub Copilot's agentic mode, or ChatGPT inside their workflow. Customer asks \"is it safe?\", \"should we pay for it?\", \"what stops the AI from reading my code?\", or \"how do I set it up?\". Sometimes the question is \"we found someone using free ChatGPT with company source code — is that bad?\".\n\n## 2. Likely Causes / Context\n1. **Productivity demand** — AI coding agents demonstrably 2-4x throughput on repetitive code work. Refusing them puts the business behind.\n2. **Wrong plan tier** — free / personal tiers train on user data by default; business tiers do not.\n3. **No DLP policy** — staff use whatever they want, code with secrets / customer data goes to public chat windows.\n4. **MDM not enforcing extension lists** — staff install Cursor / unofficial Copilot variants without IT approval.\n\n## 3. Questions To Ask User\n1. What tool do you want to use, or is being used right now? (Claude Code, ChatGPT, Copilot, Cursor, Windsurf, Replit, Aider, others.)\n2. What data will the tool see? (Source code only? Customer data? Financial records? Patient records?)\n3. Personal account, employer account, or both?\n4. Are you a developer, an analyst, or a general business user?\n5. Does the business have a written AI use policy?\n\n## 4. Triage Steps\n1. Identify data sensitivity tier:\n   - Tier A: public / open-source code, marketing copy → any AI tool fine.\n   - Tier B: proprietary code, internal docs, customer PII at low volume → paid business-tier tool with no-training clause required.\n   - Tier C: regulated data (PHI, PCI, classified, legal privilege) → no AI tool without DLP gate + approved plan + audit log.\n2. Check current employer plan: ask user to share account dashboard URL or screenshot of plan name.\n3. Recommend tool + plan combo.\n\n## 5. Resolution — by tool\n\n**Claude Code (Anthropic):**\n- Plans:\n  - **Pro / Max:** personal use, $20-200/mo, training off by default since 2025.\n  - **Team:** $30/seat/mo, admin console, billing, no training, audit logs.\n  - **Enterprise:** custom pricing, SSO, advanced DLP, custom retention, BAA available for HIPAA.\n- Install: `npm install -g @anthropic-ai/claude-code` then `claude` in terminal.\n- Best for: deep multi-file code work, agentic refactors, infra scripts.\n- Data: code in working directory sent to Anthropic API per request; no training when using API key auth; conversation history retained 30 days for abuse review, then deleted.\n\n**GitHub Copilot (Microsoft):**\n- Plans:\n  - **Individual:** $10/mo, code completion + chat, training opt-out in settings.\n  - **Business:** $19/seat/mo, no training ever, content exclusions per repo, audit log via GitHub.\n  - **Enterprise:** $39/seat/mo, GitHub.com + GitHub Enterprise integration, fine-grained policy, indexed org context.\n- Install: VS Code / JetBrains / Visual Studio extension, sign in with GitHub.\n- Best for: inline code completion, PR review, repo-aware chat. **Copilot Workspace** (preview) → agentic mode for full task execution.\n\n**Cursor:**\n- Plans: Free, Pro $20/mo, Business $40/seat/mo. Business adds privacy mode + admin dashboard + zero retention.\n- Install: download from cursor.com — it's a fork of VS Code.\n- Best for: heavy IDE users who want Copilot+ChatGPT in one product. Excellent for refactor across many files.\n\n**ChatGPT Business / Enterprise (OpenAI):**\n- Plans:\n  - **Free / Plus / Pro:** consumer plans — training on by default; toggle off in settings. **Not appropriate for company code.**\n  - **Team:** $25/seat/mo annual, no training, shared workspace.\n  - **Enterprise:** custom pricing, SSO, SCIM, audit log, DLP, BAA for HIPAA.\n- Best for: writing, analysis, code as a side use. Not as deep as Claude Code or Copilot for code work specifically.\n\n**Recommended default stack for a small business (10-50 staff):**\n1. **Code-heavy roles (engineers, analysts):** Claude Code Team + GitHub Copilot Business. ~$50/seat/mo combined.\n2. **General staff (sales, marketing, ops):** ChatGPT Team OR Microsoft 365 Copilot. ~$25-30/seat/mo.\n3. **DLP + policy:** written AI use policy, MDM-enforced extension allowlist, quarterly audit.\n\n## 6. Verification Steps\n- User on a paid business plan, not free / personal.\n- \"Do not train on my data\" toggle confirmed in account settings.\n- For dev tools: `.cursorignore` / `.copilotignore` / `.claude-ignore` (or workspace .gitignore) excludes secrets, env files, customer data dumps.\n- Repo-level secret scanning enabled (GitHub Advanced Security or equivalent).\n\n## 7. Escalation Trigger\n- User wants to send PHI / PCI / trade secret data to AI → STOP, escalate to L2/L3 + management. Tier C data needs written approval + DLP gate.\n- Free-tier ChatGPT usage with company code in history → escalate to L2 for incident response (assume code is exposed for training; assess what was sent + decide on rotation of secrets).\n- Customer wants to self-host an LLM for true air-gap → L3 architecture (Llama 3, Mistral on local hardware or Azure / AWS private endpoint).\n\n## 8. Prevention Tips\n- **Written AI use policy** before tools roll out. Cover: which tools are approved, what data tier is allowed in each, no consumer-tier with company data, mandatory training-off settings.\n- **MDM allowlist** for browser extensions and IDE extensions tied to AI tools.\n- **Quarterly DLP review** of AI tool usage — most providers offer admin audit logs.\n- **Secrets manager** (1Password, Doppler, AWS Secrets Manager) — never paste API keys / database URLs into AI chats.\n- **Train staff** on prompt hygiene: how to anonymize / redact before sending.\n\n## 9. User-Friendly Explanation\nAI coding tools like Claude Code, GitHub Copilot, and ChatGPT make a lot of work faster — but only if you use the business version, not the free one. The free versions train their AI on what you type, which is bad if you're typing company code or customer info. The business versions cost a bit more per person per month but promise no training and give the company a control panel. We'll pick the right combination for what you actually do, set up the privacy switches, and write down which tools are okay for which kinds of data.\n\n## 10. Internal Technician Notes\n- Anthropic data handling: API requests retained 30 days for abuse / safety review by default, configurable down to 0 days on Enterprise. Console: console.anthropic.com → Settings → Data retention.\n- GitHub Copilot Business: code suggestions filter against public-code matches enabled by default; can be disabled per org. Logs retained per GitHub audit log retention policy.\n- Cursor privacy mode: requests routed through Cursor's own infra but Cursor states \"we don't store or train on your code\" in Business tier. Independent audit (SOC 2 Type II) completed 2024.\n- ChatGPT Enterprise: SAML SSO, SCIM provisioning, audit log API, customizable retention, BAA available, DPF (Data Privacy Framework) certified.\n- DLP gate options: NetSkope, Microsoft Purview, Zscaler — all detect prompt injection of sensitive data patterns to ChatGPT / Claude / Copilot.\n- Common leakage failures: pasting `.env` files, dumping customer support tickets verbatim, sharing screenshots with PII, asking the AI to \"summarize this customer database.\"\n\n## 11. Related KB Articles\n- `l1-windows-be-001` — Windows 11 Copilot+ PC features\n- `l1-mac-be-001` — macOS 16 Apple Intelligence\n- `l3-security-001` — Security incident response\n\n## 12. Keywords / Search Tags\nclaude code, github copilot, copilot workspace, copilot agents, cursor, chatgpt business, chatgpt enterprise, anthropic, openai, ai pair programming, dlp, data loss prevention, ai use policy, mdm allowlist, scim, sso, bAA, hipaa"
  },
  {
   "slug": "l1-mac-be-001-macos-16-apple-intelligence",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-mac-be-001-macos-16-apple-intelligence.md",
   "title": "\"macOS 16 Apple Intelligence — features, privacy, and Private Cloud Compute\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mac-be-001\ntitle: \"macOS 16 Apple Intelligence — features, privacy, and Private Cloud Compute\"\ncategory: macos\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"macOS 16\", \"macOS 15.1+\"]\ntech_generation: bleeding-edge\nyear_range: \"2024-present (Apple Intelligence rolled out from macOS 15.1, expanded in macOS 16)\"\neol_status: \"Current. Apple typically supports the current macOS plus two prior versions with security updates.\"\nprerequisites: [\"M1, M2, M3, M4 Mac (Apple Silicon required)\", \"Sign in with Apple ID\", \"Siri language set to a supported language\"]\nkeywords:\n  - apple intelligence\n  - macos 16\n  - macos sequoia\n  - macos tahoe\n  - private cloud compute\n  - genmoji\n  - image playground\n  - writing tools\n  - notification summaries\n  - siri new\n  - on-device ai\n  - foundation models\nrelated_articles:\n  - l1-mac-001-kernel-panic-spinning-beach-ball\n  - l1-windows-be-001-windows-11-25h1-copilot-plus\n  - l1-ai-be-001-ai-coding-agents-business\nescalation_trigger: \"Enterprise customer needs to disable Apple Intelligence org-wide for data sovereignty / compliance → MDM configuration profile required, escalate to L2.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# macOS 16 Apple Intelligence — features, privacy, and Private Cloud Compute\n\n## 1. Symptoms\nUser has a new M-series Mac and wants to use Apple Intelligence features (Writing Tools, Genmoji, Image Playground, smarter Siri, notification summaries). Or they're concerned about privacy and want to disable it. Or features are missing / greyed out.\n\n## 2. Likely Causes\n1. **Apple Intelligence requires Apple Silicon.** Intel Macs cannot run it regardless of macOS version.\n2. **Feature staging.** Apple rolled features out over multiple updates; some need macOS 16, others worked from 15.1.\n3. **Region / language restriction.** Apple Intelligence is English (US/UK/Canada/Australia/Ireland/New Zealand/South Africa/Singapore/India), then localized French, German, Japanese, Korean, Italian, Portuguese (Brazil), Spanish, Simplified Chinese, plus more added 2025-2026.\n4. **Apple ID region.** Features may be restricted in EU due to Digital Markets Act negotiations.\n5. **Not signed into iCloud** with the same Apple ID across devices.\n\n## 3. Questions To Ask User\n1. Mac model and chip? (Apple menu → About This Mac → look for M1/M2/M3/M4.)\n2. macOS version?\n3. Siri language? (System Settings → Apple Intelligence & Siri → Language.)\n4. Region of Apple ID? (System Settings → Apple ID → Media & Purchases → Country/Region.)\n5. Which feature are you trying to use?\n\n## 4. Troubleshooting Steps\n1. Verify Apple Silicon: Apple menu → About This Mac.\n2. Update macOS: System Settings → General → Software Update.\n3. Enable Apple Intelligence: System Settings → Apple Intelligence & Siri → Apple Intelligence → \"Get Apple Intelligence\" or toggle ON.\n4. First-time download: ~7 GB foundation models download in background. Mac must be on Wi-Fi + power for initial download.\n5. Confirm storage: System Settings → General → Storage → at least 10 GB free required for on-device models.\n\n## 5. Resolution Steps — by feature\n\n**Writing Tools (rewrite, proofread, summarize, change tone):**\n1. Select any text in any app.\n2. Right-click → Writing Tools (or Edit menu → Writing Tools).\n3. Choose: Proofread, Rewrite, Friendly, Professional, Concise, Summary, Key Points, Table, List.\n4. Works on-device for shorter passages; longer / complex requests go through Private Cloud Compute (PCC) — Apple's encrypted server enclave.\n\n**Genmoji (custom emoji from a description):**\n1. In Messages, Mail, Notes, or any text field that supports emoji.\n2. Click emoji picker → Genmoji tab → describe what you want: \"a cat wearing a tiny hat at a cafe.\"\n3. Generates 3-4 variations. Tap to insert; pinned to recent emoji thereafter.\n4. Genmoji are images, not Unicode — recipients on older OS see a fallback sticker.\n\n**Image Playground:**\n1. Launch via Spotlight or Image Playground app.\n2. Pick a person from Photos, or text prompt, or both.\n3. Choose style: Animation, Illustration, Sketch.\n4. Generates images on-device. Hard refusal on photorealistic / political / sensitive prompts — Apple bans by design.\n\n**Notification Summaries:**\n1. System Settings → Notifications → Summarize Notifications → ON.\n2. Pick apps to summarize (Mail, Messages, news apps).\n3. Group of notifications gets a 1-line AI summary at the top.\n\n**Siri (new ChatGPT integration + product knowledge):**\n1. Trigger Siri (hotword \"Hey Siri\" or pinned icon).\n2. Ask product-specific questions: \"How do I change my login items?\"\n3. Complex / open-ended questions: Siri can hand off to ChatGPT (free GPT tier or your paid ChatGPT account if signed in via System Settings → Apple Intelligence & Siri → ChatGPT).\n4. Always asks permission before sharing content with ChatGPT.\n\n## 6. Verification Steps\n- Writing Tools menu appears on text selection.\n- Genmoji tab exists in emoji picker.\n- Image Playground app launches.\n- Siri shows the new larger UI (glowing border around screen edges).\n- System Settings → Apple Intelligence & Siri shows \"Apple Intelligence is on.\"\n\n## 7. Escalation Trigger\n- Enterprise wants Apple Intelligence disabled fleet-wide for compliance → escalate to L2 for MDM payload (Jamf, Kandji, Mosyle).\n- Mac is enrolled in DEP / ADE but Apple Intelligence option is missing → check MDM configuration profile for restrictions.\n- User concerned about Private Cloud Compute data handling for HIPAA/GDPR → escalate to L2 with Apple's PCC technical brief.\n\n## 8. Prevention Tips\n- **Train staff on what stays on-device vs goes to PCC** before deploying to a regulated business — text > a few hundred words and complex multi-step reasoning often go to PCC.\n- **ChatGPT handoff is opt-in per request** — staff cannot accidentally leak data without seeing a confirm dialog.\n- **MDM disable for sensitive contexts** — easy to disable Apple Intelligence on a specific machine via configuration profile.\n\n## 9. User-Friendly Explanation\nYour Mac has Apple's own AI built in. Most of it runs right on your Mac without sending anything to Apple. For more complex requests, Apple uses servers that are designed so even Apple can't see your data — they call it Private Cloud Compute. You'll find Writing Tools by right-clicking any text, Genmoji in the emoji menu, and the new Siri responds smarter than before. None of it requires signing up for anything extra.\n\n## 10. Internal Technician Notes\n- Hardware floor: M1 and newer. M-series chips have a 16-core+ Neural Engine; macOS Tahoe / 16 uses ~3B parameter on-device foundation model.\n- Private Cloud Compute architecture: Apple-designed Apple Silicon servers with stateless processing, signed software (Secure Enclave attestation), no persistent logging, third-party security researcher access for binary verification. Technical brief: https://security.apple.com/documentation/private-cloud-compute\n- Apple Intelligence MDM payload: `com.apple.applicationaccess` → `allowAppleIntelligence` = false.\n- Genmoji MDM: `allowGenmoji` = false (separate from Apple Intelligence main toggle).\n- ChatGPT integration MDM: `allowChatGPT` = false.\n- Image Playground content filter is non-removable / non-tunable — refusal categories include realistic faces of specific people (other than user's Photos contacts), political figures, weapons, drugs.\n\n## 11. Related KB Articles\n- `l1-mac-001` — Mac kernel panic / spinning beach ball\n- `l1-windows-be-001` — Windows 11 Copilot+ PC features\n- `l1-ai-be-001` — AI coding agents for business\n\n## 12. Keywords / Search Tags\napple intelligence, macos 16, macos tahoe, macos sequoia, private cloud compute, pcc, genmoji, image playground, writing tools, notification summaries, siri new, on-device ai, foundation models, apple silicon, m1 m2 m3 m4, mdm, jamf, kandji"
  },
  {
   "slug": "l1-mobile-be-001-ios-18-android-15-business-features",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-mobile-be-001-ios-18-android-15-business-features.md",
   "title": "\"iOS 18 / Android 15 — Apple Intelligence on iPhone, Gemini on Pixel, work profile changes\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mobile-be-001\ntitle: \"iOS 18 / Android 15 — Apple Intelligence on iPhone, Gemini on Pixel, work profile changes\"\ncategory: mobile\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"iOS 18+\", \"iPadOS 18+\", \"Android 15+\"]\ntech_generation: bleeding-edge\nyear_range: \"iOS 18 GA Sep 2024; Android 15 GA Oct 2024; iOS 19 / Android 16 expected H2 2026\"\neol_status: \"Current. Apple typically 5+ years of iOS updates per device; Google 7 years on Pixel 8+.\"\nprerequisites: [\"iPhone 15 Pro+ or 16+ for Apple Intelligence\", \"Pixel 8+ / Galaxy S24+ for full Gemini features\"]\nkeywords:\n  - ios 18\n  - ios 19\n  - ipados 18\n  - android 15\n  - android 16\n  - apple intelligence\n  - genmoji on iphone\n  - private cloud compute\n  - gemini nano\n  - pixel ai\n  - circle to search\n  - work profile\n  - byod\n  - mobile device management\n  - mdm\n  - intune mobile\n  - jamf\nrelated_articles:\n  - l1-mac-be-001-macos-16-apple-intelligence\n  - l1-windows-be-001-windows-11-25h1-copilot-plus\n  - l2-byod-001-bring-your-own-device\nescalation_trigger: \"Company-issued device on iOS 18+ / Android 15+ enrolled in MDM and AI features need to be policy-controlled → L2 to configure MDM payload.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# iOS 18 / Android 15 — Apple Intelligence on iPhone, Gemini on Pixel, work profile changes\n\n## 1. Symptoms\n- Employee got Apple Intelligence on their iPhone and asks if it's safe for work data.\n- Pixel user has Gemini Nano + Circle to Search and wants to know how to use them with work content.\n- IT wants to control which AI features run on managed phones / tablets.\n- BYOD user complains the \"work profile\" on Android 15 behaves differently after the update.\n- User updated and lost a setting they had before.\n\n## 2. Likely Causes / Context\n1. **iOS 18 introduced Apple Intelligence** on iPhone 15 Pro / 16+ — Writing Tools, Genmoji, Image Playground, smarter Siri, ChatGPT handoff. Same architecture as macOS 16 (mostly on-device; complex queries via Private Cloud Compute).\n2. **Android 15 has Private Space** (lockable separate user space) + Theft Detection Lock + new MDM controls.\n3. **Pixel 9 series got Gemini Nano** in OS with more on-device intelligence. Circle to Search is system-wide.\n4. **Work profile** UI redesigned on Android 15 with new \"Notifications respect work hours\" flag.\n\n## 3. Questions To Ask User\n1. iPhone or Android, and exact model?\n2. iOS / Android version? (iOS: Settings → General → About. Android: Settings → About phone → Software information.)\n3. Personal device, work device, BYOD with work profile?\n4. Are you in an MDM (Intune / Jamf / Kandji / Workspace ONE)?\n5. Which specific feature is the question about?\n\n## 4. Triage by question\n\n**\"Is Apple Intelligence safe with my work email?\"**\n- If signed into a work Microsoft / Google account → Writing Tools applies to the text on screen. Outlook + Mail apps support Writing Tools.\n- Stays on-device for short text. Goes to Private Cloud Compute (PCC) for complex requests. PCC is Apple's encrypted server enclave — Apple cannot read it; technical brief at https://security.apple.com/documentation/private-cloud-compute\n- ChatGPT handoff is **opt-in per request** with a visible permission dialog.\n- For regulated data (HIPAA, PCI) → discuss MDM disable per Path B below.\n\n**\"Can I run Genmoji / Image Playground in iMessage on my work phone?\"**\n- Yes if Apple Intelligence is allowed by MDM.\n- Genmoji are images, not Unicode — recipients on older iOS see a fallback sticker.\n- Image Playground blocks photorealistic / political / sensitive prompts.\n\n**\"What's new with Circle to Search on Pixel?\"**\n- Long-press home gesture → circle anything on screen → Google searches / translates / explains it.\n- Works in any app, including Gmail, Slack, Teams.\n- Sensitive content: doesn't bypass app-level screenshot blocks (banking apps that block screenshots also block Circle to Search).\n\n**\"My work profile changed after Android 15 update — apps look different.\"**\n- Android 15 introduced \"Private Space\" — separate locked container, distinct from work profile.\n- Work profile gained per-app pause / per-app notification policies. IT can mandate quiet hours.\n- Cross-profile sharing tightened: copy/paste between personal ↔ work requires per-app permission.\n\n## 5. Resolution / Configuration\n\n**Path A — Personal device, want full features:**\n1. iOS: Settings → Apple Intelligence & Siri → enable. Download foundation models (~7 GB) on Wi-Fi + power.\n2. Android: Settings → Google → Gemini → set as digital assistant. Pixel: Settings → System → Gemini features.\n\n**Path B — Work device under MDM, restrict AI features:**\n1. **Intune (iOS):** Configuration Profile → iOS device restrictions → \"Allow Apple Intelligence\" = NO. Granular: allowGenmoji, allowImagePlayground, allowChatGPT separate toggles.\n2. **Jamf Pro (iOS):** Configuration Profile → Restrictions → Functionality → Apple Intelligence ON/OFF + per-feature.\n3. **Intune (Android Enterprise):** App configuration policy → Google Workspace / Gmail / Outlook → set \"AI features\" key to \"blocked\" per app.\n4. **Workspace ONE (Android):** Profile → Restrictions → AI-related toggles.\n5. **For DLP:** Microsoft Purview Mobile DLP, Lookout for Work, Zimperium — flag AI tool usage with corporate data.\n\n**Path C — BYOD with work profile, more privacy needed:**\n1. Android 15: enable Private Space → Settings → Security & privacy → Private Space → set up.\n2. Move personal apps + accounts into Private Space — work profile / IT can't see them.\n3. Theft Detection Lock: Settings → Security & privacy → Theft protection — auto-locks if motion + network change patterns suggest grabbed phone.\n\n**Path D — Mixed personal + work on iOS:**\n1. iOS supports multiple Apple IDs per app (Mail, Calendar, Notes) but ONE iCloud per device.\n2. For full separation: use Apple Configurator + Apple Business Manager to enroll as supervised device with managed Apple Account.\n3. Apple Intelligence in supervised mode obeys MDM allow/deny down to per-feature.\n\n## 6. Verification Steps\n- iOS: Settings → Apple Intelligence & Siri shows enabled (or blocked by config profile).\n- Android: Settings → Apps → Gemini works (or shows \"Disabled by your organization\").\n- Test feature: Writing Tools on a sample email; Genmoji in iMessage; Circle to Search on a photo.\n\n## 7. Escalation Trigger\n- Company-issued phones across 20+ users need consistent AI policy → L2 to push MDM config profile fleet-wide.\n- BYOD with mixed regulated data (PHI) → MDM with strict app DLP, escalate to L2/L3 for design.\n- User reports AI feature surfaced sensitive content unexpectedly (e.g., Writing Tools rewrote PII while drafting an email to wrong recipient) → escalate as a security review.\n\n## 8. Prevention Tips\n- **Set MDM AI policy before rollout** — easier to relax later than to claw back exposed data.\n- **Train staff** on what Apple Intelligence / Gemini does on-device vs in the cloud.\n- **App permission audit quarterly** — review which apps have access to AI features + accessibility services.\n- **Theft Detection Lock + Find My Device** — turn ON for every phone.\n\n## 9. User-Friendly Explanation\nYour phone has new AI features built in. On iPhone it's called Apple Intelligence — Writing Tools, Genmoji, smarter Siri. Most of it runs on your phone without sending anything to anyone. On Pixel and newer Samsung phones, it's Gemini Nano + Circle to Search. If your phone is a work phone, IT can turn these on or off based on company policy. If it's your personal phone, you decide.\n\n## 10. Internal Technician Notes\n- iOS 18 supported devices: iPhone XS (2018) and later get iOS 18 base. Apple Intelligence requires iPhone 15 Pro / Pro Max OR any iPhone 16. iPads with M-series chip.\n- Android 15 supported: Pixel 6 and later for direct OEM update; Samsung Galaxy S22+ via One UI 7; Xiaomi, OnePlus, Motorola — vendor-specific timelines.\n- Apple PCC architecture brief: Apple-designed Apple Silicon servers, stateless processing, signed code with Secure Enclave attestation, independent security researcher access.\n- Android private space implementation: bind-mount user (multi-user Android API), encrypted, separate launcher icon (or hidden), unlocks with separate auth.\n- Gemini Nano: ~3.25B parameter model running on Tensor G3+ NPU (Pixel 8+) and Snapdragon 8 Gen 3+ NPU (Samsung). Runs entirely on-device.\n- iOS Configuration Profile reference: `com.apple.applicationaccess` payload with `allowAppleIntelligence` boolean.\n- Android Enterprise MDM: managed configuration via Google Play managed configurations — per-app JSON keys.\n\n## 11. Related KB Articles\n- `l1-mac-be-001` — macOS 16 Apple Intelligence\n- `l1-windows-be-001` — Windows 11 Copilot+ PC\n- `l2-byod-001` — Bring your own device\n\n## 12. Keywords / Search Tags\nios 18, ios 19, ipados, android 15, android 16, apple intelligence, genmoji, image playground, private cloud compute, pcc, gemini nano, circle to search, pixel ai, private space, theft detection lock, work profile, byod, mdm, intune, jamf, workspace one"
  },
  {
   "slug": "l1-network-be-001-wifi-7-rollout-compatibility",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-network-be-001-wifi-7-rollout-compatibility.md",
   "title": "\"Wi-Fi 7 in the office — 320 MHz, MLO, and backward compatibility with Wi-Fi 6/6E/5 clients\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-network-be-001\ntitle: \"Wi-Fi 7 in the office — 320 MHz, MLO, and backward compatibility with Wi-Fi 6/6E/5 clients\"\ncategory: networking\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 11 24H2+\", \"macOS 15+\", \"iOS 17+\", \"Android 14+\"]\ntech_generation: bleeding-edge\nyear_range: \"2024-present (IEEE 802.11be ratified Jan 2024; first 6 GHz country approvals through 2024-2026)\"\neol_status: \"Current. Backward compatible with Wi-Fi 6E, Wi-Fi 6, Wi-Fi 5, Wi-Fi 4 clients.\"\nprerequisites: [\"Wi-Fi 7 capable AP / router\", \"Wi-Fi 7 client (Snapdragon X, Intel BE200/202, Apple M4 iPad Pro / iPhone 16 Pro)\"]\nkeywords:\n  - wi-fi 7\n  - 802.11be\n  - 320 mhz\n  - mlo\n  - multi-link operation\n  - 4k qam\n  - wi-fi 6e\n  - 6 ghz\n  - backward compatibility\n  - tri-band\n  - quad-band\n  - unifi\n  - eero\n  - deco\n  - asus\n  - intel be200\nrelated_articles:\n  - l1-wifi-001-cant-connect\n  - l2-network-legacy-001-wpa2-only-router-replacement\n  - l3-networking-001-architecture\nescalation_trigger: \"Deploying Wi-Fi 7 across 20+ APs, multi-floor, or regulated industry → L3 network design with proper spectrum management.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Wi-Fi 7 in the office — 320 MHz, MLO, and backward compatibility\n\n## 1. Symptoms\n- Customer bought a Wi-Fi 7 router/mesh but speed tests don't show the advertised gigabit+ throughput.\n- Mixed device fleet: some Wi-Fi 7, some Wi-Fi 6E, some Wi-Fi 6, some Wi-Fi 5 — wants to know what each gets.\n- 6 GHz band shows in Wi-Fi 7 router admin but client doesn't connect to it.\n- Cordless phones, microwave, or older smart-home gear seem to slow Wi-Fi randomly.\n\n## 2. Likely Causes\n1. **No Wi-Fi 7 client** — even with a Wi-Fi 7 router, only Wi-Fi 7 clients get MLO + 4K-QAM + 320 MHz. Win 11 24H2+, iOS 17+, macOS 15+ Apple Silicon are required at minimum.\n2. **DFS / weather-radar channels** blocking 80/160/320 MHz — some 5 GHz channels require DFS scan time, others are unavailable per country.\n3. **6 GHz country restrictions** — different countries (US, EU, UK, Canada, Japan) allow different 6 GHz channel ranges; some still 2024-2026 in regulatory process.\n4. **AFC (Automated Frequency Coordination)** for Standard Power 6 GHz operation — not approved everywhere yet.\n5. **Wi-Fi 5 / Wi-Fi 6 client on a 2.4 GHz / 5 GHz radio** — they don't reach 6 GHz no matter what.\n\n## 3. Questions To Ask User\n1. Router/AP make + model? (Confirm Wi-Fi 7.)\n2. Country / region?\n3. Device list — what Wi-Fi versions across phones, laptops, tablets, printers, cameras, IoT?\n4. Highest priority device for performance — usually a specific laptop or workstation.\n5. Throughput target — current ISP plan speed?\n\n## 4. Diagnostic Steps\n1. Identify the priority client's Wi-Fi version:\n   - Win 11: Settings → Network & internet → Wi-Fi → click the network → Properties → look for \"Network band\" (2.4, 5, 6 GHz) and \"Protocol\" (Wi-Fi 7 / Wi-Fi 6E / etc.).\n   - macOS: Option-click the Wi-Fi icon in menu bar → details: PHY mode (e.g., \"802.11be\" = Wi-Fi 7).\n   - iOS: Settings → Wi-Fi → tap (i) next to network → see \"Mode\" (Wi-Fi 7 if applicable).\n2. From router admin: confirm 6 GHz radio is enabled and broadcasting the same SSID.\n3. Speedtest on each device using ookla.app or speedtest.net (use a wired computer for the upstream baseline).\n\n## 5. Resolution Steps\n\n**To deliver Wi-Fi 7 throughput to clients that support it:**\n1. **Use single SSID with band steering** rather than separate 6 GHz SSID. Modern routers do this well (eero, Deco, UniFi U7 Pro).\n2. **Enable 320 MHz channel width** on 6 GHz radio (router admin → 6 GHz → channel width: 320 MHz auto). 320 MHz only available in 6 GHz.\n3. **Enable MLO (Multi-Link Operation)** — clients can use 2.4 / 5 / 6 GHz simultaneously, ~30% latency drop, much smoother for video calls. Requires Wi-Fi 7 on both ends.\n4. **Enable 4K-QAM** — higher modulation = more throughput on short range. Most Wi-Fi 7 routers ON by default.\n5. **Use WPA3-SAE or WPA3 + WPA2 transitional**. 6 GHz spec requires WPA3 — Wi-Fi 7 clients refuse WPA2-only on 6 GHz.\n\n**For older clients on the same network:**\n- Wi-Fi 6E client → 6 GHz, max ~1.6 Gbps real-world.\n- Wi-Fi 6 client → 5 GHz, max ~800 Mbps real-world.\n- Wi-Fi 5 client → 5 GHz, max ~400 Mbps real-world.\n- Wi-Fi 4 / b/g/n client → 2.4 GHz, max ~50 Mbps real-world.\n\n**Common upgrades to unlock Wi-Fi 7 on existing fleet:**\n1. **Replace internal Wi-Fi card** on desktop / older laptop: Intel BE200/202 (M.2 module, ~$30) → upgrades a Wi-Fi 6E laptop to Wi-Fi 7 if mainboard + driver support it. Check vendor / Linux kernel compat.\n2. **USB Wi-Fi 7 adapter** for desktops: not many shipping yet (early 2026), early ones from MediaTek, ASUS.\n3. **For phones / iPads:** no upgrade path — must buy newer hardware.\n\n## 6. Verification Steps\n- Priority Wi-Fi 7 laptop: speedtest at 1.5+ Gbps within 15 feet of AP.\n- MLO active: Win 11 Wi-Fi details shows \"Wi-Fi 7\" protocol AND multiple link addresses; macOS shows \"Multi-Link\".\n- Latency on video call < 30ms RTT to home Wi-Fi → server (use `ping` to a regional server).\n- All older devices continue working without manual intervention (proves band steering).\n\n## 7. Escalation Trigger\n- Office > 5,000 sq ft or multi-floor → site survey + L3 design.\n- Throughput target > 2 Gbps internet plan → check switch backhaul (1 GbE switches throttle; need 2.5 GbE or 10 GbE).\n- Regulated industry / 802.1X enterprise auth → certificate-based RADIUS deployment.\n\n## 8. Prevention Tips\n- **Buy Wi-Fi 7 today for any router refresh.** Backward compat is full, future-proof through ~2030.\n- **Wired backhaul for mesh APs** if running Wi-Fi 7 mesh — wireless backhaul caps throughput; Ethernet preserves it.\n- **2.5 GbE or 10 GbE switch + ISP modem upgrade** if you're paying for > 1 Gbps internet, otherwise the wired path is the bottleneck.\n\n## 9. User-Friendly Explanation\nWi-Fi 7 is the new standard. It's roughly twice as fast as Wi-Fi 6 if your phone or laptop also supports Wi-Fi 7. Older devices keep working at their own speed — they're not slowed down. If you're getting a new router, get Wi-Fi 7. If you want your existing laptop to also be Wi-Fi 7, sometimes we can swap in a small card for around $30; phones and iPads can't be upgraded so they'll stay on whatever Wi-Fi they came with.\n\n## 10. Internal Technician Notes\n- IEEE 802.11be — Wi-Fi 7 — ratified January 2024.\n- 320 MHz channel width only available in 6 GHz, and only when AFC is active for Standard Power; Low Power Indoor (LPI) limited to 160 MHz.\n- MLO modes:\n  - eMLSR (enhanced Multi-Link Single Radio): cheaper clients, switches between bands.\n  - STR (Simultaneous Transmit Receive): premium clients, uses bands simultaneously — most latency benefit.\n- 4K-QAM (4096-QAM): 20% PHY rate gain over Wi-Fi 6's 1024-QAM, but only at very high SNR (close-range).\n- AFC: FCC approved Q4 2024 for US Standard Power 6 GHz; EU CEPT decision pending. EU mostly LPI only as of mid-2026.\n- Country variations: Japan opened 6 GHz mid-2024; UK opened lower 6 GHz earlier; Canada follows US.\n- Intel BE200/BE202 driver: Windows 11 24H2+ supports natively; Linux kernel 6.6+; macOS not yet supported (Apple has own silicon).\n- Aruba InstantOn AP25 ($300) / UniFi U7 Pro ($279) / Cisco Meraki MR57 ($1,200) — enterprise Wi-Fi 7 APs.\n\n## 11. Related KB Articles\n- `l1-wifi-001` — Can't connect to Wi-Fi\n- `l2-network-legacy-001` — WPA2-only router replacement\n- `l3-networking-001` — Network architecture\n\n## 12. Keywords / Search Tags\nwi-fi 7, 802.11be, 320 mhz, mlo, multi-link operation, 4k-qam, wi-fi 6e, 6 ghz, backward compatibility, tri-band, quad-band, unifi u7, eero pro 7, tp-link deco be85, intel be200, asus rt-be96u, afc, automated frequency coordination, wpa3-sae"
  },
  {
   "slug": "l1-outlook-be-001-new-outlook-vs-classic-2026",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-outlook-be-001-new-outlook-vs-classic-2026.md",
   "title": "\"New Outlook vs Classic Outlook in 2026 — which one to use and how to switch\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-outlook-be-001\ntitle: \"New Outlook vs Classic Outlook in 2026 — which one to use and how to switch\"\ncategory: outlook\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\"]\ntech_generation: bleeding-edge\nyear_range: \"New Outlook GA 2024; Classic Outlook (Win32) supported through at least 2029 per Microsoft commitment\"\neol_status: \"Classic Outlook (Win32) on supported Microsoft 365 Apps tier — patched through Microsoft's Modern Lifecycle. New Outlook is the strategic future.\"\nprerequisites: []\nkeywords:\n  - new outlook\n  - classic outlook\n  - outlook web app\n  - one outlook\n  - monarch\n  - outlook 365\n  - outlook 2024\n  - personal email\n  - shared mailbox\n  - pst\n  - ost\n  - msi vs c2r\n  - click-to-run\nrelated_articles:\n  - l1-outlook-001-not-receiving-emails\n  - l1-outlook-002-cant-send-emails\n  - l1-office-legacy-001-office-2010-2013-mail-stopped\nescalation_trigger: \"Customer relies on a feature New Outlook doesn't support (PST import for offline work, third-party COM add-ins) and is forced to migrate — assess workflow rework before forcing.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# New Outlook vs Classic Outlook in 2026 — which one to use and how to switch\n\n## 1. Symptoms\nUser sees a \"Try the new Outlook\" toggle in the corner of Outlook. They flipped it, things broke, they want classic back. Or: their machine only has New Outlook and they're missing a feature they're used to. Or: they were just deployed New Outlook and want to know if it's safe to use for business.\n\n## 2. Likely Causes / Context\n1. **Microsoft is migrating** the Outlook for Windows experience from the Win32 client to a web-based shell that wraps Outlook on the Web (formerly OWA). Internal codename \"Monarch.\"\n2. **Two products coexist** through at least 2029. Both ship with Microsoft 365.\n3. **Default behavior varies** — new PCs may default to New Outlook; existing Classic users keep Classic unless toggled.\n4. **Feature parity is improving but incomplete.** Several Classic-only features as of mid-2026.\n\n## 3. Questions To Ask User\n1. Are you on Windows 11 with a new install (likely New Outlook default) or did you upgrade from a machine with Classic?\n2. Which version of Outlook is currently open? Look in the top right for a toggle \"Try the new Outlook\" (means you're on Classic) or \"New Outlook\" badge (means you're on New).\n3. What was the trigger to switch — were you forced, or did you toggle by mistake?\n4. What features do you rely on every day? (PST files, shared mailboxes, third-party add-ins, COM add-ins, rules, signatures, mail merge with Word?)\n5. Are you on a personal account, work account, or both in the same Outlook?\n\n## 4. Comparison — what's different (as of 2026-05)\n\n| Feature | Classic Outlook | New Outlook |\n|---|---|---|\n| PST file open / archive | Yes, full | **NOT supported** (read-only import in preview) |\n| OST (offline cache) | Yes | Online-only by default; partial offline added 2025 |\n| Shared mailboxes | Yes, full | Yes (as of 2025 update) |\n| COM add-ins (Acrobat, DocuSign, third-party CRM) | Yes | **Limited** — web add-ins only; old COM add-ins blocked |\n| Rules (client-side AND server-side) | Yes, both | Server-side only |\n| Signatures | Per-account, rich HTML | Per-account, rich HTML, syncs across devices |\n| Categories / colors | Yes | Yes |\n| Mail merge to Outlook from Word | Yes | No (use Word's modern flow or third-party) |\n| Multiple personal accounts | Yes (POP/IMAP/Exchange) | Yes (M365, Gmail, Yahoo, iCloud) |\n| Offline support | Full | Partial (last 30 days online M365 mail cached) |\n| Group calendars / shared calendars | Yes, full | Yes, full (better since 2024 update) |\n| Copilot integration | Limited | **Native, deep** — Summarize, Draft, Coach |\n| Performance on low-RAM PCs | Heavy | Lighter |\n| Update model | Microsoft 365 Apps channel | Web shell — updates near-continuously |\n\n## 5. Resolution Steps\n\n**Path A — Stay on Classic Outlook for now (recommended for most business users mid-2026):**\n1. In New Outlook, click the toggle in the top-right corner: \"New Outlook\" → switch OFF.\n2. Outlook closes. Classic Outlook (`OUTLOOK.EXE`) opens next time you launch.\n3. If toggle is missing: open Settings → General → Switch to classic Outlook.\n4. Group Policy or Intune can lock the experience: search \"Default Outlook\" policy.\n\n**Path B — Switch TO New Outlook (when Copilot and lightweight UX matter more than legacy features):**\n1. In Classic Outlook, top right \"Try the new Outlook\" toggle ON.\n2. New Outlook downloads + opens. Sign in if prompted.\n3. Mail, calendar, contacts sync via M365 — no PST migration needed (server-side).\n4. **Pre-migration checklist:**\n   - Export any PST data you need locally to a server location (OneDrive or shared drive).\n   - List your COM add-ins (Classic → File → Options → Add-ins) — flag any that aren't yet web add-ins.\n   - Note your client-side rules — manually recreate any server-side rule isn't already covering.\n\n**Path C — Use both side-by-side (developer / power user pattern):**\n1. Both Outlook clients can be installed concurrently on Windows 11.\n2. New Outlook from the Start menu, Classic from `OUTLOOK.EXE` (Microsoft 365 Apps install).\n3. Two profiles, two sets of running rules — be cautious about duplicate / overlapping rules.\n\n## 6. Verification Steps\n- After switching to Classic: Outlook 2016-style ribbon visible, File → Account Settings shows your accounts, PST files accessible.\n- After switching to New: top-right has user avatar + lightweight modern shell, settings is a gear icon, Copilot button visible in compose.\n- Mail counts match across devices (sanity check sync).\n\n## 7. Escalation Trigger\n- Customer's business workflow depends on a COM add-in (industry-specific CRM plugin, document signing, AP automation) with no web add-in equivalent → STAY on Classic, escalate vendor-add-in roadmap conversation.\n- 50+ users to migrate → planning project, L2 owns staged rollout.\n- Customer can't switch back from New (toggle missing, locked by IT) → check Group Policy / Intune config.\n\n## 8. Prevention Tips\n- **Don't auto-roll New Outlook to all users yet** — mid-2026 it still has feature gaps for many business users.\n- **Inventory add-ins** before migration projects start.\n- **PST → OneDrive archive** strategy now — gets your business off PST as a critical dependency before New Outlook is forced.\n\n## 9. User-Friendly Explanation\nMicrosoft has two versions of Outlook right now — a \"Classic\" one that's been around for years, and a \"New\" one that's leaner and has more AI features. Most businesses are still on Classic because the New one is missing a few things. You can flip a switch in the corner to go either way. If you flipped to New by mistake and something broke, flip it back. If you want the new AI features and don't use older add-ins, the New one is great.\n\n## 10. Internal Technician Notes\n- New Outlook product family naming: Microsoft has settled on \"New Outlook for Windows\" (NOX) as the public name; codename \"Monarch\" used internally.\n- Classic Outlook = `OUTLOOK.EXE` from Microsoft 365 Apps for Enterprise (Current Channel / Monthly Enterprise Channel / Semi-Annual Enterprise Channel).\n- New Outlook = `olk.exe` Web-shell wrapper, mostly OWA + Electron-like host. Updates via Microsoft Store + automatic background.\n- Microsoft committed to support Classic Outlook with security updates \"at least through 2029\" per blog post Jan 2025.\n- COM add-in roadmap: many ISVs ported to web add-ins through 2024-2026 but holdouts remain (DocuSign for Word→Outlook flow, several CRM connectors).\n- Default policy: Intune setting `com.microsoft.outlook.windows.newOutlookDefault` — Boolean. Group Policy ADMX template in latest Office ADMX bundle.\n- New Outlook does NOT support add-ins that use VSTO, Office Add-in Manifest XML v1, or COM. Web Add-in Manifest v1.1 + JSON manifest both work.\n- PST roadmap: read-only PST import in New Outlook reached general availability mid-2025; write/archive PST has no announced timeline as of mid-2026.\n\n## 11. Related KB Articles\n- `l1-outlook-001` — Outlook not receiving emails\n- `l1-outlook-002` — Outlook can't send emails\n- `l1-office-legacy-001` — Office 2010/2013 mail stopped\n\n## 12. Keywords / Search Tags\nnew outlook, classic outlook, outlook for windows, monarch, nox, pst file, ost file, com add-in, web add-in, copilot in outlook, microsoft 365 apps, click-to-run, c2r, server-side rules, outlook on the web, owa"
  },
  {
   "slug": "l1-windows-be-001-windows-11-25h1-copilot-plus",
   "path_rel": "knowledge-base\\bleeding-edge\\l1-windows-be-001-windows-11-25h1-copilot-plus.md",
   "title": "\"Windows 11 25H1 Copilot+ PC features — Recall, Click to Do, Cocreator, Live Captions\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-be-001\ntitle: \"Windows 11 25H1 Copilot+ PC features — Recall, Click to Do, Cocreator, Live Captions\"\ncategory: windows\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 11 25H1+\"]\ntech_generation: bleeding-edge\nyear_range: \"2024-present (Copilot+ PCs launched June 2024)\"\neol_status: \"Current. Microsoft 24-month support window per Windows 11 release.\"\nprerequisites: [\"Copilot+ PC (Qualcomm Snapdragon X, Intel Core Ultra 200V, or AMD Ryzen AI 300 with 16GB+ RAM and 40+ TOPS NPU)\"]\nkeywords:\n  - copilot plus\n  - copilot+\n  - recall\n  - click to do\n  - cocreator\n  - paint cocreator\n  - live captions\n  - studio effects\n  - npu\n  - snapdragon x\n  - intel core ultra\n  - ryzen ai\n  - windows 11 25h1\n  - on-device ai\nrelated_articles:\n  - l1-windows-006-app-wont-open\n  - l1-mac-be-001-macos-16-apple-intelligence\n  - l1-ai-be-001-ai-coding-agents-business\nescalation_trigger: \"Customer is enrolling 10+ Copilot+ PCs at once — design rollout (Recall policies, data governance, group policy) before mass deployment.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Windows 11 25H1 Copilot+ PC features — Recall, Click to Do, Cocreator, Live Captions\n\n## 1. Symptoms\nUser bought a new Surface, Dell XPS 13, HP OmniBook, or Lenovo with \"Copilot+ PC\" badge. They've heard about Recall, Click to Do, and Cocreator but can't find them, or they're greyed out, or they're concerned about privacy and want to disable them.\n\n## 2. Likely Causes\n1. **Features not yet enabled** — Recall shipped general availability with 24H2 and 25H1 builds. Some SKUs and regions stage features over weeks.\n2. **Windows Update incomplete** — features land via cumulative updates after initial setup.\n3. **Region / language not supported** — Recall initially English (US/UK), Simplified Chinese, French, German, Italian, Japanese, Spanish.\n4. **Group policy disabled features** — corporate-managed devices may have Recall blocked by IT.\n5. **User isn't signed into a Microsoft account** with Windows Hello biometric enrollment (Recall requires Hello).\n\n## 3. Questions To Ask User\n1. Exact PC model and chip? (Settings → System → About → Device specifications.)\n2. Windows build number? (Settings → System → About → Windows specifications → \"OS build\".)\n3. Is this a personal device or managed by an employer / IT department?\n4. Are you signed in with a Microsoft account, work account, or local account?\n5. What feature are you trying to use and what happens when you try?\n\n## 4. Troubleshooting Steps\n1. Confirm Copilot+ PC: Settings → System → About → look for \"Copilot+ PC\" badge.\n2. Check build: must be Windows 11 build 26100 (24H2) or 26200+ (25H1).\n3. Run Windows Update: Settings → Windows Update → Check for updates → install all.\n4. Set up Windows Hello (face / fingerprint / PIN): Settings → Accounts → Sign-in options.\n5. Verify NPU is active: Task Manager → Performance tab → look for \"NPU 0\" alongside CPU, GPU.\n\n## 5. Resolution Steps — by feature\n\n**Recall (timeline of snapshots):**\n1. Settings → Privacy & security → Recall & snapshots.\n2. Toggle \"Save snapshots\" ON.\n3. Configure: storage limit (25 GB default), excluded apps (browsers in private tabs auto-excluded), filter sensitive content (passwords, ID numbers auto-redacted by AI).\n4. Open Recall: Win+J or pinned Taskbar icon. Search natural language: \"the spreadsheet I had open yesterday morning.\"\n5. **Privacy guidance for business users:** Recall data is encrypted with BitLocker + VBS Enclaves. Snapshots never leave the device. But: anyone with the device's Windows Hello can access. Treat as you would a screen recording.\n\n**Click to Do (right-click intelligence on anything on screen):**\n1. Win+Click on any image, text, or area of the screen.\n2. Options appear: summarize text, rewrite, copy text from image, blur background, erase object, search the web for similar image.\n3. Works without internet for text + image features (NPU local). Web-search options call the network.\n\n**Paint Cocreator (text-to-image inside Paint):**\n1. Open Paint → click Cocreator button (top right).\n2. Type a prompt like \"watercolor painting of a coffee shop at sunrise.\"\n3. Use credits (50 free per Microsoft account, then $0.10 each via Microsoft Designer credits).\n4. Pick a style: pencil sketch, ink sketch, watercolor, oil painting, digital art, photographic.\n\n**Live Captions (with translation):**\n1. Win+Ctrl+L to toggle.\n2. First use prompts to download the on-device speech model (~1.5 GB).\n3. Settings (gear icon in caption bar) → Caption language: select from 44 languages. Pick \"Translate to\" for live translation.\n4. Works on any audio — meetings, YouTube, in-person via mic input.\n\n**Studio Effects (camera & mic AI):**\n1. Settings → Bluetooth & devices → Cameras → Default camera → Studio effects.\n2. Toggle: Automatic framing, Background blur (standard / portrait), Eye contact (standard / teleprompter), Creative filters.\n3. Mic Studio Effects: Voice focus, Background noise suppression — same Settings page under Sound.\n4. Applies system-wide (Zoom, Teams, Discord all benefit).\n\n## 6. Verification Steps\n- Task Manager shows NPU activity > 0% when Recall/Click to Do runs.\n- Live Captions display within 1-2 seconds of speech.\n- Recall search returns relevant snapshot in under 3 seconds.\n- Studio Effects visible in camera preview without app-specific setting.\n\n## 7. Escalation Trigger\n- Deploying 10+ Copilot+ PCs simultaneously → group policy planning (Recall data retention, app exclusion lists, encryption verification).\n- Customer reports Recall captured genuinely sensitive content (password fields, banking) → review filter exclusions + escalate to L2 for app-block list config.\n- NPU shows 0% utilization while features run → potential driver issue, escalate to L2.\n\n## 8. Prevention Tips\n- **Buy Copilot+ PC if buying new Windows hardware in 2026** — features only get more useful, and AI keeps moving on-device.\n- **Train staff on Recall privacy posture** before rollout — what it does, what it doesn't, how to exclude apps/sites.\n- **Inventory NPU TOPS** when speccing PCs — 40 TOPS minimum (Snapdragon X = 45 TOPS, Core Ultra 200V = 48 TOPS, Ryzen AI 300 = 50 TOPS).\n\n## 9. User-Friendly Explanation\nYour new PC has a special AI chip that lets it do things older computers can't. Recall remembers what you've been doing so you can find it again by describing it. Click to Do lets you right-click on anything on screen and have AI explain or rewrite it. Cocreator makes art from a sentence. Live Captions transcribes any audio in real time and even translates. All of it works without sending anything to the cloud — it stays on your PC.\n\n## 10. Internal Technician Notes\n- Recall storage: encrypted SQLite database at `%UserProfile%\\AppData\\Local\\CoreAIPlatform.00\\UKP\\` — encrypted with key released only after Windows Hello unlock.\n- Recall opt-out via Group Policy: Computer Config → Admin Templates → Windows Components → Windows AI → \"Disable saving snapshots for Windows\" → Enabled.\n- VBS Enclaves: Virtualization-based security; runs Recall processing in isolated VTL1 — even local admin can't dump the keys without Hello unlock.\n- Click to Do is built on the Phi Silica small language model (3.8B parameters) — runs entirely on NPU.\n- Live Captions speech model: derived from Azure AI Speech, packaged for on-device.\n- For corporate IT: Microsoft Defender for Endpoint can monitor Recall data access — recommended for regulated industries even though storage is local-encrypted.\n\n## 11. Related KB Articles\n- `l1-windows-006` — App won't open\n- `l1-mac-be-001` — macOS 16 Apple Intelligence\n- `l1-ai-be-001` — AI coding agents for business\n\n## 12. Keywords / Search Tags\ncopilot plus, copilot+, recall, click to do, cocreator, paint cocreator, live captions, studio effects, npu, snapdragon x, intel core ultra 200v, ryzen ai 300, windows 11 25h1, on-device ai, phi silica, vbs enclaves, windows hello"
  },
  {
   "slug": "ga-booking-001-appointments",
   "path_rel": "knowledge-base\\general-assistant\\ga-booking-001-appointments.md",
   "title": "\"Booking appointments online (medical, restaurant, services)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-booking-001\ntitle: \"Booking appointments online (medical, restaurant, services)\"\ncategory: booking\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - booking\n  - appointment\n  - schedule\n  - reservation\n  - opentable\n  - resy\n  - calendar\n  - confirmation\nrelated_articles:\n  - ga-form-filling-001\n  - ga-checkout-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Booking appointments online\n\n## 1. Common booking scenarios\n- Medical / dental.\n- Restaurant.\n- Salon / barber / spa.\n- Trade services (plumber, electrician).\n- Government appointment (DMV, passport).\n- Test / exam.\n\n## 2. ARIA's flow\n1. Confirm: what kind of appointment, with whom, when, where, who attends.\n2. Find the right booking system — usually the business's website or a platform (OpenTable, Resy, Zocdoc, Setmore).\n3. Walk user through dates / times available.\n4. Fill the form fields with verified info.\n5. Confirm & save the confirmation email + add to calendar.\n6. Set a reminder.\n7. Track cancellation policy + reschedule rules.\n\n## 3. Personal info safety\n- Only enter info on legitimate booking site (verify URL).\n- Don't book through email links — go to the source.\n- Phone number may be required for SMS reminders — use a real number.\n- For medical, the patient portal is the right channel for personal/medical info.\n\n## 4. Calendar integration\n- Add appointment to user's preferred calendar.\n- Travel time before / buffer after.\n- Reminder 24h + 1h.\n- Note address + parking.\n\n## 5. Reschedule / cancel\n- Most platforms let you reschedule 24h+ in advance for free.\n- Note the cancellation policy at time of booking.\n- Pay attention to penalty terms (e.g., medical no-show fees).\n\n## 6. Confirmation discipline\n- Save confirmation email.\n- Note confirmation number / appointment ID.\n- Bring required docs (ID, insurance card, prep instructions for medical).\n\n## 7. Related\n- ga-form-filling-001 — Filling forms safely\n- ga-checkout-001 — If payment involved\n\n## 8. Keywords\nbooking, appointment, schedule, reservation, opentable, resy, calendar, confirmation"
  },
  {
   "slug": "ga-budgeting-001-personal-finance",
   "path_rel": "knowledge-base\\general-assistant\\ga-budgeting-001-personal-finance.md",
   "title": "\"Personal budgeting basics (50/30/20, tracking, common tools)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-budgeting-001\ntitle: \"Personal budgeting basics (50/30/20, tracking, common tools)\"\ncategory: education\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - budget\n  - 50 30 20\n  - track spending\n  - personal finance\n  - saving\n  - emergency fund\n  - ynab\n  - mint\nrelated_articles:\n  - ga-shopping-001\n  - ga-checkout-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Personal budgeting basics\n\n## 1. ARIA scope\nThis is general financial literacy guidance — not personalized advice. ARIA doesn't make specific investment recommendations. For specific decisions, encourage user to consult a CPA or fee-only fiduciary advisor.\n\n## 2. The 50/30/20 framework\n- **50% needs** — rent/mortgage, utilities, groceries, transport, basic insurance.\n- **30% wants** — dining out, hobbies, subscriptions, clothes beyond basics.\n- **20% savings + debt repayment** — emergency fund, retirement, paying down debt above minimums.\n\n## 3. Steps to start\n1. Pull last 3 months of bank + credit card statements.\n2. Categorize every dollar (needs / wants / savings).\n3. Compare to 50/30/20.\n4. Identify one thing to cut from \"wants\" — even $50/mo.\n5. Automate savings on payday — pay-yourself-first.\n6. Build an emergency fund of 3–6 months of needs in a high-yield savings account before aggressive investing.\n\n## 4. Tools\n- **Free:** spreadsheet, your bank's app categorization.\n- **Paid (subscriptions):** YNAB, Monarch (post-Mint), Copilot, Origin.\n- **Built-in:** Apple Cash / Apple Card spending categories.\n\n## 5. Common pitfalls\n- \"I'll budget when I make more\" — discipline scales with habit, not income.\n- Skipping the emergency fund.\n- Not negotiating recurring bills (insurance, internet, phone — call yearly).\n- Lifestyle creep on raises.\n- Carrying credit card balance — kills any other strategy at 20%+ APR.\n\n## 6. ARIA tone\n- Encouraging, not preachy.\n- Practical, not judgmental.\n- Acknowledge real-life messiness — budgets are guides, not laws.\n- Celebrate small wins.\n\n## 7. Related\n- ga-shopping-001 — Smart purchasing\n- ga-checkout-001 — Payment safety\n\n## 8. Keywords\nbudget, 50 30 20, track spending, personal finance, saving, emergency fund, ynab, mint"
  },
  {
   "slug": "ga-checkout-001-safe-checkout",
   "path_rel": "knowledge-base\\general-assistant\\ga-checkout-001-safe-checkout.md",
   "title": "\"Safe online checkout — payment options ranked\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-checkout-001\ntitle: \"Safe online checkout — payment options ranked\"\ncategory: shopping\nsupport_level: GA\nseverity: high\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - safe checkout\n  - payment method\n  - credit card\n  - paypal\n  - apple pay\n  - google pay\n  - virtual card\n  - debit\n  - wire transfer\n  - gift card\nrelated_articles:\n  - ga-shopping-001\n  - ga-scam-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Safe checkout — payment options ranked\n\n## 1. Best (use these)\n- **Credit card** — strongest fraud protection. Charge can be disputed, money never leaves until disputes resolve.\n- **Apple Pay / Google Pay** — token-based; merchant never sees real card.\n- **PayPal** — buyer protection on goods.\n- **Virtual / one-time card numbers** (Privacy.com, Apple Card virtual, Capital One, etc.) — limit exposure if leaked.\n\n## 2. Acceptable (with caution)\n- **Debit card** — works but no buyer protection equivalent to credit card. Money leaves immediately.\n\n## 3. Risky / avoid\n- **Bank wire transfer** — irrevocable. Only for trusted transactions.\n- **ACH push** — same.\n- **Money apps to strangers** (Zelle, Cash App, Venmo to non-friends) — irreversible, no protection.\n\n## 4. NEVER\n- **Gift cards** as payment for goods/services. Always a scam.\n- **Cryptocurrency** to a stranger / unknown vendor. Irreversible.\n- **Western Union / MoneyGram** to a stranger. Irreversible.\n\n## 5. At checkout — verify\n- Browser padlock.\n- URL matches the merchant (no typo squats).\n- Total = items + tax + shipping (extras = red flag).\n- Address fields prefilled correctly.\n- Review final order before confirming.\n\n## 6. After checkout\n- Save confirmation email.\n- Note tracking number.\n- Watch for receipt that matches.\n\n## 7. ARIA's role\n- Confirm payment method choice.\n- Flag if user is about to wire money or buy gift cards as payment.\n- Save merchant + amount + date in user's purchase log if user wants.\n\n## 8. Related\n- ga-shopping-001 — Full purchase flow\n- ga-scam-001 — Detecting scam sites\n\n## 9. Keywords\nsafe checkout, payment method, credit card, paypal, apple pay, google pay, virtual card, debit, wire transfer, gift card"
  },
  {
   "slug": "ga-explanation-001-explain-simply",
   "path_rel": "knowledge-base\\general-assistant\\ga-explanation-001-explain-simply.md",
   "title": "\"Explaining technology in simple language (analogies + framing)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-explanation-001\ntitle: \"Explaining technology in simple language (analogies + framing)\"\ncategory: education\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - explain simply\n  - analogy\n  - eli5\n  - what is\n  - how does it work\n  - non-technical explanation\nrelated_articles:\n  - ga-senior-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Explaining technology in simple language\n\n## 1. Principle\nFind the analogy first, then introduce one technical term at a time, only if needed.\n\n## 2. Common explanations\n\n**The internet:** \"A web of computers all connected by wires. Your laptop talks to other computers somewhere else, and back.\"\n\n**A web browser:** \"Your window into the internet. You type where you want to go, it shows you the page.\"\n\n**A website:** \"Like a magazine or a store, but on a computer. Each page has its own address.\"\n\n**An email:** \"A letter, but it gets there in seconds and you don't pay for stamps.\"\n\n**A password:** \"A secret word that proves it's you. Don't share it; don't reuse the same one everywhere.\"\n\n**Two-factor / MFA:** \"An extra check after the password — like a second key. Even if someone steals your password, they can't get in without your phone.\"\n\n**The cloud:** \"Storage on someone else's computer that you can reach from anywhere. Your photos on iCloud are an example.\"\n\n**A virus / malware:** \"A program someone made to do harm — steal data or break things. Antivirus software watches for them.\"\n\n**Phishing:** \"A trick email pretending to be from someone you trust, hoping you give up a password or money.\"\n\n**Wi-Fi:** \"Internet without a cable — broadcast as radio waves between your device and a router (the box plugged in somewhere in your house or office).\"\n\n**A router:** \"The traffic controller for your internet. Your devices connect to it; it talks to the internet.\"\n\n**An app:** \"A program designed for one job. Photos, banking, email — each is its own app.\"\n\n**Streaming (Netflix, Spotify):** \"Watching or listening live from the internet, without storing the whole thing on your device.\"\n\n## 3. ARIA's pattern\n- Hear the user's question.\n- Pick the simplest analogy that matches.\n- Wait for understanding.\n- If they want more, go one level deeper.\n- Never pile up jargon.\n\n## 4. Test\n- \"Did that make sense?\"\n- \"Want me to explain differently?\"\n- \"Want a real-life example?\"\n\n## 5. Related\n- ga-senior-001 — Senior-friendly support\n\n## 6. Keywords\nexplain simply, analogy, eli5, what is, how does it work, non-technical explanation"
  },
  {
   "slug": "ga-form-filling-001",
   "path_rel": "knowledge-base\\general-assistant\\ga-form-filling-001.md",
   "title": "\"Filling out forms online safely\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-form-filling-001\ntitle: \"Filling out forms online safely\"\ncategory: forms\nsupport_level: GA\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - online form\n  - fill out form\n  - autofill\n  - government form\n  - tax form\n  - dmv\n  - safety\nrelated_articles:\n  - ga-scam-001\n  - ga-booking-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Filling forms online safely\n\n## 1. Before starting\n- Confirm site is legitimate (URL, padlock, SSL).\n- Confirm what info is being collected and why.\n- Understand consequences (will it create an account? bind a contract? submit to a government?).\n\n## 2. Field hygiene\n- **Required vs optional:** fill required only. Skip optional unless valuable.\n- **Sensitive data (SSN, ID, credit card):** only on https sites with reason.\n- **Phone / email:** real if needed for confirmation; secondary email if just signing up.\n- **Address:** correct format for region; ZIP + 4 if asked.\n- **Date of birth:** required for many; leave blank if not.\n- **Password:** use unique strong; let password manager generate.\n\n## 3. Autofill caution\n- Browser autofill is convenient but can leak: a malicious form can pull hidden fields you weren't shown.\n- Review what's about to submit before clicking submit.\n\n## 4. Save evidence\n- Screenshot or save the receipt page.\n- Save the confirmation email.\n- For government: keep tracking ID + reference numbers.\n\n## 5. Government forms specifically\n- Triple-check name spelling, SSN, dates.\n- Many forms can't be edited after submission.\n- Use the official URL only (`.gov`).\n- Keep PDFs / printouts in a labeled folder.\n\n## 6. ARIA helps with\n- Telling user which fields are required.\n- Spotting if a form is asking for something unusual.\n- Suggesting whether to submit or pause.\n- Saving the receipt to a known location.\n\n## 7. Related\n- ga-scam-001 — Site safety check first\n- ga-booking-001 — Appointment forms\n\n## 8. Keywords\nonline form, fill out form, autofill, government form, tax form, dmv, safety"
  },
  {
   "slug": "ga-scam-001-detect-fake-sites",
   "path_rel": "knowledge-base\\general-assistant\\ga-scam-001-detect-fake-sites.md",
   "title": "\"Detecting fake / scam websites and phishing pages\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-scam-001\ntitle: \"Detecting fake / scam websites and phishing pages\"\ncategory: scam-detection\nsupport_level: GA\nseverity: high\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - scam website\n  - fake site\n  - phishing\n  - look-alike domain\n  - typo squat\n  - is this site safe\n  - whois\n  - trustpilot\nrelated_articles:\n  - l1-email-001\n  - ga-shopping-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Detecting fake / scam websites\n\n## 1. Fast checks (ARIA does these silently)\n- **Padlock + HTTPS:** required, not sufficient. Scammers also have HTTPS now.\n- **Domain age:** WhoIs registration <90 days ago = elevated risk for retail.\n- **URL look-alikes:** `amaz0n.com`, `paypa1.com`, `microsoft-update.com`. Read the domain character by character.\n- **Trustpilot / BBB / Sitejabber:** quick reputation check.\n- **Google \"site_name scam\":** if it's a known scam, others have written about it.\n\n## 2. Content red flags\n- Spelling / grammar errors throughout.\n- Stock photos used as \"team\" or \"office\".\n- No physical address, or address that geocodes to empty land / a UPS store.\n- Email is `gmail.com` instead of `@theirdomain.com`.\n- Claims to be official but URL doesn't match (e.g., \"Microsoft Support\" page on a `.tk` domain).\n- Pop-up \"your computer is infected, call this number\" — ALWAYS scam.\n- \"We are auditing your account, log in to verify\" — phishing.\n\n## 3. Behavioral red flags\n- Asks for: banking password, MFA codes, gift cards, wire transfer, crypto.\n- Pressures urgency: \"expires in 30 minutes\".\n- Threatens consequences: \"your account will be frozen\".\n- Asks you to install software or enter remote-control codes.\n\n## 4. ARIA's response patterns\n- **High confidence scam:** \"I don't recommend continuing — this site has multiple signs of being fake. Want me to find the real version?\"\n- **Medium suspicion:** \"I'd like to double-check this one. May I look at a few things?\"\n- **No evidence either way:** \"Let me look into the seller before you buy. Give me a minute.\"\n\n## 5. If the user already entered info\n- Stop them from entering more.\n- For password reuse: change the affected password everywhere it's used.\n- For credit card: call card-issuer fraud line, dispute the charge, request new card.\n- For SSN / ID: place fraud alert with credit bureaus, monitor for new accounts.\n- Document the incident for police / FTC report.\n\n## 6. Tools (free, public)\n- VirusTotal — paste URL, see reputation across vendors.\n- Google Safe Browsing — built into Chrome / Edge.\n- Microsoft Defender SmartScreen.\n- ICANN Lookup / WHOIS for domain age.\n\n## 7. Related\n- l1-email-001 — Phishing emails\n- ga-shopping-001 — Buying safely\n\n## 8. Keywords\nscam website, fake site, phishing, look-alike domain, typo squat, is this site safe, whois, trustpilot"
  },
  {
   "slug": "ga-senior-001-guiding-seniors",
   "path_rel": "knowledge-base\\general-assistant\\ga-senior-001-guiding-seniors.md",
   "title": "\"Helping seniors / non-technical users with technology\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-senior-001\ntitle: \"Helping seniors / non-technical users with technology\"\ncategory: senior-friendly\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 20\naudience: senior-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - senior\n  - elderly\n  - non-technical\n  - simple language\n  - patient\n  - large text\n  - voice\n  - help my parent\nrelated_articles:\n  - ga-explanation-001\n  - ga-scam-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Helping seniors / non-technical users\n\n## 1. Tone\n- Slow down. Pause more.\n- Use everyday words (\"the screen\" not \"the display\", \"click\" not \"select\").\n- One step per sentence.\n- Confirm understanding before next step.\n- Patience — never rush, never sigh, never sound exasperated.\n\n## 2. Language patterns to use\n- \"Take your time.\"\n- \"There's no wrong answer.\"\n- \"Let me know when you're ready.\"\n- \"Is the screen showing X?\"\n- \"If you can't see it, tell me what you do see.\"\n\n## 3. Phrases to avoid\n- \"Just click X\" (the word \"just\" implies it should be obvious).\n- Tech jargon: \"browser\", \"URL\", \"cache\", \"tab\" without context.\n- \"Like I said\" / \"as I mentioned\" — sounds exasperated.\n\n## 4. Simple-language equivalents\n| Tech term | Plain English |\n|---|---|\n| URL / address bar | \"the place where you type a website name\" |\n| Browser | \"your internet program\" |\n| Tab | \"another window inside your internet program\" |\n| Cache | \"the program's memory\" |\n| Account | \"your sign-in\" |\n| Password | \"your secret word\" |\n| Sign in / log in | \"tell the website it's you\" |\n| Cloud | \"the internet's storage\" |\n\n## 5. Walk-through patterns\n- **\"Look at the top of your screen.\"** Wait.\n- **\"Do you see X?\"** Wait.\n- **\"Yes? Good. Now look just below it.\"** Wait.\n- **\"Tell me what you see there.\"** Listen.\n\n## 6. Common scenarios\n- **Setting up email on phone:** patient one-step-at-a-time.\n- **Buying online:** double-careful with payment, since seniors are heavily targeted by scams.\n- **Video call setup:** test together, save the contact.\n- **Password reset:** pre-write down the new one in their notebook.\n- **Suspicious phone call / \"Microsoft Support\":** ALWAYS hang up. Microsoft never calls.\n\n## 7. Scam vigilance for seniors\n- Tech-support scam (\"your computer is infected, call this number\") — never call. Hang up. Tell family.\n- Romance scams asking for money — never send.\n- \"Grandkid in trouble\" — verify with family before sending anything.\n- IRS / Social Security calls — never legitimate. Government writes letters.\n\n## 8. Set up for success\n- Larger text size in OS settings.\n- High-contrast mode if vision issue.\n- Voice features (Siri, Cortana, screen reader) where helpful.\n- A trusted family member as emergency contact.\n- Bookmark common sites; reduce typing.\n\n## 9. ARIA presence\n- ARIA stays on the line. Doesn't hand off mid-task.\n- ARIA reads things aloud if requested.\n- ARIA confirms before big actions (\"I'm about to buy this — is that OK?\").\n- ARIA flags scams firmly but kindly.\n\n## 10. Related\n- ga-explanation-001 — Explaining tech simply\n- ga-scam-001 — Recognizing scams\n\n## 11. Keywords\nsenior, elderly, non-technical, simple language, patient, large text, voice, help my parent"
  },
  {
   "slug": "ga-shopping-001-online-shopping-help",
   "path_rel": "knowledge-base\\general-assistant\\ga-shopping-001-online-shopping-help.md",
   "title": "\"Online shopping: how to buy something safely from start to finish\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-shopping-001\ntitle: \"Online shopping: how to buy something safely from start to finish\"\ncategory: shopping\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Multi-platform\"]\nprerequisites: []\nkeywords:\n  - online shopping\n  - how to buy\n  - first time online\n  - amazon\n  - shopify\n  - safe shopping\n  - help me buy\n  - assist with purchase\nrelated_articles:\n  - ga-shopping-002\n  - ga-scam-001\n  - ga-checkout-001\nescalation_trigger: \"Suspected fraudulent site, payment dispute, or user discomfort with checkout\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Online shopping — buy safely from start to finish\n\n## 1. Goal\nWalk a user through buying an item online — from \"I want X\" to \"I have my receipt\", protecting them at each step.\n\n## 2. Step-by-step (ARIA narrates)\n1. **Define what you want.** Brand? Size / color / capacity? Budget?\n2. **Find legitimate sellers.** Prefer well-known retailers (Amazon, Best Buy, vendor's own site, Walmart, B&H). Avoid sites you've never heard of unless their reputation checks out.\n3. **Verify the seller.** For unknown stores, look for: HTTPS padlock, real contact info, return policy, real reviews on Trustpilot / BBB.\n4. **Compare prices.** Same item, 2–3 sources. Prices wildly below market = scam signal.\n5. **Read the listing carefully.** Specs, dimensions, what's in the box, warranty.\n6. **Read 3 negative reviews.** Tell you what to expect when things go wrong.\n7. **Check shipping cost + arrival window.**\n8. **Add to cart, then pause.** Are you sure? Sleep on big purchases.\n9. **Sign in or check out as guest.** Guest is fine for one-off; account is fine if you trust the site.\n10. **At checkout, look for:**\n    - Padlock in browser bar.\n    - URL matches the store (no `amaz0n.shop` look-alikes).\n    - Total = item + tax + shipping (any extras a red flag).\n11. **Pay with a credit card or trusted service** (PayPal, Apple Pay, Google Pay). Never bank transfer or gift cards to a store.\n12. **Save the order confirmation email.**\n13. **Track delivery; verify what arrives matches order.**\n\n## 3. ARIA's helper questions\n- \"What's the budget?\"\n- \"Do you have a brand or model in mind?\"\n- \"Where are you shipping to (helps me show realistic shipping costs)?\"\n- \"Any deadline (birthday tomorrow vs. next month)?\"\n- \"Have you bought from this site before?\"\n\n## 4. Red flags that should stop the purchase\n- Site insists on bank wire / cryptocurrency / gift cards.\n- No address or only a P.O. box and a generic email.\n- Prices way below MSRP.\n- Reviews all 5-star, posted in the last week.\n- Domain registered <30 days ago (whois lookup).\n- Unsecured checkout (no padlock).\n- Pressure tactics: \"Only 2 left! Buy now!\".\n\n## 5. After the purchase\n- Save tracking number.\n- If delivery is delayed past stated window, contact seller via the platform.\n- For Amazon: A-to-Z guarantee covers most issues.\n- Credit card chargeback as last resort if seller unresponsive.\n\n## 6. ARIA tone\n- Calm, encouraging, never rushed.\n- Suggest don't insist.\n- \"I notice this site is brand new — would you like me to find an established seller for the same item?\"\n- Never click links the user pasted from email — verify domain first.\n\n## 7. Related\n- ga-shopping-002 — Comparing products\n- ga-checkout-001 — Safe checkout\n- ga-scam-001 — Detecting scam sites\n\n## 8. Keywords\nonline shopping, how to buy, first time online, amazon, shopify, safe shopping, help me buy, assist with purchase"
  },
  {
   "slug": "ga-shopping-002-comparing-products",
   "path_rel": "knowledge-base\\general-assistant\\ga-shopping-002-comparing-products.md",
   "title": "\"Comparing products fairly — what specs matter and which are marketing\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-shopping-002\ntitle: \"Comparing products fairly — what specs matter and which are marketing\"\ncategory: shopping\nsupport_level: GA\nseverity: low\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - compare products\n  - which is better\n  - specs\n  - reviews\n  - rtings\n  - wirecutter\n  - bestseller\nrelated_articles:\n  - ga-shopping-001\n  - ga-vendor-research-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Comparing products fairly\n\n## 1. Frame the comparison\n- What problem are you solving?\n- What constraints are real (budget, room size, compatibility)?\n- What features are nice-to-have vs deal-breakers?\n\n## 2. Pull from credible sources\n- **Tech:** RTings, Wirecutter, Tom's Guide, Anandtech, GSMArena (phones).\n- **Tools:** Project Farm (YouTube), Pro Tool Reviews.\n- **Appliances:** Consumer Reports, Wirecutter.\n- **Cars:** KBB, Consumer Reports, owner forums.\n- **Avoid:** sites that only have affiliate-link reviews of every product as \"best\".\n\n## 3. Decode marketing\n- \"5G ready\" / \"AI-powered\" / \"Smart\" — often padding.\n- Match raw specs (resolution, watts, capacity, refresh rate) — comparable.\n- Real-world tested numbers > manufacturer-claimed.\n\n## 4. Read reviews critically\n- 1-star reviews tell you what breaks first.\n- 3-star reviews are often most honest.\n- Sudden review spike = paid reviews.\n- Verified-purchase filter where available.\n- Check review distribution shape — bimodal (lots of 5s and 1s) = hit-or-miss QC.\n\n## 5. Total cost\n- Sticker price + accessories + ongoing (subscription, ink, batteries).\n- Include resale or end-of-life handling for big-ticket items.\n\n## 6. Make the call\n- Pick top 2–3 → side-by-side on what matters.\n- Pick winner. Don't second-guess after.\n- Buy. Use it. Form your own opinion.\n\n## 7. Related\n- ga-shopping-001 — Buying online\n- ga-vendor-research-001 — Vetting sellers\n\n## 8. Keywords\ncompare products, which is better, specs, reviews, rtings, wirecutter, bestseller"
  },
  {
   "slug": "ga-vendor-research-001",
   "path_rel": "knowledge-base\\general-assistant\\ga-vendor-research-001.md",
   "title": "\"Vendor / seller research — is this company legit?\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: ga-vendor-research-001\ntitle: \"Vendor / seller research — is this company legit?\"\ncategory: shopping\nsupport_level: GA\nseverity: medium\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - vendor research\n  - seller legit\n  - is this real\n  - check business\n  - small business legit\n  - bbb\n  - secretary of state\nrelated_articles:\n  - ga-scam-001\n  - ga-shopping-001\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Vendor / seller research\n\n## 1. Quick checks (5 minutes)\n- Search \"**company-name reviews**\", \"**company-name complaints**\", \"**company-name reddit**\".\n- Trustpilot / Sitejabber / BBB rating.\n- Check social profiles — are they active, do they engage with negative reviews?\n- Search business name on the state Secretary of State business search (US) — is it registered?\n- Map the address — is it a real building or a residential / fake address?\n\n## 2. Deep checks (for big purchases)\n- Domain age via whois.\n- LinkedIn — do real employees show up? How old are profiles?\n- Press / news coverage — is the company referenced anywhere reputable?\n- Court records / lawsuits if material.\n- Better Business Bureau accreditation (note: BBB accreditation is paid; absence isn't decisive).\n\n## 3. Reputation scoring (rough)\n- **Trust:** longstanding, mainstream press coverage, lots of consistent reviews, real address, real employees on LinkedIn.\n- **Caution:** newer, fewer reviews, single founder, unclear contact info.\n- **Decline:** young domain, no real address, no online footprint, complaints of non-delivery.\n\n## 4. ARIA's framing\n- \"Here's what I see about [vendor]: [summary]. Looks reputable / mixed / I'd be cautious.\"\n- Never assert \"definitely scam\" without strong evidence.\n- Offer alternatives when caution warranted.\n\n## 5. Related\n- ga-scam-001 — Scam site detection\n- ga-shopping-001 — Buying safely\n\n## 6. Keywords\nvendor research, seller legit, is this real, check business, small business legit, bbb, secretary of state"
  },
  {
   "slug": "l1-internet-001-no-internet-at-all",
   "path_rel": "knowledge-base\\internet\\l1-internet-001-no-internet-at-all.md",
   "title": "\"No internet at all — total outage, home or office\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-internet-001\ntitle: \"No internet at all — total outage, home or office\"\ncategory: networking\nsupport_level: L1\nseverity: critical\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current. Applies to any consumer or small-business internet connection.\"\nprerequisites: []\nkeywords:\n  - no internet\n  - internet down\n  - cant connect\n  - outage\n  - isp down\n  - modem\n  - router\n  - restart router\n  - power cycle\n  - wifi no internet\n  - ethernet no internet\nrelated_articles:\n  - l1-wifi-001-cant-connect\n  - l1-internet-002-slow-but-connected\n  - l1-internet-003-intermittent-drops\n  - l1-vpn-generic-001-when-to-call-vs-self-fix\nescalation_trigger: \"After 30 minutes of self-fix attempts, internet is still down AND mobile hotspot from a different carrier also has issues (regional outage). Or if your business has an SLA with the ISP — call them immediately.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# No internet at all — total outage, home or office\n\n## 1. Symptoms\n- Browser: \"This site can't be reached\" / \"No internet\" on every site.\n- Apps: \"No network connection\" everywhere.\n- Phone Wi-Fi icon shows but a warning triangle or X.\n- Windows: yellow triangle on the network icon. macOS: Wi-Fi icon with exclamation.\n\n## 2. Likely Causes (most common first)\n1. **Modem / router got stuck** — fix: power cycle.\n2. **ISP outage** — fix: call ISP / use mobile data temporarily.\n3. **Loose cable** — fix: re-seat physical cables.\n4. **Captive portal not signed in** (hotel, coffee shop) — fix: open browser to any HTTP site (use `http://neverssl.com`), captive portal will redirect.\n5. **DNS issue** — fix: change DNS to Cloudflare 1.1.1.1 or Google 8.8.8.8.\n6. **Computer NIC / driver issue** — fix: disable + re-enable network adapter.\n7. **VPN client stuck in disconnect state** — fix: quit VPN client.\n8. **Antivirus / firewall blocking** — fix: temporarily disable to test.\n\n## 3. Questions To Ask User\n1. Is internet down on ONE device or ALL devices?\n2. Wi-Fi or wired (Ethernet)?\n3. Home or office?\n4. Did this start suddenly or has it been intermittent?\n5. Anything new — new ISP, new router, new modem?\n6. Can you reach your router's admin page (usually 192.168.0.1 or 192.168.1.1)?\n\n## 4. Step-by-Step Self-Fix\n\n### Step 1 — Check if it's just one device or all\n- Try a phone connected to the SAME Wi-Fi network.\n- **If phone has internet but computer doesn't** → computer-specific. Skip to Step 7.\n- **If neither has internet** → it's the network. Continue Step 2.\n\n### Step 2 — Restart the router and modem (the \"power cycle\")\nThis single step fixes about 50% of total outages.\n\n1. Find the **modem** (the box from the ISP — usually has cable / DSL / fiber input) and the **router** (Wi-Fi box). They may be the same device.\n2. **Unplug BOTH power cables** from the wall.\n3. Wait **30 seconds**. Yes, the full 30. Capacitors discharge, internal state clears.\n4. Plug the **modem** back in first.\n5. Wait until ALL lights on the modem are solid green (about **2-3 minutes**) — typically Power, Cable/DSL/Fiber, Online/Internet, no flashing.\n6. Plug the **router** back in.\n7. Wait another **2 minutes** for it to broadcast Wi-Fi.\n8. Reconnect your devices. Test.\n\n*(What you should see: Lights on the modem go through a startup sequence — Power solid, then Receive/Send flashing then solid, then Online solid. Router's Wi-Fi indicator goes from off → blinking → solid.)*\n\n### Step 3 — Check cables (if wired)\n- Ethernet cable from modem to router: unplug both ends, plug back in firmly until you hear a **click**.\n- Cable from wall to modem: same.\n- Look for kinks or visible damage. A bad cable looks fine but fails.\n\n### Step 4 — Try a captive portal (hotel / coffee shop / airport)\n- Open a browser.\n- Go to `http://neverssl.com` (must be `http://`, not `https://`).\n- A sign-in page should pop up automatically. Sign in or accept terms.\n- Now retry your sites.\n\n### Step 5 — Change DNS (if reachable but DNS fails)\n- Some ISP DNS servers fail randomly. Switch to a public DNS.\n- **Windows:** Settings → Network & internet → Advanced network settings → click your active adapter → Edit DNS server assignment → Manual → IPv4 ON → Preferred DNS: `1.1.1.1` → Alternate: `8.8.8.8` → Save.\n- **macOS:** System Settings → Network → click Wi-Fi → Details → DNS → click + → add `1.1.1.1` then `8.8.8.8` → OK.\n- Restart browser. Test.\n\n### Step 6 — Check ISP outage status\n- Use phone with **mobile data (not Wi-Fi)** to check ISP status:\n  - **United States:** https://downdetector.com → search your ISP.\n  - **Canada:** Bell / Rogers / Telus / Shaw / Cogeco status pages.\n  - **Or:** Tweet at your ISP — most respond fast.\n- If outage confirmed: you've done all you can. Use mobile hotspot until restored.\n\n### Step 7 — Computer-specific fix (when other devices work)\n- **Windows:**\n  1. Right-click network icon (tray) → Network and Internet settings.\n  2. Network reset → Reset now → confirm. Computer restarts.\n  3. After restart, reconnect Wi-Fi from scratch.\n- **macOS:**\n  1. System Settings → Network → Wi-Fi → Details → \"Forget This Network.\"\n  2. Re-connect from the Wi-Fi menu.\n- Disable and re-enable VPN clients (Cisco / GlobalProtect / Ivanti / others) — sometimes stuck VPN routes block normal internet.\n- Try a different browser. Chrome stuck? Try Firefox. Firefox stuck? Try Edge.\n- Temporarily disable antivirus firewall — test for 60 seconds, then re-enable. (Some endpoint security products block traffic on a bad update.)\n\n## 5. Verification Steps\n- `https://www.google.com` and `https://www.cloudflare.com` both load.\n- A speedtest at `https://speed.cloudflare.com` returns numbers.\n- Multiple sites load, not just one (rules out single-site DNS issue).\n\n## 6. When to Call ISP (Self-fix limit)\n- Modem lights show **NO internet light** (or red light) after a 5-minute warm-up post power-cycle.\n- ISP status page confirms outage in your area.\n- You've done all 7 steps above and still nothing.\n- You suspect a physical line issue (recent storm, construction work near the building).\n\n**What to tell the ISP:**\n1. Your account / phone number / address.\n2. \"Internet has been down since [time].\"\n3. \"I've power-cycled the modem and router.\"\n4. \"The [internet / online / online send] light is [solid / blinking / off].\"\n5. Get a ticket number. Ask for an ETA.\n\n## 7. When to Call Office IT (Not ISP)\n- You're in the office and only office Wi-Fi is down (your phone hotspot still works).\n- You're connecting to corporate Wi-Fi via 802.1X (certificate auth) and your cert may have expired.\n- Office uses a custom DNS / proxy and you can't reach anything internal.\n\n## 8. Prevention Tips\n- **Reboot your modem and router monthly** — even when working. Memory leaks accumulate.\n- **Buy your own modem (DOCSIS 3.1 or DOCSIS 4.0 for cable)** instead of renting from ISP. $200 once vs $15/month forever. Faster + more reliable.\n- **Have a mobile hotspot fallback.** Phone hotspot OR a dedicated hotspot. Save your sanity during outages.\n- **Note your router admin password** — keep it in a password manager.\n- **Document your network setup** with a sketch: modem → router → switch → APs. Helps anyone (you, IT, ISP tech) troubleshoot fast.\n\n## 9. User-Friendly Explanation\nThe most reliable internet fix is unplugging your modem and router for 30 seconds and plugging them back in — fixes about half of all outages. After that, check if it's just your computer (try your phone on the same Wi-Fi). If everything's down and it's not the router, your internet company probably has an outage — check their status page on your phone's cellular data. Worst case, call your ISP with your account info and the lights showing on the modem.\n\n## 10. Internal Technician Notes\n- Modem types: cable (DOCSIS 3.0 / 3.1 / 4.0), DSL (VDSL2 / G.fast), fiber (GPON / XGS-PON / 10G-EPON).\n- Common modem statuses worth knowing:\n  - **Power:** modem is powered on\n  - **Cable / DSL / WAN:** physical line sync\n  - **Receive (RX):** downstream signal locked\n  - **Send (TX):** upstream signal locked\n  - **Online / Internet:** IP address obtained (DHCP from ISP)\n- If Power + sync lights are ON but Online is OFF → modem can talk to line but not getting IP. Could be: provisioning lapsed (ISP needs to reset), MAC ban, account suspension, region-wide DHCP problem.\n- For office: check uplink switch port LEDs. Solid = link, blinking = traffic.\n- Edge cases:\n  - IPv6 enabled but DNS server only resolves IPv4 → some sites slow / fail. Test with `nslookup -type=AAAA google.com`.\n  - MTU mismatch on PPPoE links → can browse small sites but big downloads stall. Fix by lowering MTU at router to 1492.\n  - Captive portal stays open: DNS hijack to portal. Clear DNS cache `ipconfig /flushdns` (Win) or `sudo dscacheutil -flushcache` (Mac).\n- Speedtest cli: `npx speedtest` or `cloudflare-speedtest`.\n\n## 11. Related KB Articles\n- `l1-wifi-001` — Wi-Fi specifically can't connect\n- `l1-internet-002` — Slow but connected\n- `l1-internet-003` — Intermittent drops\n- `l1-vpn-generic-001` — When VPN is the cause\n\n## 12. Keywords / Search Tags\nno internet, internet down, can't connect, outage, isp down, modem, router, restart router, power cycle, wifi no internet, ethernet no internet, captive portal, dns, 1.1.1.1, 8.8.8.8, downdetector"
  },
  {
   "slug": "l1-internet-002-slow-but-connected",
   "path_rel": "knowledge-base\\internet\\l1-internet-002-slow-but-connected.md",
   "title": "\"Internet is slow but connected — speed troubleshooting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-internet-002\ntitle: \"Internet is slow but connected — speed troubleshooting\"\ncategory: networking\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - slow internet\n  - slow wifi\n  - speedtest\n  - bandwidth\n  - latency\n  - buffering\n  - lag\n  - speed test\n  - ookla\n  - cloudflare speed test\n  - mesh\n  - extender\n  - wifi signal\nrelated_articles:\n  - l1-internet-001-no-internet-at-all\n  - l1-wifi-001-cant-connect\n  - l2-network-legacy-001-wpa2-only-router-replacement\n  - l1-network-be-001-wifi-7-rollout-compatibility\nescalation_trigger: \"Wired speed is more than 30% below the ISP's advertised plan AND modem signal levels are out of spec — escalate to ISP for line work.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Internet is slow but connected — speed troubleshooting\n\n## 1. Symptoms\nBrowser loads but slowly. Video calls glitch. Streaming buffers. Downloads crawl. Speed used to be faster.\n\n## 2. Likely Causes\n1. **Wi-Fi distance / interference** — you're far from the router or there's a microwave / Bluetooth headset / cordless phone nearby.\n2. **Too many devices** competing for the same Wi-Fi.\n3. **One device hogging bandwidth** (large download, cloud backup, game install).\n4. **ISP throttling** (rare in 2026 but happens).\n5. **Old router** (Wi-Fi 4 / 5 capping speeds far below your plan).\n6. **DNS slowness.**\n7. **VPN slowing things down** (VPN adds ~10-30ms latency, sometimes more).\n8. **Outdated network drivers.**\n\n## 3. Questions To Ask User\n1. What internet plan are you paying for? (e.g., 500 Mbps cable, 1 Gbps fiber.)\n2. Wired or Wi-Fi?\n3. How far from the router?\n4. How many devices in the house / office?\n5. Is anyone running a backup, download, or stream right now?\n6. Slow on all sites or one specific site?\n\n## 4. Step-by-Step Diagnosis\n\n### Step 1 — Run a speed test\n- Go to `https://speed.cloudflare.com` (most accurate for varied measurements).\n- Note three numbers:\n  - **Download speed** (Mbps).\n  - **Upload speed** (Mbps).\n  - **Latency / ping** (ms).\n\n### Step 2 — Compare to your plan\n- Your ISP plan should match within 70-100% of the advertised speed when wired.\n- 500 Mbps plan → expect 350-500 Mbps wired.\n- On Wi-Fi: expect 50-70% of wired speed within 15 feet of a modern router. Drop sharply beyond.\n\n### Step 3 — Test wired vs Wi-Fi\n- Plug an Ethernet cable from the router directly to your laptop.\n- Run speedtest again.\n- **Wired fast, Wi-Fi slow** → Wi-Fi issue. Go to Step 4.\n- **Both slow** → ISP / router issue. Go to Step 6.\n\n### Step 4 — Wi-Fi triage\n- Move closer to the router (within 10 ft, line-of-sight). Retest.\n- Faster close-up? → distance / signal is the issue. Possible fixes:\n  - Move router to a more central location.\n  - Add a mesh node / Wi-Fi extender.\n  - Replace ancient router with Wi-Fi 6 or Wi-Fi 7 mesh (see `l2-network-legacy-001`).\n- Still slow close-up? → router configuration or radio issue.\n  - Reboot router.\n  - Switch your device to 5 GHz band (not 2.4 GHz). 2.4 GHz tops out around 50 Mbps in most homes due to interference.\n  - 5 GHz band crowded? → try 6 GHz if your router and device support it.\n\n### Step 5 — Wi-Fi interference\nCommon offenders:\n- **Microwave oven** — kills 2.4 GHz Wi-Fi while running.\n- **Older cordless phones** — 2.4 GHz / DECT 6.0.\n- **Bluetooth speakers** when actively streaming heavy audio.\n- **Baby monitors.**\n- **Neighbors' Wi-Fi** on the same channel (apartments).\n- **Solid walls / metal cabinets** between your device and the router.\n\n### Step 6 — One-device hogging\n- Open Task Manager (Win: Ctrl+Shift+Esc) → Performance tab → Wi-Fi or Ethernet.\n- Watch for sustained high \"Send\" or \"Receive\" rates while you're not actively doing anything.\n- Common culprits:\n  - **Windows Update** downloading.\n  - **OneDrive / Google Drive / Dropbox** large sync.\n  - **Backblaze / Carbonite** initial backup.\n  - **Game launcher** (Steam, Epic) downloading.\n  - **Updates to Chrome / Edge / Office** in background.\n- Pause / quit the heavy task. Speedtest again.\n\n### Step 7 — Check DNS\n- Run a speedtest with a different DNS:\n  - **Windows:** Settings → Network → Advanced → Edit DNS → Manual → 1.1.1.1 + 8.8.8.8.\n  - **macOS:** System Settings → Network → Wi-Fi → Details → DNS → +1.1.1.1.\n- If sites suddenly load faster, your old DNS was slow.\n\n### Step 8 — Check ISP / modem signal\n- Log into your router admin page (usually 192.168.0.1 or 192.168.1.1).\n- Look for \"Connection Status\" or \"Modem Status\" or \"Cable Diagnostics.\"\n- For cable (DOCSIS):\n  - **Downstream signal-to-noise ratio (SNR):** should be > 35 dB.\n  - **Downstream power level:** should be between -10 and +10 dBmV.\n  - **Upstream power level:** should be between +35 and +50 dBmV.\n- If any of these are way out of range → call ISP, line needs attention.\n\n### Step 9 — Update network drivers (Windows)\n- Settings → Windows Update → Optional updates → Driver updates.\n- Apply any network-related driver updates.\n- Reboot.\n- Retest.\n\n### Step 10 — VPN check\n- Disconnect any VPN clients (Cisco, GlobalProtect, Ivanti, NordVPN, ExpressVPN, etc.).\n- Retest.\n- If much faster without VPN: VPN is the cause. Either accept the speed hit (corporate VPN is usually slower) or switch VPN gateway location.\n\n## 5. Verification Steps\n- Cloudflare or Ookla speedtest shows speeds within 70% of your plan when wired.\n- Wi-Fi within 15 ft of router shows at least 50% of wired speed.\n- Video calls are stable.\n\n## 6. When to Call ISP\n- Wired speeds are < 50% of advertised plan AND you've rebooted the modem.\n- Modem signal levels are out of spec (see Step 8).\n- The speed has been getting progressively worse over weeks.\n- ISP can do a \"line conditioning\" or send a technician.\n\n## 7. When to Call Office IT (Office context)\n- Office-wide slowness, not just your computer.\n- Slow only when on VPN (could be gateway congestion).\n- Slow only to specific internal services (could be server-side, not network).\n\n## 8. Prevention Tips\n- **Upgrade Wi-Fi to current standard.** Wi-Fi 6E or Wi-Fi 7 in 2026. See `l2-network-legacy-001`.\n- **Place router centrally** in the home or office. Up high (top of bookshelf), not in a cabinet.\n- **5 GHz default for laptops + phones.** Reserve 2.4 GHz for IoT (smart bulbs, doorbells).\n- **Schedule backups overnight** so they don't fight with daytime work.\n- **Wired Ethernet for desktops** when possible — always faster.\n\n## 9. User-Friendly Explanation\nFirst test by plugging an Ethernet cable in to your laptop. If wired speed is good, your Wi-Fi is the issue — usually distance or interference. If wired speed is also bad, the problem is either your modem, your router, or your ISP. Run a speedtest at speed.cloudflare.com on cellular vs Wi-Fi to compare. If you're paying for 500 Mbps and only getting 150 wired, call your ISP.\n\n## 10. Internal Technician Notes\n- Single-stream limits: a single TCP connection rarely uses full link bandwidth. Speedtests use parallel streams.\n- TCP window scaling: ensure enabled on Windows; older Windows builds with it disabled cap at ~50 Mbps over long-latency links.\n- Bufferbloat: high load increases ping dramatically. Test at https://speed.cloudflare.com to see \"loaded latency.\" > 100ms loaded = bufferbloat. Fix: enable SQM / Cake AQM on router (Ubiquiti, OpenWrt support; consumer routers vary).\n- WMM / QoS settings on router help VoIP / video over best-effort traffic.\n- For multi-AP setups: ensure same SSID + same security on all APs for seamless roaming. Different SSIDs force manual re-connect.\n\n## 11. Related KB Articles\n- `l1-internet-001` — No internet at all\n- `l1-wifi-001` — Wi-Fi connection issues\n- `l2-network-legacy-001` — Old router upgrade\n- `l1-network-be-001` — Wi-Fi 7 deployment\n\n## 12. Keywords / Search Tags\nslow internet, slow wifi, speedtest, bandwidth, latency, buffering, lag, ookla, cloudflare speed test, mesh, extender, wifi signal, dns, snr, docsis, mtu, throughput"
  },
  {
   "slug": "l1-internet-003-intermittent-drops",
   "path_rel": "knowledge-base\\internet\\l1-internet-003-intermittent-drops.md",
   "title": "\"Internet drops randomly — intermittent disconnects\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-internet-003\ntitle: \"Internet drops randomly — intermittent disconnects\"\ncategory: networking\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - internet drops\n  - intermittent\n  - disconnects\n  - drops randomly\n  - flaky internet\n  - wifi drops\n  - keeps disconnecting\n  - modem reboot loop\nrelated_articles:\n  - l1-internet-001-no-internet-at-all\n  - l1-internet-002-slow-but-connected\n  - l1-wifi-001-cant-connect\nescalation_trigger: \"Modem reboots itself randomly (logs show power-cycle events with no user action) → hardware failure, ISP must replace. Or multiple devices in the office drop simultaneously several times per day → likely AP / switch issue, escalate to L2.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Internet drops randomly — intermittent disconnects\n\n## 1. Symptoms\nInternet works for 5-30 minutes then drops for 30 seconds to a few minutes. Comes back without manual action. Video calls disconnect. Cloud apps lose sync. Often \"fine\" by the time you check.\n\n## 2. Likely Causes\n1. **Modem signal levels marginal** — close to spec limit but crossing it occasionally.\n2. **Router overheating** — common in summer or when router is in a cabinet.\n3. **Wi-Fi channel congestion** — neighbors' Wi-Fi keeps drowning yours.\n4. **Faulty cable** — passes basic tests but fails under load / vibration / heat.\n5. **DNS caching weirdness** — first request hangs, others work.\n6. **ISP line work** in your area (sometimes scheduled, sometimes not).\n7. **Wi-Fi adapter driver bug** on the device.\n8. **Power adapter on router** failing intermittently.\n\n## 3. Questions To Ask User\n1. Which devices drop? Just one or multiple?\n2. Wi-Fi or wired or both?\n3. Time of day? (Evenings often = neighborhood congestion. Mid-afternoon = peak temps = overheating.)\n4. Anything trigger it? (Specific app, large download, video call?)\n5. How long has this been happening?\n\n## 4. Step-by-Step Diagnosis\n\n### Step 1 — Multi-device vs single\n- Are multiple devices in the house dropping at the same time?\n- **All devices drop simultaneously** → network (modem/router/ISP) issue.\n- **Only one device** → that device's adapter / drivers / settings.\n\n### Step 2 — Wired vs Wi-Fi\n- If only Wi-Fi drops, wired is rock solid → Wi-Fi issue.\n- If wired also drops → ISP or modem.\n\n### Step 3 — Check modem signal stability (cable internet)\n1. Log into router/modem admin page (192.168.0.1 or 192.168.100.1 for modem-only).\n2. Look for **Event Log** or **System Log**.\n3. Look for entries like:\n   - \"T3 timeout\"\n   - \"T4 timeout\"\n   - \"RNG REQ timeout\"\n   - \"DHCP RENEW WARNING\"\n   - Power-cycle events not initiated by you\n- Multiple T3/T4 timeouts in a day = unstable upstream signal. Call ISP, line issue.\n\n### Step 4 — Router heat / power test\n- Touch the top of the router (carefully — should be warm but not hot enough to be uncomfortable).\n- Router in a closed cabinet? Move it out.\n- Power adapter / brick — is it warm? Power adapters can fail intermittently. Swap with a replacement if available.\n\n### Step 5 — Cable check\n- Both Ethernet (modem to router) and coax (wall to modem):\n  - Unplug both ends, inspect connector for damage / bent pins.\n  - Re-seat firmly until click.\n- If you have a spare cable, swap with it for a few hours. Fixed = old cable was bad.\n\n### Step 6 — Wi-Fi channel scan\n- Use an app: **WiFi Analyzer** (Android free), **NetSpot** (Mac/Win free tier), **Wi-Fi Analyzer** (Windows store).\n- On 2.4 GHz: identify which channels have the LEAST overlap with your neighbors' Wi-Fi. Use channels 1, 6, or 11.\n- On 5 GHz: pick a channel range that's quiet. Auto setting usually does fine, but if you see lots of competitors, override.\n- Router admin → Wireless → Channel → manually pick → Save. Reboot router.\n\n### Step 7 — Wi-Fi adapter driver (single device dropping)\n- **Windows:** Device Manager → Network adapters → right-click your Wi-Fi → Update driver. Or visit laptop maker's support site (Dell, HP, Lenovo) for latest Wi-Fi driver — it's often newer than what Windows Update offers.\n- **macOS:** Wi-Fi driver bundled with OS — update macOS via Software Update.\n- After update, restart and test.\n\n### Step 8 — Wi-Fi power management (Windows)\n- Device Manager → Network adapters → right-click Wi-Fi → Properties → Power Management tab.\n- UNcheck \"Allow the computer to turn off this device to save power.\"\n- OK. Restart.\n- *This causes random Wi-Fi drops on many laptops when idle.*\n\n### Step 9 — Ping monitor (proves the drop)\n- Open command prompt / terminal.\n- **Windows:** `ping -t 1.1.1.1`\n- **Mac/Linux:** `ping 1.1.1.1`\n- Leave running. When internet drops, you'll see \"Request timed out\" lines. When it comes back, replies resume.\n- Note time/duration of each drop. Pattern (every X minutes? Triggered by something?) gives the diagnosis.\n\n### Step 10 — Check ISP status\n- Like Step 6 of internet-001 KB — outage in your area?\n\n## 5. Verification Steps\n- 24-hour ping monitor with < 1% packet loss.\n- Video call lasts 30+ minutes without dropping.\n- Modem log clean (no T3/T4 events).\n\n## 6. When to Call ISP\n- Modem log shows repeated T3/T4 timeouts → line conditioning / drop replacement needed.\n- Modem reboots itself (without your action) more than once a week.\n- Multiple devices in the home drop simultaneously several times per day, and the modem is < 5 years old.\n- ISP has noted area issue (call them, they may already see it).\n\n## 7. When to Call Office IT\n- Multiple staff report drops at the same times of day → AP / switch issue.\n- VPN drops mid-session (different KB — `l1-vpn-generic-001`).\n- Only office Wi-Fi affected, not personal cellular.\n\n## 8. Prevention Tips\n- **Ventilate your router.** Out of cabinets, off the floor (dust intake).\n- **Replace cables every 5-7 years** even if they look fine.\n- **Modem age:** if > 5 years and unstable, replace (own or ISP-rent).\n- **Keep firmware updated** — set router to auto-update if available.\n- **Monitor with a Smokeping or similar** if you're tech-savvy and want hard data.\n\n## 9. User-Friendly Explanation\nRandom drops are usually one of three things: a flaky cable connection (re-seat them), Wi-Fi channel congestion (switch channels), or a modem signal issue (check the modem logs). Run a continuous ping in a terminal window so you can see when it drops, and check the modem's status page when it does. If you find T3/T4 timeouts, call the ISP — they need to fix the line.\n\n## 10. Internal Technician Notes\n- T3 timeout = upstream MAC management failure (cable modem can't sync).\n- T4 timeout = downstream sync loss.\n- Both indicate physical layer issues — bad splitter, water in line, loose F-connector at amp, neighborhood plant issue.\n- Channel bonding: DOCSIS 3.0+ bonds 24+ channels. Losing one or two won't drop the connection, but losing 5+ will.\n- Wi-Fi DFS (Dynamic Frequency Selection) channels (5 GHz upper) require radar checks — connection can drop briefly when radar detected. Common near airports, military bases. Disable DFS channels in router config if this is the cause.\n- For office: configure 802.11k/v/r on multi-AP setups for fast roaming. Without it, devices \"stick\" to a weak AP instead of switching.\n- Mesh systems: backhaul over wireless can drop under load. Ethernet backhaul for stationary nodes is much more stable.\n\n## 11. Related KB Articles\n- `l1-internet-001` — No internet at all\n- `l1-internet-002` — Slow but connected\n- `l1-wifi-001` — Wi-Fi can't connect\n\n## 12. Keywords / Search Tags\ninternet drops, intermittent, disconnects, drops randomly, flaky internet, wifi drops, keeps disconnecting, modem reboot, t3 t4 timeout, docsis, channel congestion, dfs, power management"
  },
  {
   "slug": "l1-bluetooth-001-pairing-failed",
   "path_rel": "knowledge-base\\L1\\l1-bluetooth-001-pairing-failed.md",
   "title": "\"Bluetooth: device won't pair, keeps disconnecting, or audio cuts out\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-bluetooth-001\ntitle: \"Bluetooth: device won't pair, keeps disconnecting, or audio cuts out\"\ncategory: bluetooth\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - bluetooth\n  - pair\n  - won't pair\n  - keeps disconnecting\n  - airpods\n  - bose\n  - sony\n  - jabra\n  - mouse keyboard\n  - audio cuts out\n  - latency\n  - bluetooth missing\nrelated_articles:\n  - l1-teams-001\n  - l1-windows-005\nescalation_trigger: \"Bluetooth radio not detected in Device Manager / System Information at all, or hardware antenna damaged\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# Bluetooth pairing / connection problems\n\n## 1. Symptoms\n- Device shows up in pairing list but pairing fails halfway through.\n- Connects, then drops within seconds or minutes.\n- Headphones connect for music but not for calls (or vice-versa).\n- Audio is choppy, robotic, or noticeably delayed (lip-sync off).\n- Bluetooth toggle missing entirely from Settings.\n\n## 2. Likely Causes\n1. Battery on the accessory is too low to maintain a stable link.\n2. The device is paired to two hosts simultaneously and the other host is fighting.\n3. Driver crashed; the radio needs a restart.\n4. 2.4 GHz Wi-Fi or USB 3.0 interference (USB 3 ports radiate noise).\n5. For headsets: Windows is using the wrong \"audio profile\" (A2DP for music vs. Hands-Free for calls).\n6. Device firmware needs an update.\n\n## 3. Questions To Ask User\n1. What device — exact brand and model?\n2. Pairing for the first time, or it used to work?\n3. Has the device been used with another phone/PC recently?\n4. Is the issue voice/calls, music, or both?\n5. How close is the device to the PC right now?\n\n## 4. Troubleshooting Steps\n1. **Charge the accessory** to at least 30%. Low battery causes flaky pairing.\n2. **Forget + re-pair.** Settings → Bluetooth → click the device → Remove. Then pair fresh.\n3. **Move the accessory off other hosts.** Most modern earbuds connect to the last 2 hosts; turn off Bluetooth on your phone temporarily and try again.\n4. **Toggle the radio.** Turn Bluetooth off, wait 10 seconds, on again.\n5. **Move closer** — within 3 feet, line of sight, away from microwaves and USB 3 hubs.\n6. **Reboot the PC.** Cleans up a stuck radio service.\n\n## 5. Resolution Steps\n**If pairing keeps failing on Windows:**\n1. Settings → Bluetooth & devices → Devices → click the device → Remove.\n2. Put the accessory in pairing mode (usually hold the action button for 5–7 seconds until the LED blinks fast).\n3. Add device → Bluetooth → wait for it to appear.\n4. If it still won't appear: Device Manager → Bluetooth → right-click your radio → Disable, wait 10s, Enable.\n\n**If headset connects but Teams/Zoom can't hear:**\n1. Sound settings → Input → pick the Hands-Free profile of the headset (different from the Stereo / A2DP entry).\n2. In Teams: Settings → Devices → Speaker AND Microphone → set both to the Hands-Free entry.\n3. Audio quality drops to mono on calls — that's expected; Bluetooth can't run hi-fi music and a mic at the same time.\n\n**If audio cuts out periodically:**\n1. Move USB 3 / USB-C dongles 2 feet away from the Bluetooth dongle (USB 3 emits 2.4 GHz noise).\n2. Switch your Wi-Fi to 5 GHz if you're on 2.4 GHz.\n3. Update the Bluetooth driver from the OEM site (not Windows Update — OEMs often ship newer firmware).\n\n**On macOS:**\n1. Bluetooth menu → ⌥+click for advanced reset → Reset the Bluetooth module.\n2. If that fails: System Settings → Bluetooth → forget the device → re-pair.\n\n## 6. Verification Steps\n- Pair holds for a 10-minute call without dropping.\n- Music sounds clean (no robot artifacts).\n- LED on accessory shows the steady \"connected\" state.\n- Stays connected when you move 10 feet away with line of sight.\n\n## 7. Escalation Trigger\n- Bluetooth radio missing from Device Manager / System Information.\n- Code 43 / 28 on the radio after driver reinstall.\n- Pairing fails for every Bluetooth device, including a known-good test accessory.\n- → Escalate to **L2** for hardware diagnosis or driver package from OEM.\n\n## 8. Prevention Tips\n- Charge accessories before important calls.\n- Don't pair the same earbuds to phone + PC and expect both to work seamlessly — pick one host per session.\n- Keep accessories within 10 feet, line of sight when possible.\n- Update Bluetooth drivers from OEM tools quarterly.\n\n## 9. User-Friendly Explanation\n\"Bluetooth is finicky — most issues come down to one of three things: low battery on the accessory, signal interference from other USB devices or Wi-Fi, or the accessory still being connected to your phone. We'll forget the device, re-pair fresh, and switch you to the right audio mode. Should take about three minutes. If pairing works but you can't be heard on calls, that's almost always the wrong audio profile and we'll fix that in two clicks.\"\n\n## 10. Internal Technician Notes\n- Windows BT stack lives at `services.msc → Bluetooth Support Service` — restart it if pairing UI hangs.\n- HFP vs A2DP: Windows 11 22H2+ supports LE Audio which mostly fixes the music-vs-call profile dance, but you need both ends compatible.\n- USB 3 radiation: Intel whitepaper documents this; physical separation is the only fix.\n- For managed devices, check Intune for any Bluetooth restriction CSP (e.g., `Bluetooth/AllowAdvertising`, `Bluetooth/AllowDiscoverableMode`).\n- macOS Bluetooth log: `log show --predicate 'subsystem == \"com.apple.bluetooth\"' --last 10m`.\n\n## 11. Related KB Articles\n- l1-teams-001 — Teams audio + mic\n- l1-windows-005 — No sound on Windows\n\n## 12. Keywords / Search Tags\nbluetooth, pair, won't pair, keeps disconnecting, airpods, bose, sony, jabra, mouse keyboard, audio cuts out, latency, bluetooth missing, hands-free profile, a2dp, hfp"
  },
  {
   "slug": "l1-browser-001-pages-not-loading",
   "path_rel": "knowledge-base\\L1\\l1-browser-001-pages-not-loading.md",
   "title": "\"Browser issues: pages won't load, certificate errors, or constant crashes\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-browser-001\ntitle: \"Browser issues: pages won't load, certificate errors, or constant crashes\"\ncategory: browser\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - browser\n  - chrome\n  - edge\n  - firefox\n  - safari\n  - not loading\n  - this site can't be reached\n  - your connection is not private\n  - net::err_cert\n  - cache\n  - cookies\nrelated_articles:\n  - l1-wifi-001\n  - l1-windows-003\n  - l2-networking-001\nescalation_trigger: \"Same site fails for many users, or genuine cert issue on internal service, or DNS poisoning suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Browser issues: pages not loading / cert errors / crashes\n\n## 1. Symptoms\n- \"This site can't be reached\".\n- \"Your connection is not private\" / `NET::ERR_CERT_*`.\n- Browser hangs and goes white.\n- Specific site loads partially (no images, broken layout).\n- Browser crashes immediately on launch.\n- \"Aw, snap!\" / \"He's dead, Jim\" tab error.\n- Search/address bar slow.\n\n## 2. Likely Causes\n1. Cached / stale cookies, cache files corrupted.\n2. Extension conflict.\n3. Browser version outdated.\n4. Wrong system clock (kills SSL).\n5. DNS server failing for that site.\n6. Proxy / antivirus interception breaking cert chain.\n7. Site itself is down.\n8. GPU acceleration glitch (crashes on launch).\n\n## 3. Questions To Ask User\n1. Which browser (Chrome, Edge, Firefox, Safari)?\n2. Does the issue happen on every site, one specific site, or just internal sites?\n3. Does it work in another browser (Edge if you usually use Chrome)?\n4. Does Incognito / Private mode work?\n5. What does the error message say exactly?\n6. When did this start?\n\n## 4. Troubleshooting Steps\n1. Open Incognito / Private window — site loads? Then it's a cache/extension issue.\n2. Check time: Settings → Time & language → Sync now (cert errors often = clock skew).\n3. Try a different network (mobile hotspot) — works? It's network/DNS-side.\n4. Try the site on a phone — works? It's user-PC-side, not site-side.\n5. Disable all extensions: Chrome → ⋮ → Extensions → toggle all off.\n\n## 5. Resolution Steps\n**Cache / cookies:**\n1. Ctrl+Shift+Delete → choose \"All time\" → check Cached images, Cookies, Site data → Clear.\n2. Restart browser.\n\n**Extension conflict:**\n1. Disable all → restart browser → re-enable one at a time.\n2. Identify culprit; remove or update it.\n\n**Reset browser settings:**\n- Chrome: Settings → Reset settings → Restore settings to original defaults.\n- Edge: Settings → Reset settings → Restore.\n- Firefox: about:support → Refresh Firefox.\n\n**Cert error specifically:**\n1. Verify clock first.\n2. If error says \"issuer unknown\" and it's an internal corporate site, the corp root CA may not be on this device — escalate to L2 to deploy.\n3. Don't override cert warnings unless explicitly directed by IT for known internal site.\n\n**Browser crashes on launch:**\n1. Disable hardware acceleration:\n   - Chrome: chrome://settings/system → Use hardware acceleration → off.\n   - Edge: similar.\n2. Reinstall: Settings → Apps → uninstall → reinstall fresh from official site.\n\n**For Windows: reset HOSTS file if a single site fails:**\n1. Open Notepad as admin → File → Open → `C:\\Windows\\System32\\drivers\\etc\\hosts`.\n2. Look for entries with the failing site domain → comment with `#` or remove.\n3. Save → flush DNS: `ipconfig /flushdns`.\n\n## 6. Verification Steps\n- Site loads in regular browser window without errors.\n- Cert padlock present, no warnings.\n- Refresh works.\n- Same in 2 other sites you use daily.\n- 24h of normal use without recurrence.\n\n## 7. Escalation Trigger\n- Cert error on legitimate internal site after L1 steps — root CA missing.\n- Same site fails for many users.\n- Browser repeatedly crashes after reinstall — system-level issue.\n- DNS poisoning suspicion (wrong content loading).\n- → Escalate to **L2** with: error code (e.g., NET::ERR_CERT_AUTHORITY_INVALID), URL, browser version, network type, screenshot.\n\n## 8. Prevention Tips\n- Keep browser auto-updating.\n- Don't install random extensions; vet via vendor.\n- Don't use 5 browsers — pick 1 primary, 1 backup.\n- Avoid \"PC cleaner\" apps that touch browser files.\n- Don't ignore cert warnings — they're real signals.\n\n## 9. User-Friendly Explanation\n\"Your browser is having trouble — usually it's a stash of old data tripping it up, or an extension misbehaving. We'll try Incognito first to confirm, clear out the cache if that fixes it, and turn off extensions one at a time. For certificate errors, we make sure your clock is right and check whether it's a real warning we should trust.\"\n\n## 10. Internal Technician Notes\n- Chrome cache locations: `%localappdata%\\Google\\Chrome\\User Data\\Default\\` (Cache, Code Cache, IndexedDB, etc.).\n- Edge: `%localappdata%\\Microsoft\\Edge\\User Data\\Default\\`.\n- Firefox profile: `%appdata%\\Mozilla\\Firefox\\Profiles\\`.\n- For corporate proxy with TLS inspection (Zscaler, Netskope), the proxy's root CA must be in user / machine trust store; missing CA = NET::ERR_CERT_AUTHORITY_INVALID across all HTTPS.\n- Net Internals export from chrome://net-export → Crucial diagnostic for L2 — captures all DNS / connection attempts.\n- For mass internal-site cert failure, check whether AD certificate services renewed recently; CRL may be unreachable.\n\n## 11. Related KB Articles\n- l1-wifi-001 — Wi-Fi / network issues\n- l1-windows-003 — Slow PC (browser is symptom)\n- l2-networking-001 — DNS / proxy diagnosis\n\n## 12. Keywords / Search Tags\nbrowser, chrome, edge, firefox, safari, not loading, certificate, your connection is not private, net::err_cert, cache, cookies"
  },
  {
   "slug": "l1-email-001-suspicious-phishing",
   "path_rel": "knowledge-base\\L1\\l1-email-001-suspicious-phishing.md",
   "title": "\"Suspicious email / suspected phishing — what to do\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-email-001\ntitle: \"Suspicious email / suspected phishing — what to do\"\ncategory: email\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: []\nkeywords:\n  - phishing\n  - suspicious email\n  - scam email\n  - spam\n  - report phishing\n  - email scam\n  - business email compromise\n  - bec\nrelated_articles:\n  - l1-password-001\n  - l3-security-001\n  - ga-scam-001\nescalation_trigger: \"User clicked link or entered credentials, or executive impersonation, or active BEC suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Suspicious email / suspected phishing\n\n## 1. Symptoms\n- Email from familiar name but address looks off.\n- \"Action required\", \"Verify your account\", \"Your password expires today\".\n- Unexpected attachment (.zip, .iso, .htm, .docm).\n- Sense of urgency / threats / requests to bypass normal procedure.\n- Wire-transfer or gift-card requests via email.\n- Reply-to address differs from From address.\n- Mismatched display name vs sender domain.\n\n## 2. Likely Causes\n1. Phishing — generic credential theft.\n2. Spear-phishing — targeted at user's role.\n3. Business Email Compromise (BEC) — impersonating CEO/CFO/vendor.\n4. Malware delivery — attachment contains payload.\n5. Spam (annoying but not malicious).\n6. Legitimate but poorly-formatted email (rare).\n\n## 3. Questions To Ask User\n1. Did you click any link in this email?\n2. Did you open any attachment?\n3. Did you enter your password on any page after clicking?\n4. Did you reply with information?\n5. When did the email arrive — and was it expected?\n\n## 4. Troubleshooting Steps — STOP FIRST\n- Do **not** click any links.\n- Do **not** open attachments.\n- Do **not** reply.\n- Do **not** call any phone number in the email.\n- Hover (don't click) over links to see the real URL — phishing usually points to a different domain than it claims.\n- Note display vs. address: \"John Smith <jsmith@gmail.com>\" when John normally emails from \"@company.com\" is a red flag.\n\n## 5. Resolution Steps\n**If you have NOT interacted with it:**\n1. In Outlook → select message → Home tab → **Report** dropdown → \"Report Phishing\".\n2. Or: forward email as attachment to your IT phishing inbox (e.g., `phishing@iisupp.net`) — drag-drop into a new message to preserve headers.\n3. After reporting, delete from Inbox AND Deleted Items.\n4. Block the sender if pattern continues (Junk → Block Sender).\n\n**If you HAVE clicked a link:**\n1. Don't enter anything; close the tab/window.\n2. Run a full antivirus scan: Windows Security → Virus & threat protection → Scan options → Full scan.\n3. Report the email to IT — escalate.\n\n**If you HAVE entered credentials:**\n1. Immediately change your password from a known-good device.\n2. Sign out of all sessions: https://mysignins.microsoft.com → Sign out everywhere.\n3. Notify IT immediately — escalate to L2/L3.\n4. Watch your inbox for unexpected sent items, mailbox rules, MFA-prompts.\n\n**If you HAVE replied with information (BEC):**\n1. Do NOT engage further.\n2. Notify IT and finance leadership — wires can sometimes be reversed within 24h.\n3. File an IC3 report (US) or local equivalent if money was sent.\n\n## 6. Verification Steps\n- Email reported and removed from inbox.\n- If credential exposure, password change confirmed, sessions revoked.\n- Antivirus scan clean.\n- No unfamiliar Outlook rules under File → Manage Rules & Alerts.\n- No unfamiliar device under https://mysignins.microsoft.com.\n\n## 7. Escalation Trigger\n- User clicked link AND entered credentials.\n- Executive (CEO/CFO/VP) impersonation in any form.\n- Wire transfer requested or sent.\n- Mass-distribution to multiple users in same tenant.\n- Attachment was opened and ran.\n- → Escalate to **L3 / Security Team** immediately.\n\n## 8. Prevention Tips\n- Verify any urgent money / credential request via a second channel (call the person on a known number).\n- Hover before you click — every time.\n- Use the Report button — it trains the org's filter.\n- Keep MFA enabled on every account that supports it.\n- Don't reuse passwords across sites; use a password manager.\n- If something feels off, it probably is — slow down.\n\n## 9. User-Friendly Explanation\n\"That email looks like a scam. Don't click anything in it. The safest move is to report it using Outlook's Report button — that tells our security system to clean it from everyone's inbox. If you already clicked or typed your password, tell us right now: every minute matters when an attacker has your credentials. We'll change your password, kick them out of your account, and make sure nothing was stolen. There's no shame in clicking — phishers are good at this. Just tell us fast.\"\n\n## 10. Internal Technician Notes\n- Microsoft Defender for Office 365 → Threat Explorer → search by sender domain or subject for tenant impact.\n- Check for inbox rules created in last 7d — top BEC indicator: rules forwarding to RSS folder, deleting from sender, marking-as-read.\n- Sign-in logs: Entra → Sign-in logs → filter by user → look for foreign IP, non-compliant device, \"interrupted\" status.\n- Revoke sessions: `Revoke-AzureADUserAllRefreshToken -ObjectId <user>` (legacy) / `Revoke-MgUserSignInSession -UserId <id>`.\n- Search-and-destroy: Defender → Threats → Submissions → bulk remove similar emails tenant-wide.\n- For BEC: look at mailbox audit logs for `New-InboxRule`, `Set-InboxRule`, `MailboxLogin` from new IPs.\n- Engage cyber-insurance carrier if money moved.\n\n## 11. Related KB Articles\n- l1-password-001 — Password reset (after suspected compromise)\n- l3-security-001 — Security incident response runbook\n- ga-scam-001 — Detect scam websites (general assistant)\n\n## 12. Keywords / Search Tags\nphishing, suspicious email, scam email, spam, report phishing, business email compromise, bec, impersonation, credential theft"
  },
  {
   "slug": "l1-m365-001-cant-sign-in",
   "path_rel": "knowledge-base\\L1\\l1-m365-001-cant-sign-in.md",
   "title": "\"Can't sign in to Microsoft 365 / repeated password prompts\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-m365-001\ntitle: \"Can't sign in to Microsoft 365 / repeated password prompts\"\ncategory: m365\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: []\nkeywords:\n  - microsoft 365\n  - m365\n  - office 365\n  - can't sign in\n  - password prompt\n  - login loop\n  - aadsts\n  - account locked\n  - we couldn't connect\nrelated_articles:\n  - l1-mfa-001\n  - l1-password-001\n  - l2-azure-ad-001\nescalation_trigger: \"AADSTS50053 (account locked), AADSTS50126, or pattern across multiple users on same tenant\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Can't sign in to Microsoft 365 / repeated password prompts\n\n## 1. Symptoms\n- Office apps prompt for password repeatedly even after entering correct credentials.\n- \"We couldn't connect, please check your network\" with green check on network.\n- \"Need password\" badge on Outlook.\n- AADSTSxxxxx error code on the sign-in screen.\n- Sign-in loops back to start after typing password.\n\n## 2. Likely Causes\n1. Cached stale credentials.\n2. MFA challenge missed or denied.\n3. Password recently changed elsewhere; not yet propagated locally.\n4. Conditional Access policy blocking device or location.\n5. Account locked from too many failed attempts.\n6. Time/clock skew on device (>5 min off).\n7. Tenant-wide identity outage (rare).\n\n## 3. Questions To Ask User\n1. What error code or message appears (full text)?\n2. Have you used MFA today — accepted the prompt on phone or text?\n3. Did you change your password recently (today, this week)?\n4. Are you on a corporate network, home, or public Wi-Fi / hotel?\n5. Is your phone clock and PC clock both correct?\n6. Can you sign in to https://office.com from a private/incognito browser window?\n\n## 4. Troubleshooting Steps\n1. Clear cached credentials:\n   - Control Panel → User Accounts → Credential Manager → Windows Credentials.\n   - Remove every entry beginning with `MicrosoftOffice16_Data:`, `MicrosoftAccount:`, `OneDrive Cached Credential`.\n2. Restart all Office apps (close, verify in Task Manager, reopen).\n3. Verify time: Settings → Time & language → Date & time → Sync now.\n4. Test sign-in via incognito browser → office.com.\n5. Confirm MFA: open Authenticator app, accept any pending request.\n\n## 5. Resolution Steps\n**If password recently changed:**\n- Sign in fresh on each Office app; for Outlook, also: File → Account Settings → Email → Change → re-enter.\n\n**If MFA prompt is missed:**\n- Open Microsoft Authenticator app on phone — manually scroll for any pending request, approve.\n- Or use https://aka.ms/mfasetup to verify methods are current.\n\n**If account locked (AADSTS50053):**\n- Wait 30 minutes for soft unlock OR request L2 to unlock via Azure AD admin.\n\n**If Conditional Access block (AADSTS53003):**\n- Compliant device required — verify Intune / Endpoint enrollment status.\n- Or switch to a compliant network if location-based.\n\n**If clock skew:**\n- Reset time via Settings; also check BIOS clock if persistent (laptop battery often dead).\n\n## 6. Verification Steps\n- Sign-in completes without prompts after 1 attempt.\n- Office.com loads tenant home page within 5 seconds.\n- Outlook status bar reads \"Connected\".\n- Teams shows green presence.\n- 24h with no recurring prompt.\n\n## 7. Escalation Trigger\n- AADSTS error codes: 50053, 50126, 53003, 65001, 700016, 90072.\n- Multiple users in same tenant cannot sign in.\n- After credential clear + retry, prompts persist.\n- Conditional Access blocking and user device should be compliant.\n- → Escalate to **L2** with: error code, sign-in log timestamp, UPN, device name, network type.\n\n## 8. Prevention Tips\n- Don't share Microsoft accounts across users.\n- Keep one MFA method primary + one backup (text/phone call/app).\n- Don't ignore password expiry warnings — change at scheduled time, not at last minute.\n- Keep PC clock auto-synced.\n- Save the BitLocker / recovery key to your Microsoft account preemptively.\n\n## 9. User-Friendly Explanation\n\"Your computer has saved an old version of your password and is fighting with the new one. We'll clear the saved one, restart Office, and sign you in fresh. If your phone hasn't approved the security prompt yet, that'll be the next thing we check. Should take just a few minutes.\"\n\n## 10. Internal Technician Notes\n- Sign-in logs (admin): Entra portal → Users → user → Sign-in logs. Filter to last 1h, examine Status, Conditional Access result, MFA result.\n- Common AADSTS:\n  - 50053 = locked from too many failures (≥10 typically) — auto-unlock at 30 min, or admin reset via Entra.\n  - 50126 = invalid credentials.\n  - 53003 = Conditional Access blocked.\n  - 700016 = wrong app/tenant.\n  - 65001 = consent required (admin grant).\n- Credential Manager nuke (PowerShell): `cmdkey /list` then `cmdkey /delete:<TargetName>`.\n- For Office, also check `dsregcmd /status` — confirms Azure AD join state and SSO state.\n- For Mac users, clear keychain entries: Keychain Access → search \"office\" / \"microsoft\" → delete.\n\n## 11. Related KB Articles\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-password-001 — Password reset and self-service unlock\n- l2-azure-ad-001 — Conditional Access policy diagnosis\n\n## 12. Keywords / Search Tags\nmicrosoft 365, m365, office 365, can't sign in, password prompt, login loop, aadsts, account locked, mfa loop"
  },
  {
   "slug": "l1-m365-002-license-activation-issues",
   "path_rel": "knowledge-base\\L1\\l1-m365-002-license-activation-issues.md",
   "title": "\"Microsoft 365 license / activation issues — apps in reduced functionality\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-m365-002\ntitle: \"Microsoft 365 license / activation issues — apps in reduced functionality\"\ncategory: m365\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - office activation\n  - reduced functionality\n  - license\n  - subscription expired\n  - product deactivated\n  - sign in to activate office\nrelated_articles:\n  - l1-m365-001\n  - l2-licensing-001\nescalation_trigger: \"License unassigned in admin center or tenant has no available licenses for required SKU\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Microsoft 365 license / activation issues\n\n## 1. Symptoms\n- Yellow banner across Office apps: \"Most features have been turned off because your license isn't active.\"\n- Read-only mode in Word/Excel/Outlook.\n- Title bar shows \"(Unlicensed Product)\".\n- \"Sign in to activate Office\" prompt every launch.\n- Account & Privacy pane shows \"Subscription Expired\" or \"Sign in\".\n\n## 2. Likely Causes\n1. License removed from user account in M365 admin center.\n2. Office is signed in with the wrong account (personal vs work).\n3. Multiple Office installs (Office 2019 + M365) conflict.\n4. Activation server unreachable due to firewall/proxy.\n5. Subscription truly expired (trial, billing failure).\n6. User attempted >5 device installs (per-user M365 cap).\n\n## 3. Questions To Ask User\n1. What account name appears in File → Account in any Office app?\n2. Is this your work account (`name@company.com`) or personal (`@outlook.com`)?\n3. Have you recently switched companies, gotten a new email, or had role change?\n4. Is this a brand-new PC or one you've used Office on before?\n5. Are coworkers also affected?\n\n## 4. Troubleshooting Steps\n1. Open Word → File → Account → confirm signed-in user.\n2. If wrong account: Sign Out → close Word → reopen → Sign In with correct work account.\n3. Confirm activation: Account pane → \"Activated Office\" or \"Manage Account\".\n4. Check for duplicate Office installs: Settings → Apps → look for Office 2019 / Office 2016 alongside Microsoft 365.\n\n## 5. Resolution Steps\n**If wrong account signed in:**\n1. File → Account → Sign Out → confirm.\n2. Close all Office apps (verify in Task Manager).\n3. Reopen Word, sign in with correct work email.\n4. Activation completes silently if license is assigned.\n\n**If duplicate installs:**\n1. Settings → Apps → Installed apps.\n2. Uninstall any non-current Office version.\n3. Repair the M365 install: right-click Microsoft 365 Apps → Modify → Quick Repair (then Online Repair if needed).\n\n**If proxy / network blocking activation:**\n1. Confirm device can reach `https://officeclient.microsoft.com`, `https://login.microsoftonline.com`, `https://activation.sls.microsoft.com`.\n2. On corporate proxy, request whitelisting per Microsoft's published M365 endpoint list.\n\n**If license truly missing:**\n1. Tenant admin (or L2): M365 admin center → Users → Active users → user → Licenses & apps → ensure correct SKU assigned.\n2. After assignment, allow up to 30 minutes for propagation; user signs out + back in.\n\n## 6. Verification Steps\n- File → Account shows green check + \"Microsoft 365 Apps for Enterprise\" (or assigned SKU) + activation date.\n- All Office features (Track Changes, advanced editing) available — no read-only banner.\n- No \"(Unlicensed Product)\" in title bar.\n- Outlook can send/receive normally.\n\n## 7. Escalation Trigger\n- License is shown unassigned in admin portal and reassign attempt fails.\n- Tenant has no available licenses (need procurement).\n- After repair + reactivation, banner returns within 24h.\n- → Escalate to **L2** with: UPN, error message, license SKU expected, output of File → Account screenshot.\n\n## 8. Prevention Tips\n- Never install personal Office over a work-account Office on the same PC.\n- During role change, IT should pre-assign new license before old account is removed.\n- Monitor M365 admin Service Health page for activation outages.\n- Keep Office on Current Channel — older builds have known activation bugs.\n\n## 9. User-Friendly Explanation\n\"Your Office apps can't confirm your subscription right now. Most often it's signed in with a different account than the one with your license, or the license needs to be reassigned. We'll check who you're signed in as, sign you back in with the right account, and your full Office should come back. If we still see issues, we'll get a quick admin to verify your license is active.\"\n\n## 10. Internal Technician Notes\n- Activation status from CLI: `cscript \"C:\\Program Files\\Microsoft Office\\Office16\\OSPP.VBS\" /dstatus`.\n- Force re-activation token grab: `cscript \"...\\OSPP.VBS\" /act`.\n- Click-to-Run repair from CLI: `\"C:\\Program Files\\Common Files\\Microsoft Shared\\ClickToRun\\OfficeC2RClient.exe\" /update user`.\n- For per-device licenses (shared computer scenario), check `HKLM\\SOFTWARE\\Microsoft\\Office\\ClickToRun\\Configuration → SharedComputerLicensing = 1`.\n- License removal lag: changes in M365 admin can take up to 24h in worst case but typically <30 min.\n- For VL / KMS scenarios (rare in pure cloud), verify KMS host availability with `slmgr /dlv`.\n\n## 11. Related KB Articles\n- l1-m365-001 — Can't sign in to Microsoft 365\n- l2-licensing-001 — License assignment, group-based licensing, and reclaim\n\n## 12. Keywords / Search Tags\noffice activation, reduced functionality, license, subscription expired, product deactivated, unlicensed product, sign in to activate"
  },
  {
   "slug": "l1-m365-003-office-file-wont-open",
   "path_rel": "knowledge-base\\L1\\l1-m365-003-office-file-wont-open.md",
   "title": "\"Excel / Word file won't open — \\\"format not valid\\\", corrupt, or locked\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-m365-003\ntitle: \"Excel / Word file won't open — \\\"format not valid\\\", corrupt, or locked\"\ncategory: m365\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - excel won't open\n  - word won't open\n  - file format not valid\n  - the file format and extension don't match\n  - file is corrupt\n  - workbook corrupt\n  - file is locked for editing\n  - file in use\n  - open and repair\n  - spreadsheet won't open\n  - xlsx won't open\n  - docx corrupt\n  - cannot open the file\nrelated_articles:\n  - l1-m365-001\n  - l1-onedrive-002\n  - l1-onedrive-003\nescalation_trigger: \"File corrupt after Open-and-Repair AND no usable version in OneDrive/SharePoint history; or corruption across many files (possible disk/storage fault)\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Excel / Word file won't open — \"format not valid\", corrupt, or locked\n\n## 1. Symptoms\n- \"Excel cannot open the file … because the file format or file extension is not valid.\"\n- \"The file is corrupt and cannot be opened.\"\n- \"<file> is locked for editing by <another user>\" (or by \"another user\" that is actually you).\n- The file opens to a blank/garbled workbook, or Excel/Word hangs on open.\n- Double-clicking does nothing, but other Office files open fine.\n\n## 2. Likely Causes\n1. **Extension mismatch** — the file was saved as a different type (e.g. a CSV or HTML table renamed to `.xlsx`), so the extension lies about the real format.\n2. **Corrupt file** — an interrupted save, a sync conflict, or a bad download left the internal structure damaged.\n3. **Locked file** — another app/person has it open, or a stale Office owner-lock file (`~$<name>`) was left behind after a crash.\n4. **Stale Office document cache** — a cloud file (OneDrive/SharePoint) is stuck behind a bad local upload cache.\n\n## 3. Fix (in order — stop when it opens)\n1. **Verify the extension.** File Explorer → View → turn on **File name extensions**. If a `.xlsx` is really a CSV/HTML, rename it to the correct type (`.csv`, `.htm`) or re-export it. A genuine Excel file is `.xlsx`/`.xlsm`/`.xls`.\n2. **Open and Repair.** In Excel (or Word): **File → Open → Browse → single-click the file → click the arrow beside the Open button → Open and Repair → Repair.** This rebuilds the file without changing the original until you save. If Repair fails, choose **Extract Data** to recover values.\n3. **Release a locked file.** Close every Office app (check the system tray). If it is a shared/network file, the lock clears when the other person closes it or after Office times out. Delete any leftover `~$<filename>` owner-lock file in the same folder — it only records *who* had it open and contains none of your data.\n4. **Clear the Office Document Cache (last resort for cloud files).** Close all Office apps → in any Office app: **File → Options → Save → Delete cached files**. Your documents live in OneDrive/SharePoint and re-download.\n5. **Restore a known-good copy.** OneDrive/SharePoint → right-click the file → **Version history** → open/restore an earlier version.\n\n## 4. Verify\n- The file opens and the content is intact.\n- After Open-and-Repair, **Save As** a new copy so you keep a clean version.\n\n## 5. When to escalate (call IT)\n- The file is still corrupt after Open-and-Repair **and** there is no usable version in OneDrive/SharePoint history.\n- Multiple files are corrupting on the same machine (possible disk/storage fault) — stop using it and call **(647) 581-3182**.\n\n## 6. Safe automation (ARIA Guided Fix)\nARIA's `office-file-repair-v1` recipe walks these steps as guided, dry-run-safe actions (verify extension → Open-and-Repair → release lock → clear cache). It never edits the original file content; the worst case is opening a settings panel. Confirm + countdown gate every step."
  },
  {
   "slug": "l1-mac-001-kernel-panic-spinning-beach-ball",
   "path_rel": "knowledge-base\\L1\\l1-mac-001-kernel-panic-spinning-beach-ball.md",
   "title": "\"macOS: kernel panic, spinning beach ball, or unexpected restart\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mac-001\ntitle: \"macOS: kernel panic, spinning beach ball, or unexpected restart\"\ncategory: macos\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"macOS\"]\nprerequisites: []\nkeywords:\n  - kernel panic\n  - mac restart\n  - spinning beach ball\n  - rainbow wheel\n  - mac frozen\n  - mac crash\n  - \"your computer was restarted because of a problem\"\n  - macos hung\n  - sudden restart\n  - mac unresponsive\nrelated_articles:\n  - l1-windows-003\n  - l1-windows-001\nescalation_trigger: \"Kernel panic recurs >2x in 24h, panic log identifies a kext (3rd-party kernel extension) or hardware fault, or RAM/SSD diagnostics fail\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# macOS kernel panic / unresponsive Mac\n\n## 1. Symptoms\n- Mac restarts on its own with the message \"Your computer was restarted because of a problem.\"\n- A specific app shows the rainbow spinning beach ball indefinitely.\n- Cursor moves but nothing else responds — Dock, menu bar, app windows are all stuck.\n- Black screen with text in multiple languages: \"You need to restart your computer\" (the kernel panic screen).\n- Mac is hot and the fans are screaming for no obvious reason.\n\n## 2. Likely Causes\n1. A specific app is leaking memory and dragging everything down.\n2. A third-party kernel extension (kext) — usually an older driver or VPN client.\n3. Storage drive almost full (<10% free) — macOS performance degrades sharply.\n4. RAM physically failing.\n5. External display or dock incompatibility (especially after a macOS update).\n6. macOS update partially installed and never finished.\n\n## 3. Questions To Ask User\n1. macOS version — Apple menu → About This Mac.\n2. Does it happen randomly, or with a specific app?\n3. Anything new — external display, dongle, app installed in the last week?\n4. Free storage — About This Mac → More Info → Storage.\n5. When you restart, does it boot back up cleanly or panic again?\n\n## 4. Troubleshooting Steps\n1. **Force-quit the offending app.** Cmd+Option+Esc → select the app showing the beach ball → Force Quit.\n2. **Restart cleanly** (Apple menu → Restart, not \"force off\"). If you got a panic message after reboot, the system saved a panic log.\n3. **Read the panic message.** Apple → System Settings → General → About → System Report → Software → Logs → search for \"panic\". Note the kext name if shown.\n4. **Disconnect external accessories** — unplug docks, hubs, USB devices, external displays. Reboot. If it's stable, plug things back one at a time.\n5. **Check free storage.** Need at least 15% free for macOS to perform.\n\n## 5. Resolution Steps\n**If panic log mentions a third-party kext (e.g., `com.vendor.driver.something`):**\n1. Identify the vendor from the kext name.\n2. Update or uninstall that vendor's app.\n3. macOS Big Sur+ uses System Extensions — System Settings → General → Login Items & Extensions → review.\n\n**If a specific app freezes (beach ball):**\n1. Activity Monitor → CPU tab → sort by CPU. Force-quit the top offender.\n2. If the same app always freezes: reinstall it via the Mac App Store or vendor's site.\n\n**If random panics with no obvious cause:**\n1. Apple Diagnostics — shutdown, hold D while powering on. Apple Silicon: hold the power button until startup options, then ⌘+D. Run the test; note any error codes.\n2. Safe Mode — Apple Silicon: hold power until startup options, hold Shift, click Continue in Safe Mode. Intel: hold Shift while powering on. Use the Mac for an hour. If it's stable in Safe Mode, the issue is a login item or kext.\n\n**If macOS update is half-installed:**\n1. App Store → Updates → re-run the macOS update.\n2. If it fails: Apple menu → System Settings → General → Software Update → Reinstall.\n\n**For storage cleanup:**\n1. Apple menu → About This Mac → Storage → Manage.\n2. Empty the Trash. Move large files to iCloud or external storage.\n\n## 6. Verification Steps\n- 24 hours of normal use without a panic, freeze, or unexpected restart.\n- Activity Monitor shows idle CPU <15% and memory pressure in the green.\n- All accessories work without triggering a freeze.\n- No new panic logs in System Report → Software → Logs.\n\n## 7. Escalation Trigger\n- Same panic message with the same kext after uninstalling that vendor's software.\n- Apple Diagnostics returns a hardware reference (e.g., \"PFM006\" — power, \"VFD001\" — display).\n- Mac panics during boot before login.\n- → Escalate to **L2** or Apple Support with: macOS version, panic log, Apple Diagnostics codes, recent app installs.\n\n## 8. Prevention Tips\n- Don't run with <15% free storage.\n- Keep macOS and apps updated — most kext issues are fixed in vendor patches.\n- Be cautious with cheap USB-C docks; they're a common kernel-panic source.\n- Don't install ancient kernel extensions; many older vendors haven't shipped Apple Silicon-compatible drivers.\n\n## 9. User-Friendly Explanation\n\"Macs are usually stable, so when one panics or freezes, it's pointing at a specific cause. We'll force-quit anything stuck, restart cleanly, and read the message macOS leaves behind — that message names the file responsible 90% of the time. From there it's usually one of three things: an old app driver, a finicky USB-C dock, or a drive that's almost full. Each one has a quick fix.\"\n\n## 10. Internal Technician Notes\n- Panic logs live at `/Library/Logs/DiagnosticReports/`. Look for `*.panic` and `*.ips` files; recent ones are at the top.\n- `kextstat | grep -v com.apple` shows non-Apple kexts — anything here is suspect.\n- `pmset -g log | grep \"Failure\"` lists power-related crashes.\n- For Apple Silicon, kexts are largely deprecated in favor of System Extensions; if you see legacy KEXTs, the vendor is overdue for an update.\n- `ioreg -p IOUSB` for USB device tree if a dock is suspected.\n- T2 / Apple Silicon storage doesn't show SMART externally — use Apple Diagnostics for the closest indicator.\n\n## 11. Related KB Articles\n- l1-windows-001 — BSOD on Windows\n- l1-windows-003 — Slow PC\n\n## 12. Keywords / Search Tags\nkernel panic, mac restart, spinning beach ball, rainbow wheel, mac frozen, mac crash, your computer was restarted because of a problem, macos hung, sudden restart, mac unresponsive, kext, system extension"
  },
  {
   "slug": "l1-mfa-001-setup-recovery",
   "path_rel": "knowledge-base\\L1\\l1-mfa-001-setup-recovery.md",
   "title": "\"Multi-factor authentication (MFA): setup, lost device, and recovery\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mfa-001\ntitle: \"Multi-factor authentication (MFA): setup, lost device, and recovery\"\ncategory: mfa\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: []\nkeywords:\n  - mfa\n  - 2fa\n  - two factor\n  - multi factor\n  - authenticator\n  - lost phone\n  - new phone\n  - mfa code\n  - microsoft authenticator\n  - authy\n  - google authenticator\nrelated_articles:\n  - l1-m365-001\n  - l1-password-001\n  - l2-azure-ad-002\nescalation_trigger: \"User locked out with no recovery method, or admin reset required for MFA, or token replay/abuse suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# MFA: setup, lost device, and recovery\n\n## 1. Symptoms\n- \"Approve sign-in\" prompt never arrives on phone.\n- Lost or replaced phone — no MFA app installed yet.\n- New phone but old phone still has Authenticator entries.\n- \"Need more information\" sign-in interruption when MFA hasn't been enrolled.\n- Six-digit code rejected as \"incorrect\".\n- Locked out completely.\n\n## 2. Likely Causes\n1. Phone lost or replaced.\n2. Authenticator app reinstalled (entries gone).\n3. Phone clock skewed (TOTP codes are time-based — must be within ±30s).\n4. MFA method was SMS to a number the user no longer has.\n5. New device not yet trusted.\n6. Notification permissions revoked on phone.\n\n## 3. Questions To Ask User\n1. Do you still have any working MFA method (text, call, alternate app)?\n2. Did your phone change recently (replaced, reset, lost)?\n3. Is your phone's date/time set automatically?\n4. Are you receiving the push notification but it's slow, or not at all?\n5. Is your work account verified at https://aka.ms/mfasetup right now?\n\n## 4. Troubleshooting Steps\n1. Verify phone time is auto-set; correct skew.\n2. Open Microsoft Authenticator → ensure app has notification permission (phone Settings → Apps → Authenticator → Notifications).\n3. Check phone is online (data or Wi-Fi).\n4. If push not arriving, try the alternate method (text, phone call, secondary app) from the sign-in prompt's \"Other ways to sign in\".\n5. Manually open Authenticator and use the rolling 6-digit code.\n\n## 5. Resolution Steps\n**Setting up MFA for the first time:**\n1. Visit https://aka.ms/mfasetup (or follow the prompt during sign-in).\n2. Click \"Add sign-in method\" → choose Microsoft Authenticator.\n3. Install Microsoft Authenticator on phone (iOS App Store / Google Play).\n4. In the app: Add account → Work or school account → Scan QR code shown on the website.\n5. Approve the test prompt.\n6. Add a backup method (phone number for text, in case device lost).\n\n**New phone (old phone still works):**\n1. Install Authenticator on new phone.\n2. On old phone, in Authenticator: Settings → Backup → ensure cloud backup ON (with iCloud / Microsoft account).\n3. On new phone, in Authenticator: Begin recovery → sign in with same recovery account → entries restore.\n4. Re-verify each entry — Authenticator may require re-verification on new device.\n\n**New phone (old phone gone):**\n1. Try sign-in with backup method (text/call to phone number on file).\n2. If backup works → https://aka.ms/mfasetup → remove old Authenticator entry → add new.\n3. If no backup methods work → Escalate (admin reset).\n\n**Lost phone, no backup methods:**\n1. Submit identity verification request to IT (photo ID, manager confirmation per policy).\n2. Admin (L2) clears MFA registration via Entra portal.\n3. User signs in once with password only → re-enrolls fresh.\n\n## 6. Verification Steps\n- Sign-in test from a different browser session succeeds with MFA.\n- Authenticator shows current account with green \"Active\" status.\n- Two registered methods minimum (one primary + one backup).\n- \"Sign-in activity\" in My Sign-Ins shows recent successful MFA challenges.\n\n## 7. Escalation Trigger\n- User has zero working recovery methods.\n- Admin reset of MFA needed.\n- MFA prompts arriving for sign-ins user did not initiate (possible token theft / phishing).\n- Conditional Access requires compliant device and user is on personal device.\n- → Escalate to **L2** with: UPN, identity verification status, last successful sign-in, suspicious activity flags.\n\n## 8. Prevention Tips\n- Always register at least 2 MFA methods (Authenticator + phone number).\n- Enable cloud backup in Authenticator (Settings → Backup).\n- Keep a printed/secure list of verification phone numbers used.\n- Never approve MFA prompts you didn't initiate. If prompts come unprompted, your password may be compromised — change it immediately and report.\n- For very sensitive accounts, use FIDO2 security key (YubiKey) — phishing-resistant.\n\n## 9. User-Friendly Explanation\n\"MFA is the extra check that protects your account from someone who guessed or stole your password. If your phone's gone or unhappy, we have a few ways to get you back in: try a backup method like text-to-phone, restore your authenticator from cloud backup, or have IT reset it after we confirm it's really you. Adding a second method now is the best favor you can do for future-you.\"\n\n## 10. Internal Technician Notes\n- Admin MFA reset (Entra/Azure AD): Users → user → Authentication methods → Require re-register MFA.\n- Or PowerShell: `Reset-MsolStrongAuthenticationMethodByUpn -UserPrincipalName user@domain`.\n- Number matching (push notifications now show 2-digit code in browser; user types into app) is now default — reduces approval-spam attacks.\n- TOTP codes valid for current 30s window + grace; clock skew >60s breaks them.\n- For \"MFA fatigue\" attacks (attacker spams pushes hoping user approves): enable Authenticator number-matching policy and review sign-in logs for repeated denied prompts.\n- FIDO2 / Passkey rollout — recommended for admin accounts and high-value users.\n\n## 11. Related KB Articles\n- l1-m365-001 — Can't sign in to M365\n- l1-password-001 — Password reset and SSPR\n- l2-azure-ad-002 — MFA admin policy and Conditional Access integration\n\n## 12. Keywords / Search Tags\nmfa, 2fa, two factor, multi factor, authenticator, lost phone, new phone, mfa code, microsoft authenticator, push notification not arriving"
  },
  {
   "slug": "l1-mobile-email-001-work-email-on-phone",
   "path_rel": "knowledge-base\\L1\\l1-mobile-email-001-work-email-on-phone.md",
   "title": "\"Set up work email on a personal or mobile phone\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"set up work email on my phone\"",
    "\"work email on phone\"",
    "\"email on my phone\"",
    "\"add work email to phone\"",
    "\"outlook mobile setup\"",
    "\"exchange email phone\"",
    "\"configure email on phone\"",
    "\"mobile email setup\"",
    "\"add exchange account\"",
    "\"m365 email phone\"",
    "\"work email iphone\"",
    "\"work email android\"",
    "\"outlook app email\""
   ],
   "compliance": [],
   "content": "---\nid: l1-mobile-email-001\ntitle: \"Set up work email on a personal or mobile phone\"\ncategory: email\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"iOS\",\"Android\"]\nprerequisites: []\nkeywords: [\"set up work email on my phone\",\"work email on phone\",\"email on my phone\",\"add work email to phone\",\"outlook mobile setup\",\"exchange email phone\",\"configure email on phone\",\"mobile email setup\",\"add exchange account\",\"m365 email phone\",\"work email iphone\",\"work email android\",\"outlook app email\"]\nrelated_articles: [\"l1-m365-001\",\"l1-mfa-001\",\"l1-outlook-001\"]\nescalation_trigger: \"Account adds but cannot connect after correct password + MFA, or enrollment/Conditional Access blocks the device from receiving mail.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Set up work email on a personal or mobile phone\n\n## 1. Symptoms\n- You want your work email, calendar, and contacts on your phone.\n- You have a new phone and need to add your company account.\n- Mail won't add, or it adds but says it can't connect.\n- You're prompted to \"enroll\" or \"register\" the device before email will work.\n- You're unsure whether to use the built-in Mail app or the Outlook app.\n\n## 2. Likely Causes\n1. Account not yet added on the phone.\n2. Built-in Mail app used where the company requires the Outlook app.\n3. MFA not completed during sign-in.\n4. Device must be registered/enrolled (Intune / mobile management) before mail is allowed.\n5. Conditional Access policy blocking an unmanaged or non-compliant device.\n\n## 3. Questions To Ask User\n1. Is this an iPhone (iOS) or Android phone?\n2. Is it a personal phone or a company-issued one?\n3. Do you already have the Microsoft Outlook app, or the Authenticator app, installed?\n4. Do you know your full work email address and password?\n5. Have you been told the company requires the Outlook app or device enrollment?\n\n## 4. Troubleshooting Steps\n1. **Confirm credentials first.** Make sure you can sign in to https://office.com in the phone's browser with your work email and password — that proves the account works before app setup.\n2. **Use the recommended app.** Most organizations on Microsoft 365 use the **Microsoft Outlook** app (App Store / Google Play) rather than the built-in Mail app, because it supports security policies.\n3. **Install Microsoft Authenticator** if you don't have an MFA method yet — you'll likely need to approve a sign-in.\n4. **Check for an enrollment prompt.** If sign-in asks to \"register\" the device or install a company portal, that's expected — IT requires it before mail flows.\n\n## 5. Resolution Steps\n**iPhone (iOS) — recommended (Outlook app):**\n1. Install **Microsoft Outlook** from the App Store and open it.\n2. Tap **Add Account**, enter your full work email, tap **Continue**.\n3. Enter your password, then **approve the MFA prompt** in Authenticator or via text/call.\n4. If asked, allow notifications and complete any device registration step.\n5. Wait a minute for mail, calendar, and contacts to sync.\n\n**Android — recommended (Outlook app):**\n1. Install **Microsoft Outlook** from Google Play and open it.\n2. Tap **Add account**, enter your work email, tap **Continue**.\n3. Enter your password and **approve the MFA prompt**.\n4. Complete any \"register device\" / Company Portal step if prompted.\n5. Wait for the inbox to populate.\n\n**If your company uses Exchange via the built-in Mail app instead:**\n- iOS: Settings → Mail → Accounts → Add Account → **Microsoft Exchange** → enter email → sign in → approve MFA.\n- Android: Settings → Accounts → Add account → **Exchange / Corporate** (varies by phone) → enter email → sign in.\n\n## 6. Verification Steps\n- New work email appears in the inbox and you can send a test message to yourself.\n- Calendar shows your work meetings.\n- A test email sent from a computer arrives on the phone within a minute or two.\n- No repeated password prompts after setup.\n\n## 7. Escalation Trigger\n- Account adds but shows \"cannot connect\" after the correct password and approved MFA.\n- A registration/enrollment or Conditional Access step blocks the device from receiving mail.\n- The device is required to be compliant but won't pass the compliance check.\n- → Escalate to **L2** with: phone OS and model, app used (Outlook vs native), the exact error text, and whether device enrollment was completed.\n\n## 8. Prevention Tips\n- Use the Microsoft Outlook app for the smoothest, policy-compliant experience.\n- Keep the Authenticator app installed so MFA approvals are quick.\n- Keep the phone's OS and the Outlook app updated.\n- Don't add the same work account in multiple mail apps — it causes duplicate notifications and sync confusion.\n- Set a screen lock; many email policies require one before mail will sync.\n\n## 9. User-Friendly Explanation\n\"Adding work email to your phone is usually a two-minute job: install the Outlook app, type your email and password, then approve the security prompt on your phone. The reason we steer you to the Outlook app instead of your phone's built-in Mail is that it keeps work data in a protected space and follows our security rules. If your phone asks to 'register' during setup, that's normal and expected — it's just confirming the phone is allowed to receive company mail.\"\n\n## 10. Internal Technician Notes\n- Standard path is Outlook mobile + Modern Auth (OAuth) against Exchange Online; native ActiveSync is discouraged where App Protection Policies (MAM) are enforced.\n- If MAM/Intune App Protection is on, the user may need to install/sign into the Authenticator (or Company Portal on Android) before Outlook will open the mailbox.\n- Conditional Access \"require approved client app\" or \"require compliant device\" will block native Mail — direct the user to Outlook and confirm enrollment.\n- For setup failures, check Entra sign-in logs for the device for CA/MFA result and the client app used.\n- Autodiscover is automatic for M365; manual server settings should rarely be needed — if a user is entering server names, they're likely on the wrong (native) path.\n\n## 11. Related KB Articles\n- l1-m365-001 — Can't sign in to Microsoft 365\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-outlook-001 — Outlook not receiving emails\n\n## 12. Keywords / Search Tags\nset up work email on my phone, work email on phone, email on my phone, add work email to phone, outlook mobile setup, exchange email phone, configure email on phone, mobile email setup, add exchange account, work email iphone, work email android"
  },
  {
   "slug": "l1-newdevice-001-new-device-first-boot-setup",
   "path_rel": "knowledge-base\\L1\\l1-newdevice-001-new-device-first-boot-setup.md",
   "title": "\"Set up a new work laptop — first boot and sign-in\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"new laptop first boot\"",
    "\"got a new laptop\"",
    "\"new device setup\"",
    "\"first boot setup\"",
    "\"set up my new computer\"",
    "\"new computer setup\"",
    "\"autopilot enrollment\"",
    "\"new pc setup\"",
    "\"setting up new laptop\"",
    "\"first time setup\"",
    "\"oobe setup\"",
    "\"enroll new device\"",
    "\"new work computer\"",
    "\"getting started new laptop\""
   ],
   "compliance": [],
   "content": "---\nid: l1-newdevice-001\ntitle: \"Set up a new work laptop — first boot and sign-in\"\ncategory: onboarding\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 30\naudience: end-user\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"new laptop first boot\",\"got a new laptop\",\"new device setup\",\"first boot setup\",\"set up my new computer\",\"new computer setup\",\"autopilot enrollment\",\"new pc setup\",\"setting up new laptop\",\"first time setup\",\"oobe setup\",\"enroll new device\",\"new work computer\",\"getting started new laptop\"]\nrelated_articles: [\"l1-m365-001\",\"l1-mfa-001\",\"l1-onedrive-001\"]\nescalation_trigger: \"Setup stalls during enrollment/provisioning, the device won't join the company account, or required apps never install after sign-in.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Set up a new work laptop — first boot and sign-in\n\n## 1. Symptoms\n- You received a new work laptop and need to set it up for the first time.\n- The screen shows the out-of-box setup (region, keyboard, network, sign-in).\n- You're unsure whether to sign in with your work account or a personal one.\n- The device is \"getting ready\" or installing things and you don't know how long to wait.\n- Your apps and files aren't there yet on the brand-new machine.\n\n## 2. Likely Causes\n1. This is a normal first-boot (OOBE) — the device just needs to be configured and enrolled.\n2. The device is provisioning through Windows Autopilot / company enrollment, which runs automatically after you connect to the internet and sign in.\n3. Apps install automatically after enrollment and take time on first boot.\n4. Your files live in OneDrive/SharePoint and sync down after you sign in, rather than being pre-loaded.\n\n## 3. Questions To Ask User\n1. Is it a Windows laptop or a Mac?\n2. Is this your first time turning it on (fresh out-of-box screen)?\n3. Do you have a working Wi-Fi or wired network nearby, and the password?\n4. Do you know your full work email, password, and have your MFA method (Authenticator/phone) ready?\n5. Were you told this device uses Autopilot / automatic company setup?\n\n## 4. Troubleshooting Steps\n1. **Plug in power** and keep it plugged in for the whole setup.\n2. **Connect to a network early.** Choose your Wi-Fi (or plug in Ethernet) at the network step — enrollment needs internet.\n3. **Have MFA ready.** Keep your phone with Microsoft Authenticator nearby; you'll approve a prompt during sign-in.\n4. **Sign in with your WORK account**, not a personal Microsoft account, when asked for email — this is what triggers company enrollment.\n5. **Be patient on \"Setting up your device.\"** Autopilot can take 10-30+ minutes to apply policies and install apps; don't power off mid-way.\n\n## 5. Resolution Steps\n**Windows (OOBE / Autopilot):**\n1. Power on; choose **region** and **keyboard**.\n2. Connect to **Wi-Fi or Ethernet**.\n3. At the sign-in screen, enter your **work email and password**, then **approve the MFA prompt**.\n4. Let the device run **\"Setting up your device / account\"** (Autopilot Enrollment Status Page) — it applies security settings and installs core apps. Leave it plugged in and online.\n5. When you reach the desktop, **open the Company Portal / Software Center** (if present) to install any optional apps you need.\n6. **Sign in to OneDrive** so your files start syncing; sign in to Outlook and Teams.\n\n**macOS (company-enrolled):**\n1. Power on; choose region, keyboard, and **connect to a network**.\n2. Sign in / complete **Remote Management / enrollment** when prompted (this registers the Mac with the company).\n3. Create your local account, then **sign in to Microsoft 365 apps** (Outlook, Teams) with your work account and approve MFA.\n4. Let managed apps install, then sign in to OneDrive to sync files.\n\n## 6. Verification Steps\n- You reach the desktop and can open Outlook with email flowing.\n- Teams signs in and shows green presence.\n- OneDrive shows it is syncing / \"Up to date.\"\n- Core company apps are installed (or installing) without errors.\n- The device shows as enrolled/compliant in IT's console (IT can confirm).\n\n## 7. Escalation Trigger\n- Setup stalls or errors during the **Enrollment Status Page** / provisioning.\n- The device won't accept the work account or says it can't join the organization.\n- Required apps never install after you reach the desktop.\n- OneDrive won't sign in or files don't sync after a reasonable wait.\n- → Escalate to **L2** with: device make/model and serial, the exact step/error, network type, and your work email (UPN).\n\n## 8. Prevention Tips\n- Always do first-boot on a reliable network and on power.\n- Use your work account (not personal) at sign-in so policies apply.\n- Don't skip MFA setup — finishing it now avoids lockouts later.\n- Keep files in OneDrive/SharePoint so a future new device just syncs them back.\n- Don't power off during \"Setting up your device\"; interrupting enrollment can require a reset.\n\n## 9. User-Friendly Explanation\n\"A new work laptop sets itself up mostly on its own once you connect to Wi-Fi and sign in with your work email. After you sign in, it spends 10-30 minutes quietly applying our security settings and installing your apps — that 'getting ready' screen is normal, so just leave it plugged in. Your files aren't missing; they live in OneDrive and download once you sign in. Within about half an hour you'll have email, Teams, and your apps ready to go.\"\n\n## 10. Internal Technician Notes\n- Windows Autopilot: device must reach Entra/Intune over the internet during OOBE; the Enrollment Status Page (ESP) blocks the desktop until required apps/policies land. ESP timeouts are the most common stall point.\n- Confirm the device's hardware hash is registered (Autopilot deployment profile) before shipping, or it falls back to standard OOBE.\n- macOS: relies on ABM/ASM + MDM (Intune/Jamf) Automated Device Enrollment; \"Remote Management\" screen = supervised enrollment.\n- If user signed in with a personal MSA by mistake, the device won't enroll — may need to reset OOBE.\n- OneDrive Known Folder Move (KFM) usually redirects Desktop/Documents/Pictures automatically; verify it engaged so the user's profile data is protected.\n- Check enrollment/compliance state in Intune (Devices) and Entra (device join state, `dsregcmd /status` on Windows).\n\n## 11. Related KB Articles\n- l1-m365-001 — Can't sign in to Microsoft 365\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-onedrive-001 — OneDrive not syncing\n\n## 12. Keywords / Search Tags\nnew laptop first boot, got a new laptop, new device setup, first boot setup, set up my new computer, new computer setup, autopilot enrollment, new pc setup, oobe setup, enroll new device, first time setup"
  },
  {
   "slug": "l1-onedrive-001-not-syncing",
   "path_rel": "knowledge-base\\L1\\l1-onedrive-001-not-syncing.md",
   "title": "\"OneDrive not syncing / paused / stuck on 'looking for changes'\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-001\ntitle: \"OneDrive not syncing / paused / stuck on 'looking for changes'\"\ncategory: onedrive\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - onedrive\n  - not syncing\n  - paused\n  - looking for changes\n  - sync stuck\n  - red x\n  - upload pending\n  - blocked file\nrelated_articles:\n  - l1-onedrive-002\n  - l2-sharepoint-001\nescalation_trigger: \"Sync error code 0x8004... persists after reset, or pattern across multiple users on same tenant\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# OneDrive not syncing\n\n## 1. Symptoms\n- OneDrive cloud icon shows red X, paused symbol, or sync arrow stalled.\n- \"Looking for changes\" message stays for hours.\n- File modified locally doesn't appear in OneDrive web.\n- Specific files fail with \"couldn't sync\" notification.\n- \"OneDrive isn't connected. Click here to sign in.\"\n\n## 2. Likely Causes\n1. OneDrive paused (battery saver, metered network, manual pause).\n2. File name has illegal characters (`<>:\"/\\|?*` or trailing space/period).\n3. File path > 400 characters total.\n4. File >250 GB (size cap).\n5. Account credentials expired.\n6. Storage quota exceeded.\n7. File locked by an application (open in Word/Excel).\n8. Folder location moved while OneDrive was running.\n\n## 3. Questions To Ask User\n1. What does the OneDrive icon look like (red X, paused, normal cloud, blue arrows)?\n2. Are all files affected, or specific ones?\n3. What's your OneDrive storage usage? (right-click cloud → Settings → Account.)\n4. Is the file currently open in another app?\n5. Are you on battery, on Wi-Fi, on a metered connection?\n\n## 4. Troubleshooting Steps\n1. Click cloud icon → if paused, click Resume.\n2. Settings → Sync and backup → uncheck \"Pause sync when this device is on battery / metered network\" if needed.\n3. Check name of any flagged file → rename to remove special characters.\n4. Check path length: `where.exe /R C:\\Users\\<user>\\OneDrive *` — anything >400 chars must be shortened.\n5. Verify quota: cloud → Settings → Account → \"X GB of Y GB used\".\n\n## 5. Resolution Steps\n**If paused / network:**\n- Resume; if still stalled, switch to a different network briefly to confirm reachability.\n\n**If file-level sync errors:**\n- Right-click cloud → View sync problems.\n- Click each entry → fix per error message.\n- Common: rename file (drop emoji / special chars), shorten path, close app holding lock, or move file to a shorter folder.\n\n**If OneDrive itself is stuck:**\n1. Right-click cloud → Quit OneDrive.\n2. Run reset: Win+R → `%localappdata%\\Microsoft\\OneDrive\\onedrive.exe /reset` → Enter.\n3. If icon doesn't reappear in 5 min, run `%localappdata%\\Microsoft\\OneDrive\\onedrive.exe`.\n4. Sign in fresh.\n\n**If credentials expired:**\n- Same reset; on relaunch, sign in with work account.\n\n**If quota:**\n- Web: onedrive.live.com → file usage report → archive or delete.\n- Or: admin assigns 1 TB → 5 TB upgrade per Microsoft 365 SKU.\n\n## 6. Verification Steps\n- Cloud icon shows green check (or \"Up to date\").\n- \"View sync problems\" empty.\n- Test file: create new file in synced folder → verify in OneDrive web within 60s.\n- 24h of normal use without sync error notifications.\n\n## 7. Escalation Trigger\n- Reset + sign-in fails repeatedly.\n- Error codes 0x8004de40, 0x8004de80, 0x80070184, or 0x8007016A persist.\n- Mass file conflicts after a known shared folder change.\n- KFM (Known Folder Move) errors during enrollment.\n- → Escalate to **L2** with: OneDrive version, error codes, sync log path output, and tenant info.\n\n## 8. Prevention Tips\n- Avoid emojis and special chars in file/folder names.\n- Don't store OneDrive root inside another sync tool (Dropbox, Google Drive) — pick one.\n- Close Office files before forcing sync.\n- Keep OneDrive updated.\n- For laptops with SSDs <256 GB, enable Files On-Demand.\n\n## 9. User-Friendly Explanation\n\"OneDrive paused or got stuck. Either it doesn't trust your network right now, or one file has a character it doesn't like (think emoji or a colon in the name). We'll resume, fix the troublemaker file, and confirm everything is making it to the cloud. If it's deeper than that, a reset clears the slate cleanly.\"\n\n## 10. Internal Technician Notes\n- Reset command full: `%localappdata%\\Microsoft\\OneDrive\\onedrive.exe /reset` (per-user) or `\"C:\\Program Files\\Microsoft OneDrive\\OneDrive.exe\" /reset` (per-machine).\n- Logs: `%localappdata%\\Microsoft\\OneDrive\\logs\\` — `SyncDiagnostics.log` is the goldmine for L2.\n- KFM (Known Folder Move): admin-controlled. Verify Group Policy / Intune CSPs `KFMSilentOptIn`.\n- Known sync errors:\n  - 0x8004de40 — sign-in error.\n  - 0x8004de80 — token expired.\n  - 0x80070184 — file too large or quota.\n  - 0x8007016A — file is in use.\n- For corporate, check that `oneclient.sfx.ms` / `*.onedrive.com` / `*.sharepoint.com` aren't blocked at proxy.\n- Files On-Demand (Win10 1709+) — check status: `fsutil reparsepoint query \"C:\\Users\\<user>\\OneDrive\\file\"`.\n\n## 11. Related KB Articles\n- l1-onedrive-002 — File restore from version history\n- l2-sharepoint-001 — SharePoint sync conflicts\n\n## 12. Keywords / Search Tags\nonedrive, not syncing, paused, looking for changes, sync stuck, red x, upload pending, blocked file"
  },
  {
   "slug": "l1-onedrive-002-restore-deleted-file",
   "path_rel": "knowledge-base\\L1\\l1-onedrive-002-restore-deleted-file.md",
   "title": "\"Restore deleted or modified file from OneDrive / version history\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-002\ntitle: \"Restore deleted or modified file from OneDrive / version history\"\ncategory: onedrive\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: []\nkeywords:\n  - restore file\n  - deleted file\n  - recover file\n  - version history\n  - previous version\n  - rollback\n  - ransomware recovery\n  - onedrive recycle bin\nrelated_articles:\n  - l1-onedrive-001\n  - l2-backup-001\nescalation_trigger: \"File deleted >93 days ago, or ransomware detected on tenant, or shared library file requires admin restore\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Restore deleted or modified file from OneDrive\n\n## 1. Symptoms\n- File missing from OneDrive folder.\n- File is corrupted or has wrong content (overwritten).\n- \"I saved over my work and need yesterday's version.\"\n- Folder accidentally deleted.\n- Mass corruption suspected (ransomware indicator).\n\n## 2. Likely Causes\n1. User deleted file (Recycle Bin → still recoverable).\n2. Sync conflict resolved by retaining wrong copy.\n3. Another user with shared access deleted/edited.\n4. Office auto-save replaced with bad version.\n5. Ransomware encrypted files.\n\n## 3. Questions To Ask User\n1. When did the file last look correct (date + time)?\n2. Was the file in your personal OneDrive, or a shared library / SharePoint folder?\n3. Can you remember the exact filename or what's in it?\n4. Have you noticed other files going missing or renamed strangely (.crypted, .locked, .encrypted)?\n\n## 4. Troubleshooting Steps\n1. Check local Recycle Bin (desktop) — look for file there.\n2. Check OneDrive web Recycle Bin: onedrive.live.com → Recycle bin (left nav).\n3. For specific file's history: web view → right-click file → Version history.\n4. For mass loss / suspected ransomware: STOP and escalate immediately — DO NOT attempt to restore until threat is contained.\n\n## 5. Resolution Steps\n**Single deleted file (last 30 days personal / 93 days work):**\n1. onedrive.live.com (or office.com → OneDrive) → Recycle bin.\n2. Find file → right-click → Restore. File returns to its original folder.\n\n**Older deleted file (work account, second-stage bin):**\n1. Recycle bin → \"Second-stage recycle bin\" link at bottom — accessible to admins; user requests via L2.\n\n**Restore prior version:**\n1. Web view → right-click file → Version history.\n2. Click ⋯ on a version → Restore. Saves current as new version, makes restored version current.\n\n**Bulk / time-machine restore:**\n1. onedrive.live.com → Settings (gear) → Options → Restore your OneDrive.\n2. Pick a date — slider shows daily activity histogram.\n3. Confirm restore. ALL changes after that timestamp roll back. Use only when sure.\n\n**Suspected ransomware:**\n1. Disconnect device from network immediately.\n2. Do NOT attempt restore yet — escalate to L2/L3 (see escalation).\n3. Report to IT security per your incident response policy.\n\n## 6. Verification Steps\n- File is present in expected folder.\n- Open file — content matches expected version.\n- For version restore: file modified date is updated; previous versions still accessible in history.\n- Sync icon green.\n\n## 7. Escalation Trigger\n- File deleted more than 93 days ago (work) — admin retention recovery needed.\n- Mass file changes with .locked / .crypted / .[unknown] extensions — RANSOMWARE; escalate to **L3 / Security** immediately.\n- Restore your OneDrive doesn't show enough history.\n- SharePoint / shared library file — site collection admin restore needed.\n- → Escalate to **L2** for second-stage bin / **L3 / Security** for ransomware.\n\n## 8. Prevention Tips\n- Use Office auto-save with OneDrive — gives version history \"for free\".\n- Don't store irreplaceable files only locally — sync the folder via OneDrive.\n- Never delete an entire folder without confirming recursive intent.\n- Enable Personal Vault for sensitive docs (extra MFA gate).\n- Watch for unusual file activity emails from OneDrive — they flag mass deletes.\n\n## 9. User-Friendly Explanation\n\"OneDrive keeps a memory of every version of your files for 30 days, and a recycle bin for 30–93 days. So even if you deleted the file or saved over it, we can usually pull it back. We'll find the right one and restore it together. The only time this gets tricky is if a virus encrypted things — that's a bigger fix and we'll loop in security.\"\n\n## 10. Internal Technician Notes\n- Personal OneDrive recycle bin: 30 days.\n- OneDrive for Business: 93 days for end-user; admins have second-stage bin (90 days more).\n- \"Restore your OneDrive\": rolls back ALL changes after chosen point — like a time machine. Up to 30 days back.\n- Ransomware detection: M365 has built-in alerts (\"File detection settings\"); SOC team should be looped in.\n- Version history retention: defaults to 500 versions; tunable per library (SharePoint Library settings → Versioning).\n- For shared libraries (SharePoint), use site recycle bin first, then admin-level.\n- Always check `Get-MailboxAuditLog` and Audit Log Search before declaring a deletion intentional vs. malicious.\n\n## 11. Related KB Articles\n- l1-onedrive-001 — OneDrive not syncing\n- l2-backup-001 — Backup retention and admin restore\n\n## 12. Keywords / Search Tags\nrestore file, deleted file, recover file, version history, previous version, rollback, ransomware, onedrive recycle bin"
  },
  {
   "slug": "l1-onedrive-003-version-conflict",
   "path_rel": "knowledge-base\\L1\\l1-onedrive-003-version-conflict.md",
   "title": "\"OneDrive sync conflict — 'two copies of file' / file with computer name appended\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-003\ntitle: \"OneDrive sync conflict — 'two copies of file' / file with computer name appended\"\ncategory: onedrive\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - sync conflict\n  - duplicate file\n  - file conflict\n  - two copies\n  - my computer copy\n  - merged file\n  - which version\nrelated_articles:\n  - l1-onedrive-001\n  - l1-onedrive-002\nescalation_trigger: \"Conflict pattern affects shared library and multiple users; needs admin merge tooling\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# OneDrive sync conflict\n\n## 1. Symptoms\n- File \"report.docx\" suddenly accompanied by \"report-PCNAME.docx\".\n- Notification \"OneDrive couldn't merge changes — keeping both copies\".\n- Two near-identical files in same folder.\n- Office app's \"Conflict — Resolve\" banner.\n\n## 2. Likely Causes\n1. Same file edited offline on two devices, both came online.\n2. Collaborator and user edited simultaneously without auto-save.\n3. Older Office version that lacks real-time co-authoring.\n4. File on slow network — change conflict during save.\n5. Sync was paused on one device for a long time.\n\n## 3. Questions To Ask User\n1. Which file is affected?\n2. Did anyone else edit it recently?\n3. Were you offline (no internet) while working on it?\n4. Do you see \"report-LAPTOPNAME.docx\" type name?\n5. Are these Word/Excel/PowerPoint files (co-authoring) or other file types?\n\n## 4. Troubleshooting Steps\n1. Open both versions side-by-side in their app.\n2. Compare differences (Word: Review → Compare).\n3. Decide which content to keep, or merge.\n4. Save merged version with original name.\n5. Delete the redundant copy.\n\n## 5. Resolution Steps\n**For Word docs (most graceful):**\n1. Open both files in Word.\n2. Review tab → Compare → Combine.\n3. Pick original document and your conflict copy → OK.\n4. Word produces merged view; accept changes you want.\n5. Save As original filename → overwrite when prompted.\n6. Delete the conflict file.\n\n**For Excel:**\n- No native compare — manually review sheets, copy cells from conflict copy as needed.\n- Save merged as original.\n\n**For other file types (PDF, images, etc.):**\n- Pick the version you want to keep; rename it back to the original name; delete the loser.\n\n**Prevent recurrence:**\n- Enable Office AutoSave (top-left toggle in Word/Excel/PowerPoint when file is on OneDrive).\n- Use real-time co-authoring (Office 2016+) — multiple editors stay in sync.\n- Don't edit the same file offline on multiple devices.\n\n## 6. Verification Steps\n- Original filename present, content correct.\n- Conflict-named file deleted.\n- OneDrive shows green check on the file.\n- Open file in Office → no conflict banner.\n\n## 7. Escalation Trigger\n- Conflict pattern repeats daily for the same user (sync misconfigured).\n- Multiple users on shared library generating conflicts en masse — library setting / co-authoring policy issue.\n- Merge needed across many files (admin tooling).\n- → Escalate to **L2** with: filenames, frequency, library, file types.\n\n## 8. Prevention Tips\n- Use AutoSave on OneDrive-stored files.\n- Use Office 2016+ for real-time co-authoring.\n- Keep OneDrive online — don't pause for hours.\n- Don't edit large monolithic files concurrently — split into sections.\n- Communicate with collaborators — Teams chat \"I'm editing X\" reduces conflicts.\n\n## 9. User-Friendly Explanation\n\"OneDrive saw two different versions of the same file and didn't want to lose anyone's work, so it kept both. We'll open them, pick the changes you want, save it back as the original, and delete the duplicate. To prevent this, turn on AutoSave next time you're editing — it keeps everyone in sync.\"\n\n## 10. Internal Technician Notes\n- Conflict naming convention: `<filename>-<computername>.<ext>` for OneDrive, or `<filename>-<user>'s conflicted copy <date>.<ext>` for SharePoint sync.\n- For PowerPoint, real-time co-authoring requires PPTX format on SharePoint/OneDrive + Office 365 build with co-author flag.\n- For mass conflicts post-migration, use SharePoint Migration Tool's Conflict Report to identify and bulk-resolve.\n- AutoSave is OneDrive-aware: a file in synced OneDrive auto-enables; a local-only file cannot.\n- Co-authoring requires write access for both users; if one has only \"Edit\" and another \"Owner\", policies still permit co-author but conflict rules change.\n\n## 11. Related KB Articles\n- l1-onedrive-001 — OneDrive sync issues\n- l1-onedrive-002 — File restore / version history\n\n## 12. Keywords / Search Tags\nsync conflict, duplicate file, file conflict, two copies, my computer copy, merged file, which version, autosave"
  },
  {
   "slug": "l1-outlook-001-not-receiving-emails",
   "path_rel": "knowledge-base\\L1\\l1-outlook-001-not-receiving-emails.md",
   "title": "\"Outlook not receiving new emails\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-outlook-001\ntitle: \"Outlook not receiving new emails\"\ncategory: outlook\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - outlook\n  - not receiving emails\n  - email stuck\n  - inbox not updating\n  - missing emails\n  - send/receive\nrelated_articles:\n  - l1-outlook-002\n  - l1-m365-002\n  - l2-exchange-001\nescalation_trigger: \"Send/Receive returns 0x8004... errors, or issue affects multiple users in same tenant\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Outlook not receiving new emails\n\n## 1. Symptoms\n- New messages don't appear, but they show in Outlook on the web.\n- \"Working offline\" badge in status bar.\n- Send/Receive button does nothing visible.\n- Specific senders' emails don't arrive (rest do).\n- Inbox shows up to a date and stops.\n\n## 2. Likely Causes\n1. Outlook is in Offline mode.\n2. Send/Receive group disabled or interval too long.\n3. OST file corrupted (cached mode).\n4. Mailbox over quota — incoming queued at server.\n5. Junk Email or rules redirecting messages.\n6. Specific sender blocked or in junk filter.\n7. Network connectivity loss.\n8. Tenant-wide mail flow issue (Exchange Online).\n\n## 3. Questions To Ask User\n1. Are you missing all emails, or only from specific people?\n2. Do the missing emails appear in Outlook Web (outlook.office.com)?\n3. Does the bottom status bar say \"Connected\", \"Offline\", or \"Disconnected\"?\n4. When did you last receive any email at all?\n5. Have you set up any new rules or moved any items recently?\n6. Are you the only one affected, or are coworkers seeing the same?\n\n## 4. Troubleshooting Steps\n1. Check Outlook status bar — if \"Working Offline\", click **Send/Receive** tab → toggle off **Work Offline**.\n2. Open https://outlook.office.com — verify mail is arriving server-side.\n3. Send/Receive tab → **Send/Receive All Folders** (F9). Watch progress dialog for errors.\n4. Check **Junk Email** folder for missing messages.\n5. File → Manage Rules & Alerts — review for redirect/forward/delete rules user didn't expect.\n6. Verify mailbox usage: Outlook Web → Settings → General → Storage. If over quota, archive or delete old items.\n\n## 5. Resolution Steps\n**If Outlook is offline:**\n- Send/Receive → uncheck Work Offline.\n\n**If specific senders only:**\n- Home → Junk → Junk E-mail Options → check Blocked Senders, Safe Senders, and Filters.\n- Ask sender to resend; check delivery in Outlook Web first.\n\n**If OST file corrupted:**\n1. Close Outlook completely (verify no `OUTLOOK.EXE` in Task Manager).\n2. File → Account Settings → Account Settings → Data Files tab.\n3. Note the OST file location.\n4. Open File Explorer to that folder, rename `*.ost` to `*.ost.old`.\n5. Reopen Outlook — it will rebuild the OST from server (15–60 min for typical mailbox).\n\n**If quota:**\n- Archive items: File → Cleanup Tools → Archive (or Online Archive if licensed).\n- Empty Deleted Items.\n- Empty Junk.\n- For corporate: request quota increase from L2.\n\n## 6. Verification Steps\n- Sender to user test: have someone send a test message; user receives within 60 seconds.\n- Outlook status bar shows \"Connected to: Microsoft Exchange\".\n- Send/Receive completes with no error in the progress dialog.\n- Inbox count matches Outlook Web inbox count.\n\n## 7. Escalation Trigger\n- Send/Receive shows error codes `0x8004010F`, `0x800CCC0F`, `0x80042108`, or any HTTP 5xx in the progress dialog.\n- Multiple users on the same tenant report the same issue → tenant-wide mail flow.\n- Mail is missing on Outlook Web too → Exchange Online side, escalate immediately.\n- OST rebuild fails or hangs >2 hours.\n- → Escalate to **L2** with: error code, screenshots, account UPN, OST size, and whether issue spans multiple users.\n\n## 8. Prevention Tips\n- Don't disable Send/Receive groups.\n- Archive monthly to keep mailbox under 80% of quota.\n- Use Focused Inbox sparingly — it can hide messages users don't realize exist.\n- Train users to check Junk weekly.\n- For laptops with intermittent network, keep Cached Exchange Mode ON.\n\n## 9. User-Friendly Explanation\n\"Outlook isn't pulling new mail from the server. Often it's stuck in Offline mode, or it's filtered something into Junk. We'll get it talking to the server again, peek in Junk, and double-check no rule is moving things. If we still can't see your latest emails, we'll log into the web version to confirm where they actually are, then fix the right piece.\"\n\n## 10. Internal Technician Notes\n- OST default location: `%localappdata%\\Microsoft\\Outlook\\` — back it up before deletion if user has local-only items (PST attachments etc.).\n- Mailbox quota check (admin): `Get-MailboxStatistics user@domain | ft DisplayName,TotalItemSize,ItemCount`.\n- Mail flow trace: Exchange Admin Center → Mail flow → Message trace → search by recipient + date range.\n- For shared mailboxes accessed in cached mode, OST can balloon — consider Online mode for small-mailbox shared.\n- 0x8004010F often = corrupted profile, not OST. Fix with `Mail (Microsoft Outlook)` Control Panel applet → New Profile.\n- If MFA was enforced recently and user hadn't reauth'd, modern auth prompts get suppressed in some Outlook builds — `outlook.exe /resetnavpane` then close + reopen forces auth.\n\n## 11. Related KB Articles\n- l1-outlook-002 — Outlook crashes / won't open\n- l1-m365-002 — Microsoft 365 license / activation issues\n- l2-exchange-001 — Exchange Online mail flow troubleshooting\n\n## 12. Keywords / Search Tags\noutlook, not receiving, email stuck, inbox not updating, missing emails, send receive, offline mode, ost, junk filter"
  },
  {
   "slug": "l1-outlook-002-cant-send-emails",
   "path_rel": "knowledge-base\\L1\\l1-outlook-002-cant-send-emails.md",
   "title": "\"Outlook can't send emails / messages stuck in Outbox\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-outlook-002\ntitle: \"Outlook can't send emails / messages stuck in Outbox\"\ncategory: outlook\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - outlook\n  - can't send\n  - stuck in outbox\n  - email not sending\n  - unable to send\n  - smtp error\n  - outbox\nrelated_articles:\n  - l1-outlook-001\n  - l2-exchange-001\nescalation_trigger: \"Multiple users on same tenant cannot send, or NDR shows 5.7.x policy violation, or DKIM/SPF/DMARC failure\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Outlook can't send emails / messages stuck in Outbox\n\n## 1. Symptoms\n- Composed message sits in **Outbox** indefinitely.\n- \"Outlook is trying to send your message\" dialog hangs.\n- NDR (non-delivery report) bounces back from Postmaster with a code like `5.7.1`, `5.7.135`, `5.4.6`, `5.2.2`.\n- Send button appears to do nothing.\n- \"Cannot send this item\" error pops up.\n\n## 2. Likely Causes\n1. Large attachment exceeding 25 MB / 35 MB tenant limit.\n2. Recipient address typo or external block.\n3. Outlook in offline mode.\n4. Stuck Outbox item from a prior failed send.\n5. Authentication / token expired (especially after password change).\n6. Tenant policy blocking external recipients.\n7. Mailbox quota exceeded (cannot send when over).\n\n## 3. Questions To Ask User\n1. Is it one specific email, or all of them?\n2. Is there an attachment? How big?\n3. What does the NDR (bounce) message say, if any?\n4. Did you change your password recently?\n5. Are you online? (try a website)\n6. Is the recipient internal (same company) or external?\n\n## 4. Troubleshooting Steps\n1. Open Outbox folder. If a single email is stuck, double-click → close. Outlook needs the message unlocked to delete or retry.\n2. Move the stuck message to Drafts (drag).\n3. Check internet: open https://office.com — should load.\n4. Check Outlook status bar — must say \"Connected\".\n5. Send/Receive → click **Work Offline** off if engaged.\n6. Try sending a small test message (no attachment) to yourself.\n\n## 5. Resolution Steps\n**If a stuck message blocks Outbox:**\n1. Outlook → Send/Receive → Work Offline (toggle ON to halt sending).\n2. Drag the stuck message from Outbox to Drafts.\n3. Toggle Work Offline OFF.\n4. Open the Drafts copy — re-attach files if needed — Send.\n\n**If attachment too large:**\n- For corporate users: upload to OneDrive → share link → paste link in email instead.\n- M365 default 25 MB per send (some tenants 35 MB or 150 MB). External providers vary.\n\n**If NDR cites 5.7.x (security/policy):**\n- 5.7.1 → recipient or domain blocked your tenant. Contact recipient via phone.\n- 5.7.135 → SPF/DKIM authentication block. Escalate to L2.\n- 5.7.708 → access denied; user may be on M365 sender block list. Escalate.\n\n**If authentication issue (recent password change):**\n1. File → Account Settings → Account Settings → highlight account → Change → re-enter password.\n2. If MFA recently enabled, complete the modern auth prompt.\n3. If repeated auth pop-ups: File → Account Settings → Account Settings → Email → Repair.\n\n**If quota:**\n- Cannot send while over quota. Archive or delete old items first (see l1-outlook-001 §5).\n\n## 6. Verification Steps\n- Stuck message no longer in Outbox.\n- Test message to self arrives within 60 seconds.\n- External test (to personal email or coworker) arrives without NDR.\n- Status bar shows \"Connected to: Microsoft Exchange\".\n\n## 7. Escalation Trigger\n- NDR codes: `5.7.135`, `5.7.708`, `5.7.520`, `5.7.230` — tenant policy.\n- Multiple users in same tenant cannot send.\n- External-domain bounces with DMARC/DKIM failures.\n- Password change does not resolve repeated auth prompts.\n- → Escalate to **L2** with: NDR header (full), recipient domain, sender UPN, last successful send timestamp.\n\n## 8. Prevention Tips\n- Use OneDrive links for files >10 MB by default.\n- Keep mailbox under quota — over-quota mailboxes can receive but not send.\n- Update Outlook to current channel; old builds have known auth bugs.\n- Train users on what NDRs mean — \"5.x.x means hard fail; copy-paste it to IT.\"\n- Don't bulk-send via Outlook from a regular mailbox — flagged as spam.\n\n## 9. User-Friendly Explanation\n\"Your email isn't leaving your computer. It's usually one of three things: a too-big attachment, the message got stuck so nothing else can leave, or your password changed and Outlook hasn't caught up. We'll move the stuck one out of the way, retry with a smaller file via OneDrive if needed, and re-sign you in if that's the issue. Should be back to sending in a couple of minutes.\"\n\n## 10. Internal Technician Notes\n- Outbox lock: items in Outbox in \"in-progress\" state can't be deleted. Forcing offline first releases the lock.\n- For shared/delegated mailboxes, \"Send As\" requires `SendAs` permission on the source mailbox; \"Send on Behalf\" requires `GrantSendOnBehalfTo`. Confirm in Exchange Admin.\n- Modern auth issues: clear cached creds via `Control Panel → User Accounts → Credential Manager` — remove all `MicrosoftOffice16_Data:*` entries, then close + reopen Outlook.\n- For NDR `5.7.135` \"this message can't be delivered due to authentication\", check Exchange Admin Center → Mail Flow → spoof intelligence; the sender may be flagged.\n- Outlook for Mac uses different sync — issues may need profile rebuild via `Outlook Profile Manager`.\n\n## 11. Related KB Articles\n- l1-outlook-001 — Outlook not receiving new emails\n- l2-exchange-001 — Exchange Online mail flow troubleshooting\n\n## 12. Keywords / Search Tags\noutlook, can't send, stuck in outbox, email not sending, smtp error, attachment too large, ndr, bounce, postmaster"
  },
  {
   "slug": "l1-passkey-001-passkey-setup-and-signin",
   "path_rel": "knowledge-base\\L1\\l1-passkey-001-passkey-setup-and-signin.md",
   "title": "\"Set up and sign in with a passkey (passwordless / FIDO2 / Windows Hello)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"passkey setup\"",
    "\"passwordless sign in\"",
    "\"fido2 key\"",
    "\"windows hello passkey\"",
    "\"phone as passkey\"",
    "\"microsoft 365 passkey\"",
    "\"entra passkey\"",
    "\"how to use a passkey\"",
    "\"sign in without password\"",
    "\"add a passkey\"",
    "\"passkey vs password\"",
    "\"security key login\"",
    "\"scan qr code to sign in\"",
    "\"platform passkey\"",
    "\"roaming passkey\""
   ],
   "compliance": [],
   "content": "---\nid: l1-passkey-001\ntitle: \"Set up and sign in with a passkey (passwordless / FIDO2 / Windows Hello)\"\ncategory: identity\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"passkey setup\",\"passwordless sign in\",\"fido2 key\",\"windows hello passkey\",\"phone as passkey\",\"microsoft 365 passkey\",\"entra passkey\",\"how to use a passkey\",\"sign in without password\",\"add a passkey\",\"passkey vs password\",\"security key login\",\"scan qr code to sign in\",\"platform passkey\",\"roaming passkey\"]\nrelated_articles: [\"l1-passkey-002\",\"l1-mfa-001\",\"l1-m365-001\",\"l1-password-001\"]\nescalation_trigger: \"User cannot enroll a passkey because the tenant has not enabled the passkey/FIDO2 authentication method, or the device does not support a platform authenticator.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Set up and sign in with a passkey\n\n## 1. Symptoms\n- User wants to \"go passwordless\" or was told to \"add a passkey\" for their work account.\n- Sign-in screen now offers \"Sign in with a passkey\" / \"Use Windows Hello or a security key\" / \"Face, fingerprint, or PIN.\"\n- User has a new phone or laptop and wants the same fast sign-in they had before.\n- \"Other ways to sign in\" appears but the user does not understand which option is a passkey.\n- User is unsure whether the passkey lives on the phone, the laptop, or a USB key.\n\n## 2. Likely Causes\nThis is usually a setup/how-to request, not a fault. Common reasons the user is asking:\n1. Organization is rolling out phishing-resistant passwordless sign-in.\n2. User received a prompt to \"register a passkey\" during sign-in.\n3. User bought a new device and the passkey did not automatically appear.\n4. Confusion between a **platform passkey** (built into a device — Windows Hello, Touch ID, the phone) and a **roaming passkey** (a separate FIDO2 security key like a USB/NFC key).\n\n## 3. Questions To Ask User\n1. Which account is this for — your work/school (Microsoft 365 / Entra) account, or a personal account?\n2. What device are you setting it up on — Windows PC, Mac, or phone?\n3. Does your PC have a fingerprint reader, a face camera (Windows Hello), or at least a Hello PIN set up?\n4. Do you have a physical security key (USB/NFC), or do you want to use the device itself / your phone?\n5. Is this your first passkey, or are you adding a second device?\n\n## 4. Troubleshooting Steps\nBefore enrolling, confirm the prerequisites:\n1. Confirm the device is up to date (Windows Update / macOS update) — passkey support improves with OS updates.\n2. On Windows, confirm Windows Hello is set up: **Settings → Accounts → Sign-in options → set up Face, Fingerprint, or PIN.** A passkey on Windows is protected by Hello, so Hello must exist first.\n3. On Mac, confirm Touch ID or a device password is configured and the user is signed into iCloud (for syncing).\n4. Confirm the browser is current (Edge, Chrome, or Safari) — passkey prompts use the browser/OS, not a plugin.\n5. If \"Add passkey\" is greyed out or missing for a work account, the tenant may not have enabled the method — see Escalation.\n\n## 5. Resolution Steps\n**A. Enroll a passkey on Windows (Windows Hello as the passkey):**\n1. Go to your account security/My Sign-Ins page (for M365: https://aka.ms/mysignins → **Security info**).\n2. Choose **Add sign-in method → Passkey** (or \"Security key / Passkey\").\n3. When prompted \"Where do you want to save this passkey?\", choose **This device (Windows Hello)**.\n4. Approve with your fingerprint, face, or Hello PIN. The passkey is now stored in the PC's secure hardware (TPM).\n\n**B. Enroll a passkey on a phone (phone-as-passkey):**\n1. On the account security page on your **computer**, choose **Add passkey → iPhone, iPad, or Android device** (or \"Use a different device\").\n2. A **QR code** appears on the computer screen.\n3. **Scan the QR code with the phone's camera.** The phone connects over Bluetooth (keep both devices close and Bluetooth on).\n4. Approve on the phone with Face ID / fingerprint / screen lock. The passkey is saved to the phone's keychain (iCloud Keychain on iPhone, Google Password Manager on Android).\n\n**C. Enroll a roaming passkey on a security key (USB/NFC FIDO2 key):**\n1. Choose **Add passkey → Security key**.\n2. Insert the USB key (or tap an NFC key to the device).\n3. Create or enter the key's **PIN**, then touch the gold disc/sensor to confirm presence.\n4. The passkey now lives on the physical key and works on any device you plug it into.\n\n**D. Sign in with a passkey afterward:**\n1. At the sign-in screen, enter the username (or it may be remembered), then choose **Sign in with a passkey / other ways to sign in → Passkey**.\n2. For a device passkey: approve with Hello/Touch ID/PIN.\n3. For a phone passkey on a different computer: choose \"phone,\" scan the QR with the phone, approve on the phone.\n4. For a security key: insert/tap the key, enter its PIN, touch the sensor.\n\n## 6. Verification Steps\n- The new passkey is listed under **Security info / Sign-in options** with the device name and the date added.\n- Open a fresh private/incognito browser window and complete one full passkey sign-in successfully.\n- Confirm the user has **at least one backup sign-in method** (a second passkey, the Authenticator app, or a phone number) — see l1-passkey-002.\n- For phone-as-passkey, confirm it works against a different computer (the cross-device flow), not only the enrolling computer.\n\n## 7. Escalation Trigger\n- The passkey / FIDO2 method is **not enabled in the tenant**, so \"Add passkey\" is missing or fails — requires an admin to enable it in the Entra authentication-methods policy. Escalate to **L2**.\n- The device has no platform authenticator (no Hello, no Touch ID) and the user has no security key.\n- Enrollment repeatedly fails with a hardware/TPM error.\n\n## 8. Prevention Tips\n- **Always register two passkeys/methods** (for example, the laptop *and* the phone, or a passkey *and* the Authenticator app). One device failure should never cause a lockout.\n- Keep a physical security key as a phishing-resistant backup for high-value accounts.\n- Enable cloud sync for phone passkeys (iCloud Keychain / Google Password Manager) so a replacement phone restores them.\n- Never share a passkey QR code with anyone — a passkey login request you did not start is a red flag.\n\n## 9. User-Friendly Explanation\n\"A passkey replaces your password with something only you have — your phone, your laptop, or a little security key — unlocked by your face, fingerprint, or PIN. There's nothing to type and nothing for an attacker to phish, because the secret never leaves your device. You can store a passkey right on your computer (Windows Hello), on your phone (scan a QR code to use it on other computers), or on a USB security key. The golden rule: set up two of them, so losing one device never locks you out.\"\n\n## 10. Internal Technician Notes\n- Passkeys are FIDO2/WebAuthn credentials. **Platform** passkeys are bound to the device's authenticator (Windows Hello/TPM, Apple Secure Enclave); **roaming** passkeys live on an external FIDO2 authenticator (security key).\n- Phone-as-passkey uses the CTAP 2.2 \"hybrid\" transport (QR + BLE proximity) — Bluetooth must be on for both devices; it is presence-proximity, not internet-relayed.\n- Synced passkeys (iCloud Keychain, Google Password Manager) roam across a user's own devices; device-bound passkeys (Windows Hello, security keys) do not sync and must be enrolled per device.\n- For Entra: passkey (FIDO2) is enabled under **Authentication methods policy**. Attestation enforcement and AAGUID allow-lists can restrict which key models are accepted.\n- Passkeys satisfy MFA in a single gesture (possession + biometric/PIN) and are phishing-resistant — prefer for admins and high-value users.\n\n## 11. Related KB Articles\n- l1-passkey-002 — Passkey recovery when a device is lost or replaced\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-m365-001 — Can't sign in to Microsoft 365\n- l1-password-001 — Password reset and self-service password reset\n\n## 12. Keywords / Search Tags\npasskey setup, passwordless sign in, fido2 key, windows hello passkey, phone as passkey, microsoft 365 passkey, entra passkey, scan qr code to sign in, platform passkey, roaming passkey, security key login, add a passkey"
  },
  {
   "slug": "l1-passkey-002-passkey-recovery-lost-device",
   "path_rel": "knowledge-base\\L1\\l1-passkey-002-passkey-recovery-lost-device.md",
   "title": "\"Recover passkey access after a lost, replaced, or broken device\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"lost passkey\"",
    "\"passkey not working\"",
    "\"new phone passkey\"",
    "\"replaced laptop passkey\"",
    "\"remove old passkey\"",
    "\"passkey locked out\"",
    "\"backup sign in method\"",
    "\"delete lost device passkey\"",
    "\"security info microsoft account\"",
    "\"register new passkey\"",
    "\"passkey recovery\"",
    "\"admin reset passkey\"",
    "\"cant sign in passkey\"",
    "\"passkey failed\""
   ],
   "compliance": [],
   "content": "---\nid: l1-passkey-002\ntitle: \"Recover passkey access after a lost, replaced, or broken device\"\ncategory: identity\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"lost passkey\",\"passkey not working\",\"new phone passkey\",\"replaced laptop passkey\",\"remove old passkey\",\"passkey locked out\",\"backup sign in method\",\"delete lost device passkey\",\"security info microsoft account\",\"register new passkey\",\"passkey recovery\",\"admin reset passkey\",\"cant sign in passkey\",\"passkey failed\"]\nrelated_articles: [\"l1-passkey-001\",\"l1-mfa-001\",\"l1-password-001\",\"l1-m365-001\"]\nescalation_trigger: \"User has lost all passkeys and has no remaining backup sign-in method, requiring an admin to reset authentication methods after identity verification.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Recover passkey access after a lost or replaced device\n\n## 1. Symptoms\n- Phone or laptop that held the passkey was lost, stolen, reset, or stopped working.\n- \"Sign in with a passkey\" no longer works on the new device.\n- User got a new phone and the passkey did not carry over.\n- Passkey prompt appears but fails (\"couldn't verify\" / \"this passkey isn't recognized\").\n- User is worried they are locked out completely.\n- An old/lost device still shows under the account's sign-in methods and needs removing.\n\n## 2. Likely Causes\n1. The passkey was **device-bound** (Windows Hello on the old PC, or a security key) and that device is gone — it cannot be moved.\n2. The passkey was on a phone but **cloud sync was off**, so the replacement phone did not restore it.\n3. The user is trying to use a **synced** passkey but is not signed into the same Apple/Google account on the new device.\n4. Bluetooth is off, breaking the phone-as-passkey cross-device flow.\n5. Account security info still lists a device the user no longer controls.\n\n## 3. Questions To Ask User\n1. Which account is affected — work/school (M365 / Entra) or a personal Microsoft account?\n2. Do you still have **any** other way to sign in (a second passkey, the Authenticator app, a phone number for text/call)?\n3. Where was the lost passkey — on the phone, the laptop (Windows Hello), or a USB security key?\n4. Is your new phone signed into the same iCloud/Google account as the old one?\n5. Was the lost device potentially stolen (vs. just retired)? This affects how urgently we remove its access.\n\n## 4. Troubleshooting Steps\n1. If the passkey \"won't work\" but the device still exists: confirm **Bluetooth is on** (for phone cross-device), the OS/browser is current, and the user is unlocking with the correct face/fingerprint/PIN.\n2. For a synced phone passkey on a new phone: confirm the new phone is signed into the **same iCloud Keychain (iPhone)** or **Google Password Manager (Android)** account; synced passkeys restore from there.\n3. If the device is genuinely gone, do **not** keep retrying the missing passkey — move to a backup sign-in method instead (Resolution).\n4. Identify whether *any* backup method remains; this determines whether the user can self-serve or needs an admin.\n\n## 5. Resolution Steps\n**A. Sign in with a backup method (preferred — no admin needed):**\n1. At sign-in, choose **Other ways to sign in / I can't use my passkey**.\n2. Pick a remaining method: a **second passkey**, the **Microsoft Authenticator** app, or a **text/call** to a registered phone number.\n3. Complete sign-in with that method.\n\n**B. Register a new passkey on the replacement device:**\n1. Once signed in, go to **Security info** (work/school: https://aka.ms/mysignins → Security info; personal: account.microsoft.com → Security → Advanced security options).\n2. Choose **Add sign-in method → Passkey** and follow l1-passkey-001 to enroll on the new device or phone.\n\n**C. Remove the lost device's passkey from the account:**\n1. In **Security info / sign-in methods**, find the entry for the old/lost device (named by device, with the date added).\n2. Select it and choose **Delete / Remove**. This revokes that passkey so a thief cannot use it.\n3. Repeat for any other stale entries.\n\n**D. All passkeys lost and NO backup method (admin reset):**\n1. Contact IT to verify identity per policy (photo ID, manager confirmation).\n2. An admin (L2) resets the account's authentication methods in Entra.\n3. The user signs in with the temporary method provided, then immediately enrolls a fresh passkey **and** a second backup method.\n\n## 6. Verification Steps\n- The user can complete a full sign-in on the **new** device with a newly enrolled passkey.\n- The lost device's passkey no longer appears under sign-in methods.\n- At least **two** working methods are now registered (e.g., new passkey + Authenticator or phone).\n- Recent sign-in activity shows the successful recovery and no unexpected sign-ins from the lost device.\n\n## 7. Escalation Trigger\n- User has **no** remaining sign-in method (all passkeys lost, no Authenticator, no phone) — requires admin authentication-methods reset after identity verification. Escalate to **L2**.\n- The lost device was stolen and there are signs of unauthorized sign-ins.\n- The personal/account portal will not let the user delete the stale passkey.\n\n## 8. Prevention Tips\n- **Two methods, always.** Never rely on a single passkey on a single device — keep a second passkey (another device or a security key) or the Authenticator app as backup.\n- Turn on passkey cloud sync (iCloud Keychain / Google Password Manager) so a replacement phone restores passkeys automatically.\n- Before retiring or selling a device, **remove its passkey from the account first**.\n- Keep one registered phone number or a hardware security key as an offline fallback.\n\n## 9. User-Friendly Explanation\n\"If the device that held your passkey is gone, don't panic — but don't keep tapping the missing passkey either. The fix is to sign in another way (a second passkey, the Authenticator app, or a text code), then add a fresh passkey on your new device and delete the old device from your account so nobody else can use it. If you've truly lost every way in, IT can reset things once we confirm it's really you. The lesson for next time: always keep two ways to sign in.\"\n\n## 10. Internal Technician Notes\n- Device-bound passkeys (Windows Hello, FIDO2 security keys) **cannot** be migrated — recovery always means re-enroll on the new device. Synced passkeys restore from the platform keychain.\n- Admin reset path (Entra): **Users → user → Authentication methods → Delete** the stale passkey, or **Require re-register**. Confirm the lost credential's entry is removed, not just the device record.\n- Deleting the passkey from Security info revokes the credential server-side; the orphaned credential on a stolen device becomes useless without the account entry.\n- Watch for \"all methods lost\" cases caused by single-method rollouts — push the two-method standard during onboarding to prevent these tickets.\n- For personal Microsoft accounts the portal is account.microsoft.com (Advanced security options); for work/school it is My Sign-Ins / Entra.\n\n## 11. Related KB Articles\n- l1-passkey-001 — Set up and sign in with a passkey\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-password-001 — Password reset and self-service password reset\n- l1-m365-001 — Can't sign in to Microsoft 365\n\n## 12. Keywords / Search Tags\nlost passkey, passkey not working, new phone passkey, remove old passkey, backup sign in method, register new passkey, admin reset passkey, delete lost device passkey, security info, passkey recovery, locked out passkey"
  },
  {
   "slug": "l1-password-001-reset-and-sspr",
   "path_rel": "knowledge-base\\L1\\l1-password-001-reset-and-sspr.md",
   "title": "\"Password reset / forgotten password (self-service)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-password-001\ntitle: \"Password reset / forgotten password (self-service)\"\ncategory: passwords\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: []\nkeywords:\n  - password reset\n  - forgot password\n  - sspr\n  - self service password reset\n  - locked out\n  - account locked\n  - reset link\nrelated_articles:\n  - l1-mfa-001\n  - l1-m365-001\n  - l2-active-directory-001\nescalation_trigger: \"User cannot complete SSPR (no verification methods or expired), or admin reset required, or local-account-only PC with lost password\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Password reset / forgotten password (self-service)\n\n## 1. Symptoms\n- \"I forgot my password.\"\n- \"Sign-in says my password is wrong.\"\n- \"My account is locked out.\"\n- \"Password expired and I can't change it from sign-in screen.\"\n- \"Caps Lock was on and I'm now locked.\"\n\n## 2. Likely Causes\n1. Forgotten password.\n2. Multiple wrong attempts triggered lockout.\n3. Password expired and grace period passed.\n4. Caps Lock / wrong keyboard language.\n5. Account disabled administratively (offboarding, security).\n\n## 3. Questions To Ask User\n1. Have you tried with Caps Lock OFF and your keyboard set to your usual language?\n2. Are you trying to sign in to your work account (M365 / company login)?\n3. Have you registered for self-service password reset (SSPR) — added phone or app to your account?\n4. Do you still have access to your phone / authenticator?\n5. Are you remote, or in the office on a corporate network?\n\n## 4. Troubleshooting Steps\n1. Try sign-in once more with Caps Lock confirmed OFF.\n2. Wait 30 minutes if lockout suspected (auto-unlock often).\n3. Verify SSPR enrollment: visit https://aka.ms/ssprsetup.\n4. Confirm a phone or Authenticator is registered before attempting reset.\n\n## 5. Resolution Steps\n**Self-service reset (SSPR):**\n1. From sign-in page, click \"Can't access your account?\" / \"Forgot password?\".\n2. Enter UPN (email) and the captcha.\n3. Pick a verification method (phone text, phone call, Authenticator code, or email).\n4. Receive code → enter.\n5. Set new password (must satisfy: min length 8, mix of upper/lower/number/symbol, not reused).\n6. Wait 30 seconds for sync.\n7. Sign in.\n\n**For a Windows-joined device, when a remote user resets cloud password but local cache is stale:**\n- Connect to corporate VPN, then lock + unlock with new password to refresh local cached credentials.\n- Or: use \"Reset password\" link on Windows lock screen if SSPR-from-Windows is enabled.\n\n**For password expired:**\n- Sign-in normally prompts \"Your password has expired\" — change in-flow.\n- If sign-in screen doesn't show option: log in via web (office.com), it'll prompt there.\n\n## 6. Verification Steps\n- Sign-in succeeds with new password on web.\n- Outlook, Teams, Office apps sign back in successfully.\n- Lock + unlock Windows session works with new password.\n- 24h with no further \"wrong password\" issues.\n\n## 7. Escalation Trigger\n- User not enrolled in SSPR (no methods registered).\n- Reset goes through but Windows local cache rejects new password despite VPN refresh.\n- Account marked disabled in Azure AD / AD.\n- Local-account-only PC (workgroup) with lost password — different recovery path.\n- → Escalate to **L2** for admin reset; **L3** if local Windows account requires offline tooling.\n\n## 8. Prevention Tips\n- Register at least 2 verification methods at https://aka.ms/ssprsetup.\n- Use a password manager (corporate-approved) to avoid forgetting.\n- Don't share passwords across personal and work accounts.\n- Don't use a date-of-birth / pet name / sequential pattern.\n- For shared workstations, never let the OS save the password for someone else's account.\n\n## 9. User-Friendly Explanation\n\"You can reset your own password without needing to call IT, as long as you've registered a phone or the Authenticator app. We'll go to the reset page, prove it's you with a code on your phone, and pick a new password. If your laptop still wants the old one after, we'll connect to the company network for a moment so it catches up.\"\n\n## 10. Internal Technician Notes\n- SSPR portal: https://passwordreset.microsoftonline.com or via the sign-in page link.\n- Admin reset (cloud-only): Entra → Users → user → Reset password.\n- Hybrid AD: ensure Azure AD Connect Password Writeback is enabled, or reset will only update cloud → user can sign into M365 but not into AD-joined PC.\n- Cached credentials on Windows: stored in registry / `lsass`. VPN + lock/unlock refreshes; otherwise, only old password works at console until a domain-connected session.\n- Lockout policy default in Entra: 10 failed attempts → 1-min lockout, doubling for repeats. Tune via Authentication methods policy.\n- Password protection bans common passwords; enforce custom banned list for company-specific weak passwords.\n\n## 11. Related KB Articles\n- l1-mfa-001 — MFA setup and recovery\n- l1-m365-001 — Can't sign in to M365\n- l2-active-directory-001 — AD account unlock / admin reset\n\n## 12. Keywords / Search Tags\npassword reset, forgot password, sspr, self service, locked out, account locked, reset link, password expired"
  },
  {
   "slug": "l1-printer-001-not-printing",
   "path_rel": "knowledge-base\\L1\\l1-printer-001-not-printing.md",
   "title": "\"Printer not printing / job stuck in queue\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-printer-001\ntitle: \"Printer not printing / job stuck in queue\"\ncategory: printers\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - printer\n  - not printing\n  - print queue\n  - stuck job\n  - offline\n  - print spooler\n  - won't print\n  - paper jam\n  - error printing\nrelated_articles:\n  - l2-printers-001\n  - l1-printer-002\nescalation_trigger: \"Print server side error, or driver requires admin install, or hardware error code on display\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Printer not printing / job stuck in queue\n\n## 1. Symptoms\n- Click Print, nothing comes out.\n- Printer shows \"Offline\" in Windows.\n- Job sits in queue with status \"Error\", \"Spooling\", or \"Sent to printer\" forever.\n- Printer prints garbage / unreadable characters.\n- \"Cannot connect to printer\" error 0x00000709 or similar.\n- Printer powers on but won't accept jobs.\n\n## 2. Likely Causes\n1. Printer powered off or sleeping.\n2. Network or USB connection lost.\n3. Print spooler service stopped/crashed.\n4. Stuck job blocks queue.\n5. Wrong default printer selected.\n6. Driver mismatch / corrupt.\n7. Out of paper / toner / ink.\n8. Paper jam.\n9. Printer's IP changed (DHCP).\n\n## 3. Questions To Ask User\n1. Is the printer powered on, with no error lights?\n2. Is it USB or network (Wi-Fi / Ethernet)?\n3. Does the printer's display show any error message?\n4. Does the printer queue show \"Offline\" or any items?\n5. Does it work for other people / from a phone?\n6. When did it last work?\n\n## 4. Troubleshooting Steps\n1. Confirm printer power, paper, no jam, all covers closed.\n2. Settings → Printers & scanners → select printer → Open queue.\n3. Cancel all stuck jobs (right-click each → Cancel; or Printer menu → Cancel All Documents).\n4. Check \"Use Printer Offline\" — if checked, uncheck.\n5. Set as default if user has multiple.\n6. For network printers: ping the printer's IP from Command Prompt.\n7. Restart Print Spooler:\n   - Win+R → `services.msc`.\n   - Find \"Print Spooler\" → Right-click → Restart.\n\n## 5. Resolution Steps\n**If queue stuck:**\n1. Stop Print Spooler service.\n2. Open `C:\\Windows\\System32\\spool\\PRINTERS\\` — delete all files inside.\n3. Start Print Spooler.\n4. Re-send job.\n\n**If \"Offline\" persists:**\n- Power-cycle printer (off 30 sec, on, wait 2 min for boot).\n- Verify network: ping printer IP. If fails, DHCP changed IP — reconfigure printer port to current IP, or use hostname.\n\n**If wrong / stale driver:**\n- Settings → Printers & scanners → printer → Remove device.\n- Re-add: + Add device → wait for discovery → install.\n- For corporate printers, use the print server queue (`\\\\printserver\\printername`) instead of direct IP.\n\n**If hardware error on display:**\n- Note exact error code from printer (e.g., HP \"59.40\", Brother \"TS-02\").\n- Refer to printer's manual or vendor support.\n- Often fixed by reseating toner cartridge or clearing paper path.\n\n**If garbage output:**\n- Wrong driver — uninstall, install printer's exact model driver from vendor site (not the generic).\n\n## 6. Verification Steps\n- Test page prints cleanly (Settings → printer → Open queue → Printer → Properties → Print Test Page).\n- Real document from Word prints to correct printer.\n- Print queue empty after job completes.\n- Printer status shows \"Ready\" or \"Idle\".\n\n## 7. Escalation Trigger\n- Print server (`\\\\printserver`) unreachable.\n- Driver install requires admin and user lacks rights.\n- Hardware error code from display.\n- Issue affects all users of this printer.\n- → Escalate to **L2** with: printer make/model, IP, error codes, screenshot of queue, driver name/version.\n\n## 8. Prevention Tips\n- Use print server / managed print queue for shared printers — easier to fix centrally.\n- Don't install random \"Universal Print Driver\" downloads from search engines — use vendor official.\n- Reserve printer IP via DHCP reservation so it doesn't shift.\n- Power-cycle printers monthly.\n- Replace toner before \"low\" — running empty causes spooler errors.\n\n## 9. User-Friendly Explanation\n\"Your printer and your computer aren't seeing eye to eye. Usually one stuck job blocks everything behind it, or Windows decided the printer is offline. We'll clear the queue, restart the print service, and make sure the printer is reachable. Should be one of the faster fixes.\"\n\n## 10. Internal Technician Notes\n- Print Spooler service name: `Spooler`. CLI restart: `net stop spooler && net start spooler`.\n- Stuck queue dir: `%systemroot%\\System32\\spool\\PRINTERS\\` — `.SHD` and `.SPL` files. Delete only when service is stopped.\n- Network printer IP discovery: print printer's network config page from its physical menu.\n- Error 0x00000709 = print server / GPO mismatch on default printer; check `HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows → Device`.\n- Error 0x0000011b (since 2021 KB) = related to PrintNightmare patches; need vendor patched drivers, or registry value `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print → RpcAuthnLevelPrivacyEnabled = 0` (security trade-off).\n- For Mac, use IPP/Bonjour discovery; CUPS web UI at `localhost:631` for advanced.\n\n## 11. Related KB Articles\n- l1-printer-002 — Printer prints garbled / wrong characters\n- l2-printers-001 — Print server and queue management\n\n## 12. Keywords / Search Tags\nprinter, not printing, print queue, stuck job, offline, print spooler, won't print, paper jam, error printing"
  },
  {
   "slug": "l1-printer-002-prints-garbage",
   "path_rel": "knowledge-base\\L1\\l1-printer-002-prints-garbage.md",
   "title": "\"Printer prints garbled / unreadable / wrong characters\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-printer-002\ntitle: \"Printer prints garbled / unreadable / wrong characters\"\ncategory: printers\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - garbled print\n  - wrong characters\n  - prints symbols\n  - prints code\n  - printer driver\n  - corrupt print\nrelated_articles:\n  - l1-printer-001\n  - l2-printers-001\nescalation_trigger: \"Replacing driver doesn't resolve, or print server queue produces same output for all users\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Printer prints garbled / wrong characters\n\n## 1. Symptoms\n- Pages of random characters / symbols / boxes.\n- Half a page prints, then ejects.\n- Strange page formatting — text runs off the side.\n- Color or graphics missing entirely.\n- Test page is fine but actual documents print junk.\n\n## 2. Likely Causes\n1. Wrong driver (e.g., installed PCL when printer is PostScript, or vice versa).\n2. Universal driver picked for printer that wants vendor-specific.\n3. Driver corrupt — print spool data malformed.\n4. Stuck print job in queue corrupted subsequent jobs.\n5. Cable / network issue corrupting data mid-stream (rare).\n6. Application using wrong page size or font not embedded.\n\n## 3. Questions To Ask User\n1. Does the printer's own test page (from its physical menu) print correctly?\n2. Does ANY app print correctly, or all garbled?\n3. Is this a new printer, or has it been working before?\n4. What driver name appears in Settings → printer → Properties?\n\n## 4. Troubleshooting Steps\n1. From printer menu, print a self-test page — confirms hardware OK.\n2. Try printing a different document type (Notepad → simple text).\n3. Settings → Printers & scanners → printer → Open queue → cancel all jobs.\n4. Restart Print Spooler service.\n5. Note current driver name (Settings → printer → Printer properties → Advanced tab → Driver field).\n\n## 5. Resolution Steps\n**Wrong driver type:**\n1. Identify printer model (label on physical printer).\n2. Visit vendor support site → download \"PCL 6\" driver if printer supports PCL, or \"PostScript / PS\" for PS printers (most modern enterprise printers prefer PCL 6 for Windows).\n3. Settings → Printers & scanners → remove existing printer.\n4. Install fresh driver from downloaded package (vendor's installer is best).\n5. Re-add printer.\n\n**Corrupt driver:**\n1. Print Management (`printmanagement.msc`) → All Drivers → right-click old driver → Remove driver package.\n2. Reinstall fresh.\n\n**Stuck job poisoning queue:**\n1. Stop spooler service.\n2. Delete files in `C:\\Windows\\System32\\spool\\PRINTERS\\`.\n3. Start spooler.\n4. Re-add the print job from Word/Excel/etc.\n\n**Universal driver issue:**\n- For HP devices, \"HP Universal Print Driver\" can confuse some printers. Use the device-specific PCL 6 driver instead.\n\n**Application-side issue:**\n- Try Print to PDF first, then send PDF to printer. If PDF looks fine but printed garbage → driver. If PDF is also garbage → app problem.\n\n## 6. Verification Steps\n- Test print from Notepad reads correctly.\n- Word doc prints with proper layout, fonts, images.\n- Color output (if applicable) matches screen.\n- Multiple pages print without corruption.\n- 5+ documents printed without recurrence.\n\n## 7. Escalation Trigger\n- After driver reinstall, garbage continues.\n- Print server queue (`\\\\printserver\\Q`) produces same garbage for all users.\n- Vendor driver not available for current Windows build.\n- Hardware suspected (e.g., specific page area always corrupt — toner contamination).\n- → Escalate to **L2** with: printer model, current driver name + version, sample output photo, app used, server queue if applicable.\n\n## 8. Prevention Tips\n- Match driver type (PCL/PS) to printer's actual capabilities.\n- Use vendor's official driver, not generic Windows-supplied.\n- For corporate, use a centrally-managed print server with curated drivers.\n- Keep firmware on printer current.\n- Don't mix universal and device-specific drivers across same printer fleet.\n\n## 9. User-Friendly Explanation\n\"The printer is getting confused about what it should print. Almost always it's the driver — the translator between your computer and the printer is using the wrong dictionary. We'll swap to the right one and you'll get clean output. Should take a few minutes.\"\n\n## 10. Internal Technician Notes\n- PCL 6 (XL) is preferred for most modern HP/Brother/Lexmark.\n- PostScript is preferred for Adobe-heavy / pre-press / high-end laser.\n- Print queue files: `.SHD` (shadow / metadata) and `.SPL` (raw spool data) in `%systemroot%\\System32\\spool\\PRINTERS\\`.\n- For server-side, Print Management → Forms tab and Drivers tab; v3 vs v4 driver model matters (v4 is \"type 4\" / package-aware, less prone to corruption).\n- For PCL prints showing readable text mid-garbage, often a font isn't embedded — check application's print settings for \"Print as image\" workaround.\n- Network packet drops corrupting raw print streams — check switch port errors if persistent.\n\n## 11. Related KB Articles\n- l1-printer-001 — Printer not printing at all\n- l2-printers-001 — Print server / queue / driver management\n\n## 12. Keywords / Search Tags\ngarbled print, wrong characters, prints symbols, prints code, printer driver, corrupt print, pcl, postscript"
  },
  {
   "slug": "l1-security-001-lost-or-stolen-device",
   "path_rel": "knowledge-base\\L1\\l1-security-001-lost-or-stolen-device.md",
   "title": "\"Lost or stolen work laptop or phone — report and secure it now\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"lost my work laptop\"",
    "\"laptop stolen\"",
    "\"my laptop might be stolen\"",
    "\"lost laptop\"",
    "\"stolen device\"",
    "\"lost my phone\"",
    "\"remote wipe\"",
    "\"report lost device\"",
    "\"missing work device\"",
    "\"find my device\"",
    "\"remote lock\"",
    "\"misplaced laptop\"",
    "\"work phone lost\"",
    "\"stolen laptop report\""
   ],
   "compliance": [],
   "content": "---\nid: l1-security-001\ntitle: \"Lost or stolen work laptop or phone — report and secure it now\"\ncategory: security\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\",\"iOS\",\"Android\"]\nprerequisites: []\nkeywords: [\"lost my work laptop\",\"laptop stolen\",\"my laptop might be stolen\",\"lost laptop\",\"stolen device\",\"lost my phone\",\"remote wipe\",\"report lost device\",\"missing work device\",\"find my device\",\"remote lock\",\"misplaced laptop\",\"work phone lost\",\"stolen laptop report\"]\nrelated_articles: [\"l1-mfa-001\",\"l1-password-001\",\"l1-m365-001\"]\nescalation_trigger: \"Any confirmed or suspected loss/theft of a work device is reported to IT/security immediately so sessions can be revoked and the device locked or wiped.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Lost or stolen work laptop or phone — report and secure it now\n\n## 1. Symptoms\n- You cannot find your work laptop, phone, or tablet and believe it is lost or stolen.\n- A device was left in a taxi, hotel, airport, café, or vehicle and not recovered.\n- A bag containing a work device was stolen.\n- You suspect someone may have taken or accessed your device without permission.\n- A device is missing and may still be powered on and signed in to email or apps.\n\n## 2. Likely Causes\n1. Device physically lost in transit or in a public place.\n2. Device stolen (theft, break-in, pickpocket).\n3. Device misplaced at home or office (may be recoverable).\n4. Device handed to the wrong person or left unattended.\n\n## 3. Questions To Ask User\n1. Which device is it — laptop, phone, or tablet? Make/model if known?\n2. When and where did you last have it? How long ago?\n3. Was it powered on and signed in (email, Teams, VPN, password manager)?\n4. Is it lost (possibly recoverable) or do you believe it was stolen?\n5. Does it have a SIM/cellular, and is \"Find My\" / device tracking enabled?\n6. Were any other items taken (badge, second device, paper notes)?\n\n## 4. Troubleshooting Steps\n1. **Report it immediately.** Time matters most — contact IT/security right away rather than searching for an hour first. Early reporting lets IT revoke access before data can be reached.\n2. **Do not delay to \"look around first.\"** You can keep looking after reporting; reporting is reversible if the device turns up.\n3. **Change your password now** from another trusted device (phone or another computer) — this alone can cut off most access.\n4. **Approve no unexpected MFA prompts.** If a sign-in approval request appears that you did not start, deny it and tell IT — it may be the thief trying to get in.\n5. **Locate the device** if you safely can: use Find My (Apple), Find My Device (Android/Google), or Microsoft account \"Find my device\" for Windows. Note its last location for IT and, if stolen, for police — but never confront a thief in person.\n\n## 5. Resolution Steps\n**What you should do:**\n1. Report the loss to IT/security through the normal channel as your first action.\n2. From a trusted device, change your account password and sign out of all sessions where the option exists (for example, in your account security page).\n3. If the device had cellular service and is a phone, consider asking your carrier to suspend the SIM (IT can advise).\n4. If theft is involved, file a police report and keep the report number — IT and insurance may need it.\n\n**What IT does (so you know what to expect):**\n1. **Revoke active sessions and tokens** so existing sign-ins on the device stop working.\n2. **Remote lock or remote wipe** the device through MDM (for example, Microsoft Intune) or Find My — this can lock the screen and erase company data remotely once the device is online.\n3. **Reset or require re-registration of MFA** if the device was an authenticator.\n4. **Disable or reset the account** temporarily if needed, then re-enable once you are secured.\n5. **Confirm disk encryption** (BitLocker on Windows, FileVault on macOS) so that even if the disk is removed, the data stays unreadable.\n\n## 6. Verification Steps\n- IT confirms the device is reported and a lock/wipe command has been queued or completed.\n- Your password is changed and old sessions are signed out.\n- You can sign in normally on a replacement or trusted device with your new password and MFA.\n- No unexpected MFA prompts continue to arrive.\n- If wiped, the device shows as wiped/retired in the management console (IT confirms).\n\n## 7. Escalation Trigger\n- Any confirmed or suspected loss or theft — this is always reported to IT/security immediately.\n- The device held highly sensitive data, was signed in to admin tools, or had a password manager open.\n- Suspicious sign-in attempts or MFA prompts continue after the password change.\n- → Escalate to **L2 / Security** with: device type and owner, last-known location and time, whether it was signed in, and any police report number.\n\n## 8. Prevention Tips\n- Keep disk encryption on (BitLocker / FileVault) — IT usually enforces this, but confirm it is enabled.\n- Use a strong screen lock and short auto-lock timeout on every work device.\n- Enable Find My / device location tracking before you ever need it.\n- Don't leave devices visible in cars or unattended in public.\n- Save your BitLocker/recovery key to your Microsoft or work account ahead of time.\n- Keep work data in OneDrive/SharePoint, not only on the local disk, so a wipe doesn't lose your files.\n\n## 9. User-Friendly Explanation\n\"The single most important thing is to tell us right away — even before you finish looking for it. The moment we know, we can lock the device, sign it out of everything, and erase the company data on it remotely. Your laptop and phone are also encrypted, which means that even if someone takes the drive out, they can't read your files. So a lost device is usually a lost piece of hardware, not a lost data event — as long as we hear about it quickly. After we secure your account, we'll get you back to work on another device.\"\n\n## 10. Internal Technician Notes\n- Speed is the control: revoke sessions/tokens first (Entra: Users → user → Revoke sessions), then queue MDM lock/wipe.\n- Intune: Devices → select device → Lock / Wipe / Retire. Wipe = full reset; Retire = remove company data only (use for personal/BYOD).\n- Find My (Apple Business Manager / iCloud) and Find My Device (Android Enterprise) can locate, lock, and erase managed mobiles.\n- Reset MFA methods if the device was an authenticator (aka.ms/mfasetup / Entra → Authentication methods).\n- Confirm encryption status before assuming data-at-rest is safe: BitLocker `manage-bde -status`; macOS `fdesetup status`.\n- Log the incident per the security/incident process; capture last-known location, sign-in state, and any police report number for insurance.\n- For BYOD, prefer selective/Retire wipe to avoid erasing personal data; document the choice.\n\n## 11. Related KB Articles\n- l1-mfa-001 — MFA setup, lost device, and recovery\n- l1-password-001 — Password reset and self-service unlock\n- l1-m365-001 — Can't sign in to Microsoft 365\n\n## 12. Keywords / Search Tags\nlost my work laptop, laptop stolen, my laptop might be stolen, lost laptop, stolen device, lost my phone, remote wipe, report lost device, missing work device, find my device, remote lock, work phone lost"
  },
  {
   "slug": "l1-teams-001-audio-not-working",
   "path_rel": "knowledge-base\\L1\\l1-teams-001-audio-not-working.md",
   "title": "\"Microsoft Teams: no audio in meetings (mic or speaker not working)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-teams-001\ntitle: \"Microsoft Teams: no audio in meetings (mic or speaker not working)\"\ncategory: teams\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - teams\n  - no audio\n  - can't hear\n  - mic not working\n  - microphone\n  - speaker\n  - other people can't hear me\n  - audio device not detected\nrelated_articles:\n  - l1-teams-002\n  - l1-windows-005\nescalation_trigger: \"USB audio device not detected by Windows at all (driver/hardware), or all users on tenant report similar\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Teams: no audio in meetings\n\n## 1. Symptoms\n- \"Other people can't hear me\" — mic not picking up.\n- \"I can't hear anyone\" — speaker silent.\n- Mic icon shows muted/disabled greyed out.\n- Audio device dropdown empty or shows wrong device.\n- Echo, distortion, or one-way audio.\n- Bluetooth headset connects but Teams can't use it.\n\n## 2. Likely Causes\n1. Wrong audio device selected in Teams (laptop speakers vs headset).\n2. Windows app permission denied to microphone.\n3. Headset USB cable / Bluetooth connection issue.\n4. Another app holding exclusive access to audio device (Zoom, Webex, browser).\n5. Outdated Teams version with known audio bug.\n6. Driver issue with Realtek / USB audio.\n7. System mute toggled (laptop hardware mute key).\n\n## 3. Questions To Ask User\n1. Are you using laptop built-in mic, USB headset, or Bluetooth headset?\n2. Can you hear yourself in Windows Sound settings → \"Test microphone\"?\n3. Is the issue happening in only Teams, or also in other apps (Zoom, browser)?\n4. Have you joined another meeting today that worked?\n5. Do you see your headset listed in Teams Settings → Devices?\n\n## 4. Troubleshooting Steps\n1. Teams → ⋯ menu → Settings → Devices → confirm correct Speaker, Microphone, and Camera selected from dropdowns.\n2. Click \"Make a test call\" (Settings → Devices) — leave a test message; Teams plays it back.\n3. Windows Settings → System → Sound → input/output devices match physical device.\n4. Settings → Privacy & security → Microphone → Microsoft Teams toggle = ON.\n5. Close any other audio app (Zoom, Spotify, browser tabs with media).\n6. Unplug + replug USB headset; for Bluetooth, disconnect + reconnect.\n\n## 5. Resolution Steps\n**If wrong device selected:**\n- In Teams Settings → Devices, pick the correct hardware. Teams will remember per device.\n\n**If permission denied:**\n- Settings → Privacy → Microphone → Enable for Teams. Restart Teams.\n\n**If exclusive access conflict:**\n- Right-click speaker icon (taskbar) → Sound settings → More sound settings → Recording tab → device → Properties → Advanced → uncheck \"Allow apps to take exclusive control\".\n\n**If Teams is misbehaving:**\n- Quit Teams completely (right-click tray icon → Quit, AND Task Manager kill `Teams.exe` and `ms-teams.exe`).\n- Clear Teams cache:\n  - Classic Teams: `%appdata%\\Microsoft\\Teams` — close, delete contents, reopen.\n  - New Teams: `%localappdata%\\Packages\\MSTeams_8wekyb3d8bbwe\\LocalCache` — close, delete contents, reopen.\n- Reopen Teams, sign back in.\n\n**If Bluetooth headset:**\n- Pair fresh: Settings → Bluetooth & devices → Remove device → re-pair.\n- Many headsets require selecting \"Hands-free profile\" vs \"Stereo\" — Teams audio works on hands-free.\n\n**If Windows doesn't see device at all:**\n- Device Manager → Audio inputs and outputs → check for warnings.\n- Update driver (right-click → Update driver).\n- For Realtek issues, get latest from OEM support page (NOT third-party \"driver booster\").\n\n## 6. Verification Steps\n- Teams test call records and plays back voice clearly.\n- In a real meeting, two-way audio confirmed by other party.\n- No echo or feedback.\n- Audio holds for 30+ minutes without dropouts.\n\n## 7. Escalation Trigger\n- Windows fails to detect a working USB audio device → driver/hardware (escalate to L2).\n- Issue affects every meeting and every device chosen — system-level.\n- Audio drops every 5–10 min consistently — likely driver/firmware.\n- Multiple users on same tenant report same issue at same time — service-side, escalate.\n- → Escalate to **L2** with: device make/model, Teams version, output of `dxdiag` audio section, sample call ID from Settings → About → Diagnostics.\n\n## 8. Prevention Tips\n- Standardize on a known-good headset model (Jabra Evolve, Poly Voyager, Logi Zone) for fewer driver issues.\n- Don't run Zoom and Teams simultaneously — they fight over audio devices.\n- Keep Teams updated; restart it weekly.\n- Bluetooth is more failure-prone than wired — wired USB-C / USB-A is the gold standard for reliability.\n- Disable headset's \"auto-pause when removed from ear\" if false-pausing meetings.\n\n## 9. User-Friendly Explanation\n\"Teams is sending audio to the wrong place, or Windows hasn't given Teams permission to use your mic. We'll point Teams at your real headset, run a quick test call so you can hear yourself, and check Windows didn't block the microphone. Most calls fix in under five minutes. If your headset isn't even showing up, we'll look at drivers next.\"\n\n## 10. Internal Technician Notes\n- New Teams (MSIX): cache path is `%localappdata%\\Packages\\MSTeams_8wekyb3d8bbwe\\`.\n- Classic Teams cache: `%appdata%\\Microsoft\\Teams\\` — `Cache`, `Code Cache`, `databases`, `GPUCache`, `IndexedDB`, `Local Storage`, `tmp`.\n- Diagnostic logs: Ctrl+Alt+Shift+1 (Classic) / Settings → Get logs (New) — needed for L2 escalation.\n- Common Bluetooth profile mismatch: \"Headset (HFP)\" mono vs \"Headphones (A2DP)\" stereo — Teams uses HFP for two-way.\n- For Realtek pop/crackle: disable \"Audio enhancements\" in device Properties → Enhancements tab.\n- For meeting-room USB audio devices (e.g. Logitech MeetUp), firmware updates via vendor app often resolve.\n\n## 11. Related KB Articles\n- l1-teams-002 — Teams won't load / stuck on splash\n- l1-windows-005 — Audio not working at OS level\n\n## 12. Keywords / Search Tags\nteams, no audio, can't hear, mic not working, microphone, speaker, other people can't hear me, audio device, bluetooth headset"
  },
  {
   "slug": "l1-teams-002-wont-load-stuck-splash",
   "path_rel": "knowledge-base\\L1\\l1-teams-002-wont-load-stuck-splash.md",
   "title": "\"Microsoft Teams won't load / stuck on splash screen\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-teams-002\ntitle: \"Microsoft Teams won't load / stuck on splash screen\"\ncategory: teams\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - teams won't load\n  - teams stuck\n  - white screen\n  - splash screen\n  - teams crashes\n  - teams won't sign in\n  - new teams not opening\nrelated_articles:\n  - l1-teams-001\n  - l1-m365-001\nescalation_trigger: \"Reinstall fails, Teams admin center reports incident, or all users on tenant unable to load\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Teams won't load / stuck on splash screen\n\n## 1. Symptoms\n- Teams shows logo/splash and never progresses to inbox.\n- White screen on launch.\n- \"We're sorry — we've run into an issue\" with retry button looping.\n- Teams immediately closes after launch.\n- Sign-in succeeds in browser but desktop app fails.\n\n## 2. Likely Causes\n1. Corrupted Teams cache.\n2. Stale credential from previous session.\n3. Windows network stack glitch (DNS, proxy).\n4. Conflicting Teams installations (Classic + New).\n5. Outdated Teams build with known crash bug.\n6. Antivirus / endpoint agent blocking Teams.\n7. Service-side outage (status.office.com).\n\n## 3. Questions To Ask User\n1. Does it stop on the very first splash, or after the loading bar?\n2. Can you sign in to teams.microsoft.com in a browser?\n3. Did this start today suddenly, or has it been worsening?\n4. Is this New Teams (purple icon, \"Microsoft Teams\") or Classic (blue with white people icon)?\n5. Have you installed antivirus or VPN software recently?\n\n## 4. Troubleshooting Steps\n1. Quit Teams fully — right-click tray icon → Quit. Then verify Task Manager shows no `Teams.exe` / `ms-teams.exe`.\n2. Restart PC.\n3. Check service health: https://portal.office.com/servicestatus (or admin posts on social).\n4. Try teams.microsoft.com in a private browser window — confirms server-side OK.\n\n## 5. Resolution Steps\n**Cache clear (most common fix):**\n- New Teams: close → File Explorer → `%localappdata%\\Packages\\MSTeams_8wekyb3d8bbwe\\LocalCache` → delete contents → relaunch.\n- Classic Teams: close → `%appdata%\\Microsoft\\Teams\\` → delete contents (or just `Cache`, `Code Cache`, `Local Storage`, `IndexedDB`).\n\n**Credential clear:**\n- Control Panel → Credential Manager → Windows Credentials → remove `msteams_*` and `MicrosoftAccount:user=*` (related entries) → relaunch Teams.\n\n**Reinstall:**\n- Settings → Apps → Installed apps → uninstall both \"Microsoft Teams\" and \"Microsoft Teams (work or school)\" if both present.\n- Also remove `%localappdata%\\Microsoft\\Teams\\` folder.\n- Reinstall: New Teams via Microsoft Store, or via M365 admin pushed app, or https://teams.microsoft.com/downloads.\n\n**Antivirus check:**\n- Temporarily allow Teams in security software (whitelisting `Teams.exe` and the Microsoft Store ms-teams package).\n- Re-enable AV after testing.\n\n## 6. Verification Steps\n- Teams loads to chats list within 30 seconds.\n- Presence shows correct status (green/Available).\n- Test call works (Settings → Devices → Make a test call).\n- Send test message in a chat and receive.\n\n## 7. Escalation Trigger\n- Cache clear + reinstall fails to resolve.\n- Office service status page shows Teams incident.\n- Pattern across multiple users in same office/tenant.\n- Endpoint protection blocking Teams cannot be bypassed without admin override.\n- → Escalate to **L2** with: Teams version, OS build, screenshot of failure point, log file from `%appdata%\\Microsoft\\Teams\\logs.txt` (Classic) or get-logs export (New).\n\n## 8. Prevention Tips\n- Don't run Classic + New Teams concurrently on same login during a transition — uninstall the one you don't need.\n- Restart Teams weekly to clear memory leaks.\n- Allow Teams updates to install automatically.\n- Don't store Teams cache on a synced location (OneDrive home folder); causes corruption.\n- For locked-down environments, ensure firewall allows `*.teams.microsoft.com`, `*.microsoft.com`, and Microsoft 365 endpoints.\n\n## 9. User-Friendly Explanation\n\"Teams gets confused if its memory of past sessions gets corrupted. We'll wipe that little stash, sign you in fresh, and it almost always opens straight up. If a bigger fix is needed we'll reinstall the app. Should be done in a few minutes.\"\n\n## 10. Internal Technician Notes\n- New Teams = MSIX from Store; Classic = Squirrel-based. Different uninstall paths matter.\n- Classic crash logs: `%appdata%\\Microsoft\\Teams\\logs.txt` (rolling).\n- New Teams logs: Settings → About → Get logs (or `Ctrl+Alt+Shift+1` keyboard shortcut to upload).\n- For Citrix/VDI environments, Teams optimization pack must match (Classic VDI optimizer ≠ New Teams VDI). Confirm with Citrix HDX policy.\n- DNS issue diagnostic: `nslookup teams.microsoft.com` and `Resolve-DnsName *.teams.microsoft.com`.\n- For corporate proxy with TLS inspection, often the cert chain breaks Teams; whitelist the Microsoft cert pin.\n\n## 11. Related KB Articles\n- l1-teams-001 — Teams audio not working\n- l1-m365-001 — Can't sign in to M365\n\n## 12. Keywords / Search Tags\nteams won't load, teams stuck, white screen, splash screen, teams crashes, teams won't sign in, new teams not opening"
  },
  {
   "slug": "l1-usb-001-device-not-recognized",
   "path_rel": "knowledge-base\\L1\\l1-usb-001-device-not-recognized.md",
   "title": "\"USB device not recognized / unknown device / 'malfunctioned'\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-usb-001\ntitle: \"USB device not recognized / unknown device / 'malfunctioned'\"\ncategory: usb\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - usb\n  - usb device not recognized\n  - unknown device\n  - malfunctioned\n  - usb-c\n  - thunderbolt\n  - dock\n  - external drive\n  - hub\n  - port not working\n  - code 43\nrelated_articles:\n  - l1-windows-006\n  - l1-bluetooth-001\nescalation_trigger: \"Same device + same port fails after fresh OS install, or all USB ports fail simultaneously, or BIOS doesn't see USB devices at boot\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# USB device not recognized\n\n## 1. Symptoms\n- Tray notification: \"USB device not recognized\" or \"The last USB device you connected to this computer malfunctioned.\"\n- Device appears in File Explorer briefly, then disappears.\n- External drive shows in Disk Management but with no drive letter.\n- USB-C dock works on one machine, not another.\n- One USB port doesn't detect anything; another port works fine.\n\n## 2. Likely Causes\n1. Underpowered port (especially older USB 2.0 on the front of a desktop).\n2. Damaged or partially-inserted cable.\n3. Driver in a bad state — Windows assigned a generic stub instead of the real driver.\n4. Power-saving setting put the USB hub to sleep and it didn't wake.\n5. USB-C cable that only carries power, not data (very common).\n6. External drive needs more amperage than the port can deliver — shows up but disconnects under load.\n7. USB controller froze; needs reboot.\n\n## 3. Questions To Ask User\n1. Did the device ever work on this computer?\n2. Front port or back port? Hub or dock?\n3. Different cable available to test with?\n4. What's the device — flash drive, external drive, dock, phone, printer?\n5. Any \"malfunctioned\" / \"unknown device\" pop-up text?\n\n## 4. Troubleshooting Steps\n1. **Try a different USB port.** Prefer a port directly on the laptop / desktop motherboard (back of tower), not a front port or hub.\n2. **Try a different cable.** Many USB-C cables are charge-only. A known-good data cable rules cabling out.\n3. **Test the device on another computer.** Confirms the device itself is alive.\n4. **Reseat fully** — push until you feel/hear the click. Front USB-A ports often have a 1mm wiggle that stops contact.\n5. **Reboot the PC.** Resets the USB host controller.\n\n## 5. Resolution Steps\n**If \"USB device not recognized\" toast keeps appearing:**\n1. Device Manager → Universal Serial Bus controllers → look for entries with yellow ⚠.\n2. Right-click each → Uninstall device. Don't tick \"delete driver software\" — just uninstall.\n3. Action menu → Scan for hardware changes. Windows reinstalls them.\n\n**If the device shows as \"Unknown device\" with code 43:**\n1. Device Manager → right-click the unknown device → Properties → Driver tab → Uninstall device.\n2. Unplug the device, wait 10s, replug.\n3. If still code 43 → device or cable is failing on the host side; try another machine to confirm.\n\n**If an external drive disappears under load:**\n1. Powered USB hub fixes most underpowered-port issues. Cheap solution.\n2. Self-powered (wall-plug) external drives don't have this problem — switch if available.\n\n**Power-saving fix (Windows):**\n1. Device Manager → Universal Serial Bus controllers → for each USB Root Hub: Properties → Power Management → uncheck \"Allow the computer to turn off this device to save power\".\n2. Reboot.\n\n**On macOS:**\n1. System Information → USB → confirm the device shows up at all. If it doesn't, it's a hardware/cable issue.\n2. Reset NVRAM (Intel Macs): shutdown → power on while holding ⌥+⌘+P+R until you hear the second startup chime.\n3. Try a different USB-C-to-USB adapter — Apple's official ones are most reliable.\n\n## 6. Verification Steps\n- Device appears in Device Manager / System Information without warnings.\n- File Explorer / Finder shows the drive letter / mount point.\n- Read/write a small test file successfully.\n- Device stays connected through 10 minutes of normal use.\n\n## 7. Escalation Trigger\n- All USB ports fail at the same time → motherboard or power supply issue.\n- Code 43 persists after a fresh Windows install → hardware.\n- BIOS/UEFI doesn't see USB devices at boot.\n- → Escalate to **L2** with: device + cable + port + error code(s) + Device Manager screenshot.\n\n## 8. Prevention Tips\n- Keep one labeled \"data cable\" near your dock — most USB-C cables are charge-only.\n- For external drives that move between machines, prefer a powered hub.\n- Eject before unplugging — yanking under write can corrupt the partition table.\n- Don't daisy-chain hubs; one hub max between PC and device.\n\n## 9. User-Friendly Explanation\n\"USB issues come down to four things — port, cable, power, or driver. We'll rule them out in order. Try a different port first, then a different cable. If both check out, we'll reset the driver in about ten seconds. If a powered USB device drops out under load, that's almost always a port that can't push enough power, and a $15 powered hub fixes it permanently.\"\n\n## 10. Internal Technician Notes\n- Windows: `Get-PnpDevice -Status Error` quickly enumerates problem devices.\n- Code 43 = the device reported a problem; can be hardware OR a driver that gave up.\n- Code 28 = no driver; pull from OEM, not generic.\n- Selective Suspend bug: `powercfg /change usb-selective-suspend-setting 0` disables the suspend that often kills external drives.\n- USB-C cables: even brand-name ones lie about USB 3 / Thunderbolt support — test with `usbview.exe` to see negotiated speed.\n- For Intune fleets, restrict USB storage with the Defender device control policies if data leakage is a concern.\n\n## 11. Related KB Articles\n- l1-windows-006 — App won't open\n- l1-bluetooth-001 — Bluetooth pairing\n- l2-drivers-001 — Driver fleet rollback\n\n## 12. Keywords / Search Tags\nusb, usb device not recognized, unknown device, malfunctioned, usb-c, thunderbolt, dock, external drive, hub, port not working, code 43, code 28, charge only cable"
  },
  {
   "slug": "l1-vpn-001-cant-connect",
   "path_rel": "knowledge-base\\L1\\l1-vpn-001-cant-connect.md",
   "title": "\"VPN won't connect / disconnects randomly\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-001\ntitle: \"VPN won't connect / disconnects randomly\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - vpn\n  - won't connect\n  - vpn disconnects\n  - vpn timeout\n  - cisco anyconnect\n  - globalprotect\n  - fortinet\n  - openvpn\n  - always on vpn\nrelated_articles:\n  - l2-vpn-001\n  - l1-wifi-001\nescalation_trigger: \"Multiple users in same office / region cannot connect, or certificate revoked, or VPN gateway error reported by client\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# VPN won't connect / disconnects randomly\n\n## 1. Symptoms\n- VPN client shows \"Connecting...\" indefinitely.\n- \"Authentication failed\" or \"Login failed\".\n- Connects then drops within minutes.\n- \"VPN is unreachable\" / \"Cannot contact gateway\".\n- Connects but corporate resources still inaccessible.\n- Certificate error.\n\n## 2. Likely Causes\n1. Wrong username/password (or post-password-change client cache).\n2. MFA not approved on phone.\n3. Network blocking VPN (hotel, public Wi-Fi, geographic).\n4. Client outdated.\n5. Certificate expired (machine or user).\n6. VPN gateway under load / outage.\n7. Corporate firewall regional rules blocking user's source IP.\n8. Split-tunnel routing not picking up corporate routes.\n9. Local DNS preventing gateway resolution.\n\n## 3. Questions To Ask User\n1. Which VPN client (AnyConnect, GlobalPalo Alto, Fortinet, OpenVPN, Always-On)?\n2. Does it fail at \"Connecting\", at sign-in, or after connecting?\n3. What error message exactly?\n4. Are you on home Wi-Fi, mobile hotspot, or public Wi-Fi?\n5. Did you change your password recently?\n6. Does the VPN icon in system tray show green/red/yellow?\n\n## 4. Troubleshooting Steps\n1. Try a different network — mobile hotspot is the cleanest test (no firewall interference).\n2. Restart the VPN client (quit fully, reopen).\n3. Reboot the device.\n4. Test gateway resolution: `nslookup vpn.company.com` — should return an IP.\n5. Test reachability: `ping vpn.company.com` (often blocked by gateway, but DNS resolution alone is informative).\n6. Try connecting via web portal (e.g., GlobalProtect web portal) if available.\n\n## 5. Resolution Steps\n**Authentication issue:**\n- Sign in to https://office.com first to confirm password works for cloud.\n- Approve any MFA prompt on phone.\n- Update VPN client to latest version.\n\n**Network blocking:**\n- Switch to mobile hotspot to confirm.\n- For public Wi-Fi, complete captive portal first, then try VPN.\n- Disable IPv6 temporarily if VPN client doesn't handle dual-stack: Network adapter → Properties → uncheck IPv6.\n\n**Certificate issue:**\n- For corporate device cert: connect on corporate LAN once to refresh; or contact L2 to push new cert.\n- For user cert: re-enroll via portal.\n\n**DNS resolution failure:**\n- Switch DNS to 1.1.1.1 / 8.8.8.8 → retry.\n\n**Split-tunnel routes wrong:**\n- After connect, run `route print` (Windows) → corporate subnets should appear via VPN tunnel adapter.\n- If missing, reconnect; persistent fix from L2 (gateway config).\n\n**Reinstall:**\n- Settings → Apps → uninstall VPN client → reinstall current version from corporate portal or vendor.\n\n## 6. Verification Steps\n- VPN client shows green / \"Connected\".\n- Internal site (e.g., intranet.company.com) loads.\n- File share / printer accessible.\n- Speed acceptable (within 70% of base ISP, allowing for VPN overhead).\n- Connection holds 30+ minutes idle.\n\n## 7. Escalation Trigger\n- Multiple users in same office / region all failing.\n- VPN gateway returns specific error code.\n- Certificate revoked or expired and reissue requires admin.\n- Always-On VPN profile policy not deploying.\n- → Escalate to **L2** with: client version, exact error, attempted gateway, source IP, time, screenshot.\n\n## 8. Prevention Tips\n- Keep VPN client auto-updating.\n- Always use MFA-protected accounts.\n- Don't share corporate VPN credentials across people.\n- Reboot device weekly — keeps cert and policy fresh.\n- For frequent travelers, install vendor's \"VPN Diagnostic\" tool — saves time on remote support.\n\n## 9. User-Friendly Explanation\n\"The VPN is the secure tunnel back to your company's network. If it can't connect, it's usually one of three things: your password got out of sync, your network is blocking it, or the security certificate needs refreshing. We'll try the simplest fixes first — different network, fresh sign-in, restart the client — and most of the time you're back on in five minutes.\"\n\n## 10. Internal Technician Notes\n- Cisco AnyConnect logs: `%programdata%\\Cisco\\Cisco AnyConnect Secure Mobility Client\\` → `vpnui.txt`, `vpnagent.txt`.\n- GlobalProtect logs: `%localappdata%\\Palo Alto Networks\\GlobalProtect\\Logs\\`.\n- Fortinet FortiClient logs: `%appdata%\\Fortinet\\FortiClient\\Logs\\`.\n- For Always-On VPN (Windows): check `Get-VpnConnection -AllUserConnection`, GP/Intune profile state, and Trusted Network Detection.\n- Cert validation: `certutil -store My` (user) / `certutil -store -enterprise NTAuth` for issuer trust chain.\n- Common AnyConnect errors:\n  - \"Certificate validation failure\" → expired cert chain.\n  - \"Login Denied\" → bad creds or AAA denied at gateway.\n  - \"Failed to acquire IP\" → DHCP scope full at gateway.\n- For split-tunnel where some traffic is missing, dump `route print` and compare against corporate's expected subnets.\n\n## 11. Related KB Articles\n- l1-wifi-001 — Wi-Fi connection issues\n- l2-vpn-001 — VPN gateway, certs, and Always-On profile management\n\n## 12. Keywords / Search Tags\nvpn, won't connect, disconnects, timeout, anyconnect, globalprotect, fortinet, openvpn, always on, certificate"
  },
  {
   "slug": "l1-webcam-001-camera-not-working",
   "path_rel": "knowledge-base\\L1\\l1-webcam-001-camera-not-working.md",
   "title": "\"Webcam / camera not working in Teams, Zoom, or other apps\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-webcam-001\ntitle: \"Webcam / camera not working in Teams, Zoom, or other apps\"\ncategory: webcam\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - webcam\n  - camera\n  - video off\n  - camera not working\n  - camera not detected\n  - black screen video\n  - integrated camera\n  - external webcam\n  - logitech\n  - privacy shutter\n  - camera in use\nrelated_articles:\n  - l1-teams-001\n  - l1-windows-005\n  - l1-windows-006\nescalation_trigger: \"Camera not detected in Device Manager / System Information after driver reinstall, or hardware shutter physically broken\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# Webcam / camera not working\n\n## 1. Symptoms\n- Black or frozen image where the video preview should be.\n- \"Other apps are using the camera\" or \"We can't find your camera\" error.\n- Camera works in one app but not another.\n- Tiny LED next to the lens never lights up during a call.\n- A second app stays on the camera and locks out the next one.\n\n## 2. Likely Causes\n1. Privacy shutter or physical sliding cover is closed.\n2. App-level camera permission turned off (Windows Settings or macOS System Settings).\n3. Another app is holding the camera (Teams, Zoom, OBS, browser tab).\n4. Driver is corrupt or fell back to a generic device.\n5. USB hub is underpowered for an external webcam.\n6. External webcam plugged into a USB-C dock that doesn't pass video.\n\n## 3. Questions To Ask User\n1. Is the camera built-in or USB? Brand?\n2. Does the LED next to the lens turn on?\n3. Does it work in any other app (the Camera app for Windows, Photo Booth on Mac)?\n4. When did this start — sudden, after an update, after plugging in something new?\n5. Is there a physical privacy shutter? (Many laptops have one and it's easy to miss.)\n\n## 4. Troubleshooting Steps\n1. **Privacy shutter check.** Look at the lens — if there's a sliding cover, slide it open.\n2. **Close every app** that might be holding the camera — Teams, Zoom, OBS, browser tabs that use video. Then reopen only the one you need.\n3. **Test in the OS Camera app** — Windows: Camera (Start menu). macOS: Photo Booth. If the OS app shows video, the issue is app-side.\n4. **Check OS-level camera permission** — Windows: Settings → Privacy & security → Camera → ensure it's On for the app. macOS: System Settings → Privacy & Security → Camera → toggle the app on.\n5. **Unplug + replug** an external webcam. If on a USB-C dock, plug directly into the laptop instead.\n6. **Reboot.** Resets the camera service if a process is stuck.\n\n## 5. Resolution Steps\n**If OS Camera app works but Teams/Zoom doesn't:**\n1. Sign out and back into the app.\n2. In Teams: Settings → Devices → Camera dropdown → pick the right device.\n3. In Zoom: Settings → Video → Camera dropdown.\n\n**If OS Camera app shows \"We can't find your camera\" (Windows):**\n1. Device Manager → Cameras → right-click your device → Update driver → Search automatically.\n2. If still failing → right-click → Uninstall device → reboot. Windows will reinstall on boot.\n\n**If on macOS and the Camera privacy panel doesn't list the app:**\n1. Quit the app completely (Cmd+Q).\n2. Re-open. macOS will prompt for camera permission on first use.\n\n**External webcam not detected at all:**\n1. Try a different USB port (preferably directly on the laptop, not a hub).\n2. Test on another machine to rule out hardware failure.\n\n## 6. Verification Steps\n- LED next to lens lights up when the app shows the preview.\n- You can see yourself in the in-app preview.\n- A test call shows your video to the other side.\n- Camera does NOT stay locked when you close the app — opening another video app works immediately.\n\n## 7. Escalation Trigger\n- Device Manager shows error code 10/45 on the camera that persists after driver reinstall.\n- Camera doesn't appear in Device Manager / System Information at all.\n- Hardware shutter is physically jammed.\n- → Escalate to **L2** with: brand/model of webcam, OS build, screenshot of Device Manager, what the OS Camera app reports.\n\n## 8. Prevention Tips\n- Don't run multiple video apps simultaneously — they fight over the camera.\n- For external webcams, plug directly into the laptop. Cheap USB-C docks often pass data but not video.\n- If you use a privacy slider, develop a habit of opening it before a call, not during.\n- Keep webcam drivers updated through OEM tools (Dell Update, Lenovo Vantage, HP Support Assistant).\n\n## 9. User-Friendly Explanation\n\"Cameras get tripped up in three usual ways: a sliding cover, a permission switch, or another app that's already holding the camera. We'll check all three in under a minute. If the LED next to your camera lights up but you still see black, that's almost always an app permission. If the LED never comes on at all, it's the cover or a driver. Either way, this is a quick fix.\"\n\n## 10. Internal Technician Notes\n- Windows: `Get-PnpDevice -Class Camera` quick lists all camera devices and state.\n- Code 45 in Device Manager almost always means the device is disconnected at the bus level — physical reseat or different port.\n- Logitech Capture and Logi G Hub both background-hold cameras even when minimized — kill via Task Manager if they're not actively in use.\n- macOS: `system_profiler SPCameraDataType` enumerates connected cameras.\n- For Intune-managed devices, ensure no Camera-restriction policy is in effect (`Settings catalog → Privacy → Let Windows apps access the camera`).\n\n## 11. Related KB Articles\n- l1-teams-001 — Teams audio + mic\n- l1-windows-005 — No sound on Windows\n- l1-windows-006 — App won't open\n\n## 12. Keywords / Search Tags\nwebcam, camera, video off, camera not working, camera not detected, black screen video, integrated camera, external webcam, logitech, privacy shutter, camera in use, camera app"
  },
  {
   "slug": "l1-wifi-001-cant-connect",
   "path_rel": "knowledge-base\\L1\\l1-wifi-001-cant-connect.md",
   "title": "\"Wi-Fi: can't connect / shows 'no internet, secured' / yellow triangle\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-wifi-001\ntitle: \"Wi-Fi: can't connect / shows 'no internet, secured' / yellow triangle\"\ncategory: wifi\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - wifi\n  - wi-fi\n  - no internet\n  - no internet secured\n  - yellow triangle\n  - wireless not working\n  - can't connect\n  - dropped connection\nrelated_articles:\n  - l2-networking-001\n  - l1-vpn-001\nescalation_trigger: \"Issue affects multiple users on same SSID, or network adapter shows error code 10/12/43, or DHCP exhaustion suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Wi-Fi: can't connect / no internet\n\n## 1. Symptoms\n- Wi-Fi connected, but yellow triangle/exclamation on icon.\n- \"No internet, secured\" tooltip.\n- Web pages don't load; ping fails.\n- Connects then immediately disconnects.\n- \"Couldn't connect\" / \"Cannot connect to this network\" error.\n- Speed test shows <1 Mbps despite \"good\" signal.\n\n## 2. Likely Causes\n1. Router / AP issue (most common — restart fixes ~half).\n2. ISP outage upstream of router.\n3. DHCP didn't issue valid IP (169.254.x.x = APIPA = no DHCP).\n4. DNS server unreachable (config or ISP).\n5. Saved wrong password for SSID.\n6. Wi-Fi driver glitch / outdated.\n7. Captive portal not yet completed (hotel, airport, café).\n8. Adapter disabled or in airplane mode.\n\n## 3. Questions To Ask User\n1. Are you at home, office, or public Wi-Fi?\n2. Are other devices on the same Wi-Fi working?\n3. What does the Wi-Fi icon look like (full bars / yellow / X)?\n4. Have you connected to this network before successfully?\n5. Did you change anything before it stopped (new router, password, OS update)?\n6. Have you tried restarting your router?\n\n## 4. Troubleshooting Steps\n1. Toggle airplane mode ON → wait 10 seconds → OFF.\n2. Forget the network: Settings → Network → Wi-Fi → Manage known networks → select SSID → Forget. Reconnect with password.\n3. Restart router: power off 30 seconds → power on. Wait 2 minutes for full boot.\n4. Check IP: Win+R → `cmd` → `ipconfig`. If \"169.254.x.x\" or \"0.0.0.0\", DHCP failed.\n5. Renew lease: `ipconfig /release` then `ipconfig /renew`.\n6. Flush DNS: `ipconfig /flushdns`.\n7. Reset network stack:\n   - `netsh winsock reset`\n   - `netsh int ip reset`\n   - Reboot.\n\n## 5. Resolution Steps\n**If APIPA (169.254.x.x):**\n- Router restart fixes ~70%. If persists, check router DHCP scope (admin) or pool exhaustion (more devices than scope).\n\n**If DNS-only failure (you can ping IPs but not load sites):**\n1. Settings → Network → Wi-Fi → adapter properties → Edit DNS → Manual → IPv4: `1.1.1.1` and `8.8.8.8`.\n2. `ipconfig /flushdns`.\n3. Re-test web.\n\n**If wrong password saved:**\n- Forget + reconnect with correct password.\n\n**If captive portal (hotel/airport):**\n- Open browser → navigate to any HTTP site (try `neverssl.com`) → portal page should auto-redirect → log in.\n\n**If driver:**\n- Device Manager → Network adapters → Wi-Fi adapter → right-click Update driver → Search automatically.\n- For Intel/Realtek, get latest from OEM support page.\n\n**If adapter disabled:**\n- Device Manager → adapter → Enable.\n- Or: Settings → Network → adapter properties → Enable.\n- Hardware Wi-Fi switch / Fn-key combo: re-enable.\n\n## 6. Verification Steps\n- `ipconfig` shows valid IP (not 169.254.x.x), valid gateway.\n- `ping 1.1.1.1` succeeds (network).\n- `ping google.com` succeeds (DNS).\n- Web pages load in browser.\n- Speedtest.net within 70% of expected plan speed.\n\n## 7. Escalation Trigger\n- Network adapter shows code 10/12/43 in Device Manager (driver/hardware).\n- Multiple users on same SSID/AP all affected.\n- Reset commands return errors.\n- Driver update doesn't take or repeats failure.\n- ISP modem light pattern indicates outage.\n- → Escalate to **L2** with: `ipconfig /all` output, signal strength, AP name/MAC, router make/model, when last working.\n\n## 8. Prevention Tips\n- Reboot home router monthly.\n- Keep Wi-Fi driver current via OEM update tool.\n- Don't auto-connect to public networks.\n- For corporate, use 5 GHz band where available — less congestion.\n- Avoid placing router in metal cabinet, near microwaves, or near baby monitors.\n\n## 9. User-Friendly Explanation\n\"Your Wi-Fi sees the network but the connection isn't fully working. Most often it's the router needing a restart, or your computer's network settings got tangled. We'll restart what needs restarting, refresh the connection, and confirm you can actually load websites. If your Wi-Fi card itself is acting up, we'll update its driver.\"\n\n## 10. Internal Technician Notes\n- `netsh wlan show interfaces` — current SSID, BSSID, signal, RX/TX rate.\n- `netsh wlan show profiles` — saved networks; `netsh wlan show profile name=\"X\" key=clear` reveals stored password (admin context, audit-loggable).\n- For repeated APIPA → packet capture at AP shows whether DHCP DISCOVER reaches and OFFER returns.\n- For captive portal that won't show: try `http://1.1.1.1/cdn-cgi/trace` — Cloudflare's HTTP target dodges HSTS issues.\n- Code 10 in Device Manager = driver failed to start; code 12 = resource conflict; code 43 = device reported failure. Each has different fix paths.\n- For Mac users, `wdutil info` shows everything in one go (since macOS 14).\n\n## 11. Related KB Articles\n- l1-vpn-001 — VPN connection issues\n- l2-networking-001 — Network troubleshooting deep dive\n\n## 12. Keywords / Search Tags\nwifi, wi-fi, no internet, secured, yellow triangle, wireless not working, can't connect, dropped, dns"
  },
  {
   "slug": "l1-wifi-003-keeps-dropping-intermittent",
   "path_rel": "knowledge-base\\L1\\l1-wifi-003-keeps-dropping-intermittent.md",
   "title": "\"Wi-Fi: connection keeps dropping or disconnecting intermittently\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-wifi-003\ntitle: \"Wi-Fi: connection keeps dropping or disconnecting intermittently\"\ncategory: wifi\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: []\nkeywords:\n  - wifi dropping\n  - wifi keeps disconnecting\n  - intermittent wifi\n  - wifi drops every few minutes\n  - reconnects by itself\n  - unstable wireless\n  - wifi cuts out\n  - keeps losing connection\n  - flaky wifi\nrelated_articles:\n  - l1-wifi-001\n  - l1-wifi-002\n  - l2-networking-001\nescalation_trigger: \"Many users on the same AP/SSID drop together, drops correlate with DHCP lease renewals, or RF survey shows AP overload — that is an L2 wireless/network problem, not a single endpoint.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# Wi-Fi keeps dropping / disconnects intermittently\n\n## 1. Symptoms\n- Wi-Fi shows \"Connected\" then drops to \"No internet\" or disconnects entirely every few minutes, then comes back on its own.\n- Teams/Zoom calls cut out briefly; downloads stall and resume.\n- Signal bars fluctuate even when the laptop hasn't moved.\n- Drops happen more often when the laptop wakes from sleep or moves between rooms.\n\n## 2. Likely Causes\n1. **Wi-Fi adapter power management** is turning the radio off to save battery (the single most common cause on Windows laptops).\n2. **Band/channel steering** — the laptop keeps roaming between 2.4 GHz and 5 GHz, or between two access points with the same SSID, and drops during the hand-off.\n3. **Weak / variable signal** from distance, walls, or interference (microwaves, 2.4 GHz cordless phones, USB 3 hubs).\n4. **Outdated or crashing Wi-Fi driver.**\n5. **Channel congestion** — too many networks on the same 2.4 GHz channel.\n6. **DHCP lease too short or conflicting**, so the device briefly loses its IP.\n7. Router/AP firmware bug or an overloaded access point (points to L2 if it's site-wide).\n\n## 3. Questions To Ask User\n1. Does it drop on a schedule (e.g., every few minutes) or randomly?\n2. Does it only drop after the laptop sleeps, or while actively in use?\n3. Does it happen everywhere, or only in one room / far from the router?\n4. Do other devices (phone, a colleague's laptop) on the same Wi-Fi drop too?\n5. Is the laptop on battery or plugged in when it drops?\n6. Recent change — new router, moved desk, Windows update?\n\n## 4. Troubleshooting Steps\n1. **Check if other devices drop too.** If a phone on the same network is rock-solid, the problem is this laptop; if everything drops, it's the network (→ escalate).\n2. **Plug in / disable battery saver.** If drops stop while plugged in, it's adapter power management (fix in §5).\n3. **Move closer to the router** temporarily. If stable up close, it's a signal/range problem.\n4. **Forget and reconnect** the network: Settings → Network & internet → Wi-Fi → Manage known networks → Forget → reconnect with the password.\n5. **Reboot the laptop** to clear a stuck Wi-Fi service or driver.\n6. **Reboot the home router** (unplug 30 seconds) if this is a home/remote worker.\n\n## 5. Resolution Steps\n**Windows — stop the adapter from powering down (most common fix):**\n1. Device Manager → Network adapters → right-click your Wi-Fi adapter → Properties → **Power Management** tab → **uncheck** \"Allow the computer to turn off this device to save power\" → OK.\n2. Settings → System → Power & battery → set Power mode to **Balanced** (not Best power efficiency) while troubleshooting.\n\n**Windows — lock to the stronger band / stop roaming churn:**\n1. Device Manager → Wi-Fi adapter → Properties → **Advanced** tab.\n2. Set **Roaming Aggressiveness / Roaming Sensitivity** to **Low / 1**.\n3. If 2.4 GHz is congested and 5 GHz reaches the desk, set **Preferred Band** to **5 GHz** (Prefer 5 GHz).\n\n**Windows — refresh the driver:**\n1. Device Manager → Wi-Fi adapter → right-click → Update driver → Search automatically.\n2. If still flaky, download the latest driver from the **laptop maker's** support site (Dell/HP/Lenovo ship newer Wi-Fi firmware than Windows Update).\n\n**Windows — clear a bad network stack (if drops persist):**\n1. Open Command Prompt / PowerShell **as admin** and run, in order:\n   - `netsh winsock reset`\n   - `netsh int ip reset`\n   - `ipconfig /flushdns`\n2. Reboot.\n\n**macOS — rebuild Wi-Fi settings:**\n1. System Settings → Wi-Fi → Details → **Forget** the network → re-join.\n2. If it keeps dropping: remove and re-add Wi-Fi in System Settings → Network, then reboot. (On older macOS, deleting the `SystemConfiguration` network preference files achieves the same — L2 task.)\n\n## 6. Verification Steps\n- Stay connected for a continuous 15-minute period (e.g., a Teams call) with no drop.\n- `ping -t 8.8.8.8` (Windows) or `ping 8.8.8.8` (macOS) for 5 minutes shows no sustained timeouts.\n- Signal stays steady when the laptop is at its normal desk location, on battery.\n\n## 7. Escalation Trigger\n- Multiple users / devices on the same SSID or access point drop at the same times.\n- Drops line up with DHCP lease renewals or appear in the AP/controller logs.\n- A site RF survey is needed (channel overlap, AP placement, co-channel interference).\n- Adapter shows hardware errors (Code 43/10) after a clean driver reinstall — possible failing radio.\n- → Escalate to **L2** for wireless infrastructure / driver-package / hardware diagnosis.\n\n## 8. Prevention Tips\n- Leave the Wi-Fi adapter's power-management off on desktops and docked laptops.\n- For home/remote workers, recommend 5 GHz at the desk and keeping the router off the floor / away from microwaves.\n- Keep Wi-Fi drivers current from the OEM tool, not just Windows Update.\n- Avoid USB 3 hubs/SSDs directly beside the laptop on 2.4 GHz (they radiate 2.4 GHz noise).\n\n## 9. User-Friendly Explanation\n\"Your laptop is connecting fine but then briefly letting go of the Wi-Fi — usually because Windows is powering the wireless chip down to save battery, or because it's hopping between two signals and stumbling on the hand-off. We'll stop it from powering down, point it at the stronger signal, and freshen the driver. That fixes the great majority of these. If your phone drops on the same network too, then it's the router or office Wi-Fi and we'll get the network team on it.\"\n\n## 10. Internal Technician Notes\n- Confirm power-management cause fast: `powercfg /requests` won't show it, but if drops stop on AC power it's almost certainly the NIC power CSP.\n- Check roaming logs: Event Viewer → Applications and Services Logs → Microsoft → Windows → WLAN-AutoConfig (Operational) — disconnect reason codes pinpoint roaming vs. auth vs. signal.\n- For managed fleets, a Wi-Fi power-management state can be enforced via Intune/GPO so end users can't re-enable it.\n- 802.11r/k/v fast-roaming misconfig on the AP side causes synchronized drops — hand to L2 with the WLAN-AutoConfig export.\n- `netsh wlan show interfaces` shows live RSSI / channel; below ~-70 dBm at the desk = range problem.\n\n## 11. Related KB Articles\n- l1-wifi-001 — Wi-Fi can't connect at all\n- l1-wifi-002 — Connected but no internet\n- l2-networking-001 — Deep network troubleshooting\n\n## 12. Keywords / Search Tags\nwifi dropping, wifi keeps disconnecting, intermittent wifi, wifi drops every few minutes, reconnects by itself, unstable wireless, wifi cuts out, keeps losing connection, flaky wifi, power management, roaming aggressiveness, 5ghz, wlan-autoconfig"
  },
  {
   "slug": "l1-windows-001-blue-screen-stop-error",
   "path_rel": "knowledge-base\\L1\\l1-windows-001-blue-screen-stop-error.md",
   "title": "\"Blue screen of death (BSOD) on Windows 10/11\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-001\ntitle: \"Blue screen of death (BSOD) on Windows 10/11\"\ncategory: windows\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - bsod\n  - blue screen\n  - stop error\n  - kernel panic\n  - system crash\n  - critical_process_died\n  - whea_uncorrectable\n  - memory_management\n  - driver_irql\nrelated_articles:\n  - l1-windows-002\n  - l2-drivers-003\n  - l2-performance-005\nescalation_trigger: \"BSOD repeats more than 3 times in 24h, occurs during boot before login, or shows DISK or NTFS-related stop codes\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Blue screen of death (BSOD) on Windows 10/11\n\n## 1. Symptoms\n- Screen turns solid blue (or black on Win11) with a sad-face emoji and a stop code such as `CRITICAL_PROCESS_DIED`, `IRQL_NOT_LESS_OR_EQUAL`, `MEMORY_MANAGEMENT`, `WHEA_UNCORRECTABLE_ERROR`, or `PAGE_FAULT_IN_NONPAGED_AREA`.\n- PC restarts unexpectedly, sometimes with a \"collecting error info...\" progress percentage.\n- May happen when launching a specific app, plugging in a peripheral, or at random.\n\n## 2. Likely Causes\n1. Recently installed or corrupt device driver (most common — display, audio, network).\n2. Failing RAM module or storage drive (SSD/HDD).\n3. Recent Windows Update with a regression.\n4. Overheating CPU or GPU.\n5. Malware or rootkit.\n6. Unstable overclock or BIOS settings (rare on managed corporate hardware).\n\n## 3. Questions To Ask User\n1. What stop code appears on the blue screen? (Take a phone photo if needed.)\n2. Did this start after installing/updating any software, drivers, or Windows updates in the last 7 days?\n3. Does it happen when running a specific application, or randomly?\n4. How many times has it occurred in the last 24 hours?\n5. Is the device a laptop or desktop, and is it on AC power?\n6. Has any new hardware been connected (USB hub, dock, monitor, drive)?\n\n## 4. Troubleshooting Steps\n1. **Note the stop code** before the PC reboots — it's the single most useful piece of evidence.\n2. Disconnect non-essential peripherals (USB drives, docks, secondary monitors) and reboot.\n3. Boot to Safe Mode (Settings → System → Recovery → Advanced startup → Restart now → Troubleshoot → Advanced options → Startup Settings → 4 = Safe Mode).\n4. If Safe Mode is stable, the issue is software/driver-related, not hardware.\n5. In Settings → Update & Security → View update history, identify any update installed in the last week.\n\n## 5. Resolution Steps\n**If a recent update is suspected:**\n1. Settings → Windows Update → Update history → Uninstall updates → remove the most recent quality update.\n2. Reboot and use the PC normally for 30 min to confirm stability.\n\n**If a recent driver is suspected:**\n1. Open Device Manager (`devmgmt.msc`).\n2. Locate the suspect device (yellow warning icon, or recently updated by date).\n3. Right-click → Properties → Driver tab → **Roll Back Driver**.\n4. Reboot.\n\n**If random / no clear cause:**\n1. Run `sfc /scannow` from elevated Command Prompt (System file checker).\n2. Run `DISM /Online /Cleanup-Image /RestoreHealth`.\n3. Run Windows Memory Diagnostic (`mdsched.exe`) — schedules a reboot test.\n4. Run `chkdsk C: /f /r` — schedules at next reboot.\n5. Check Event Viewer → Windows Logs → System for \"BugCheck\" entries; record full stop code and parameters.\n\n## 6. Verification Steps\n- 24 hours of normal use without recurrence.\n- Event Viewer shows no new `BugCheck` events after the fix.\n- The originally reported workflow (e.g., launching the app that triggered it) completes successfully 3 consecutive times.\n\n## 7. Escalation Trigger\n- BSOD recurs more than 3 times in 24 hours despite L1 steps.\n- Stop code is `INACCESSIBLE_BOOT_DEVICE`, `NTFS_FILE_SYSTEM`, `DISK_HARDWARE_ERROR`, or any code containing `WHEA` (likely hardware).\n- BSOD occurs before login screen — user cannot reach desktop.\n- PC fails to boot into Safe Mode.\n- → Escalate to **L2** with: stop code(s), timestamps from Event Viewer, install dates of recent updates/drivers, and minidump file from `C:\\Windows\\Minidump\\`.\n\n## 8. Prevention Tips\n- Keep Windows Update and OEM driver updates current — but don't install drivers from unverified third-party sites.\n- Avoid \"driver booster\" type utilities — they're a top cause of BSODs.\n- Maintain at least 15% free space on the C: drive.\n- Use a quality UPS or stable power source for desktops.\n- Don't ignore single BSODs — log them; patterns matter.\n\n## 9. User-Friendly Explanation\n\"That blue screen means Windows hit something it couldn't recover from and had to restart to keep your data safe. Most of the time it's a driver or a recent update — we'll roll back what changed first, run a couple of checks to make sure your memory and disk are healthy, and you'll be back in business. If it keeps happening, we'll bring in a technician to look closer at the hardware.\"\n\n## 10. Internal Technician Notes\n- Minidump location: `C:\\Windows\\Minidump\\*.dmp`. Analyze with WinDbg + `!analyze -v`.\n- Full memory dump (if enabled): `C:\\Windows\\MEMORY.DMP`.\n- Useful Event Viewer filter: System log, Source = `BugCheck` or `Microsoft-Windows-WER-SystemErrorReporting`.\n- If `WHEA_UNCORRECTABLE_ERROR`, almost always CPU/RAM hardware — check vendor diagnostic.\n- For repeating `DRIVER_IRQL_NOT_LESS_OR_EQUAL`, the parameter at offset 3 is the offending driver address — `lmvm` it in WinDbg.\n- For OEM laptops (Dell, HP, Lenovo), run vendor pre-boot diagnostics (F12 / Esc / F2 menus).\n- If BitLocker is enabled and disk errors are suspected, ensure recovery key is on file before running `chkdsk /r`.\n\n## 11. Related KB Articles\n- l1-windows-002 — Windows won't boot / stuck on spinning dots\n- l2-drivers-003 — Driver rollback strategies and WHQL gating\n- l2-performance-005 — Diagnosing intermittent system instability\n\n## 12. Keywords / Search Tags\nbsod, blue screen, stop error, kernel panic, system crash, critical_process_died, whea_uncorrectable, memory_management, driver_irql, windows crashing, computer keeps restarting"
  },
  {
   "slug": "l1-windows-002-wont-boot-spinning-dots",
   "path_rel": "knowledge-base\\L1\\l1-windows-002-wont-boot-spinning-dots.md",
   "title": "\"Windows won't boot — stuck on spinning dots or black screen\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-002\ntitle: \"Windows won't boot — stuck on spinning dots or black screen\"\ncategory: windows\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - won't boot\n  - stuck on logo\n  - spinning dots\n  - black screen\n  - boot loop\n  - automatic repair loop\n  - windows not loading\nrelated_articles:\n  - l1-windows-001\n  - l2-bitlocker-001\n  - l3-disaster-recovery-002\nescalation_trigger: \"BitLocker recovery key prompt appears, or boot fails after 2 startup-repair cycles, or storage SMART warnings present\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Windows won't boot — stuck on spinning dots or black screen\n\n## 1. Symptoms\n- Manufacturer logo + spinning dots loop indefinitely.\n- \"Preparing Automatic Repair\" appears repeatedly — never resolves.\n- Black screen after POST with only a cursor.\n- BitLocker recovery key prompt appears unexpectedly.\n- \"Boot device not found\" or \"No bootable medium\" message.\n\n## 2. Likely Causes\n1. Failed Windows update or interrupted shutdown corrupted boot files.\n2. Bad sectors on the system drive or failing SSD/HDD.\n3. BCD (Boot Configuration Data) corruption.\n4. New hardware (especially RAM, storage, or external boot device) changed boot order.\n5. BitLocker triggered protection mode after firmware/hardware change.\n6. Disk fully encrypted and TPM cleared.\n\n## 3. Questions To Ask User\n1. What exactly do you see on screen (read it word-for-word, or photo)?\n2. Did the PC shut down normally last time, or was there a power loss / forced shutdown?\n3. Has any hardware changed — new RAM, SSD, dock, USB drive plugged in?\n4. Is BitLocker enabled? (Corporate-managed devices typically yes.)\n5. Do you have your BitLocker recovery key (Microsoft account or organization portal)?\n6. Did Windows Update install anything in the last 24 hours before the issue?\n\n## 4. Troubleshooting Steps\n1. Disconnect ALL external USB devices except keyboard and mouse, then reboot.\n2. Force three failed boots: power on → as soon as Windows logo appears, hold power button until off → repeat. After the third attempt Windows enters Recovery Environment (WinRE).\n3. From WinRE: Troubleshoot → Advanced options → Startup Repair. Let it run.\n4. If Startup Repair fails, return to Advanced options → Command Prompt and run:\n   - `bootrec /fixmbr`\n   - `bootrec /fixboot` (if \"Access denied\", run `bootsect /nt60 sys` first)\n   - `bootrec /scanos`\n   - `bootrec /rebuildbcd`\n5. Run `chkdsk C: /f /r` from the same CMD.\n\n## 5. Resolution Steps\n**If above completes successfully:**\n1. Exit and reboot. Most boot-config issues resolve here.\n\n**If BitLocker prompt appears:**\n1. Retrieve the recovery key from one of:\n   - User's Microsoft account → https://account.microsoft.com/devices/recoverykey\n   - Azure AD / Entra ID portal (admin) → Devices → Device → BitLocker keys\n   - Active Directory (admin) → Computer object → BitLocker tab\n2. Enter the 48-digit key.\n3. Once booted, run `manage-bde -protectors -get C:` to confirm protector state, and re-enable TPM protector if needed.\n\n**If still stuck:**\n1. Boot from a Windows 10/11 USB installer.\n2. Choose \"Repair your computer\" → Troubleshoot → System Restore. Pick a restore point from before the failure.\n3. Or: Reset this PC → Keep my files (last resort before reimaging).\n\n## 6. Verification Steps\n- Windows boots to the lock screen and accepts credentials.\n- Event Viewer (after login) shows no `bugcheck` or `disk` errors in the last hour.\n- All apps the user relies on launch successfully.\n- BitLocker reports \"Protection On\" via `manage-bde -status`.\n\n## 7. Escalation Trigger\n- After two cycles of Startup Repair + bootrec, system still won't boot.\n- BitLocker recovery key cannot be located in any directory.\n- SMART data shows warning/critical attributes on the system drive.\n- Repeat boot failures after a successful repair within 7 days.\n- → Escalate to **L2** for image-based recovery, or **L3** if hardware replacement is suspected.\n\n## 8. Prevention Tips\n- Always allow Windows updates to complete fully before shutting down.\n- Use UPS power on critical desktops.\n- Confirm BitLocker keys are escrowed to Azure AD / on-prem AD before encryption.\n- Keep a known-good recovery USB on hand for critical user laptops.\n- Watch SMART data quarterly with CrystalDiskInfo or vendor tooling.\n\n## 9. User-Friendly Explanation\n\"Your computer is having trouble starting up. Often it's a small file Windows uses to know where to load itself from — we can usually rebuild that in a few minutes. If your work device is encrypted, we may need a recovery key from your IT records to unlock it. We'll get you running and figure out what triggered it so it doesn't happen again.\"\n\n## 10. Internal Technician Notes\n- WinRE auto-trigger: 3 consecutive failed boots. If WinRE doesn't appear, the recovery partition may be deleted or the BCD entry for it is missing.\n- Useful command from WinRE CMD: `bcdedit /enum all` — surfaces any orphaned or wrong-disk OS entries.\n- For UEFI systems with EFI partition issues: `mountvol Z: /S` then rebuild EFI: `bcdboot C:\\Windows /s Z: /f UEFI`.\n- BitLocker: if TPM is reset, recovery key required ONCE to re-establish trust. Document the firmware/UEFI change cause.\n- If `bootrec /fixboot` returns Access Denied on UEFI, that's expected — the EFI partition needs `bcdboot`.\n- Image deployment fallback: PXE / Intune Autopilot reset → user productivity in <90 min on managed hardware.\n\n## 11. Related KB Articles\n- l1-windows-001 — Blue screen of death (BSOD)\n- l2-bitlocker-001 — BitLocker recovery key retrieval and re-protection\n- l3-disaster-recovery-002 — User device reimage workflow\n\n## 12. Keywords / Search Tags\nwon't boot, stuck on logo, spinning dots, black screen, boot loop, automatic repair loop, windows not loading, bcd, bootrec, bitlocker recovery, computer dead"
  },
  {
   "slug": "l1-windows-003-slow-pc-performance",
   "path_rel": "knowledge-base\\L1\\l1-windows-003-slow-pc-performance.md",
   "title": "\"Computer running slow / performance lag\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-003\ntitle: \"Computer running slow / performance lag\"\ncategory: performance\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - slow computer\n  - laggy\n  - performance\n  - high cpu\n  - high memory\n  - high disk usage\n  - 100% disk\n  - slow startup\n  - takes forever to load\nrelated_articles:\n  - l2-performance-005\n  - l2-malware-001\n  - l1-windows-004\nescalation_trigger: \"Performance issue persists after L1 cleanup, or task manager shows 100% disk usage with no identifiable process\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Computer running slow / performance lag\n\n## 1. Symptoms\n- Apps take 30+ seconds to open.\n- Mouse and typing feel laggy.\n- File Explorer takes a long time to populate folders.\n- Boot to login takes >2 minutes.\n- Fans spin up loudly even when idle.\n- Task Manager shows CPU, memory, or disk at 90–100%.\n\n## 2. Likely Causes\n1. Too many startup apps consuming RAM and CPU.\n2. Low free disk space (<10% on C:).\n3. Background indexing (Windows Search, OneDrive sync, antivirus scan).\n4. Outdated/conflicting drivers (especially storage and Wi-Fi).\n5. Malware or PUP (potentially unwanted programs).\n6. Failing storage drive.\n7. Insufficient RAM for current workload.\n\n## 3. Questions To Ask User\n1. When did you first notice this — sudden, or gradual over weeks?\n2. Is it slow always, or only with specific apps?\n3. How much free space on the C: drive? (This PC → C: drive properties.)\n4. How many browser tabs and apps do you typically have open?\n5. When did you last restart your PC (not just close the lid)?\n6. Have you installed anything new recently?\n\n## 4. Troubleshooting Steps\n1. **Reboot.** Not \"close lid and re-open\" — full Restart from Start menu. ~40% of cases resolve here.\n2. Open Task Manager (Ctrl+Shift+Esc) → Processes tab → sort by CPU, then by Memory, then by Disk. Note top 3 in each.\n3. Task Manager → Startup tab → disable any non-essential apps with \"High\" impact rating.\n4. Settings → System → Storage → Cleanup recommendations → run.\n5. Check C: drive free space — needs ≥15% free to perform normally.\n6. Settings → Apps → Installed apps — look for unfamiliar entries, recent installs, or \"search bar\" / \"browser helper\" type apps.\n\n## 5. Resolution Steps\n**If startup is the issue:**\n1. Disable: OneDrive (if not work-required at startup), Spotify, Teams (if not corporate-required), any chat clients, Adobe updaters.\n2. Keep: Antivirus, security agents, OEM device manager, Microsoft 365 apps.\n\n**If disk space is the issue:**\n1. Storage Sense → On.\n2. Empty Recycle Bin and Downloads folder.\n3. Move large files (Videos, ISOs) to OneDrive / external.\n4. Run Disk Cleanup as administrator → \"Clean up system files\" → Windows Update Cleanup, Previous Windows installations, Delivery Optimization Files.\n\n**If a process is pegging CPU/disk:**\n1. In Task Manager, right-click the process → Properties → check Publisher.\n2. If unknown publisher and high resource use → suspect malware. Run Windows Defender full scan (Virus & threat protection → Scan options → Full scan).\n3. If \"Antimalware Service Executable\" / `MsMpEng.exe` — wait, it's an active scan; will subside.\n4. If \"System\" or `Ntoskrnl.exe` is high — likely driver issue, escalate.\n\n## 6. Verification Steps\n- After full restart, idle CPU <10%, idle memory <60% used.\n- Boot to login screen <60 seconds.\n- Office apps launch in <10 seconds.\n- File Explorer opens folders instantly.\n- 24 hours of use without slowdown report.\n\n## 7. Escalation Trigger\n- Task Manager shows 100% disk for >10 minutes with no identifiable process.\n- Slowdown returns within hours of cleanup.\n- \"System Interrupts\" process consuming >5% CPU consistently — driver issue.\n- Defender scan finds threats it cannot quarantine.\n- → Escalate to **L2** with: top processes, free disk space, output of `winsat formal -restart`, and any threat names found.\n\n## 8. Prevention Tips\n- Restart at least weekly — pending updates and memory leaks compound.\n- Don't run more than ~15 browser tabs concurrently on 8GB RAM.\n- Avoid \"PC cleaner / optimizer\" utilities — they cause more problems than they solve.\n- Keep at least 20% of C: free.\n- Uninstall apps you don't use; bloat is real.\n\n## 9. User-Friendly Explanation\n\"Your PC is doing too many things at once, or it's running low on space. We'll clean up the apps that start automatically, free up some disk room, and check that nothing unwanted is using your CPU. After a quick restart you should feel a real difference. If it stays slow, that's a sign of something deeper and we'll get a tech to look.\"\n\n## 10. Internal Technician Notes\n- Resource Monitor (`resmon`) gives a finer picture than Task Manager — Disk tab shows per-file activity.\n- High disk on Win10 was historically Superfetch / SysMain — usually fine to disable on SSD systems: `sc config sysmain start=disabled`.\n- Windows Search indexing on rebuild can hammer disk for hours — let it finish overnight before judging.\n- For laptops, also check Power Plan: Settings → System → Power → Best performance during diagnosis.\n- For OEM laptops, vendor \"support assistant\" apps often install bloat — uninstall after asset capture.\n- `winsat formal` regenerates the WEI — useful to compare against baseline after fix.\n\n## 11. Related KB Articles\n- l1-windows-004 — Disk cleanup and storage management\n- l2-performance-005 — Diagnosing intermittent system instability\n- l2-malware-001 — Malware triage and quarantine\n\n## 12. Keywords / Search Tags\nslow computer, laggy, performance, high cpu, high memory, 100% disk, slow startup, takes forever, sluggish, freezing, hangs"
  },
  {
   "slug": "l1-windows-004-disk-cleanup",
   "path_rel": "knowledge-base\\L1\\l1-windows-004-disk-cleanup.md",
   "title": "\"Disk full / out of space on C: drive\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-004\ntitle: \"Disk full / out of space on C: drive\"\ncategory: performance\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - disk full\n  - out of space\n  - low disk space\n  - c drive full\n  - storage full\n  - clear space\n  - cleanup\nrelated_articles:\n  - l1-windows-003\n  - l1-onedrive-001\nescalation_trigger: \"Cleanup recovers <5% on a 256 GB+ drive, or hidden files / WinSxS bloat needs admin tools\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Disk full / out of space on C: drive\n\n## 1. Symptoms\n- Red bar in This PC under C: drive.\n- \"Low disk space\" notification.\n- Office / Teams won't open or save.\n- Updates failing — \"We couldn't install Windows update\" with not enough space.\n- Browser slows or crashes.\n\n## 2. Likely Causes\n1. Downloads / Desktop / Documents folders bulging.\n2. Old Windows install (Windows.old) after upgrade.\n3. Temp files / browser cache / Teams cache.\n4. Large local OneDrive sync (not using Files On-Demand).\n5. Big media files (videos, ISOs).\n6. Hibernate file (`hiberfil.sys`) on small SSD.\n7. Many local Outlook OST files (large mailbox cached).\n\n## 3. Questions To Ask User\n1. How big is your C: drive total? (This PC → C: → Properties.)\n2. How much free now?\n3. When did it last have plenty of room?\n4. Do you store videos, large files, or VM disks locally?\n5. Are you using OneDrive Files On-Demand (or syncing everything)?\n\n## 4. Troubleshooting Steps\n1. Settings → System → Storage → see breakdown.\n2. Run Storage Sense: Storage settings → Cleanup recommendations.\n3. Empty Recycle Bin and Downloads.\n4. Find large files: File Explorer → Search \"size:huge\" or \"size:gigantic\" in C:.\n5. Check Settings → System → Storage → Temporary files — select all → Remove.\n\n## 5. Resolution Steps\n**Standard cleanup:**\n1. Storage → Cleanup recommendations → run all suggested.\n2. Disk Cleanup utility (`cleanmgr.exe`) → C: → click \"Clean up system files\":\n   - Windows Update Cleanup\n   - Previous Windows installations (Windows.old) — frees 10–30 GB\n   - Delivery Optimization Files\n   - Recycle Bin\n   - Temporary files\n\n**OneDrive bloat:**\n1. Right-click OneDrive cloud icon → Settings → Sync and backup → Free up space (Files On-Demand).\n2. Files become cloud-only icons; opens download on click.\n\n**Outlook OST too large:**\n1. File → Account Settings → Account Settings → Data Files tab → see OST size.\n2. Reduce: File → Account Settings → Account Settings → Email → Change → Mail to keep offline → reduce slider (e.g., to 6 months).\n\n**Browser caches:**\n- Clear Chrome/Edge/Firefox cache (Ctrl+Shift+Del).\n\n**Disable hibernate (saves up to 16 GB on big-RAM laptops):**\n- Run as admin: `powercfg -h off`. Note: disables Fast Startup; usually fine on SSDs.\n\n**Move large folders:**\n- Documents/Pictures/Videos: right-click → Properties → Location → move to D: or external.\n- For OneDrive users, store in OneDrive instead.\n\n## 6. Verification Steps\n- C: free space ≥ 20% of total.\n- Settings → Storage shows green/no warning.\n- Office apps open and save without complaint.\n- Windows Update completes.\n\n## 7. Escalation Trigger\n- Cleanup yields <5% recovery on a 256 GB+ drive (likely hidden bloat — WinSxS, system restore points, large logs).\n- User has VM / dev tooling generating huge files we can't move.\n- Drive itself is too small for role (recommend hardware upgrade via L2).\n- → Escalate to **L2** with: drive size, free space, list of largest folders, Storage settings screenshot.\n\n## 8. Prevention Tips\n- Use OneDrive Files On-Demand on laptops.\n- Keep Downloads tidy — delete after use.\n- Don't store multimedia on C:; use external or cloud.\n- Run Disk Cleanup quarterly.\n- Right-size mailbox cache to 6–12 months for typical users.\n\n## 9. User-Friendly Explanation\n\"Your hard drive is full and Windows needs a bit of room to operate. We'll free up the easy stuff first — old Windows installer files, browser cache, downloads you don't need. If your OneDrive is taking up your whole drive, we'll switch on Files On-Demand so files only download when you actually open them. You'll have plenty of room in a few minutes.\"\n\n## 10. Internal Technician Notes\n- Hidden bloat suspects: `C:\\Windows\\Installer\\`, `C:\\Windows\\WinSxS\\`, `C:\\Windows\\Temp\\`, user `%temp%`, `C:\\$WinREAgent\\` (post-update).\n- WinSxS cleanup: `Dism.exe /Online /Cleanup-Image /StartComponentCleanup /ResetBase` — removes superseded components, slow.\n- Use `treesize free` or `WizTree` for quick visualization (don't install on prod without IT approval).\n- For laptops with 256 GB SSDs, Office cache + Teams + OneDrive can eat 50–80 GB on their own — Files On-Demand is mandatory.\n- `vssadmin list shadowstorage` — shadow copies / restore points sometimes consume 10%+; can be reduced with `vssadmin resize shadowstorage`.\n\n## 11. Related KB Articles\n- l1-windows-003 — Slow PC (often correlated)\n- l1-onedrive-001 — OneDrive sync issues\n\n## 12. Keywords / Search Tags\ndisk full, out of space, low disk space, c drive full, storage full, clear space, cleanup, files on demand"
  },
  {
   "slug": "l1-windows-005-audio-no-sound",
   "path_rel": "knowledge-base\\L1\\l1-windows-005-audio-no-sound.md",
   "title": "\"Windows: no sound at all from the computer\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-005\ntitle: \"Windows: no sound at all from the computer\"\ncategory: windows\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - no sound\n  - no audio\n  - speakers not working\n  - audio missing\n  - no audio output device\n  - red x speaker icon\n  - audio service not running\nrelated_articles:\n  - l1-teams-001\n  - l2-drivers-003\nescalation_trigger: \"Audio device not detected after driver reinstall, or hardware failure suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Windows: no sound at all\n\n## 1. Symptoms\n- Speaker icon in taskbar shows red X.\n- \"No audio output device is installed\".\n- Volume slider works but no sound.\n- Sound only on headphones, not speakers (or vice versa).\n- Sound suddenly cut out mid-use.\n\n## 2. Likely Causes\n1. Wrong default playback device.\n2. Volume muted or extremely low.\n3. Headphone jack disconnected (sometimes detection sticks).\n4. Audio driver glitch.\n5. Audio service not running.\n6. Bluetooth profile issue.\n7. Recent Windows Update broke audio (rare).\n\n## 3. Questions To Ask User\n1. Have you ever heard sound from this PC?\n2. Are you using built-in speakers, USB, or Bluetooth?\n3. Is volume in taskbar non-zero and not muted?\n4. Are there headphones plugged in?\n5. Did this start after an update?\n\n## 4. Troubleshooting Steps\n1. Click speaker icon → confirm not muted.\n2. Click speaker icon → check device dropdown — pick correct output.\n3. Right-click speaker → Sound settings → scroll Output → confirm device.\n4. Test sound: Settings → System → Sound → Test (button next to device).\n5. Unplug then replug headphones (refreshes detection).\n6. Run audio troubleshooter: Settings → System → Sound → Troubleshoot.\n\n## 5. Resolution Steps\n**Wrong default:**\n- Settings → Sound → Output → set correct device.\n\n**Service not running:**\n1. Win+R → `services.msc`.\n2. Find \"Windows Audio\" and \"Windows Audio Endpoint Builder\" → both should be Running, Automatic.\n3. Right-click → Restart.\n\n**Driver glitch:**\n1. Device Manager → Sound, video and game controllers.\n2. Right-click your audio device → Uninstall device → check \"Delete the driver software\" → OK.\n3. Reboot. Windows reinstalls automatically.\n4. If issue persists, install OEM driver from manufacturer's support page.\n\n**Headphone jack stuck \"plugged in\":**\n- Sometimes after physical unplug, OS still believes headphones are present. Plug + unplug 2–3 times, or restart.\n\n**Bluetooth audio:**\n- Settings → Bluetooth & devices → device → make sure \"Connected voice/audio\" is on.\n- Re-pair if needed.\n\n**After Windows Update broke audio:**\n- Settings → Windows Update → Update history → uninstall most recent update.\n- Or roll back driver: Device Manager → device → Properties → Driver → Roll Back Driver.\n\n## 6. Verification Steps\n- \"Test\" button plays the chime.\n- Music in browser plays clearly.\n- Headphone test (plug + unplug) routes correctly.\n- 30 minutes of mixed use without dropout.\n\n## 7. Escalation Trigger\n- Audio device not visible at all in Device Manager after driver reinstall.\n- Hardware failure suspected (no jack works, board-level).\n- Bluetooth audio works only on Hands-free, not Stereo (firmware issue).\n- → Escalate to **L2** with: device make/model, Device Manager screenshot, OS build, recent update history.\n\n## 8. Prevention Tips\n- Don't unplug headphones mid-volume — pop sounds can blow drivers (rare, but real).\n- Keep audio driver current via OEM utility.\n- Don't disable \"Audio Endpoint Builder\" / \"Windows Audio\" services.\n- Avoid third-party audio \"enhancers\" — they often break standard playback.\n- For Bluetooth, charge headset regularly; low battery = poor profile negotiation.\n\n## 9. User-Friendly Explanation\n\"Windows is sending sound somewhere it shouldn't, or the audio bit is asleep. We'll point sound at the right speaker, restart the audio piece, and re-detect your headphones if you're using them. Most no-sound issues fix in two minutes.\"\n\n## 10. Internal Technician Notes\n- Audio service dependencies: `Windows Audio` depends on `Multimedia Class Scheduler`, `Windows Audio Endpoint Builder`, `RPC`. Issues with any cascade.\n- Realtek HD Audio Manager often shipped with OEMs — its enhancements can override defaults; ensure correct playback device is selected in BOTH OS sound and Realtek manager.\n- For HDMI audio not switching when monitor connects, check `mmsys.cpl → Playback → Set Default → Default Communications Device` (sometimes Teams hijacks default).\n- For \"no audio output device\" with no devices visible: `Get-PnpDevice -Class Media -Status OK` to confirm WMI sees it; if not, real driver/hardware issue.\n- DirectX audio issues: `dxdiag` → Sound tab → check for \"no problems found\".\n\n## 11. Related KB Articles\n- l1-teams-001 — Teams audio not working (different scope)\n- l2-drivers-003 — Driver rollback strategies\n\n## 12. Keywords / Search Tags\nno sound, no audio, speakers not working, audio missing, no audio output device, red x, audio service"
  },
  {
   "slug": "l1-windows-006-app-wont-open",
   "path_rel": "knowledge-base\\L1\\l1-windows-006-app-wont-open.md",
   "title": "\"An app won't open / closes immediately / shows error on launch\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-006\ntitle: \"An app won't open / closes immediately / shows error on launch\"\ncategory: windows\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: []\nkeywords:\n  - app won't open\n  - app crashes\n  - exe won't run\n  - application error\n  - not opening\n  - closes immediately\nrelated_articles:\n  - l1-windows-003\n  - l2-windows-001\nescalation_trigger: \"Multiple apps fail to launch (system-wide), or specific app crashes after reinstall\"\nlast_invalidated: 2026-05-07\nversion: 1.0\n---\n\n# An app won't open / closes immediately\n\n## 1. Symptoms\n- Double-click icon, nothing happens.\n- App splash flashes then disappears.\n- \"This app can't run on your PC\".\n- \"The application was unable to start correctly (0xc000007b)\".\n- Black window flashes and closes.\n\n## 2. Likely Causes\n1. Corrupted app install / update interrupted.\n2. Missing dependency (Visual C++ Redistributable, .NET, DirectX).\n3. Antivirus blocking the executable.\n4. User permissions (running as wrong user).\n5. Compatibility issue — app expects older Windows.\n6. Conflicting background process.\n7. Profile corruption (specific to one user account).\n\n## 3. Questions To Ask User\n1. When did it last open successfully?\n2. Did you install / update the app or Windows recently?\n3. Do you see any error message at all?\n4. Does it work for another user logged in to the same PC?\n5. Is the app installed for all users, or just you?\n\n## 4. Troubleshooting Steps\n1. Restart the PC. Solves a quarter of these.\n2. Right-click app → Run as administrator (rules in or out a permissions issue).\n3. Open Event Viewer → Windows Logs → Application → look for error matching app launch time.\n4. Check if a different user on same PC can launch it.\n5. Open Task Manager → confirm no zombie process from prior launch (kill if present).\n\n## 5. Resolution Steps\n**Repair the app:**\n- Settings → Apps → Installed apps → app → ⋮ → Modify / Repair (where supported, e.g., M365, most enterprise apps).\n\n**Reinstall:**\n- Uninstall via Settings → Apps → Installed apps.\n- Restart.\n- Reinstall from official source.\n\n**Missing runtime:**\n- For \"0xc000007b\" or \"MSVCP*.dll missing\" → install latest Visual C++ Redistributables (x86 + x64) from Microsoft.\n- For \".NET Framework x.x is required\" → install via Settings → Optional features.\n\n**Compatibility:**\n- Right-click .exe → Properties → Compatibility tab → Run this program in compatibility mode for Windows 7/8 → try.\n\n**Antivirus:**\n- Check Windows Security → Virus & threat protection → Protection history. If app blocked, restore + add exclusion (only if from known-good vendor).\n\n**User profile corrupt:**\n- Test with a different user account. If app launches for them and not for current user → profile rebuild required (escalate to L2).\n\n## 6. Verification Steps\n- App launches and reaches its main window in <30 sec.\n- App's primary function works (open file / save / log in).\n- 3 consecutive launches succeed without issue.\n\n## 7. Escalation Trigger\n- Multiple apps won't launch — system-wide problem.\n- Reinstall doesn't resolve and app is critical.\n- Compatibility / DLL hell unresolvable at L1.\n- User profile suspected corrupted.\n- → Escalate to **L2** with: app name + version, error code, Event Viewer entry, attempted fixes.\n\n## 8. Prevention Tips\n- Don't kill an app installer mid-flight.\n- Keep Visual C++ and .NET runtimes current.\n- Don't allow random \"uninstaller\" apps to delete shared runtimes.\n- Whitelist legitimate work apps in security software during install.\n- Reboot weekly.\n\n## 9. User-Friendly Explanation\n\"The app's having trouble starting. Often it's a missing piece it needs (a runtime), or its install got corrupted, or something is blocking it. We'll repair it first, then check Event Viewer for clues, and reinstall fresh if needed. Most apps come back with a 5-minute fix.\"\n\n## 10. Internal Technician Notes\n- Useful Event Viewer filter: Application log, Source = `Application Error` or `.NET Runtime`. Match by exe name + timestamp.\n- 0xc000007b classic = mixing 32 vs 64-bit DLLs; ensure correct VC++ redist (both x86 and x64).\n- For Store / MSIX apps that won't launch: `Get-AppxPackage` to check state; `Get-AppxLog` for install errors. Reset via Settings → Apps → app → Advanced → Reset.\n- Profile corruption test: log on with admin/test account → run app. If works → use ProfWiz or rebuild user profile.\n- For per-user installs in C:\\Users\\<u>\\AppData\\Local\\Programs\\, check that AV didn't quarantine pieces.\n\n## 11. Related KB Articles\n- l1-windows-003 — Slow PC / app launch slow\n- l2-windows-001 — User profile rebuild\n\n## 12. Keywords / Search Tags\napp won't open, app crashes, exe won't run, application error, not opening, closes immediately, 0xc000007b"
  },
  {
   "slug": "l2-active-directory-001-account-lockout",
   "path_rel": "knowledge-base\\L2\\l2-active-directory-001-account-lockout.md",
   "title": "\"Active Directory: account lockout / repeating lockouts after password change\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-active-directory-001\ntitle: \"Active Directory: account lockout / repeating lockouts after password change\"\ncategory: active-directory\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nos_scope: [\"Windows Server 2016+\"]\nprerequisites: [\"AD Account Operators or higher\", \"Event Log access on DCs\"]\nkeywords:\n  - account lockout\n  - locked out\n  - bad password attempts\n  - repeating lockout\n  - cached credential\n  - service account locked\n  - 4740 event\nrelated_articles:\n  - l1-password-001\n  - l2-azure-ad-001\nescalation_trigger: \"Lockout source unidentifiable, or service account, or pattern across many accounts (possible attack)\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# AD account lockout — finding the source\n\n## 1. Symptoms\n- User reports being locked out repeatedly even after admin unlock.\n- Account locks within minutes of unlock.\n- Service account locks daily.\n- Multiple users locking simultaneously (broadcast credential issue).\n\n## 2. Likely Causes\n1. Cached old password on a phone (Outlook ActiveSync), tablet, or laptop after password change.\n2. Mapped network drive using saved old credential.\n3. Saved Wi-Fi profile with domain creds.\n4. Scheduled task running as user with old password.\n5. Service account with hardcoded password in script/server.\n6. Brute-force attack against the account.\n\n## 3. Questions To Ask\n- Recent password change — yes/no, when?\n- All devices the user signs in on (laptop, phone, tablet, desktop, kiosk)?\n- Mapped drives, scheduled tasks, ActiveSync devices?\n- Frequency of lockout?\n\n## 4. Troubleshooting Steps\n1. On PDC emulator (holds master lockout state) → Event Viewer → Security → filter for Event ID 4740 (\"A user account was locked out\").\n2. Note \"Caller Computer Name\" — that's the source machine sending bad creds.\n3. Microsoft Account Lockout & Management Tools (LockoutStatus.exe) gives a UI for this.\n4. On caller machine, open Event Viewer → Security → 4625 events for that user — narrows process / source workstation.\n5. Check Credential Manager (`cmdkey /list`) on caller for stale entries.\n\n## 5. Resolution Steps\n**Cached creds on phone (Outlook / ActiveSync):**\n- Have user remove + re-add the work profile / mail account on phone with new password.\n- For Intune-enrolled phones, force update profile.\n\n**Mapped drive with saved cred:**\n- On caller machine: `cmdkey /delete:server.domain.local`.\n- Reconnect drive with current creds (or via GPO).\n\n**Scheduled task with old password:**\n- Task Scheduler → identify tasks running as user → Actions → update creds.\n\n**Wi-Fi enterprise SSID:**\n- Forget + reconnect with current creds.\n\n**Service account:**\n- Find every place the password is used (DSC, SCCM, scripts, services).\n- Change all in coordination, then reset AD password.\n- Best practice: convert to Group Managed Service Account (gMSA) — auto-rotated.\n\n**Brute force:**\n- Check 4625 source IPs and counts. If external, escalate to L3/Security.\n- Consider implementing Smart Lockout in Azure AD / Microsoft Defender for Identity.\n\n## 6. Verification Steps\n- 24 hours with no Event 4740 for the user.\n- LockoutStatus.exe shows account \"Not Locked Out\" across all DCs.\n- User signs in normally everywhere.\n\n## 7. Escalation Trigger\n- Source machine cannot be identified after 4740 review.\n- Service account that's hardcoded in many places.\n- Pattern of lockouts across many accounts (attack).\n- → Escalate to **L3 / Security**.\n\n## 8. Prevention Tips\n- Use gMSA for all service accounts.\n- Don't reuse passwords across accounts.\n- Set sane lockout policy (5–10 attempts, 15 min reset is common).\n- Monitor for 4740 spikes — alert if >5/hour.\n- Implement password rotation hygiene with documented update procedures.\n\n## 9. User-Friendly Explanation\n\"Some device of yours is still trying to log in with your old password. We need to find which one — usually a phone, mapped drive, or saved Wi-Fi — and update it. Once we do, the lockouts stop.\"\n\n## 10. Internal Technician Notes\n- Lockout policy is set in default domain policy GPO (`Computer Config → Policies → Windows Settings → Security Settings → Account Policies → Account Lockout Policy`).\n- PDC role: `netdom query fsmo`.\n- LockoutStatus.exe (free Microsoft tool) — checks all DCs at once.\n- ALTools / `Get-LockoutEvents` PowerShell — pulls 4740 across DCs.\n- For RODC-served sites, lockouts replicate from RODC to writable DC; source field still populated.\n- Microsoft Defender for Identity flags lockout patterns and suspicious lateral attempts.\n\n## 11. Related KB Articles\n- l1-password-001 — User password reset\n- l2-azure-ad-001 — Cloud sign-in lockouts\n\n## 12. Keywords / Search Tags\naccount lockout, locked out, bad password attempts, repeating lockout, cached credential, service account, 4740 event"
  },
  {
   "slug": "l2-asset-management-001-it-asset-lifecycle",
   "path_rel": "knowledge-base\\L2\\l2-asset-management-001-it-asset-lifecycle.md",
   "title": "\"IT asset lifecycle: procurement, deployment, refresh, retirement\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-asset-management-001\ntitle: \"IT asset lifecycle: procurement, deployment, refresh, retirement\"\ncategory: asset-management\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 45\naudience: admin\nos_scope: [\"Multi-platform\"]\nprerequisites: [\"asset register / CMDB access\", \"Intune or equivalent MDM\"]\nkeywords:\n  - asset management\n  - asset register\n  - cmdb\n  - itam\n  - procurement\n  - device refresh\n  - hardware lifecycle\n  - asset tag\n  - serial number\n  - depreciation\n  - device retirement\n  - e-waste\n  - asset audit\nrelated_articles:\n  - l2-onboarding-001\n  - l2-offboarding-001\n  - l2-deployment-001\nescalation_trigger: \"Lost/stolen device, missing serial in audit, or device returned with sensitive data not wiped\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# IT asset lifecycle management\n\n## 1. Symptoms / triggers\n- New hire needs a device today and the bench is empty.\n- Audit reveals devices in CMDB without users, or users without devices.\n- Finance asks for accurate depreciation by quarter.\n- Devices show up at the help desk with no asset tag.\n- Returns from offboarded users sit on a shelf for weeks.\n- Vendor renewal quote arrives and we don't know what we have.\n\n## 2. Likely causes\n1. No single source of truth — spreadsheet + Intune + procurement portal disagree.\n2. Asset tags applied physically but not digitally (or vice versa).\n3. Receiving process bypasses the IT register when bought by a department directly.\n4. Returns aren't reconciled before being marked \"available\".\n5. No defined refresh policy (3 yrs / 4 yrs / on-demand).\n\n## 3. Questions to ask\n1. What's the source of truth — Intune Devices, a SaaS like Lansweeper/Snipe-IT, or a spreadsheet?\n2. Who owns the asset register — IT, Finance, or both?\n3. What's the device standard — current SKU, accepted alternates, by role?\n4. Do we have asset tags AND serial numbers in the register?\n5. Who authorises a write-off (lost/stolen/damaged)?\n\n## 4. Troubleshooting / triage\n1. **Reconcile** — pull a CSV from Intune (or your MDM), pull purchase orders for the period, compare. Anything in MDM not in PO = grey-market or BYOD. Anything in PO not in MDM = unenrolled.\n2. **Tag every active device** with both a physical sticker AND a digital tag stored in MDM custom attribute.\n3. **Define states**: Procured · In stock · Deployed · Returned · In repair · Retired · Lost.\n4. **Set a refresh cadence** — typical: laptops 3 yrs (knowledge workers) / 4 yrs (light users) / 5 yrs (servers); phones 2 yrs.\n5. **Wipe on return** — auto-trigger MDM wipe on offboarding. Don't shelve a device until wipe-success is logged.\n\n## 5. Resolution / runbook\n**Procurement intake:**\n1. PO is created in finance system → IT receives notification.\n2. IT enters: serial, model, supplier, PO #, projected user, asset tag (next sequential).\n3. Device arrives → physical sticker applied → enrolled in MDM with tag attribute.\n4. State = \"In stock\" until assigned.\n\n**Assignment / deployment:**\n1. New hire ticket → pull next-available device matching role.\n2. Update register: state = \"Deployed\", user UPN, deployed-at timestamp.\n3. Asset transfers (user-to-user) require a ticket for audit.\n\n**Returns / offboarding:**\n1. Device returned to IT inbox → state = \"Returned\".\n2. Trigger MDM wipe → wait for confirmation.\n3. Hardware inspection: damage/missing keys/screen → state = \"In repair\" or \"Retired\".\n4. If usable → state = \"In stock\", ready for the next deployment.\n\n**Retirement / e-waste:**\n1. Device is end-of-life or beyond economic repair.\n2. Confirm wipe (NIST 800-88 destruction certificate for stored sensitive data).\n3. Log destruction certificate against the asset record.\n4. Send to certified e-waste vendor.\n5. State = \"Retired\" — never delete the record (audit trail).\n\n## 6. Verification\n- Random sample of 10 devices → CMDB record matches physical sticker matches MDM enrollment.\n- Refresh report — devices over policy age count = projected procurement budget.\n- Returns aging — no device sits in \"Returned\" >5 business days.\n- Audit log — no asset state change without a corresponding ticket.\n\n## 7. Escalation trigger\n- Lost / stolen device suspected → Security incident pathway, not asset cleanup. Run l3-security-001.\n- Audit gap >5% (unaccounted devices) → Pause procurement, run a fleet sweep.\n- Returned device with un-wiped sensitive data → Privacy incident.\n\n## 8. Prevention\n- Standardise on 1–3 device SKUs per role; resist the urge to one-off purchase.\n- Refresh budget reviewed quarterly with Finance.\n- Asset tag at receiving, not at deployment.\n- Auto-wipe on offboarding — never shelf without confirmation.\n- Quarterly reconciliation between Finance, MDM, and CMDB.\n\n## 9. User-friendly explanation\n\"Asset management is just keeping the list of company devices honest. We tag everything when it arrives, update the list when it gets used or returned, and confirm it's wiped before it's stored or thrown out. That keeps audits clean, keeps purchasing on schedule, and stops a stolen laptop from becoming a data breach.\"\n\n## 10. Internal technician notes\n- Intune: `Get-IntuneManagedDevice | Where-Object { $_.deviceCategoryDisplayName -eq $null }` finds untagged devices.\n- Custom attributes for asset tag are configured under `Devices → Configuration → Custom`.\n- For warehouses with bulk receiving, batch-enroll via Autopilot CSV upload then bulk-set tag attribute.\n- NIST 800-88 destruction certificate template should be attached to every Retired record — auditors ask for this.\n- Snipe-IT (open source) is the cheapest CMDB for SMBs <500 devices; ServiceNow / Jira Asset for larger.\n\n## 11. Related KB articles\n- l2-onboarding-001 — New user onboarding (where assignment is triggered).\n- l2-offboarding-001 — User offboarding (where wipe + return is triggered).\n- l2-deployment-001 — Image build / Autopilot.\n\n## 12. Keywords / search tags\nasset management, asset register, cmdb, itam, procurement, device refresh, hardware lifecycle, asset tag, serial number, depreciation, device retirement, e-waste, asset audit, snipe-it, lansweeper"
  },
  {
   "slug": "l2-azure-ad-001-conditional-access-block",
   "path_rel": "knowledge-base\\L2\\l2-azure-ad-001-conditional-access-block.md",
   "title": "\"Conditional Access blocking sign-in (AADSTS53003 / 53000)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-azure-ad-001\ntitle: \"Conditional Access blocking sign-in (AADSTS53003 / 53000)\"\ncategory: azure-ad\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: [\"Entra Conditional Access Administrator\", \"Sign-in Logs reader\"]\nkeywords:\n  - conditional access\n  - aadsts53003\n  - aadsts53000\n  - access blocked\n  - compliant device required\n  - mfa policy\n  - locations\n  - blocked by policy\nrelated_articles:\n  - l1-m365-001\n  - l2-intune-001\n  - l3-security-001\nescalation_trigger: \"Policy change required affecting >10 users, or break-glass account also blocked, or signs of token replay attack\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Conditional Access blocking sign-in\n\n## 1. Symptoms\n- AADSTS53003: \"Access has been blocked by Conditional Access policies.\"\n- AADSTS53000: \"Your device must be compliant.\"\n- AADSTS50158: \"External security challenge not satisfied.\"\n- Sign-in works on managed device, fails on personal device.\n- Sign-in works on corporate network, fails from home.\n\n## 2. Likely Causes\n1. Policy targets a group user shouldn't be in, or excludes a group they should be in.\n2. Device not joined / not compliant per Intune evaluation.\n3. Location-based block (country, IP).\n4. App targeting includes app user is signing in to.\n5. Session control (Sign-in frequency, persistent browser) tripping.\n6. New policy deployed in last 24h.\n\n## 3. Questions To Ask\n1. UPN, exact error code, timestamp, app, device name, source IP?\n2. Is device Azure AD joined / compliant per Intune?\n3. Is user in a CA-targeted or excluded group recently?\n4. Did any CA policy change in last 7 days (audit log)?\n\n## 4. Troubleshooting Steps\n1. Entra portal → Sign-in logs → filter by user + last 1h → click failed sign-in.\n2. Open \"Conditional Access\" tab on the failed sign-in → identify which policy enforced the block.\n3. Note \"Result\" column for each policy: Success, Failure, Not Applied, etc.\n4. Open the offending policy → review users, conditions (locations, devices), grant controls.\n\n## 5. Resolution Steps\n**Device not compliant:**\n- Have user open Company Portal → Check status. Resolve any flagged item (encryption, updates).\n- Or: temporarily exclude user from policy for break-fix; re-include after device fixed.\n\n**Policy misconfiguration (target/exclude wrong):**\n- Edit policy → Users → adjust group inclusion/exclusion.\n- Bring up CA \"What If\" tool to verify before save.\n\n**Location-based block (legitimate user travel):**\n- Add the user's country to a Trusted Locations or excluded location for the policy.\n\n**Break-glass scenario:**\n- Use the documented break-glass account (always excluded from all CA policies) to make the change.\n- After fix, audit-log the use.\n\n**Token theft suspicion:**\n- Revoke sessions: `Revoke-MgUserSignInSession -UserId <id>`.\n- Reset password.\n- Investigate sign-in logs for foreign IPs / devices.\n\n## 6. Verification Steps\n- User signs in successfully and CA tab on the success record shows policies = Success.\n- \"What If\" tool returns Allow for user/app/location combination.\n- No new failures in 24h.\n\n## 7. Escalation Trigger\n- Policy change must affect >10 users — coordinate with security team.\n- Break-glass account also failing.\n- Token theft / unusual locations across multiple users (incident).\n- → Escalate to **L3 / Security**.\n\n## 8. Prevention Tips\n- Always test new CA policies in Report-only mode for 1 week first.\n- Maintain at least two break-glass accounts (different MFA, MFA-excluded, monitored).\n- Document every policy's rationale.\n- Tag policies with owner.\n- Monthly policy review.\n\n## 9. User-Friendly Explanation\n\"A security rule blocked your sign-in because something didn't match what we require — usually it's that your device isn't checked in as managed, or you're in a place we don't expect you. We'll find which rule and fix it for you.\"\n\n## 10. Internal Technician Notes\n- \"What If\" tool: Entra → Conditional Access → What If — simulate user/app/IP/device and see policies that apply.\n- Sign-in log JSON: download for L3 forensics. Look at `conditionalAccessStatus`, `appliedConditionalAccessPolicies[]`.\n- Policy audit log: Entra → Audit logs → Service = Conditional Access. Tracks who changed what when.\n- Common AADSTS:\n  - 53003 — blocked by CA grant control.\n  - 53000 — device required compliant.\n  - 53002 — app must be approved client app.\n  - 50158 — external security challenge (e.g., MFA required by partner).\n- Authentication strength (FIDO2 / passkey only) policies: ensure user has registered the required strength method.\n\n## 11. Related KB Articles\n- l1-m365-001 — Can't sign in\n- l2-intune-001 — Device compliance not reporting\n- l3-security-001 — Identity incident response\n\n## 12. Keywords / Search Tags\nconditional access, aadsts53003, aadsts53000, access blocked, compliant device required, mfa policy, locations"
  },
  {
   "slug": "l2-bitlocker-001-recovery-key-retrieval",
   "path_rel": "knowledge-base\\L2\\l2-bitlocker-001-recovery-key-retrieval.md",
   "title": "\"BitLocker: recovery key retrieval and re-protection\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-bitlocker-001\ntitle: \"BitLocker: recovery key retrieval and re-protection\"\ncategory: bitlocker\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 20\naudience: admin\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: [\"Entra Cloud Device Administrator\", \"AD BitLocker recovery info read\"]\nkeywords:\n  - bitlocker\n  - recovery key\n  - recovery prompt\n  - tpm reset\n  - hardware change\n  - manage-bde\n  - protector\nrelated_articles:\n  - l1-windows-002\n  - l2-intune-001\nescalation_trigger: \"No recovery key in any directory; data may be unrecoverable. Or hardware platform regression after BIOS update.\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# BitLocker recovery key retrieval and re-protection\n\n## 1. Symptoms\n- \"Enter the recovery key for this drive\" prompt at boot.\n- After BIOS / firmware update, BitLocker triggered protection.\n- Disk swapped, board replaced, TPM cleared.\n- `manage-bde -status` shows protection ON but TPM protector missing.\n\n## 2. Likely Causes\n1. Hardware change broke TPM seal.\n2. Firmware / UEFI updated outside Microsoft-blessed path.\n3. Boot configuration changed (Secure Boot toggled).\n4. PCR values changed.\n5. Disk moved to another machine.\n6. Genuine encryption integrity event.\n\n## 3. Retrieving the recovery key\n**Cloud-joined (Azure AD / Entra) device:**\n- Entra portal → Devices → Devices → find device → Recovery keys (left blade).\n- User self-service: https://account.microsoft.com/devices/recoverykey (personal MS) or https://myaccount.microsoft.com/device-list (work).\n\n**Hybrid / AD-joined:**\n- ADUC (or RSAT) → Computer object → BitLocker Recovery tab → list of stored keys.\n- Or PowerShell: `Get-ADObject -Filter {ObjectClass -eq \"msFVE-RecoveryInformation\"} -SearchBase \"CN=<computer>,...\" -Properties msFVE-RecoveryPassword`.\n\n**Intune (cloud-managed):**\n- Endpoint Manager → Devices → device → Recovery keys.\n\n**Local backup:**\n- USB / printed copy created at encryption time (user kept it).\n\n## 4. Resolution / Re-Protection\n1. Boot using recovery key.\n2. After login, open admin Command Prompt:\n   ```\n   manage-bde -status C:\n   manage-bde -protectors -get C:\n   ```\n3. If TPM protector missing:\n   ```\n   manage-bde -protectors -delete C: -type RecoveryPassword\n   manage-bde -protectors -add C: -tpm\n   manage-bde -protectors -add C: -RecoveryPassword\n   manage-bde -protectors -get C:    # confirm new password\n   ```\n4. Force backup of new key to AAD/AD/Intune:\n   - For Intune-managed: `BitLocker.exe -BackupToAAD -Password <numeric ID>` (or the BackupToAD cmdlet); next sync uploads.\n\n## 5. Verification\n- `manage-bde -status` → TPM, Numerical Password, External Key (if used) listed.\n- New recovery key visible in directory of record.\n- Reboot completes without recovery prompt.\n\n## 6. Escalation Trigger\n- No recovery key anywhere — data unrecoverable; treat as a data-loss event.\n- Hardware regression after BIOS update repeats across fleet.\n- → Escalate to **L3** for fleet-wide remediation.\n\n## 7. Prevention\n- Always escrow keys to AAD/AD/Intune at encryption time. Verify by spot check.\n- Use Microsoft-blessed firmware update method (Dell Command Update, HP Manager, Lenovo Vantage) — many BIOS updates suspend BitLocker automatically.\n- Suspend BitLocker manually before risky firmware changes:\n  ```\n  manage-bde -protectors -disable C: -RebootCount 1\n  ```\n- Avoid Secure Boot toggling on encrypted disks.\n\n## 8. Internal Technician Notes\n- TPM PCRs that BitLocker measures (default): 0, 2, 4, 7, 11. PCR 7 (Secure Boot) is the usual culprit on firmware change.\n- For platforms that don't survive firmware updates clean, customize PCR profile via GPO/Intune (avoid PCR 7) — security trade-off.\n- For machine name change / hardware ID change, AAD device record may go stale; ensure single device record per physical machine.\n- For recovery key BackupToAAD failure, check `Microsoft-Windows-BitLocker-API/Management` event log.\n- Intune Encryption report + Endpoint security blade is the single pane of glass for fleet status.\n\n## 9. User-Friendly Explanation\n\"Your laptop's encryption was triggered to ask for the recovery key — usually because something at the firmware or hardware layer changed. We have your key on file, we'll unlock the drive, and then re-secure it so it doesn't ask again.\"\n\n## 11. Related KB Articles\n- l1-windows-002 — Won't boot / BitLocker prompt\n- l2-intune-001 — Intune compliance and encryption settings\n\n## 12. Keywords / Search Tags\nbitlocker, recovery key, recovery prompt, tpm reset, hardware change, manage-bde, protector"
  },
  {
   "slug": "l2-byod-001-bring-your-own-device",
   "path_rel": "knowledge-base\\L2\\l2-byod-001-bring-your-own-device.md",
   "title": "\"BYOD policy: app protection, conditional access, data containers\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-byod-001\ntitle: \"BYOD policy: app protection, conditional access, data containers\"\ncategory: byod\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: admin\nos_scope: [\"iOS\", \"Android\", \"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: [\"Intune\", \"Conditional Access\", \"App protection policies\"]\nkeywords:\n  - byod\n  - bring your own device\n  - personal device\n  - app protection\n  - mam\n  - mdm\n  - app wrap\n  - intune app policy\n  - data container\n  - work profile\n  - jamf\n  - work data wipe\nrelated_articles:\n  - l2-intune-001\n  - l2-azure-ad-001\n  - l1-mfa-001\nescalation_trigger: \"Personal device on shared corporate VPN with no MAM, or jailbroken/rooted device flagged in compliance\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# BYOD: secure access from personal devices\n\n## 1. Symptoms / triggers\n- New hire wants to use their personal MacBook / iPhone / Android.\n- Contractor requests email + Teams from their own laptop.\n- An exec asks why they can't access SharePoint on their tablet.\n- Audit flags personal devices accessing corporate SaaS without MAM.\n- A user reports their personal photos were \"deleted\" by IT (they weren't — work data was wiped).\n\n## 2. Likely causes\n1. No clear BYOD policy distinction between MAM (App-only) and MDM (Full-device).\n2. Conditional Access lets BYOD in but doesn't enforce app protection.\n3. User installed the work app outside the MAM-protected store flow.\n4. Old policy assumed MDM enrolment which deters most users.\n5. No data-loss-prevention container — copy/paste from Outlook to WhatsApp is unrestricted.\n\n## 3. Questions to ask\n1. Does your BYOD model permit MDM (full-device control) or only MAM (per-app control)?\n2. Is the device personal-and-occasional, or personal-and-primary work device?\n3. What apps must access corporate data — Outlook, Teams, OneDrive, custom LOB?\n4. Does the device meet baseline (encryption on, biometric lock, OS within N versions of latest)?\n5. Are you in a regulated industry (HIPAA / PCI / GDPR) — that changes the answer.\n\n## 4. Triage rules / decision tree\n1. **MAM-only is the default** for personal devices. Don't enrol the personal device in MDM unless the user agrees in writing — otherwise privacy complaints follow.\n2. **Conditional Access enforces** — block any sign-in to corporate apps from personal devices that aren't MAM-protected.\n3. **Lost / stolen → selective wipe** of work data only. Personal photos and family memories untouched.\n4. **Compromise → revoke**, don't try to fix on the device.\n\n## 5. Resolution / setup playbook\n**MAM (App protection) — recommended default for BYOD:**\n1. Intune → App protection policies → Create for iOS + Android.\n2. Apply to: Outlook, Teams, OneDrive, Word, Excel, PowerPoint, Edge.\n3. Settings: PIN required, encrypt org data, block backup to personal cloud, block copy-out, app data wipe after 90 days offline.\n4. Apply only to BYOD enrolment (don't double-apply to corporate-owned devices that already have MDM).\n5. Conditional Access policy: require app-protection compliance for these apps when sign-in is from a personal device.\n\n**MDM (full-device, opt-in) — for users who want all apps:**\n1. Intune Company Portal → enrol personal device.\n2. Compliance policy: encryption required, OS minimum version, biometric lock, no jailbreak/root.\n3. Apple Business Manager (iOS) → User-enrolment splits user vs. work data containers.\n4. Android → Work Profile (Android Enterprise).\n\n**Wipe playbook:**\n- Selective wipe (data only) — Intune → Devices → Wipe → \"Retain enrolment, remove company data\".\n- Full wipe (MDM only, with user consent) — Intune → Wipe → factory reset.\n- Confirm wipe-success before closing the ticket.\n\n## 6. Verification\n- Pilot user can read corporate email but cannot copy a body into a personal WhatsApp.\n- Conditional Access logs show \"Compliant: Yes (App Protection)\" for managed-app sign-ins.\n- Personal apps (camera, browser, banking) function normally with no IT visibility.\n- Selective-wipe test: removes only work data, personal data intact.\n\n## 7. Escalation trigger\n- Compliance audit reveals corporate data accessed from non-MAM devices → Block immediately, pivot to remediation.\n- User refuses MAM → grant a corporate-owned loaner; do not lower the bar.\n- Regulated data (PHI / PCI) leaves the container → Privacy / legal escalation, not just IT.\n\n## 8. Prevention\n- Publish the BYOD policy in the employee handbook (one page, plain English).\n- Onboarding includes a 5-minute video: \"What IT can and cannot see on your personal device.\"\n- Enforce by Conditional Access — don't rely on user goodwill.\n- Quarterly review of the device-compliance dashboard.\n- Make MAM enrolment self-serve: user opens Outlook on their phone, gets prompted, follows wizard, done.\n\n## 9. User-friendly explanation\n\"BYOD means you can use your own phone or laptop for work, but only the work apps are protected by IT — your personal photos, contacts, and apps stay private. If your phone is ever lost or you leave the company, IT can wipe just the work data without touching anything personal. The trade is: while you're here, you have to put a PIN on the work apps, and we'll block copy-paste from work to personal apps so company data doesn't accidentally get out.\"\n\n## 10. Internal technician notes\n- Intune App Protection settings catalog: avoid \"Block all keyboards except Microsoft\" unless the org actually uses SwiftKey enterprise — it's a common usability complaint.\n- For Android, the pre-installed Microsoft Authenticator handles MAM enrolment cleanly. For iOS, the Microsoft Intune Company Portal app is required (not the Authenticator).\n- Apple User Enrolment (iOS 13+) is the cleanest split — Apple ID for personal stays user's, Managed Apple ID provisioned for work.\n- For macOS BYOD, Jamf with User Approved MDM works but is heavier than App Protection on iOS — consider declining MDM on personal Macs and require corporate-owned for power users.\n- Conditional Access excluded apps: be explicit. Excluding \"Browser\" from app-protection policy lets users access OWA in any browser, which defeats the policy.\n- For PCI / HIPAA / regulated tenants, default-deny BYOD and require corporate-owned. The MAM-only path is for moderate compliance regimes.\n\n## 11. Related KB articles\n- l2-intune-001 — Intune device compliance.\n- l2-azure-ad-001 — Conditional Access.\n- l1-mfa-001 — MFA setup.\n\n## 12. Keywords / search tags\nbyod, bring your own device, personal device, app protection, mam, mdm, app wrap, intune app policy, data container, work profile, jamf, work data wipe, selective wipe, user enrolment"
  },
  {
   "slug": "l2-deployment-001-image-build",
   "path_rel": "knowledge-base\\L2\\l2-deployment-001-image-build.md",
   "title": "\"Device deployment: Autopilot, image hygiene, app rings\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-deployment-001\ntitle: \"Device deployment: Autopilot, image hygiene, app rings\"\ncategory: deployment\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 45\naudience: admin\nprerequisites: [\"Intune\", \"Endpoint Manager\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - deployment\n  - autopilot\n  - oobe\n  - app rings\n  - configuration profiles\n  - device images\n  - white glove\nrelated_articles:\n  - l2-onboarding-001\n  - l2-intune-001\nescalation_trigger: \"Pilot fails wide rollout, or Autopilot service incident, or compliance gap on deployment\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Device deployment lifecycle\n\n## 1. Approach\n- **Autopilot user-driven** for general fleet — user runs OOBE, Autopilot configures.\n- **Pre-provisioning (white glove)** for high-touch — IT runs first phase, user finishes from anywhere.\n- No traditional imaging (avoid MDT/SCCM OS imaging unless legacy reason).\n\n## 2. Setup\n1. Vendor uploads hardware hashes to Autopilot at procurement.\n2. Profile (Deployment profile): user-driven, named org, Azure AD join, locale.\n3. ESP profile: required apps + timeout (60 min default).\n4. Compliance + Configuration profiles assigned to dynamic device group filtering by Autopilot tag.\n5. App ring: Pilot (1%) → Wave 1 (10%) → Wave 2 (50%) → All.\n\n## 3. Verification on deployment\n- Device enrolls, runs ESP, completes in <60 min.\n- Compliance Yes within 24h.\n- All required apps present.\n- User-facing: Outlook signed in, OneDrive synced, Teams signed in, browser homed correctly.\n\n## 4. Quality gates\n- Define KPIs: mean time to ready, deployment success rate, # of in-flight failures.\n- Track via Endpoint analytics + Intune reports.\n- Failures auto-page on-call.\n\n## 5. Escalation\n- Autopilot service incident — Microsoft.\n- Mass enrollment failure — L3 + Microsoft case.\n- Pilot regression — pause wave, investigate.\n\n## 6. Prevention / Quality\n- Maintain golden config, version-controlled.\n- Don't push experimental apps to broad ring.\n- Pilot drivers + Windows Updates separately from app changes.\n- Test on every model in active fleet quarterly.\n\n## 7. Notes\n- For Win11 24H2+ Autopilot device preparation phase replaces ESP for some scenarios.\n- Use `Get-WindowsAutopilotInfo -Online` at procurement for any unmanaged stock.\n- For shared devices (kiosks), Shared PC mode + Autopilot self-deploying mode.\n- For user state migration, OneDrive Known Folder Move handles 95% of cases — no USMT needed.\n\n## 8. Related\n- l2-intune-001 — Compliance + enrollment\n- l2-onboarding-001 — User onboarding flow\n\n## 9. Keywords\ndeployment, autopilot, oobe, app rings, configuration profiles, device images, white glove"
  },
  {
   "slug": "l2-device-001-laptop-replacement-migration",
   "path_rel": "knowledge-base\\L2\\l2-device-001-laptop-replacement-migration.md",
   "title": "\"Laptop replacement / refresh: migrate a user to a new device with no data loss\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-device-001\ntitle: \"Laptop replacement / refresh: migrate a user to a new device with no data loss\"\ncategory: device-lifecycle\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 90\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: [\"Replacement device available\", \"User's data is in OneDrive/known-folder-redirected or backed up\", \"Intune/Autopilot for corporate devices\"]\nkeywords:\n  - laptop replacement\n  - device refresh\n  - new laptop migration\n  - move to new computer\n  - data migration\n  - hardware swap\n  - device refresh runbook\n  - transfer files new pc\n  - decommission old laptop\nrelated_articles:\n  - l1-newdevice-001\n  - l2-intune-002\n  - l2-offboarding-001\nescalation_trigger: \"Bulk fleet refresh / imaging program design, or recovery of data that exists only on a failed local disk — data-recovery vendor / L3 program work.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# Laptop replacement / refresh — migrate with no data loss\n\n## 1. Symptoms / Requests\n- \"My laptop is being replaced — move everything over.\"\n- Scheduled hardware refresh (lease end / 3–5 year lifecycle).\n- Device failing (battery, performance, damage) and needs swapping.\n- New hire was issued the wrong/temporary device and needs the standard build.\n\n## 2. Goal / Definition of Done\n1. User signed in on the new device with all apps, mail, and files.\n2. **Zero data loss** — everything previously on the old device is accessible on the new one (ideally because it was in OneDrive/SharePoint all along).\n3. Old device wiped, unenrolled, and returned/decommissioned.\n4. Asset records updated.\n\n## 3. Pre-Migration Questions / Checklist\n1. What's on the old device that is **only local** (Desktop/Documents not redirected, local PSTs, app data, certificates, browser profiles, line-of-business app local databases)?\n2. Is **OneDrive Known Folder Move** active (Desktop/Documents/Pictures already in the cloud)?\n3. Any **encryption** (BitLocker/FileVault) — do we have the recovery key before touching the disk?\n4. Specialized software / licenses / hardware dongles to re-activate?\n5. Local admin or saved credentials the user will need re-established?\n6. Is the new device corporate (Autopilot) or a manual build?\n\n## 4. Migration Steps\n**A) Capture what's only local (before anything):**\n1. Confirm/turn on **OneDrive Known Folder Move** on the old device and let Desktop/Documents/Pictures finish syncing (status = green check).\n2. Identify and back up genuinely local items: local **PSTs**, browser bookmarks/profiles (or rely on Edge/Chrome profile sync), app config, signed **certificates** (export if needed), local LOB app data.\n3. Verify the **BitLocker/FileVault recovery key** is escrowed in Entra ID/Intune (do not wipe until confirmed).\n\n**B) Prepare the new device:**\n1. Corporate Windows: run **Autopilot** OOBE → user signs in → device enrolls and applies policy/apps (see l2-intune-002).\n2. Manual build: enroll into Intune, sign in with the work account so Entra join + MDM apply.\n3. Let **assigned apps** install; install any specialized software not delivered by Intune.\n\n**C) Restore the user's data & settings:**\n1. Sign the user into **OneDrive** on the new device — Desktop/Documents/Pictures rehydrate automatically (the big win of KFM).\n2. Outlook: add the work account; it rebuilds the OST from Exchange Online. Re-import any local **PST** archives, or move them to Online Archive.\n3. Re-map network drives (l2-fileshare-001), reconnect printers, restore browser profile (sign in to sync).\n4. Re-activate licensed apps / re-pair hardware dongles.\n\n**D) Validate with the user:**\n1. Have the **user** confirm they can open their key files, send/receive mail, reach their apps and shares, and print — before the old device leaves their hands.\n\n**E) Decommission the old device:**\n1. In Intune: confirm the new device is healthy, then **Retire/Wipe** the old device and delete its Entra/Intune records.\n2. Wipe local disk per policy (BitLocker already protects data; a remote **Wipe** or reset clears it). For disposal, follow the data-sanitization standard.\n3. Collect the device; update the **asset management** record (l2-asset-management is the lifecycle reference).\n\n## 5. Resolution Notes by Scenario\n- **Old device still works:** ideal — sync everything first, validate on new, then wipe. This is the no-loss path.\n- **Old device dead/won't boot but disk OK:** pull data via a USB enclosure or boot media before wipe; if encrypted, you need the recovery key.\n- **Disk failed / no backup and not in OneDrive:** data may be unrecoverable without a data-recovery vendor — set expectations honestly and escalate.\n\n## 6. Verification Steps\n- User opens a sample of their **own** Desktop/Documents files on the new device.\n- Outlook shows full mail; calendar and contacts present.\n- Network drives, printers, and required apps all work for the user.\n- Old device shows **Retired/Wiped** in Intune and is removed from Entra ID.\n- Asset record reflects the new serial assigned to the user and the old one as returned/disposed.\n\n## 7. Escalation Trigger\n- Data exists **only** on a failed local disk → data-recovery vendor.\n- Large/bulk refresh needing an imaging/Autopilot program design → L3 deployment.\n- Specialized LOB app migration that vendor support must perform.\n\n## 8. Prevention Tips\n- Enforce **OneDrive Known Folder Move** fleet-wide so a laptop swap is near-instant and lossless by default.\n- Discourage local PSTs and local-only data; standardize on SharePoint/OneDrive + Online Archive.\n- Ensure **BitLocker/FileVault keys escrow** automatically to Entra ID/Intune at enrollment.\n- Use **Autopilot** so replacement builds are hands-off and consistent.\n- Keep asset records current so refresh cycles are planned, not reactive.\n\n## 9. User-Friendly Explanation\n\"Because your files live in OneDrive and your email lives in the cloud, moving to a new laptop is mostly a sign-in: we set up the new machine, you log in, and your Desktop, Documents, and email come right back. We'll check together that everything you need is there before we take the old laptop — and only then do we securely wipe it. The main things we hand-carry are anything saved only on the old machine, so tell us about any files you keep locally.\"\n\n## 10. Internal Technician Notes\n- KFM (Known Folder Move) is the single highest-leverage control for painless refreshes — verify it's actually on, not just assigned.\n- Don't trust \"it's all in OneDrive\" — check for local PSTs (`%LOCALAPPDATA%\\Microsoft\\Outlook`), `C:\\` working folders, and app-local data (e.g., AppData) that KFM doesn't cover.\n- Confirm BitLocker key escrow in Entra ID before any wipe; a wipe without the key = unrecoverable.\n- Edge/Chrome profile sign-in restores bookmarks/passwords/extensions — faster than manual export.\n- For Autopilot, pre-stage the new device's hardware hash + profile so OOBE is hands-off; otherwise it falls back to manual enroll.\n- Retire vs. Wipe in Intune: Retire removes company data/management (BYOD-friendly); Wipe factory-resets (corporate disposal). Choose per ownership.\n\n## 11. Related KB Articles\n- l1-newdevice-001 — New laptop first boot\n- l2-intune-002 — Device enrollment\n- l2-offboarding-001 — Exit / device return process\n\n## 12. Keywords / Search Tags\nlaptop replacement, device refresh, new laptop migration, move to new computer, data migration, hardware swap, device refresh runbook, transfer files new pc, decommission old laptop, known folder move, autopilot, bitlocker key escrow, retire vs wipe"
  },
  {
   "slug": "l2-dhcp-001-scope-exhaustion",
   "path_rel": "knowledge-base\\L2\\l2-dhcp-001-scope-exhaustion.md",
   "title": "\"DHCP scope exhaustion / clients getting APIPA / lease conflicts\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-dhcp-001\ntitle: \"DHCP scope exhaustion / clients getting APIPA / lease conflicts\"\ncategory: dhcp\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 25\naudience: admin\nprerequisites: [\"DHCP server admin\"]\nos_scope: [\"Windows Server 2016+\"]\nkeywords:\n  - dhcp\n  - apipa\n  - 169.254\n  - scope exhaustion\n  - lease\n  - reservation\n  - failover\n  - rogue dhcp\nrelated_articles:\n  - l1-wifi-001\n  - l2-dns-001\nescalation_trigger: \"Rogue DHCP detected, or fleet IP conflicts, or scope cannot be expanded due to subnet limits\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# DHCP scope exhaustion / lease issues\n\n## 1. Symptoms\n- Clients receiving 169.254.x.x (APIPA).\n- \"IP address conflict\" notifications.\n- New devices cannot obtain IP.\n- Lease pool ~95% utilized.\n- Rogue DHCP suspected (unexpected gateway returned).\n\n## 2. Causes\n1. Pool too small for number of devices (BYOD growth).\n2. Lease duration too long → expired devices still hold IPs.\n3. Rogue DHCP on subnet (consumer router plugged in).\n4. DHCP failover misconfigured.\n5. DHCP guard not enabled on switches.\n6. Reservations conflict with dynamic range.\n\n## 3. Resolution\n**Scope expansion:**\n- Subnet has room → extend scope range.\n- Subnet maxed → re-architect to /23 or new VLAN.\n\n**Lease duration:**\n- Reduce from 8 days to 1–4 days for high-churn networks (BYOD, guest).\n\n**Rogue DHCP:**\n- `Get-DhcpServerInDC` (authorized servers).\n- Network capture (`tcpdump port 67 or port 68`) on subnet to see who else is offering leases.\n- Locate by MAC → switch port → physical disconnect.\n- Enable DHCP Snooping on switches.\n\n**Failover health:**\n- `Get-DhcpServerv4Failover` — state should be \"Normal\".\n- Re-sync if \"Recover\" / \"Communication Interrupted\".\n\n## 4. Verification\n- New client gets valid IP within seconds.\n- Pool utilization drops below 70%.\n- No 169.254 reports.\n- Failover state Normal.\n\n## 5. Escalation Trigger\n- Rogue DHCP source can't be located.\n- Subnet cannot expand (legacy hardcoded).\n- Persistent IP conflicts after lease cycle.\n- → Escalate to **L3 / Network Architecture**.\n\n## 6. Prevention\n- Right-size scope: total devices × 1.5.\n- Lease 1–2 days for laptops, 4–8 for static-ish desktops.\n- DHCP Snooping + IP Source Guard on switches.\n- Document reservations.\n- Monitor scope utilization >70% as warning.\n\n## 7. Internal Notes\n- DHCP failover modes: load-balance (50/50) vs hot-standby. Hot-standby simpler for small estates.\n- Stats: `Get-DhcpServerv4ScopeStatistics`.\n- Rogue detection (Windows): DHCP service refuses to start if not authorized in AD.\n- For IPv6 scopes, use SLAAC + DHCPv6 thoughtfully — many clients use SLAAC by default.\n\n## 8. Related Articles\n- l1-wifi-001 — Client APIPA symptom\n- l2-dns-001 — DNS often co-located with DHCP\n\n## 9. Keywords\ndhcp, apipa, 169.254, scope exhaustion, lease, reservation, failover, rogue dhcp"
  },
  {
   "slug": "l2-dns-001-internal-resolution",
   "path_rel": "knowledge-base\\L2\\l2-dns-001-internal-resolution.md",
   "title": "\"DNS: internal name resolution failing / split-brain issues\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-dns-001\ntitle: \"DNS: internal name resolution failing / split-brain issues\"\ncategory: dns\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"DNS server admin\", \"AD permissions\"]\nos_scope: [\"Windows Server 2016+\"]\nkeywords:\n  - dns\n  - name resolution\n  - split brain\n  - conditional forwarder\n  - stub zone\n  - dns scavenging\n  - srv records\n  - aging\nrelated_articles:\n  - l1-wifi-001\n  - l3-networking-001\n  - l2-active-directory-001\nescalation_trigger: \"Replication failure, root hint corruption, or DNS poisoning suspected\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# DNS: internal name resolution failing\n\n## 1. Symptoms\n- Internal hostname doesn't resolve from clients but pings by IP works.\n- External DNS works, internal doesn't (split-brain mismatch).\n- DCs cannot replicate (DNS is foundational).\n- Stale records causing wrong-host responses.\n- Long resolution times (>2s for internal).\n\n## 2. Common Causes\n1. Client using public DNS (8.8.8.8) instead of internal DC DNS.\n2. Conditional forwarder missing or pointing to dead IP.\n3. Aging/scavenging mis-configured → stale or missing records.\n4. Replication broken between DCs.\n5. _msdcs zone delegation broken.\n6. DNS service not running on DC.\n\n## 3. Diagnosis\n1. On client: `ipconfig /all` — confirm DNS servers point to internal DCs.\n2. `nslookup <internal-host>` — check authoritative response.\n3. `nslookup _ldap._tcp.dc._msdcs.<domain>` — should list DCs.\n4. On DC: `dcdiag /test:dns /v` — comprehensive DNS health.\n5. `Get-DnsServer | fl` and check zones.\n6. `repadmin /replsummary` — replication health.\n\n## 4. Resolution Pathways\n**Client mis-configured:**\n- DHCP scope must hand out internal DNS only (not public). Update scope.\n- Static-IP devices: correct manually.\n\n**Conditional forwarder broken:**\n- DNS Manager → forward lookup zones → adjust forwarders / conditional forwarders.\n\n**Stale records:**\n- Enable aging on relevant zones (Properties → Aging, no-refresh 7 / refresh 7).\n- Run scavenging once cleanly.\n\n**Replication:**\n- `repadmin /syncall /A /e /P` — force replication.\n- `dcdiag /test:replications` to identify lag/source.\n\n**Service down:**\n- `Restart-Service DNS` — confirm event log clean after.\n\n**_msdcs delegation:**\n- Verify _msdcs zone exists, delegated, replicated to all DCs in forest.\n\n## 5. Verification\n- `nslookup` returns correct results from clients.\n- `dcdiag /test:dns` clean.\n- `repadmin /replsummary` no errors.\n- 24h with no DNS-related ticket.\n\n## 6. Escalation Trigger\n- Replication failure persists after sync attempts.\n- Suspected DNS poisoning (wrong answers from authoritative).\n- Forest-wide DNS outage.\n- → Escalate to **L3 / Architecture**.\n\n## 7. Prevention\n- Always point AD-joined clients to AD-integrated DNS (DCs), never to public.\n- Enable aging on all dynamic zones; run scavenging weekly.\n- Monitor DNS event log + replication daily.\n- Document forwarders, conditional forwarders, secondary zones.\n- Don't expose internal DNS to internet.\n\n## 8. Internal Notes\n- AD-integrated zones replicate via AD; non-integrated zones via DNS NOTIFY/AXFR.\n- `dnscmd /info /version` shows DNS server version + flags.\n- `Get-DnsServerStatistics` for performance.\n- For conditional forwarders, store-in-AD makes them replicate; otherwise per-DC.\n- For Azure private zones / hybrid scenarios, use Azure DNS Private Resolver as the conduit.\n\n## 9. Related Articles\n- l1-wifi-001 — Client-side DNS issues\n- l2-active-directory-001 — AD foundational\n- l3-networking-001 — Architecture\n\n## 10. Keywords\ndns, name resolution, split brain, conditional forwarder, stub zone, dns scavenging, srv records, aging"
  },
  {
   "slug": "l2-drivers-001-driver-rollback",
   "path_rel": "knowledge-base\\L2\\l2-drivers-001-driver-rollback.md",
   "title": "\"Driver rollback / WHQL gating / fleet driver management\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-drivers-001\ntitle: \"Driver rollback / WHQL gating / fleet driver management\"\ncategory: drivers\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 20\naudience: admin\nprerequisites: [\"Intune / Endpoint Manager admin\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - driver\n  - rollback\n  - whql\n  - intune driver\n  - autopatch\n  - oem driver\n  - windows update for business\nrelated_articles:\n  - l1-windows-001\n  - l1-windows-005\n  - l2-intune-001\nescalation_trigger: \"Bad driver hits >5% of fleet, or BSOD pattern after Windows Update, or vendor regression\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Driver management at fleet scale\n\n## 1. Symptoms\n- Many devices BSOD after recent Windows update.\n- Specific device family (laptop model) hits same crash signature.\n- Wireless / display / audio regression after driver push.\n- Optional driver auto-applied causing instability.\n\n## 2. Resolution\n**Pause the bad driver:**\n- Intune → Devices → Windows → Windows Updates → Quality update profile → Pause for 7 days.\n- Or for driver specifically: WUFB driver policy → Pause specific driver.\n\n**Roll back per-device (urgent):**\n- Device Manager → device → Properties → Driver → Roll Back Driver.\n- Or `pnputil /enum-drivers` → identify package → `pnputil /delete-driver oem##.inf /uninstall /force`.\n\n**Block driver fleet-wide:**\n- Microsoft Update Catalog → identify driver INF + version.\n- Intune driver update policy → exclude / block.\n\n**Pin to known-good:**\n- Use OEM tooling (Dell Command Update / HP Image Assistant / Lenovo System Update) integrated with Intune for vendor-blessed driver bundles.\n\n## 3. Verification\n- BSOD telemetry from MDE drops.\n- Affected models stable for 24h.\n- WUFB compliance reports policy in effect.\n\n## 4. Escalation\n- Vendor regression — open case with OEM.\n- Microsoft known-issue page for the update.\n- → L3 + vendor.\n\n## 5. Prevention\n- Rings: pilot 1% → broad 25% → fleet 100%, with 3-day soak between rings.\n- Use Windows Autopatch where possible.\n- Don't enable \"Optional updates\" on managed devices.\n- Maintain a driver baseline per device model.\n- Subscribe to OEM advisories.\n\n## 6. Notes\n- Optional drivers historically caused most regressions.\n- For Surface fleet, Surface Driver Update tool is canonical.\n- WHQL signing isn't a guarantee of stability — only of basic compatibility.\n- For Win11 24H2+, driver telemetry surfacing in Intune is more granular.\n\n## 7. Related\n- l1-windows-001 — BSOD user-facing\n- l2-intune-001 — Intune compliance\n\n## 8. Keywords\ndriver, rollback, whql, intune driver, autopatch, oem driver, windows update for business"
  },
  {
   "slug": "l2-endpoint-001-defender-asr",
   "path_rel": "knowledge-base\\L2\\l2-endpoint-001-defender-asr.md",
   "title": "\"Defender ASR rules / Attack Surface Reduction tuning\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-endpoint-001\ntitle: \"Defender ASR rules / Attack Surface Reduction tuning\"\ncategory: endpoint\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"Defender for Endpoint admin\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - asr\n  - attack surface reduction\n  - defender\n  - block office macros\n  - block credential stealing\n  - audit mode\n  - rule guid\nrelated_articles:\n  - l2-malware-001\n  - l3-security-001\nescalation_trigger: \"Mass block on legitimate business app or ASR rule conflict with business workflow\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Defender ASR rules\n\n## 1. Goals\nASR rules block exploit techniques without breaking apps. Use Audit mode first, Block mode after tuning.\n\n## 2. High-value rules to enable\n- Block credential stealing from LSASS.\n- Block Office apps from creating child processes.\n- Block Office macros from internet origin.\n- Block all Office apps from injecting code into other processes.\n- Block executable content from email/webmail.\n- Block Adobe Reader from creating child processes.\n- Use advanced protection against ransomware.\n\n## 3. Deploy\n- Intune → Endpoint security → Attack surface reduction → ASR Rules profile.\n- Set each rule: Audit / Block / Warn / Off.\n- Pilot Audit on all → review in MDE → Block in waves.\n\n## 4. Investigate alerts\n- MDE → Alerts → filter \"ASR\".\n- Review process tree, parent, command line.\n- If legitimate app blocked: add file/path/folder exclusion via ASR rules profile.\n- Don't disable rule globally to fix one app.\n\n## 5. Verification\n- Rule in Block mode and report shows expected blocks.\n- No business-app regression after 7d.\n- Alerts triaged, exclusions documented.\n\n## 6. Escalation\n- Mass block on critical line-of-business app.\n- ASR conflict with EDR vendor (if 3rd party).\n- → L3.\n\n## 7. Prevention\n- Always Audit-first, 30-day soak.\n- Document why each rule is on, exceptions, owner.\n- Review exclusions quarterly.\n- Don't blanket-disable.\n\n## 8. Notes\n- Rule GUIDs published by Microsoft; necessary for advanced hunting.\n- Some rules need Defender AV active (not 3rd-party).\n- Tamper Protection on prevents users / malware from disabling.\n- \"Warn\" mode lets user override once — use sparingly.\n\n## 9. Related\n- l2-malware-001 — Triage\n- l3-security-001 — IR runbook\n\n## 10. Keywords\nasr, attack surface reduction, defender, block office macros, block credential stealing, audit mode, rule guid"
  },
  {
   "slug": "l2-exchange-001-mail-flow",
   "path_rel": "knowledge-base\\L2\\l2-exchange-001-mail-flow.md",
   "title": "\"Exchange Online: mail flow troubleshooting / NDR analysis\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-exchange-001\ntitle: \"Exchange Online: mail flow troubleshooting / NDR analysis\"\ncategory: exchange\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"Exchange Online Admin\"]\nos_scope: [\"Exchange Online\"]\nkeywords:\n  - mail flow\n  - ndr\n  - bounce\n  - 5.7.x\n  - message trace\n  - dkim\n  - spf\n  - dmarc\n  - connector\nrelated_articles:\n  - l1-outlook-001\n  - l1-outlook-002\n  - l1-email-001\nescalation_trigger: \"Tenant-wide mail flow outage, or domain reputation block, or DMARC enforcement failure\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Exchange Online mail flow\n\n## 1. Diagnosis\n**Message trace:**\n- Exchange Admin Center → Mail flow → Message trace.\n- Recipient + date range → click traced message → see hop-by-hop.\n- Status: Delivered, Filtered as spam, Failed, Pending, Expanded.\n\n**For inbound from external:**\n- Check anti-spam / anti-malware policies (Defender for O365).\n- Check connectors (especially partner orgs with hybrid).\n\n**For outbound to external:**\n- DKIM signed: Defender → Policies → DKIM → enabled per domain.\n- SPF record correct in DNS: `v=spf1 include:spf.protection.outlook.com -all`.\n- DMARC published, enforcement level matches readiness.\n\n## 2. Common NDR codes\n| Code | Meaning | Fix |\n|---|---|---|\n| 5.0.0 | Generic delivery failure | Check trace |\n| 5.1.1 | Recipient unknown | Verify address |\n| 5.1.10 | Recipient unknown to org's relay | Verify alias |\n| 5.2.2 | Mailbox full | Recipient quota |\n| 5.4.1 | Relay denied | Connector / auth issue |\n| 5.4.6 | Hop count exceeded | Loop in routing |\n| 5.7.1 | Recipient blocks sender | Domain reputation / policy |\n| 5.7.135 | Tenant policy block | Anti-spam / quarantine |\n| 5.7.230 | Spam-detected outbound | Sender remediation |\n| 5.7.708 | Service-level outbound block | Microsoft escalation |\n\n## 3. Resolution Pathways\n**5.7.135 / 5.7.708 (outbound block):**\n- Check user's compromised state (cred theft → spam from account).\n- Reset password, revoke sessions, scan device.\n- Submit to Microsoft if false-positive; Defender → Submissions.\n\n**Connector misconfig (hybrid):**\n- Test with `Test-OutlookConnectivity` and partner connector authentication.\n- Verify TLS cert on connector.\n\n**Domain reputation:**\n- Check sender reputation: Microsoft Sender Insights (smtpguru.com / Talos / Talos Reputation).\n- Resolve cause, request delisting if external block lists.\n\n## 4. Verification\n- Test send to external (Gmail/Yahoo/Outlook.com) lands in inbox, not spam.\n- Test send from external lands inbox.\n- DKIM/SPF/DMARC pass per `Authentication-Results` header.\n\n## 5. Escalation\n- Tenant-wide block from Microsoft (5.7.708 mass).\n- Domain on RBL (Spamhaus, etc.).\n- Persistent reputation issues → Microsoft + L3.\n\n## 6. Prevention\n- Implement DMARC progressively: monitor → quarantine → reject.\n- DKIM both selectors enabled.\n- Don't send bulk from regular mailbox; use SendGrid / Postmark.\n- Monitor outbound spam alerts.\n- User awareness on account compromise.\n\n## 7. Notes\n- Defender for O365 quarantine: users can self-release low-confidence; admins for high-confidence.\n- Hybrid connectors: cert auth preferred over IP-based.\n- Mass mailers should use dedicated subdomain (`marketing.company.com`) so reputation hit doesn't affect main domain.\n\n## 8. Related\n- l1-outlook-001 — User not receiving\n- l1-outlook-002 — User can't send\n- l1-email-001 — Phishing reports\n\n## 9. Keywords\nmail flow, ndr, bounce, 5.7.x, message trace, dkim, spf, dmarc, connector"
  },
  {
   "slug": "l2-fileshare-001-mapped-drive-sync",
   "path_rel": "knowledge-base\\L2\\l2-fileshare-001-mapped-drive-sync.md",
   "title": "\"Shared / mapped network drive won't sync, keeps disconnecting, or shows stale files\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-fileshare-001\ntitle: \"Shared / mapped network drive won't sync, keeps disconnecting, or shows stale files\"\ncategory: fileshare\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: [\"User account has share/NTFS permissions\", \"Connectivity to the file server / DFS namespace\"]\nkeywords:\n  - mapped drive disconnected\n  - network drive not syncing\n  - shared drive missing\n  - red x on mapped drive\n  - offline files stuck\n  - dfs not updating\n  - drive letter gone\n  - shared folder out of date\n  - reconnect at logon\nrelated_articles:\n  - l1-onedrive-001\n  - l2-permissions-001\n  - l2-dns-001\nescalation_trigger: \"Many users lose the same share at once, DFS namespace/referral failures, or file-server SMB/replication (DFS-R) backlog — that is a server/infrastructure (L3) problem.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# Shared / mapped network drive not syncing or disconnecting\n\n## 1. Symptoms\n- A mapped drive (e.g., `S:`) shows a **red X** or \"Disconnected Network Drive\" and needs a click to reconnect.\n- Files on the share look out of date; a colleague's changes don't appear until a refresh or reboot.\n- \"An error occurred while reconnecting… The local device name is already in use.\"\n- Offline Files shows conflicts or sits \"working offline\" when actually online.\n- The drive letter disappears after sleep, VPN reconnect, or logon.\n\n## 2. Likely Causes\n1. **The red X is cosmetic** — Windows shows drives as disconnected until first access; they reconnect on click. Often not a real fault.\n2. **Credentials don't persist** — saved credential mismatch, or the share is on a different domain/realm.\n3. **VPN/network not up at logon**, so \"Reconnect at sign-in\" fails before the tunnel is ready.\n4. **SMB session drop** from idle timeout, flaky Wi-Fi, or power management on the NIC.\n5. **Offline Files (CSC) cache** is stale or corrupt, showing old content / stuck conflicts.\n6. **DFS namespace** pointing the client at a down or far replica; referral cache stale.\n7. **Drive-letter collision** — the letter is already used by another mapping or a USB device.\n8. **Name resolution** — DNS/NetBIOS can't resolve the server name (works by IP, not by name).\n\n## 3. Questions To Ask User\n1. Is it one share or all network drives?\n2. Does it affect just you, or your whole team/floor?\n3. Are you on VPN / remote, or in the office wired?\n4. Does double-clicking the drive reconnect it (cosmetic red X), or does it error?\n5. \"Stale files\" — do you see a colleague's edits after pressing F5 / reopening?\n6. Did it start after a password change, new laptop, or moving offices?\n\n## 4. Troubleshooting Steps\n1. **Double-click the drive.** If it opens fine, the red X was cosmetic — explain and move on.\n2. **Resolve the server by name:** `ping servername` and `nslookup servername`. If name fails but IP works, it's DNS (→ §5 / l2-dns-001).\n3. **List current sessions:** `net use` shows mapped drives and their status; `klist` shows Kerberos tickets.\n4. **Test the raw path:** open `\\\\server\\share` in Explorer directly. If the UNC works but the mapped letter doesn't, it's the mapping/credentials.\n5. **Check VPN timing** for remote users — does the drive work after a manual reconnect post-VPN?\n6. **Check Offline Files** status: Control Panel → Sync Center → Manage offline files.\n\n## 5. Resolution Steps\n**Re-create the mapping cleanly:**\n1. `net use S: /delete` (or remove the mapping in Explorer).\n2. `net use S: \\\\server\\share /persistent:yes` — supply correct credentials if prompted; tick \"Remember my credentials\".\n3. If credentials are wrong/stale: Control Panel → **Credential Manager** → Windows Credentials → remove old entries for that server → re-map.\n\n**Fix \"local device name already in use\":**\n1. `net use S: /delete`, reboot, then re-map. If it persists, check for a GPO/login-script mapping the same letter, or a USB drive holding `S:`.\n\n**Stop SMB sessions dropping (idle/power):**\n1. Device Manager → NIC → Power Management → uncheck \"Allow the computer to turn off this device to save power\".\n2. For chronic idle disconnects, raise the SMB client session timeout via policy (L2 change, document it).\n\n**Repair stale / stuck Offline Files (CSC):**\n1. Sync Center → resolve any listed conflicts (keep server or local version deliberately).\n2. If corrupt, re-initialize the CSC cache: set `HKLM\\SYSTEM\\CurrentControlSet\\Services\\CSC\\Parameters\\FormatDatabase = 1` (DWORD) → reboot (rebuilds the offline cache; ensure pending changes are synced first).\n3. Where OneDrive/SharePoint is the standard, consider migrating off Offline Files entirely.\n\n**Refresh DFS referrals:**\n1. `dfsutil /pktflush` (clears the client referral cache) so the client re-queries the namespace for a healthy target.\n2. Verify the client is hitting the closest/online target; if a replica is down, escalate.\n\n**Force a fresh view of \"stale\" files:**\n1. Press **F5** in the folder; SMB caches directory listings briefly. If edits still don't appear and others see them, suspect DFS-R replication lag (→ escalate).\n\n## 6. Verification Steps\n- The mapped drive opens immediately on logon without a red-X click (or the red X is understood as cosmetic).\n- `net use` shows the drive as **OK**, not Disconnected/Unavailable.\n- A test file created by another user appears after F5 within the expected replication window.\n- After sleep/VPN reconnect, the drive is reachable without manual remap.\n\n## 7. Escalation Trigger\n- An entire team/site loses the same share simultaneously.\n- DFS namespace/referral errors, or DFS-R replication backlog causing stale files for everyone.\n- SMB signing/encryption or authentication (Kerberos/NTLM) failures in the server logs.\n- Suspected file-server storage, share permission, or capacity issue.\n- → Escalate to **L3 / file-server admin** with `net use`, `klist`, and `dfsutil` output attached.\n\n## 8. Prevention Tips\n- Map drives via GPP/Intune (item-level targeting) rather than ad-hoc, so they're consistent and self-heal.\n- For remote users, prefer Always-On VPN or move the data to SharePoint/OneDrive so logon-timing races disappear.\n- Disable NIC power-management on docked machines.\n- Keep DNS healthy; avoid mapping by IP (breaks Kerberos and DFS).\n\n## 9. User-Friendly Explanation\n\"That red X usually just means Windows hasn't reopened the drive yet — clicking it reconnects. When it genuinely won't sync, it's normally a saved-password mismatch, the VPN not being ready when you log in, or an old offline-cache copy showing stale files. We'll clear the saved credentials, re-map the drive cleanly, and refresh the cache so you see everyone's latest changes. If your whole team lost it at once, that's the file server and we'll get the server team on it.\"\n\n## 10. Internal Technician Notes\n- Cosmetic red X is by-design (KB on auto-reconnect); don't chase it unless access actually fails.\n- `net use` status `Unavailable` vs. `Disconnected` matters — Unavailable = genuine reachability problem.\n- Logon-script vs. GPP vs. Intune mappings can collide on a drive letter; audit all three.\n- Kerberos double-hop / SPN issues show as access-denied only by name (not IP) — check `setspn` and time skew (l1-clock-001).\n- CSC database rebuild discards un-synced offline edits — sync first.\n- DFS: `dfsutil /pktinfo` shows which target the client chose and its referral state.\n\n## 11. Related KB Articles\n- l1-onedrive-001 — OneDrive not syncing\n- l2-permissions-001 — NTFS / file-share permissions\n- l2-dns-001 — Internal name resolution\n\n## 12. Keywords / Search Tags\nmapped drive disconnected, network drive not syncing, shared drive missing, red x on mapped drive, offline files stuck, dfs not updating, drive letter gone, shared folder out of date, reconnect at logon, net use, credential manager, csc cache, dfsutil"
  },
  {
   "slug": "l2-intune-001-device-compliance",
   "path_rel": "knowledge-base\\L2\\l2-intune-001-device-compliance.md",
   "title": "\"Intune device compliance: device shows non-compliant or fails to enroll\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-intune-001\ntitle: \"Intune device compliance: device shows non-compliant or fails to enroll\"\ncategory: intune\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nos_scope: [\"Windows 10\", \"Windows 11\", \"iOS\", \"Android\", \"macOS\"]\nprerequisites: [\"Intune Administrator\", \"Endpoint Manager portal access\"]\nkeywords:\n  - intune\n  - device compliance\n  - not compliant\n  - autopilot\n  - enrollment failed\n  - hybrid join\n  - company portal\n  - device not registered\nrelated_articles:\n  - l2-azure-ad-001\n  - l2-bitlocker-001\n  - l3-endpoint-001\nescalation_trigger: \"Mass enrollment failure, or compliance regression after policy change, or Autopilot ESP timeout\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Intune device compliance / enrollment\n\n## 1. Symptoms\n- Intune portal shows device \"Not compliant\" with reason.\n- \"Your device does not meet your organization's requirements.\"\n- Autopilot ESP (Enrollment Status Page) hangs or times out.\n- \"Hybrid Azure AD join\" failing.\n- Company Portal app shows \"Couldn't add device\".\n- New device not appearing in Intune at all.\n\n## 2. Likely Causes\n1. BitLocker not enabled where required.\n2. Encryption method mismatch (TPM only vs PIN).\n3. AV signatures out of date.\n4. Compliance policy targets wrong OS edition.\n5. Autopilot profile not assigned, or hardware hash not registered.\n6. Hybrid join: no line-of-sight to AD during enrollment.\n7. User-driven Autopilot but user not in target group.\n\n## 3. Questions To Ask / Verify\n- Device serial / Azure AD device ID?\n- Compliance policy assigned (ID + name)?\n- Is the device in the right Azure AD group for Autopilot profile?\n- What Autopilot stage failed (Device prep, Device setup, Account setup)?\n- Hardware hash present in `Get-AutopilotDevice`?\n\n## 4. Troubleshooting Steps\n1. Endpoint Manager → Devices → all devices → find device → Compliance.\n2. Note exactly which compliance setting is failing.\n3. Devices → Enrollment status → if Autopilot, view per-device deployment status.\n4. On device: Settings → Accounts → Access work or school → click connection → Info → Sync.\n5. Pull `MDM Diagnostics report` from device: Settings → Accounts → Access work or school → Export your management log files.\n\n## 5. Resolution Steps\n**Compliance reason: BitLocker:**\n- Verify on device: `manage-bde -status C:` shows \"Protection On\".\n- If missing, push BitLocker policy via Intune; ensure TPM present (`tpm.msc`).\n\n**Compliance reason: AV signatures:**\n- Update Defender: Win+R → `cmd` → `\"C:\\Program Files\\Windows Defender\\MpCmdRun.exe\" -SignatureUpdate`.\n\n**Autopilot device not registered:**\n1. Run on the device (admin PowerShell): `Install-Script Get-WindowsAutopilotInfo -Force; Get-WindowsAutopilotInfo.ps1 -Online`.\n2. Provide creds with Intune permission. This uploads hardware hash to Autopilot service.\n3. Wait 5–10 min, then run user OOBE.\n\n**Autopilot profile assignment:**\n- Endpoint Manager → Devices → Enroll → Deployment Profiles → assigned to group containing this device.\n- Confirm group includes by device ID, not just user.\n\n**Hybrid AAD join (more complex):**\n- Confirm on-prem AD Connect SCP set: `Get-ADObject -Identity \"CN=62a0ff2e-97b9-4513-bf6b-4a0aabe4ba9c,CN=Device Registration Configuration,CN=Services,CN=Configuration,$(Get-ADRootDSE).configurationNamingContext)\" -Properties keywords`.\n- Confirm device successfully creates `dsregcmd /status` shows AzureAdJoined: YES, DomainJoined: YES.\n\n**Wipe and reset:**\n- Endpoint Manager → device → Wipe (Autopilot reset) — re-runs OOBE clean.\n\n## 6. Verification Steps\n- Device shows \"Compliant\" in Intune.\n- `dsregcmd /status` shows AzureAdJoined: YES, EnterpriseJoined / DomainJoined: YES (if hybrid).\n- Conditional Access sign-in shows \"Compliant: Yes\".\n- User can access targeted resources.\n\n## 7. Escalation Trigger\n- Mass enrollment failure (>5 devices same week).\n- Compliance regression after policy edit affects >10 devices.\n- Autopilot ESP timeout (>1h) on standard profile.\n- AAD Connect or hybrid join service issue.\n- → Escalate to **L3** with: device count, policy IDs, MDM diag bundles, AAD Connect logs.\n\n## 8. Prevention Tips\n- Always pilot policy changes against a small test group before tenant-wide.\n- Pre-register Autopilot hashes at hardware vendor (Dell / HP / Lenovo can do this for procurement).\n- Maintain a dedicated test device for compliance validation.\n- Monitor Endpoint Manager → Reports → Compliance daily.\n- Document policy intent + target.\n\n## 10. Internal Technician Notes\n- MDM diag log path: `%programdata%\\Microsoft\\IntuneManagementExtension\\Logs\\` — `IntuneManagementExtension.log`, `AgentExecutor.log`.\n- Autopilot enrollment phases: device prep, device setup, account setup. Each has timeouts (default ~60 min total).\n- For hybrid: domain controller line-of-sight at OOBE = Always-On VPN before login OR direct LAN.\n- BitLocker compliance race: device may report compliant before encryption finishes; allow 4h grace.\n- `Get-AutopilotDevice` (graph) requires `WindowsAutoPilot.ReadWrite` scope.\n- For ESP \"Account Setup\" hang, often Win32 app with bad detection rule — review `IntuneManagementExtension.log` for app deploy errors.\n\n## 11. Related KB Articles\n- l2-azure-ad-001 — Conditional Access\n- l2-bitlocker-001 — BitLocker recovery and policy\n- l3-endpoint-001 — Endpoint architecture and incident response\n\n## 12. Keywords / Search Tags\nintune, device compliance, not compliant, autopilot, enrollment failed, hybrid join, company portal, device not registered"
  },
  {
   "slug": "l2-intune-002-device-enrollment",
   "path_rel": "knowledge-base\\L2\\l2-intune-002-device-enrollment.md",
   "title": "\"MDM enrollment: enroll a Windows / iOS / Android device into Intune (and fix failed enrollment)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-intune-002\ntitle: \"MDM enrollment: enroll a Windows / iOS / Android device into Intune (and fix failed enrollment)\"\ncategory: intune\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 40\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\", \"iOS\", \"Android\"]\nprerequisites: [\"User has an Intune/EMS license\", \"Entra ID account in good standing\", \"Device meets OS minimums\"]\nkeywords:\n  - intune enrollment\n  - mdm enroll\n  - enroll device\n  - autopilot\n  - company portal\n  - enrollment failed\n  - 0x80180014\n  - mdm enrollment blocked\n  - device not compliant\n  - byod enroll\nrelated_articles:\n  - l2-intune-001\n  - l2-byod-001\n  - l2-azure-ad-001\nescalation_trigger: \"Enrollment restrictions, Autopilot profile assignment, or APNs/managed-Google-Play tenant config — tenant-level MDM platform work for L3.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# MDM enrollment into Intune (and failed-enrollment fixes)\n\n## 1. Symptoms / Requests\n- \"Enroll my new laptop / phone into management.\"\n- New hire's device needs to be managed before it can access email or apps.\n- Enrollment fails with errors like **0x80180014**, \"Something went wrong,\" \"This device is already enrolled,\" or \"Your administrator hasn't given you access.\"\n- Device shows **Not compliant** after enrolling, so Conditional Access blocks apps.\n\n## 2. Likely Causes (for failures)\n1. **No Intune license** assigned to the user.\n2. **Enrollment restrictions** block the platform/version, or the **device limit** (default 5/user) is hit.\n3. **MDM user scope** not set to include the user (Entra ID → Mobility/MDM).\n4. **Device already enrolled / orphaned** record from a prior owner or wipe.\n5. **Windows**: trying to \"Connect work account\" (registration only) instead of full enrollment; or device is **Hybrid-joined** and racing with Autopilot.\n6. **iOS**: missing/expired **APNs certificate**, or Company Portal not installed.\n7. **Android**: managed Google Play / work-profile not configured, or personal-vs-corporate mismatch.\n8. **Time/date skew** breaking token issuance (see l1-clock-001).\n\n## 3. Questions To Ask\n1. What platform and OS version? Corporate-owned or BYOD?\n2. Brand-new out-of-box (Autopilot?) or already in use?\n3. Exact error text / code at the point it fails?\n4. Was the device previously enrolled or owned by someone else?\n5. Does the user have an Intune license (you can confirm in admin center)?\n\n## 4. Triage Steps\n1. **Confirm licensing:** the user has Intune/EMS in Microsoft 365 admin → Licenses.\n2. **Check MDM user scope:** Entra ID → Mobility (MDM and MAM) → Microsoft Intune → MDM user scope includes the user (All or their group).\n3. **Check enrollment restrictions:** Intune admin → Devices → Enrollment → restrictions allow the platform/version and the user isn't over the device cap.\n4. **Look for an existing device record:** Intune → Devices → All devices — search the serial/name for a stale/duplicate object.\n\n## 5. Resolution Steps\n**Windows — standard user enrollment (Entra join):**\n1. Settings → Accounts → **Access work or school** → **Connect** → **Join this device to Azure AD** (full join = MDM enroll), sign in with the work account, complete MFA.\n2. *Or* if already Entra-joined: Settings → Access work or school → click the account → **Info** → confirm MDM is connected; if not, \"Connect\" enrolls into MDM.\n3. Force a policy sync: Settings → Access work or school → Info → **Sync**, or `dsregcmd /status` to confirm `AzureAdJoined: YES` and MDM URLs present.\n\n**Windows — Autopilot (new corporate device):**\n1. Ensure the hardware hash is uploaded and an Autopilot **deployment profile** is assigned to the device group.\n2. OOBE → connect network → sign in with work account → Autopilot applies the profile and enrolls automatically.\n3. If it falls back to a normal OOBE, the profile wasn't assigned in time (→ check group membership / escalate).\n\n**iOS/iPadOS (BYOD or corporate):**\n1. Install **Intune Company Portal** from the App Store.\n2. Open it → sign in → **Begin** → install the management profile (Settings prompts to allow) → trust it.\n3. Confirm the device appears in Intune and the management profile is installed under Settings → General → VPN & Device Management.\n\n**Android (work profile / fully managed):**\n1. Install **Intune Company Portal** from Google Play → sign in → follow the **work profile** setup.\n2. Approve the managed Google Play account; corporate apps land in the work-profile section.\n\n**Fix common failures:**\n- **0x80180014 / \"blocked\":** almost always an **enrollment restriction** or **MDM scope** excluding the user, or a missing license — fix in §4 then retry.\n- **\"Already enrolled\" / orphaned record:** delete the stale device object in Intune, then on the device run `dsregcmd /leave` (Windows) or remove the management profile (mobile), reboot, re-enroll.\n- **Device cap reached:** raise the per-user device limit in enrollment restrictions or remove old devices.\n\n## 6. Verification Steps\n- Device appears in **Intune → Devices** with the correct user and **Managed by: Intune (MDM)**.\n- `dsregcmd /status` (Windows) shows `AzureAdJoined: YES` and an MDM enrollment URL.\n- Compliance state flips to **Compliant** after first policy evaluation.\n- A Conditional-Access-gated app (e.g., Outlook) opens, proving the managed/compliant state is honored.\n- Company Portal lists the device as managed; assigned apps begin installing.\n\n## 7. Escalation Trigger\n- Enrollment **restrictions / Autopilot profiles / APNs cert / managed Google Play** need tenant changes.\n- Hybrid Azure AD join + Autopilot timing conflicts requiring AAD Connect / GPO work.\n- Compliance fails for a policy reason that needs the baseline redesigned.\n- → Escalate to **L3 endpoint/identity engineering** with the device's enrollment status and the exact error.\n\n## 8. Prevention Tips\n- Assign Intune licenses as part of onboarding (l2-onboarding-001) so devices can enroll on day one.\n- Keep the **APNs certificate** renewed (annual) — expiry breaks all iOS management at once; calendar it.\n- Pre-provision corporate Windows devices via **Autopilot** so users get a hands-off, compliant setup.\n- Set a sensible per-user device limit and clean up stale device records regularly.\n\n## 9. User-Friendly Explanation\n\"Enrolling your device means it gets registered with the company so it can safely receive email, apps, and security settings — and so we can wipe just the work data if it's ever lost. On a phone you'll install the Company Portal app and follow a couple of prompts; on a new laptop it often happens automatically the first time you sign in. Once it's enrolled and shows as 'compliant,' your work apps will open without being blocked.\"\n\n## 10. Internal Technician Notes\n- `dsregcmd /status` is the fastest Windows truth source: AzureAdJoined, DeviceId, MDM URL, and tenant details.\n- Distinguish **Entra registration** (BYOD, identity only) from **Entra join** (full MDM) — users often do the former and wonder why management never applies.\n- Stale objects: delete in Intune AND Entra ID; a duplicate Entra device can block re-enroll.\n- 0x80180014 maps to enrollment-restriction/scope blocks far more often than a device fault.\n- iOS APNs cert is tenant-wide and silent on expiry until devices stop checking in — track its expiry date.\n- Force Windows MDM sync via Task Scheduler → Microsoft → Windows → EnterpriseMgmt → run the sync task for fast policy pull.\n\n## 11. Related KB Articles\n- l2-intune-001 — Device compliance\n- l2-byod-001 — Bring-your-own-device\n- l2-azure-ad-001 — Conditional Access block\n\n## 12. Keywords / Search Tags\nintune enrollment, mdm enroll, enroll device, autopilot, company portal, enrollment failed, 0x80180014, mdm enrollment blocked, device not compliant, byod enroll, dsregcmd, entra join, apns certificate, enrollment restrictions"
  },
  {
   "slug": "l2-mail-auth-001-spf-dkim-dmarc",
   "path_rel": "knowledge-base\\L2\\l2-mail-auth-001-spf-dkim-dmarc.md",
   "title": "\"Email authentication: SPF, DKIM, and DMARC setup and troubleshooting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"spf record\"",
    "\"dkim setup\"",
    "\"dmarc policy\"",
    "\"email going to spam\"",
    "\"domain being spoofed\"",
    "\"spf 10 lookup limit\"",
    "\"dkim selector cname\"",
    "\"dmarc p=reject\"",
    "\"email authentication failing\"",
    "\"mail rejected external\"",
    "\"txt record email\"",
    "\"dmarc rua report\"",
    "\"spf softfail hardfail\"",
    "\"email spoofing protection\"",
    "\"quarantine vs reject\""
   ],
   "compliance": [],
   "content": "---\nid: l2-mail-auth-001\ntitle: \"Email authentication: SPF, DKIM, and DMARC setup and troubleshooting\"\ncategory: email\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 45\naudience: it-technician\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"spf record\",\"dkim setup\",\"dmarc policy\",\"email going to spam\",\"domain being spoofed\",\"spf 10 lookup limit\",\"dkim selector cname\",\"dmarc p=reject\",\"email authentication failing\",\"mail rejected external\",\"txt record email\",\"dmarc rua report\",\"spf softfail hardfail\",\"email spoofing protection\",\"quarantine vs reject\"]\nrelated_articles: [\"l2-mail-auth-002\",\"l1-email-001\",\"l2-dns-002\",\"l2-m365-mailflow-001\"]\nescalation_trigger: \"Legitimate business mail is being rejected/quarantined by a strict DMARC or third-party policy and the sending source cannot be authenticated without changes to a system outside IT's control.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Email authentication: SPF, DKIM, and DMARC\n\n## 1. Symptoms\n- Outbound mail lands in recipients' Junk/Spam folders.\n- Recipients report receiving spoofed mail \"from\" your domain.\n- External systems bounce your mail with \"SPF fail,\" \"DKIM fail,\" or \"DMARC reject.\"\n- A newly added sending service (CRM, ticketing, marketing tool, scanner-to-email) suddenly fails to deliver.\n- DMARC aggregate reports show large volumes of unauthenticated mail.\n\n## 2. Likely Causes\n1. **SPF** missing, incomplete (a sending service not listed), or exceeding the 10 DNS-lookup limit (PermError).\n2. **DKIM** not enabled, wrong/rotated selector, or CNAMEs not published.\n3. **DMARC** absent (no spoofing protection) or set too strict before all sources are authenticated.\n4. **Alignment** failure — SPF/DKIM technically pass but on a domain that doesn't match the visible From address.\n5. Multiple SPF TXT records on the domain (only one is allowed).\n6. A new or rogue sender not authorized in any of the three records.\n\n## 3. Questions To Ask User\n1. What exactly is the complaint — your mail going to spam, your domain being spoofed, or a specific recipient rejecting you?\n2. What is the affected sending domain, and what services send mail as that domain (M365/Google, CRM, marketing platform, app/relay, copier scan-to-email)?\n3. Has anything changed recently — new vendor, DNS edit, domain migration?\n4. Can you provide a sample bounce/NDR or a recent DMARC aggregate report?\n5. Who controls DNS for the domain, and do you have edit access?\n\n## 4. Troubleshooting Steps\n1. **Inventory senders.** List every system that sends as the domain. SPF/DKIM/DMARC only protect mail you account for.\n2. **Read current records** with public DNS lookups (an MXToolbox-style SPF/DKIM/DMARC lookup, or `nslookup -type=txt yourdomain`).\n3. **Check SPF:** confirm exactly **one** TXT record beginning `v=spf1`; confirm each sending service's `include:` is present; count DNS lookups (each `include`, `a`, `mx`, `ptr`, `exists`, `redirect` counts) — must stay **≤ 10** or you get PermError.\n4. **Check DKIM:** for each selector, query `selector._domainkey.yourdomain` and confirm the CNAME/TXT resolves and signing is enabled at the provider.\n5. **Check DMARC:** query `_dmarc.yourdomain` for a `v=DMARC1` record; note the `p=` policy and whether reporting (`rua`) is configured.\n6. **Check alignment:** in a failing sample, compare the From-header domain to the SPF (Return-Path/MailFrom) domain and the DKIM `d=` domain. DMARC passes only if at least one is **aligned** to the From domain.\n\n## 5. Resolution Steps\n**SPF — build/repair the record:**\n- One TXT record only: `v=spf1 include:spf.protection.outlook.com include:_spf.google.com ip4:203.0.113.10 -all` (use only the includes/IPs your senders actually need).\n- `~all` = SoftFail (mark suspicious); `-all` = HardFail (reject). Start with `~all` while validating, move to `-all` once all senders are confirmed.\n- If over 10 lookups: remove unused includes, replace bulky includes with specific `ip4:`/`ip6:` entries, or flatten/consolidate. Never publish two `v=spf1` records.\n\n**DKIM — enable signing:**\n- At the mail provider, enable DKIM for the domain; it generates one or more **selectors**.\n- Publish the provider's **CNAME** records (e.g. `selector1._domainkey` → provider host) or the TXT public key.\n- Turn signing **on** only after the DNS records resolve. Rotate selectors per provider guidance; keep old selector live until rotation completes.\n\n**DMARC — deploy gradually:**\n1. Start monitoring: `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; fo=1`.\n2. Read aggregate (`rua`) reports for ~2–4 weeks; identify and authenticate every legitimate source via SPF/DKIM until they show **aligned pass**.\n3. Tighten to `p=quarantine` (optionally with `pct=` ramp), then to `p=reject` once reports are clean.\n4. Optionally add `ruf=` for forensic/failure reports and `aspf`/`adkim` for strict alignment if needed.\n\n**Diagnose specific complaints:**\n- *Mail to spam:* ensure SPF + DKIM both pass and align; missing DKIM is a common cause.\n- *Being spoofed:* a `p=reject` DMARC (once legit mail is authenticated) is what stops spoofing.\n- *External mail rejected:* find which check failed in the bounce, authenticate that source, or correct alignment.\n\n## 6. Verification Steps\n- Send a test to an external mailbox and inspect headers: `Authentication-Results` shows `spf=pass`, `dkim=pass`, `dmarc=pass`.\n- SPF lookup count is ≤ 10 with no PermError; exactly one `v=spf1` record exists.\n- DKIM selector(s) resolve and the test message is signed with `d=` aligned to the From domain.\n- DMARC aggregate reports over the following days show legitimate sources passing and unauthorized sources failing.\n- Spoofing test (where authorized) is rejected/quarantined per the policy.\n\n## 7. Escalation Trigger\n- Legitimate mail is still rejected because a sending source cannot be authenticated without changes in a system you don't control (vendor/relay).\n- DNS is managed by an external party and edits cannot be made in a reasonable window.\n- DMARC `p=reject` cannot be safely reached because an unknown high-volume legitimate sender remains. Escalate to **L3 / email architecture** with the sender inventory and recent reports.\n\n## 8. Prevention Tips\n- Maintain a living inventory of all systems authorized to send as each domain; update SPF/DKIM whenever a vendor is added or removed.\n- Always deploy DMARC at `p=none` first and let reports guide tightening — never jump straight to `p=reject`.\n- Keep SPF well under the 10-lookup limit; prefer specific IPs over chains of includes.\n- Subdomains and parked/non-sending domains should also carry DMARC (`p=reject`) to block lookalike abuse.\n- Document selector rotation schedules so DKIM never silently breaks.\n\n## 9. User-Friendly Explanation\n\"These three records prove your mail is really from you. SPF lists the servers allowed to send on your behalf, DKIM stamps each message with a tamper-proof signature, and DMARC tells the world what to do if a message fails those checks — and emails you reports of who's pretending to be you. Set them up correctly and your legitimate mail stops landing in spam while impostors get blocked.\"\n\n## 10. Internal Technician Notes\n- DMARC alignment: SPF aligns on the **MailFrom/Return-Path** domain; DKIM aligns on the **`d=`** domain. Forwarding breaks SPF (Return-Path rewrites) but DKIM usually survives — this is why DKIM is the more durable signal and why DMARC needs only one aligned pass.\n- SPF lookup limit is **10 DNS mechanisms** (not 10 records); exceeding it yields PermError and a DMARC fail on the SPF side. `void` lookups also count toward limits per RFC 7208.\n- `~all` SoftFail vs `-all` HardFail: many receivers treat both leniently, so DMARC `p=reject` is what actually enforces rejection — SPF alone is not sufficient anti-spoofing.\n- Use the aggregate `rua` XML reports (via a parser or DMARC service) to enumerate sources; raw XML is unreadable at volume.\n- M365: DKIM under Defender/Exchange admin (rotate to 2048-bit). Google Workspace: DKIM under Apps → Gmail → Authenticate email. Both publish selector CNAMEs/TXT in DNS.\n- Beware BIMI and MTA-STS as adjacent topics — BIMI typically requires DMARC at enforcement first.\n\n## 11. Related KB Articles\n- l2-mail-auth-002 — Diagnosing mail flow and NDR/bounce codes\n- l1-email-001 — Reporting suspicious/phishing email\n- l2-dns-002 — Editing public DNS records (TXT/CNAME/MX)\n- l2-m365-mailflow-001 — Exchange Online mail flow and connectors\n\n## 12. Keywords / Search Tags\nspf record, dkim setup, dmarc policy, email going to spam, domain being spoofed, spf 10 lookup limit, dkim selector cname, dmarc p=reject, alignment fail, dmarc rua report, mail rejected external, quarantine vs reject, txt record email"
  },
  {
   "slug": "l2-malware-001-triage",
   "path_rel": "knowledge-base\\L2\\l2-malware-001-triage.md",
   "title": "\"Malware / suspected infection: triage and containment\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-malware-001\ntitle: \"Malware / suspected infection: triage and containment\"\ncategory: security\nsupport_level: L2\nseverity: critical\nestimated_time_minutes: 60\naudience: admin\nprerequisites: [\"Endpoint security admin\", \"Defender for Endpoint console\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - malware\n  - virus\n  - infected\n  - ransomware\n  - compromised\n  - quarantine\n  - mde\n  - defender for endpoint\n  - isolation\nrelated_articles:\n  - l1-email-001\n  - l3-security-001\nescalation_trigger: \"Ransomware, lateral movement detected, exfiltration suspected, or executive workstation\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Malware / suspected infection triage\n\n## 1. Symptoms\n- AV alert: trojan / dropper / ransomware family detected.\n- Defender for Endpoint alert (DfE / MDE).\n- Files renamed with .locked / .crypted / .[ext].\n- Unusual processes running (powershell -enc, mshta, certutil from temp).\n- Outbound traffic to known-bad IPs/domains.\n- User reports unusual pop-ups / browser hijack.\n\n## 2. Immediate actions (in order)\n1. **Isolate the device.** MDE → Action → Isolate device. Severs network except for MDE comms.\n2. **Capture state.** MDE → Collect investigation package (auto-bundles logs, mem, processes).\n3. **Identify the threat.** Note IoC: file hash, command line, parent process, user context.\n4. **Block IoCs at perimeter.** Defender → Indicators → add hash, IP, URL.\n5. **Check spread.** MDE → Hunting → search for same hash / SHA / parent across fleet.\n6. **Notify security lead.** Per IR plan.\n7. **Preserve evidence.** Don't reformat yet — get image if needed.\n\n## 3. Triage decision tree\n- **AV-flagged, low impact, single device, no spread:** quarantine confirmed → run full scan → reimage if precious account or cannot fully clean.\n- **Ransomware indicator:** stop, treat as incident — see L3 Security runbook.\n- **Lateral movement signs (4624 from unusual sources, RDP from outside):** treat as incident.\n- **PUP / adware only:** uninstall via Settings → run cleanup → user education → close.\n\n## 4. Cleanup procedure (low-impact malware)\n1. Defender full scan: `MpCmdRun.exe -Scan -ScanType 2`.\n2. Update signatures: `MpCmdRun.exe -SignatureUpdate`.\n3. Boot to Safe Mode + Networking; rerun scan.\n4. Use Microsoft Safety Scanner (`msert.exe`) as second opinion.\n5. Run `autoruns64.exe` → identify and remove persistent entries.\n6. Clear Temp folders.\n7. Reboot, normal mode, full scan again — clean.\n8. Reset user passwords for accounts active on device.\n9. Reset session tokens (Revoke-MgUserSignInSession).\n10. Restore device from clean image if confidence low.\n\n## 5. Verification\n- Two consecutive full scans clean.\n- No abnormal autoruns.\n- No outbound traffic to known-bad after release.\n- User can authenticate and work normally.\n- 7 days of MDE silence post-release.\n\n## 6. Escalation\n- Ransomware, BEC, exfiltration, exec compromise — **L3 / SOC** immediately.\n- Cyber-insurance carrier.\n- Legal / compliance (notification obligations).\n\n## 7. Prevention\n- ASR rules in Defender (Block credential stealing, Block Office macros from internet, etc.).\n- Phishing-resistant MFA (FIDO2) for privileged accounts.\n- Application Control (WDAC) on high-value workstations.\n- Patch hygiene — Windows + browser + 3rd-party.\n- Backups: 3-2-1, immutable, tested restores.\n\n## 8. Internal Notes\n- Investigation package includes: running processes, network connections, schtasks, prefetch, MDE telemetry.\n- Common indicators: `powershell -enc`, `rundll32` running from %temp%, `wscript` from email attachment.\n- Use Live Response shell (`!script`) only with chain-of-custody discipline.\n- For ransomware specifically: do not negotiate without legal approval; preserve the ransom note (often `_README.txt` in encrypted dirs).\n- Reimage > clean for serious infections — cleaning is best-effort, image is deterministic.\n\n## 9. User-Friendly Explanation\n\"We saw signs your device was attacked. We've cut its network connection so nothing can spread, and we're cleaning it up safely. Don't try to fix it yourself — we're treating this like a crime scene so we know what happened and protect the rest of the company.\"\n\n## 11. Related Articles\n- l1-email-001 — Phishing report\n- l3-security-001 — Full IR runbook\n\n## 12. Keywords\nmalware, virus, infected, ransomware, compromised, quarantine, mde, defender for endpoint, isolation"
  },
  {
   "slug": "l2-networking-001-deep-troubleshoot",
   "path_rel": "knowledge-base\\L2\\l2-networking-001-deep-troubleshoot.md",
   "title": "\"Network troubleshooting: latency, packet loss, MTU, switching\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-networking-001\ntitle: \"Network troubleshooting: latency, packet loss, MTU, switching\"\ncategory: networking\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 45\naudience: admin\nprerequisites: [\"Network admin / read access to switches\"]\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - latency\n  - packet loss\n  - mtu\n  - jumbo frames\n  - traceroute\n  - mtr\n  - pmtud\n  - duplex\n  - errors\nrelated_articles:\n  - l1-wifi-001\n  - l2-dns-001\n  - l3-networking-001\nescalation_trigger: \"Pattern points to ISP, infrastructure replacement needed, or capacity exhausted\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Network deep troubleshoot\n\n## 1. Symptoms\n- Slow file transfers, high latency.\n- Periodic packet loss / ping spikes.\n- VPN / RDP disconnects.\n- Specific app slow but speedtest fine.\n\n## 2. Diagnostic toolkit\n- `ping -t <host>` — quick loss/latency check.\n- `mtr -i 1 -c 100 <host>` (or pathping/tracert) — per-hop loss.\n- `iperf3` — throughput between two endpoints.\n- `Test-NetConnection -InformationLevel Detailed` — RTT + port + diagnostic.\n- Packet capture: Wireshark, Microsoft Message Analyzer.\n\n## 3. Common findings + fixes\n- **Hop X has 30% loss while X+1 doesn't:** routing/asymmetry on hop. Often fine if return path is clean.\n- **Real loss on first hop:** local switch/cable issue. Check switch port errors (`show interface`).\n- **MTU issues (works for small packets, breaks for large):** PMTUD broken. Lower MSS / clamp on edge: `iptables -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu`.\n- **Duplex mismatch:** auto-negotiation failed; force Gigabit full-duplex on both sides.\n- **Jumbo frame mismatch:** end-to-end MTU must agree (1500 default; jumbo 9000 if all kit supports).\n- **App slow but bandwidth fine:** likely app-level / DNS / TLS — capture and look at handshake times.\n\n## 4. Verification\n- 0% loss baseline over 100 pings.\n- Throughput ≥ link speed × 80%.\n- No errors / discards on switch port.\n- App responsive under load.\n\n## 5. Escalation\n- ISP-side issue: open carrier ticket with mtr trace + timestamps.\n- Hardware replacement.\n- Architecture redesign needed.\n- → L3 / Vendor.\n\n## 6. Prevention\n- Monitor switch errors continuously.\n- Cable test on install; label every patch.\n- Standard MTU 1500 unless infra all-jumbo.\n- Avoid auto-negotiation in legacy environments — configure explicitly.\n- Capacity plan: monitor link utilization, upgrade at 70%.\n\n## 7. Notes\n- Wi-Fi adds variability; wired is the truth source for diagnosis.\n- ICMP can be deprioritized; use `Test-NetConnection -Port` for TCP RTT.\n- TCP RWIN issues on long-haul: tune via `netsh int tcp` autotuning.\n\n## 8. Related\n- l1-wifi-001 — User-side\n- l2-dns-001 — DNS\n- l3-networking-001 — Architecture\n\n## 9. Keywords\nlatency, packet loss, mtu, jumbo frames, traceroute, mtr, pmtud, duplex, errors"
  },
  {
   "slug": "l2-offboarding-001-exit-process",
   "path_rel": "knowledge-base\\L2\\l2-offboarding-001-exit-process.md",
   "title": "\"User offboarding: identity disable, data preservation, license recovery\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-offboarding-001\ntitle: \"User offboarding: identity disable, data preservation, license recovery\"\ncategory: onboarding\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 45\naudience: admin\nprerequisites: [\"Entra User Admin\", \"Exchange Admin\", \"License admin\"]\nos_scope: [\"All\"]\nkeywords:\n  - offboarding\n  - termination\n  - exit\n  - disable account\n  - litigation hold\n  - shared mailbox\n  - license reclaim\n  - sessions revoked\nrelated_articles:\n  - l2-onboarding-001\n  - l3-security-001\nescalation_trigger: \"Hostile termination, regulated industry retention, or executive/privileged user\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# User offboarding\n\n## 1. Trigger\n- HR notifies (planned) or security incident (immediate).\n\n## 2. Sequence (immediate offboarding for hostile/security)\n1. **Disable account** (don't delete).\n2. **Revoke all sessions** — `Revoke-MgUserSignInSession`.\n3. **Reset password** to long random — prevents re-auth via cached.\n4. **Remove from privileged groups.**\n5. **Block sign-in to Microsoft 365** — Entra → user → Block sign-in.\n6. **Wipe / retire device** via Intune — wipe for hostile, retire for amicable.\n7. **Notify SOC / Security** if elevated privileges.\n\n## 3. Standard offboarding (planned, last day)\n1. Last day at end of business: disable account.\n2. Revoke sessions, reset password.\n3. Convert mailbox to shared (within 30 days for free retention; otherwise license stays for 30d).\n4. Set out-of-office \"I no longer work at X — please contact Y\".\n5. Delegate inbox to manager (read-only).\n6. OneDrive: transfer ownership to manager (Entra → user → OneDrive → \"Get access to files\").\n7. Remove from license group → license auto-reclaims after group-based reconciliation.\n8. Remove from groups, DLs, ACLs.\n9. Place mailbox + OneDrive on Litigation/In-Place Hold per retention policy (typically 90d–7y).\n10. Document everything in ticket.\n\n## 4. Day +30\n- Confirm shared mailbox conversion sticking.\n- Confirm OneDrive contents migrated to manager / archive.\n- Confirm device returned & wiped.\n- Final review: privileged-access checks confirm no orphan grants.\n\n## 5. Verification\n- User cannot sign in (test from incognito).\n- License reclaimed in M365 admin.\n- Manager has access to former mailbox + OneDrive.\n- All groups removed.\n- Audit log captures the offboarding actions.\n\n## 6. Escalation\n- Hostile termination, regulated industry, or possible IP theft → L3 / Security / Legal.\n\n## 7. Prevention / Quality\n- Run quarterly orphan-account scan: disabled >180 days → delete.\n- Use Entra ID Governance access packages — auto-revoke on offboarding.\n- Document hold requirements per business / jurisdiction.\n- Pre-built runbook saves time on hostile exits.\n\n## 8. Notes\n- Mailbox conversion to shared requires <50 GB; otherwise keep licensed.\n- Litigation hold: `Set-Mailbox -LitigationHoldEnabled $true -LitigationHoldDuration <days>`.\n- Session revocation is critical — without it, attacker with refresh token can persist.\n- For BYOD, retire (don't wipe) preserves personal data.\n\n## 9. Related\n- l2-onboarding-001 — Mirror process\n- l3-security-001 — Hostile-exit incident response\n\n## 10. Keywords\noffboarding, termination, exit, disable account, litigation hold, shared mailbox, license reclaim, sessions revoked"
  },
  {
   "slug": "l2-onboarding-001-new-user",
   "path_rel": "knowledge-base\\L2\\l2-onboarding-001-new-user.md",
   "title": "\"New user onboarding: account, license, device, and access provisioning\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-onboarding-001\ntitle: \"New user onboarding: account, license, device, and access provisioning\"\ncategory: onboarding\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 60\naudience: admin\nprerequisites: [\"Entra User Administrator\", \"Intune\", \"License\", \"Group ownership\"]\nos_scope: [\"Windows\", \"iOS\", \"Android\", \"macOS\"]\nkeywords:\n  - onboarding\n  - new hire\n  - provisioning\n  - first day\n  - account creation\n  - license assignment\n  - device deployment\n  - autopilot\n  - group based licensing\nrelated_articles:\n  - l2-intune-001\n  - l1-mfa-001\n  - l1-password-001\nescalation_trigger: \"Onboarding for executive / regulated user, or HR system integration failure\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# New user onboarding\n\n## 1. Inputs (from HR / hiring manager)\n- Full name, preferred name, manager.\n- Title, department, location, start date.\n- Required apps / shared mailboxes / distribution lists.\n- Device type (laptop model, mobile).\n- Equipment delivery address.\n- Any special access (admin, finance, regulated data).\n\n## 2. Sequence\n1. **Identity:**\n   - Entra → Users → New user. UPN per naming convention.\n   - Set Manager. Add to \"All Employees\" group + dept group.\n   - Force password change on first sign-in.\n2. **Licensing:**\n   - Group-based licensing assigns M365 + add-ons via department group membership. Verify within 15 min: Licenses & apps tab.\n3. **Mailbox / DLs:**\n   - Membership in shared mailboxes via Entra group.\n4. **MFA registration page:**\n   - Send user the SSPR / MFA setup link for first-day completion.\n5. **Device — Autopilot:**\n   - Verify device hardware hash uploaded.\n   - Assigned Autopilot profile = User-driven.\n   - Targeted compliance + config policies.\n6. **Apps:**\n   - Required Win32 apps (Office, browser, line-of-business) via Intune.\n   - VPN profile, certs.\n7. **Access:**\n   - JML matrix dictates: file shares, SharePoint sites, Confluence space, GitHub org, etc.\n8. **Welcome:**\n   - Onboarding email with first-sign-in instructions, support contact, equipment tracking.\n9. **Day-1 check:**\n   - User reports successful sign-in, MFA, mail flow, OneDrive sync.\n10. **Day-7 check:**\n    - Compliance status, app coverage, no missing access tickets.\n\n## 3. Verification\n- Entra: user active, manager set, group memberships correct.\n- Intune: device enrolled, compliant within 24h of activation.\n- M365 admin: license assigned, mailbox provisioned.\n- User can sign in to Outlook, Teams, OneDrive, primary line-of-business app.\n\n## 4. Escalation\n- Executive / privileged user — extra access reviews + SOC notification.\n- HR system integration failure — escalate to HRIS team.\n\n## 5. Prevention / Improvement\n- Automate via Identity Lifecycle (Entra ID Governance) once HR system has API.\n- Standardize device images.\n- Record JML matrix in source control; review quarterly.\n- Use access packages (Entra ID Governance) for repeatable role grants.\n\n## 6. Notes\n- Group-based licensing has reconciliation lag up to 24h in worst case.\n- Pre-stage devices: ship to user with hardware hash uploaded; user runs Autopilot from anywhere with internet.\n- For regulated industries, document onboarding for audit (separation of duties, approvals).\n- Don't send temp password and login link in same email — split channels.\n\n## 7. Related\n- l2-intune-001 — Compliance\n- l1-mfa-001 — User MFA setup\n- l1-password-001 — User password setup\n\n## 8. Keywords\nonboarding, new hire, provisioning, first day, account creation, license assignment, device deployment, autopilot, group based licensing"
  },
  {
   "slug": "l2-outlook-001-slow-performance",
   "path_rel": "knowledge-base\\L2\\l2-outlook-001-slow-performance.md",
   "title": "\"Outlook is slow, freezes, or hangs on 'Processing' / 'Not Responding'\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-outlook-001\ntitle: \"Outlook is slow, freezes, or hangs on 'Processing' / 'Not Responding'\"\ncategory: outlook\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\"]\nprerequisites: [\"User can sign in to Outlook\", \"Local admin or remote-management access for profile/OST work\"]\nkeywords:\n  - outlook slow\n  - outlook freezing\n  - outlook not responding\n  - outlook hangs\n  - outlook processing\n  - large ost\n  - outlook performance\n  - outlook lag\n  - cached exchange mode\nrelated_articles:\n  - l1-outlook-001\n  - l1-outlook-003\n  - l2-exchange-001\nescalation_trigger: \"Slowness affects many users on the same mailbox database or Exchange server, or mailbox/OST corruption persists after profile rebuild — that is an Exchange/server-side (L3) problem.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# Outlook slow / freezing / \"Not Responding\"\n\n## 1. Symptoms\n- Outlook takes a long time to launch or shows \"Processing…\" on startup.\n- UI freezes (\"Not Responding\") when switching folders, searching, or opening large mailboxes.\n- Search is slow or returns incomplete results.\n- Sending/receiving lags; the status bar sits on \"Updating this folder\" for a long time.\n\n## 2. Likely Causes\n1. **Oversized OST/PST** — a cached mailbox or large local PST (multi-GB) makes Outlook crawl, especially on a spinning disk.\n2. **Too much cached** — Cached Exchange Mode set to \"All\" on a 50 GB+ mailbox.\n3. **Misbehaving add-in** (especially CRM, archiving, AV, or PDF toolbars).\n4. **Corrupt OST or search index.**\n5. **Corrupt Outlook profile.**\n6. **Hardware/disk contention** — low free disk, OneDrive/AV scanning the OST, low RAM.\n7. **Network latency to Exchange Online** (poor Wi-Fi, VPN, or proxy intercepting MAPI/HTTP).\n\n## 3. Questions To Ask User\n1. Slow always, or only on launch / search / a specific large folder?\n2. Roughly how big is the mailbox (File → Account Settings shows the data file)?\n3. Did it start after an update, a new add-in, or migrating to a new PC?\n4. Slow only on VPN / Wi-Fi, or also on a wired/office connection?\n5. Any PST files attached (archives, old .pst on a network share)?\n\n## 4. Troubleshooting Steps\n1. **Start in Safe Mode:** hold **Ctrl** while launching Outlook (or `outlook.exe /safe`). If it's fast in Safe Mode, an add-in is the culprit.\n2. **Check the data-file size:** File → Account Settings → Account Settings → Data Files. Note OST/PST size and location.\n3. **Check free disk space and where the OST lives** (`%LOCALAPPDATA%\\Microsoft\\Outlook`). Confirm AV/OneDrive isn't scanning/syncing the OST folder.\n4. **Test search:** File → Options → Search → \"Indexing Options\" → confirm Outlook is indexed and indexing is complete.\n5. **Test on the web:** open Outlook on the web (OWA). If OWA is fast, the problem is the local client, not the mailbox/server.\n\n## 5. Resolution Steps\n**Disable problem add-ins:**\n1. File → Options → Add-ins → Manage: **COM Add-ins** → Go.\n2. Uncheck all non-essential add-ins → OK → restart Outlook. Re-enable one at a time to find the offender.\n\n**Right-size Cached Exchange Mode (big win on large mailboxes):**\n1. File → Account Settings → Account Settings → double-click the Exchange account → set **\"Mail to keep offline\"** to **3 or 6 months** instead of \"All\".\n2. Restart Outlook; it rebuilds a smaller OST. Confirm OST shrinks under `%LOCALAPPDATA%\\Microsoft\\Outlook`.\n\n**Rebuild the OST (clears local corruption):**\n1. Close Outlook. Rename the `.ost` (e.g., `outlook.ost` → `outlook.ost.old`) in `%LOCALAPPDATA%\\Microsoft\\Outlook`.\n2. Reopen Outlook — it rebuilds the OST from Exchange Online (no data loss; the mailbox is the source of truth). Allow time to re-sync.\n\n**Rebuild the search index (if search is the slow part):**\n1. File → Options → Search → Indexing Options → Advanced → **Rebuild**. Let it complete (can take an hour on large mailboxes).\n\n**Create a fresh Outlook profile (if still slow / profile corruption):**\n1. Control Panel → Mail (Microsoft Outlook) → Show Profiles → **Add** a new profile → configure the account.\n2. Set Outlook to \"Prompt for a profile\" or set the new one as default → launch with the new profile.\n\n**Reduce/relocate PSTs:**\n1. Move large archive `.pst` files off network shares to local disk, or migrate them into Online Archive. PSTs on network shares are unsupported and slow.\n\n## 6. Verification Steps\n- Outlook launches and reaches the inbox in a reasonable time (target < 15s on SSD).\n- Folder switching and search return quickly with no \"Not Responding\".\n- OST size is sane for the offline window chosen.\n- A 10-minute working session shows no freezes; send/receive completes promptly.\n\n## 7. Escalation Trigger\n- Many users on the same mailbox DB / Exchange Online region are slow at the same time.\n- OST corruption recurs immediately after a clean rebuild (possible mailbox-side corruption → run server-side repair).\n- MAPI-over-HTTP / Autodiscover errors point to a proxy or network-path issue.\n- → Escalate to **L3 / Exchange admin** for mailbox repair, throttling-policy review, or proxy/Autodiscover fixes.\n\n## 8. Prevention Tips\n- Keep Cached Exchange Mode at 3–6 months for large mailboxes, not \"All\".\n- Exclude the Outlook OST folder from real-time AV scanning and from OneDrive Known Folder sync.\n- Encourage Online Archive instead of local PSTs; never store PSTs on network shares.\n- Audit add-ins fleet-wide; remove abandoned/duplicate toolbars via policy.\n\n## 9. User-Friendly Explanation\n\"Outlook gets sluggish when it's trying to keep too much mail on your laptop, when an add-in is misbehaving, or when its local cache file gets corrupted. We'll start it in a clean mode to spot a bad add-in, trim how much mail it stores locally, and rebuild its cache from the server — none of your email is lost because the real copy lives in the cloud. It should feel snappy again after that.\"\n\n## 10. Internal Technician Notes\n- `outlook.exe /safe` isolates add-ins; `outlook.exe /rpcdiag` and the connection status (Ctrl+right-click the tray icon → Connection Status) reveal latency/RTT to Exchange.\n- OST > ~25–50 GB is a known performance cliff on HDDs; SSDs tolerate more but still benefit from a shorter offline window.\n- ScanPST repairs PST only, not OST — for OST you rename/rebuild.\n- Check `HKCU\\Software\\Microsoft\\Office\\16.0\\Outlook` for stuck/forced add-in keys; managed AV add-ins sometimes reload after being disabled.\n- Confirm the OST isn't living on a redirected/roamed/OneDrive-synced path — that is a frequent silent cause.\n\n## 11. Related KB Articles\n- l1-outlook-001 — Not receiving emails\n- l1-outlook-003 — Send/receive errors\n- l2-exchange-001 — Mail flow troubleshooting\n\n## 12. Keywords / Search Tags\noutlook slow, outlook freezing, outlook not responding, outlook hangs, outlook processing, large ost, outlook performance, outlook lag, cached exchange mode, rebuild ost, com add-ins, search index rebuild, online archive"
  },
  {
   "slug": "l2-patch-management-001-patch-management",
   "path_rel": "knowledge-base\\L2\\l2-patch-management-001-patch-management.md",
   "title": "\"Patch management program design and update troubleshooting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"patch management\"",
    "\"patch cadence\"",
    "\"ring deployment\"",
    "\"maintenance window\"",
    "\"wsus intune autopatch\"",
    "\"third party patching\"",
    "\"update failed 0x8024\"",
    "\"stuck windows update\"",
    "\"reboot loop after update\"",
    "\"patch compliance reporting\"",
    "\"out of band patch\"",
    "\"emergency patch\"",
    "\"server vs workstation patching\"",
    "\"risk acceptance exception\"",
    "\"windows update troubleshooter\""
   ],
   "compliance": [],
   "content": "---\nid: l2-patch-management-001\ntitle: \"Patch management program design and update troubleshooting\"\ncategory: endpoint-management\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"patch management\",\"patch cadence\",\"ring deployment\",\"maintenance window\",\"wsus intune autopatch\",\"third party patching\",\"update failed 0x8024\",\"stuck windows update\",\"reboot loop after update\",\"patch compliance reporting\",\"out of band patch\",\"emergency patch\",\"server vs workstation patching\",\"risk acceptance exception\",\"windows update troubleshooter\"]\nrelated_articles: [\"l2-deployment-001\",\"l2-endpoint-001\",\"l2-vuln-001\",\"l2-server-maint-001\"]\nescalation_trigger: \"A patch causes production-impacting breakage requiring rollback/vendor engagement, or a critical vulnerability cannot be patched within SLA and needs a documented risk-acceptance decision.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Patch management program and troubleshooting\n\n## 1. Symptoms\n- Endpoints failing compliance/vulnerability scans for missing updates.\n- Updates fail to install (error codes, stuck at a percentage, repeated retries).\n- Devices stuck in a reboot loop or \"undoing changes\" after an update.\n- A patch broke an application or driver and needs rolling back.\n- No consistent cadence — patches applied ad hoc, some machines months behind.\n- Third-party apps (browsers, runtimes, PDF tools) unpatched and flagged.\n\n## 2. Likely Causes\n1. **Program gaps:** no defined cadence, rings, or maintenance windows; no compliance reporting.\n2. **Client health:** update service stopped, corrupted update cache, low disk space, broken servicing stack.\n3. **Connectivity/scope:** device not reaching the update source (WSUS/Intune/Autopatch/CDN) or not in the right deployment group.\n4. **Conflicts:** a bad patch, driver incompatibility, or pending reboot blocking further updates.\n5. **Third-party blind spot:** OS patching covered but app patching unmanaged.\n\n## 3. Questions To Ask User\n1. Is this a **single device** failing, or a **fleet-wide / program** issue?\n2. What's the exact error code or where does it stick, and what's the OS build?\n3. What tool manages updates here (WSUS, Intune/Windows Update for Business, Autopatch, third-party patcher)?\n4. Did a specific app/driver break right after a known patch (and which KB/version)?\n5. For servers: is there an approved maintenance window and an HA/failover path?\n\n## 4. Troubleshooting Steps\n**Single-device update failure:**\n1. Check free disk space and pending-reboot state; reboot to clear a pending operation, then retry.\n2. Run the OS update troubleshooter; confirm the update service is running and the device reaches its update source/group.\n3. For Windows, reset the update components if the cache is corrupt: stop the update/BITS/cryptographic services, clear the `SoftwareDistribution` and `catroot2` caches, restart services, retry.\n4. Repair the servicing stack/component store (`DISM /Online /Cleanup-Image /RestoreHealth`, then `sfc /scannow`) when errors point to corruption.\n5. Translate the error class generically: `0x8024xxxx` = Windows Update agent/connectivity/source errors (agent can't fetch, source unreachable, or catalog issue) — verify reachability to the update source and group membership first.\n\n**Reboot loop / \"undoing changes\":**\n1. Boot to recovery; uninstall the most recent quality/feature update or roll back the driver.\n2. Restore from a known-good restore point/image if needed; capture logs before reimaging.\n\n**Program-level:**\n1. Review cadence, rings, compliance %, and which devices/groups are out of band.\n2. Confirm third-party patching coverage and server vs workstation policies.\n\n## 5. Resolution Steps\n**A. Build the cadence (program):**\n1. **Rings:** Pilot/Test → Early adopters → Broad → (Critical/sensitive last). Each ring validates before the next.\n2. **Cadence:** ship monthly quality updates on a fixed schedule after a short soak in the pilot ring; schedule feature updates less often with broader validation.\n3. **Maintenance windows:** define per device class (workstations vs servers) with reboot windows; use deadlines + grace periods to force compliance while respecting user disruption.\n4. **Emergency / out-of-band:** define an expedited path for actively exploited criticals — shorten/skip soak, push to all rings within the SLA, with a documented approver.\n\n**B. Tooling (use what's in place, generically):**\n- **WSUS** for on-prem approval/distribution; **Intune / Windows Update for Business** for cloud ring policies and deadlines; **Windows Autopatch** for managed ring orchestration; **third-party patching tools** for browsers, runtimes, and apps the OS updater ignores. Pick one authority per scope to avoid conflicting policies.\n\n**C. Compliance & measurement:**\n- Track **% of devices at the latest approved patch level** by ring, age of oldest missing critical, and failure counts. Surface non-compliant and unreachable devices for remediation.\n\n**D. Failed updates:**\n- Remediate per Troubleshooting (cache reset, servicing repair, reachability). For widespread failures, suspect a bad approval/policy or a source outage and pause the rollout.\n\n**E. Third-party app patching:**\n- Enroll the common high-risk apps (browsers, Java/.NET runtimes, PDF/Office add-ins, conferencing) into the patcher with their own cadence; these are frequent exploit targets.\n\n**F. Server cadence:**\n- Patch servers in a separate, more conservative ring with explicit change windows, HA/failover order, pre-patch snapshots/backups, and a tested rollback.\n\n**G. Exceptions & risk acceptance:**\n- When a patch can't be applied (app incompatibility, legacy system), document the exception: asset, missing patch, business reason, compensating controls, owner, and a review/expiry date. Track it; don't let it become permanent silently.\n\n## 6. Verification Steps\n- The previously failing device installs the update and reports compliant after reboot.\n- Compliance dashboard shows the ring reaching target % within the expected window.\n- A rolled-back patch is confirmed removed and the app/driver is functional; a re-test plan exists before re-deploying.\n- Third-party apps report current versions in the patch tool.\n- Documented exceptions have an owner and a review date.\n\n## 7. Escalation Trigger\n- A patch causes **production-impacting breakage** needing coordinated rollback or vendor engagement. Escalate to **L3 / change management** with the KB/version, scope, and logs.\n- A critical/actively-exploited vulnerability **cannot be patched within SLA**, requiring a formal **risk-acceptance** decision by the business owner.\n- Fleet-wide update failure points to a source/policy outage beyond local scope.\n\n## 8. Prevention Tips\n- Always pilot before broad release; never push untested patches fleet-wide.\n- Keep adequate free disk space and healthy servicing stacks in the base image to prevent the most common failures.\n- Separate server and workstation cadences with their own windows, backups, and rollback plans.\n- Include third-party app patching from day one — OS-only patching leaves the most-exploited software exposed.\n- Maintain backups/snapshots before server/feature updates so rollback is always possible.\n- Review the exception list regularly so risk acceptances don't quietly persist.\n\n## 9. User-Friendly Explanation\n\"Patching keeps software protected against newly discovered security holes — but pushing every update to everyone at once is risky, because a bad patch can break things. So we update in waves: a small test group first, then wider groups once it's proven safe, all on a predictable schedule with set reboot times. Urgent security fixes get a fast lane. We also patch the everyday apps, not just the operating system, and we track which machines are up to date so nothing falls behind.\"\n\n## 10. Internal Technician Notes\n- `0x8024xxxx` codes are Windows Update agent/connectivity/source failures (e.g. can't reach WSUS/CDN, bad catalog, wrong group). Triage = reachability + group membership + cache integrity before deeper repair. `0x800f0xxx` codes point at the component store/servicing stack — use DISM/SFC. Don't memorize codes; map by family and check the relevant log.\n- Reset sequence: stop wuauserv/bits/cryptsvc/msiserver, rename `SoftwareDistribution` and `catroot2`, restart, rescan. Pair with DISM RestoreHealth + SFC for corruption.\n- Pick a single update authority per scope; overlapping WSUS + Intune/WUfB policies cause \"deferred forever\" or fighting deployments.\n- For reboot loops, recovery-mode uninstall of the latest quality update / driver rollback beats reimaging when time allows; always grab logs first.\n- Servers: enforce snapshot/backup + tested rollback and stagger across HA pairs so patching never drops the service.\n- Vulnerability scanners drive the priority list; reconcile scanner findings with patch-tool compliance to catch reporting blind spots (especially third-party apps and unreachable/offline devices).\n\n## 11. Related KB Articles\n- l2-deployment-001 — Image build and baseline configuration\n- l2-endpoint-001 — Endpoint management/MDM enrollment\n- l2-vuln-001 — Vulnerability scanning and remediation workflow\n- l2-server-maint-001 — Server maintenance windows and change control\n\n## 12. Keywords / Search Tags\npatch management, patch cadence, ring deployment, maintenance window, wsus, intune, autopatch, third party patching, 0x8024 error, stuck windows update, reboot loop, patch compliance, out of band patch, server vs workstation patching, risk acceptance exception"
  },
  {
   "slug": "l2-performance-001-deep-dive",
   "path_rel": "knowledge-base\\L2\\l2-performance-001-deep-dive.md",
   "title": "\"Performance deep dive: WPR / xperf / consistent slowness diagnosis\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-performance-001\ntitle: \"Performance deep dive: WPR / xperf / consistent slowness diagnosis\"\ncategory: performance\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 60\naudience: technician\nprerequisites: [\"Local admin\", \"ADK with Windows Performance Toolkit\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - performance\n  - wpr\n  - xperf\n  - traces\n  - boot performance\n  - high cpu\n  - long delay\n  - hang\nrelated_articles:\n  - l1-windows-003\n  - l2-drivers-001\nescalation_trigger: \"Trace shows kernel-mode driver or firmware issue requiring vendor\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Performance deep dive (WPR / xperf)\n\n## 1. When to use\n- L1 cleanup didn't resolve consistent slowness.\n- Hang on specific action (slow file open, slow browser).\n- Boot >2 minutes without obvious cause.\n- High kernel time (red in Task Manager).\n\n## 2. Capture\n- Install Windows Performance Recorder (ADK).\n- WPR profiles: General, CPU usage, Disk IO, Networking IO, etc.\n- Capture: `wpr -start GeneralProfile -filemode` → reproduce → `wpr -stop trace.etl`.\n\n## 3. Analyze\n- Open .etl in Windows Performance Analyzer (WPA).\n- Common views:\n  - **CPU Usage (Sampled):** which process / module consumed CPU.\n  - **Disk Usage:** I/O heat per file/process.\n  - **Network Usage:** byte-by-byte.\n  - **Window in focus:** UI delay attribution.\n\n## 4. Common findings\n- 3rd-party AV consuming CPU on file access → exclusion list audit.\n- Telemetry agent hammering disk → version upgrade or disable.\n- DPC/ISR storm from driver → driver update / replace.\n- WMI Provider Host (svchost) high → identify provider via `wmiprvse.exe` PID + `Get-WmiObject` query in trace.\n- Search indexer rebuilding → wait or rebuild index.\n\n## 5. Action\n- Document fix in KB (specific to user's environment).\n- Push policy / driver / exclusion via Intune.\n- Verify post-fix with second trace.\n\n## 6. Escalation\n- Vendor regression in driver / firmware → vendor case.\n- Microsoft case for OS-level regressions.\n- → L3.\n\n## 7. Prevention\n- Standardize endpoint apps; reduce surface area.\n- Curate AV exclusions per Microsoft's published guidance per role.\n- Monitor key counters: CPU time per logon, disk queue length, DPC time.\n\n## 8. Notes\n- For boot perf, WPR `Boot` profile + `wpr -boottrace -addboot GeneralProfile`.\n- ProcMon for individual file access narratives.\n- For VDI / RDS, capture is heavier — coordinate window with users.\n\n## 9. Related\n- l1-windows-003 — User-facing slow PC\n- l2-drivers-001 — Driver fleet management\n\n## 10. Keywords\nperformance, wpr, xperf, traces, boot performance, high cpu, long delay, hang"
  },
  {
   "slug": "l2-permissions-001-ntfs-fileshare",
   "path_rel": "knowledge-base\\L2\\l2-permissions-001-ntfs-fileshare.md",
   "title": "\"NTFS / file share permissions: access denied, broken inheritance, audit\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-permissions-001\ntitle: \"NTFS / file share permissions: access denied, broken inheritance, audit\"\ncategory: permissions\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"File server admin\", \"AD groups admin\"]\nos_scope: [\"Windows Server\", \"Windows 10/11 file shares\"]\nkeywords:\n  - ntfs\n  - permissions\n  - access denied\n  - share\n  - inheritance\n  - take ownership\n  - icacls\n  - effective access\nrelated_articles:\n  - l2-sharepoint-001\n  - l2-active-directory-001\nescalation_trigger: \"Cross-forest, broken ACL on critical share, or active investigation/audit\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# NTFS / share permissions\n\n## 1. Symptoms\n- \"Access denied\" on file/folder despite group membership.\n- Inheritance broken at unexpected level.\n- New user added to group still cannot open.\n- Cannot delete file (locked / orphan permissions).\n\n## 2. Diagnosis\n**Effective Access:**\n- File Properties → Security → Advanced → Effective Access tab → pick user/group → View effective access.\n\n**ACL inspection:**\n- `icacls \"C:\\Path\\To\\Folder\"` — current ACEs.\n- `icacls \"C:\\Path\\To\\Folder\" /verify` — list inconsistencies.\n\n**Share permissions:**\n- Most restrictive of share + NTFS applies.\n- `Get-SmbShareAccess -Name <share>` shows share ACL.\n\n**Token bloat:**\n- User in 50+ groups can hit Kerberos token size cap; symptoms: random access denied, sign-in delays.\n\n## 3. Resolution\n**Add missing perm:**\n- Add via Properties → Security or `icacls \"C:\\Path\" /grant \"DOMAIN\\Group:(OI)(CI)M\"`.\n\n**Restore inheritance:**\n- Properties → Security → Advanced → Enable Inheritance.\n\n**Reset broken ACL:**\n- `icacls \"C:\\Path\" /reset /T /C` — resets to inherit. Use carefully.\n\n**Take ownership (orphan):**\n- `takeown /F \"C:\\Path\" /R /D Y` then `icacls \"C:\\Path\" /grant Administrators:F /T`.\n\n**Token size:**\n- Increase MaxTokenSize via GPO; or reduce group memberships.\n\n## 4. Verification\n- Affected user opens / saves / deletes target.\n- Effective Access shows expected.\n- Inheritance reflects intent.\n- 3 sample paths random-tested.\n\n## 5. Escalation\n- Cross-forest trust ACL.\n- Mass restoration (DR scenario).\n- Forensic preservation in progress.\n- → L3.\n\n## 6. Prevention\n- Use security groups, not direct user grants.\n- Document ACL design at share root; let inheritance carry.\n- Avoid Deny ACEs unless absolutely required.\n- Quarterly access review.\n- Monitor for changes via auditing (4670, 4663).\n\n## 7. Notes\n- AGDLP model: Account → Global → Domain Local → Permission.\n- Don't use Everyone for production data.\n- \"Authenticated Users\" includes computer accounts — careful on services.\n- For ABE (Access-Based Enumeration), users see only what they can access — reduces support tickets.\n\n## 8. Related\n- l2-sharepoint-001 — Cloud equivalent\n- l2-active-directory-001 — Group membership issues\n\n## 9. Keywords\nntfs, permissions, access denied, share, inheritance, take ownership, icacls, effective access"
  },
  {
   "slug": "l2-printers-001-server-management",
   "path_rel": "knowledge-base\\L2\\l2-printers-001-server-management.md",
   "title": "\"Print server / queue management / Universal Print rollout\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-printers-001\ntitle: \"Print server / queue management / Universal Print rollout\"\ncategory: printers\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"Print server admin\", \"Intune / GPO\"]\nos_scope: [\"Windows Server 2016+\", \"Windows 10/11\"]\nkeywords:\n  - print server\n  - print queue\n  - universal print\n  - printnightmare\n  - point and print\n  - driver isolation\n  - 0x0000011b\nrelated_articles:\n  - l1-printer-001\n  - l1-printer-002\nescalation_trigger: \"PrintNightmare-class CVE in environment, or print server compromise, or fleet-wide outage\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Print server / queue / Universal Print\n\n## 1. Common scenarios\n- Mass error 0x0000011b after security update.\n- Spooler service crashing on print server.\n- Driver isolation incompatibility.\n- Migrating to Universal Print (cloud).\n\n## 2. Error 0x0000011b (PrintNightmare-related)\n- Microsoft hardened RPC; some drivers / configs break.\n- **Workaround (security trade-off):** `HKLM\\SYSTEM\\CurrentControlSet\\Control\\Print → RpcAuthnLevelPrivacyEnabled = 0`.\n- **Better:** update drivers to vendor's PrintNightmare-compatible version + keep registry secure.\n- **Best:** move to Universal Print + Direct Print where possible.\n\n## 3. Spooler service crashes\n- Event Viewer → System → Source = Service Control Manager / PrintService.\n- Identify driver causing crash (`PrintService/Operational` log shows driver name on access).\n- Remove offending driver: `pnputil /enum-drivers` → `pnputil /delete-driver oem##.inf /uninstall /force`.\n- Reinstall vendor's current driver.\n- Spooler service Recovery tab → restart on first/second/subsequent failure.\n\n## 4. Driver isolation\n- Print Management → Drivers → driver → Set Driver Isolation = \"Isolated\".\n- Crashes confined to `PrintIsolationHost.exe`, spooler stays alive.\n\n## 5. Universal Print migration\n- Connector installed on a Windows Server with line-of-sight to physical printers.\n- Register printers in Universal Print portal.\n- Push printers via Intune (Configuration → Universal Print policy).\n- Users see them under Settings → Printers, queue lives in Azure.\n- No more on-prem print server for Win10/11 fleets.\n\n## 6. Verification\n- Test print across all critical printers post-change.\n- Spooler stable for 24h.\n- Driver list matches approved baseline.\n- For UP: printers listed in user's \"Printers & scanners\" without manual install.\n\n## 7. Escalation\n- Active CVE exploitation in environment.\n- Print server compromise.\n- → L3 / Security.\n\n## 8. Prevention\n- Vendor drivers: PCL 6 universal preferred for fleet.\n- Keep print server patched + isolated (not domain controller).\n- Migrate to Universal Print to retire on-prem print servers.\n- Driver review: maintain a curated list, no random installs.\n- Monthly audit of installed drivers.\n\n## 9. Notes\n- Universal Print subscription includes a job allotment per license — track usage.\n- Direct Print (UP without connector) requires printers with native UP support.\n- For shared computer scenario / RDS, isolate drivers strictly — driver crash on RDS host kills printing for all users.\n\n## 10. Related\n- l1-printer-001 — User-facing not printing\n- l1-printer-002 — Garbled output\n\n## 11. Keywords\nprint server, print queue, universal print, printnightmare, point and print, driver isolation, 0x0000011b"
  },
  {
   "slug": "l2-rdp-001-cant-connect",
   "path_rel": "knowledge-base\\L2\\l2-rdp-001-cant-connect.md",
   "title": "\"Remote Desktop (RDP) / RDS connection issues\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-rdp-001\ntitle: \"Remote Desktop (RDP) / RDS connection issues\"\ncategory: rdp\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 25\naudience: admin\nprerequisites: [\"RDS / Server admin\", \"AD\"]\nos_scope: [\"Windows Server 2016+\", \"Windows 10/11 RDP\"]\nkeywords:\n  - rdp\n  - remote desktop\n  - rds\n  - terminal server\n  - rd gateway\n  - cant connect\n  - certificate\n  - licensing grace period\nrelated_articles:\n  - l1-vpn-001\n  - l2-vpn-001\n  - l3-networking-001\nescalation_trigger: \"Mass RDS outage, license server failure, or session host capacity exhausted\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Remote Desktop / RDS issues\n\n## 1. Symptoms\n- \"Remote Desktop can't connect to remote computer\".\n- Black screen after authentication.\n- \"The remote session was disconnected because there are no Remote Desktop License Servers available\".\n- \"Your computer can't connect to the remote computer because the Remote Desktop Gateway server is temporarily unavailable\".\n- Frequent disconnects.\n\n## 2. Causes\n1. Network unreachable / firewall blocking 3389.\n2. NLA mismatch (client doesn't support).\n3. RD Gateway cert expired.\n4. Licensing grace period (120 days) expired without proper RDS CALs.\n5. Session host overloaded.\n6. UDP path issues (RDP uses UDP for performance, falls back to TCP).\n7. Profile load failure (FSLogix / UPD).\n\n## 3. Resolution\n**Network / firewall:**\n- Test reachability: `Test-NetConnection <host> -Port 3389`.\n- For RD Gateway: 443 TCP/UDP.\n\n**Cert expired (RD Gateway / Connection Broker):**\n- Renew SSL cert; bind via Server Manager → Remote Desktop Services → Edit Deployment → Certificates.\n\n**Licensing grace expired:**\n- Server Manager → RD Licensing Diagnoser.\n- Activate license server, install per-user/per-device CALs.\n\n**Profile load failure (FSLogix):**\n- Check user's profile container (`Profile_<username>.vhd(x)`) on storage path.\n- Look at FSLogix Apps logs in `%programdata%\\FSLogix\\Logs\\`.\n- Common: storage path unreachable, container locked by previous session, disk full.\n\n**Session host overload:**\n- Server Manager → RDS deployment → check session count vs capacity.\n- Scale out: add session host, rebalance.\n\n## 4. Verification\n- User connects in <15 seconds.\n- Profile loads cleanly.\n- App suite responsive.\n- 30-min idle without disconnect.\n\n## 5. Escalation Trigger\n- Mass outage (>10 users).\n- License server fails to activate.\n- Session host crash loop.\n- → **L3**.\n\n## 6. Prevention\n- Document license model and CAL count.\n- Monitor session host CPU/RAM/profile-load times.\n- Cert expiry alerts at 90/30/7 days.\n- Use Connection Broker for HA.\n- For Azure Virtual Desktop, use Azure Monitor / Log Analytics.\n\n## 7. Internal Notes\n- RDP UDP transport: `gpedit → Computer Config → Admin Templates → Windows Components → Remote Desktop Services → Remote Desktop Connection Client → Turn Off UDP On Client`.\n- For \"Black screen\", `gpedit → ...→ Remote Session Environment → Use hardware default graphics adapter for all RDS sessions`.\n- FSLogix container disk performance: avoid SMB over slow links — use Azure Files Premium / FSx.\n- For AVD: stuck session → drain mode + log off via Azure Portal.\n\n## 8. Related Articles\n- l2-vpn-001 — Often paired with RDP for remote\n- l3-networking-001 — Network architecture\n\n## 9. Keywords\nrdp, remote desktop, rds, terminal server, rd gateway, cant connect, certificate, licensing grace period"
  },
  {
   "slug": "l2-sase-001-sase-sse-ztna",
   "path_rel": "knowledge-base\\L2\\l2-sase-001-sase-sse-ztna.md",
   "title": "\"SASE, SSE, and ZTNA fundamentals and troubleshooting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"sase\"",
    "\"sse\"",
    "\"ztna\"",
    "\"zero trust network access\"",
    "\"ztna vs vpn\"",
    "\"secure web gateway\"",
    "\"casb\"",
    "\"fwaas\"",
    "\"ztna agent not connecting\"",
    "\"cant reach internal app\"",
    "\"posture policy blocking\"",
    "\"split tunnel issue\"",
    "\"sase client certificate\"",
    "\"private app unreachable\"",
    "\"identity policy denied\""
   ],
   "compliance": [],
   "content": "---\nid: l2-sase-001\ntitle: \"SASE, SSE, and ZTNA fundamentals and troubleshooting\"\ncategory: network-security\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 40\naudience: it-technician\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"sase\",\"sse\",\"ztna\",\"zero trust network access\",\"ztna vs vpn\",\"secure web gateway\",\"casb\",\"fwaas\",\"ztna agent not connecting\",\"cant reach internal app\",\"posture policy blocking\",\"split tunnel issue\",\"sase client certificate\",\"private app unreachable\",\"identity policy denied\"]\nrelated_articles: [\"l2-vpn-001\",\"l2-dns-001\",\"l2-azure-ad-001\",\"l2-network-troubleshoot-001\"]\nescalation_trigger: \"A ZTNA private-application connector or the SASE/SSE vendor cloud is down, or policy changes are required that exceed local administrative scope.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# SASE, SSE, and ZTNA fundamentals and troubleshooting\n\n## 1. Symptoms\n- The SASE/SSE agent shows \"disconnected,\" \"connecting,\" or \"captive portal\" and never goes green.\n- A specific internal (private) application is unreachable, while internet browsing works (or vice versa).\n- User is blocked at sign-in with an \"access denied / device not compliant / posture failed\" message.\n- Some sites are blocked or decrypted unexpectedly (SWG/inspection policy).\n- Performance is poor or certain apps break only when the agent is on.\n\n## 2. Likely Causes\n1. **Agent/tunnel:** agent not running, not enrolled, expired token, or unreachable PoP/edge.\n2. **Identity:** user not in the access policy group, or IdP/SSO/MFA step failed.\n3. **Posture/compliance:** device fails a posture check (OS version, disk encryption, AV/EDR, certificate).\n4. **Private app reachability:** the ZTNA **connector** to that app/segment is down or the app isn't defined in policy.\n5. **Inspection/TLS:** SWG TLS-decryption breaks an app due to certificate pinning or a missing root CA on the device.\n6. **Routing:** split-tunnel misconfig, DNS resolving private names to the wrong place, or overlapping subnets.\n\n## 3. Questions To Ask User\n1. What does the agent status say exactly, and what is the error/code?\n2. Is **everything** broken (no internet) or only a specific app/site?\n3. Are you signed in to the agent with your work identity, and did MFA succeed?\n4. On-network (office) or remote? Wired, Wi-Fi, hotspot, or behind another VPN?\n5. When did it last work, and did anything change (new laptop, OS update, password change, travel)?\n\n## 4. Troubleshooting Steps\n1. **Confirm the layer.** SSE = SWG + CASB + ZTNA + FWaaS (the security cloud). SASE = SSE + SD-WAN (adds the network/transport). ZTNA = the private-app access piece. Decide whether the issue is internet egress (SWG), a SaaS control (CASB), or private-app access (ZTNA).\n2. **Agent health:** confirm the client is running, enrolled, and showing a healthy edge/PoP. Restart the agent; check it can reach the vendor cloud (the agent usually shows the connected PoP).\n3. **Identity:** verify the user is signed in with the correct identity and is a member of the policy/group granting the app. Re-auth if the session/token expired.\n4. **Posture:** check the device-posture/compliance result. Confirm OS version, disk encryption, EDR/AV running, and any required device certificate are present and valid.\n5. **Private app path (ZTNA):** confirm the app is defined as a private application in policy, the **connector** serving its segment is healthy, and DNS for the app's hostname resolves via the ZTNA service (not public DNS to a dead IP).\n6. **Inspection/TLS:** if only certain HTTPS apps break, suspect TLS decryption — confirm the SWG root CA is installed/trusted and add cert-pinned apps to a do-not-decrypt/bypass list.\n7. **Routing/split-tunnel:** verify the app's subnet/hostname is in the tunnel's include list and there are no overlapping RFC1918 ranges or a competing VPN.\n\n## 5. Resolution Steps\n**A. Agent won't connect:**\n1. Restart agent; if still failing, re-enroll/re-authenticate the device.\n2. Verify outbound reachability to the vendor's PoP/cloud (corporate firewall/proxy may block required ports/FQDNs — allow them).\n3. Clear a captive-portal state on hotel/guest Wi-Fi (open a plain HTTP site to trigger the portal, authenticate, then reconnect).\n\n**B. \"Can't reach internal app\" (ZTNA triage):**\n1. Confirm the **app is published** in the ZTNA policy and the user/group is **entitled**.\n2. Confirm the **connector** for that app's network segment is online (vendor console shows connector health).\n3. Resolve the app's hostname while connected — it should resolve to the ZTNA service, not a public/stale IP.\n4. Verify posture is passing; a posture failure silently removes entitlement to sensitive apps.\n5. Test from a second known-good user to isolate user-specific vs app-wide.\n\n**C. Access denied / posture/identity block:**\n1. Read the policy decision in the vendor logs (which rule denied, on what attribute).\n2. Remediate the failing posture attribute (update OS, enable encryption, restart EDR, reissue cert) or correct group membership.\n3. Re-evaluate posture / re-sign-in and retest.\n\n**D. App breaks only with agent on (inspection):**\n1. Identify if TLS decryption is applied; install/trust the SWG root CA on the device.\n2. Add cert-pinned or sensitive apps (banking, native clients) to a **bypass/no-decrypt** policy.\n\n## 6. Verification Steps\n- Agent shows **connected** to a healthy PoP with the correct identity.\n- The previously failing app loads and functions end-to-end while connected.\n- Vendor policy logs show an **allow** decision for the user/app with posture **pass**.\n- Internet egress and the private app both work without one breaking the other.\n- A second user reproduces success, confirming the fix is policy/infra-level not local.\n\n## 7. Escalation Trigger\n- A **ZTNA connector** or the SASE/SSE **vendor cloud/PoP** is down (app-wide outage). Escalate to **L3 / vendor support** with connector IDs and timestamps.\n- Required policy, group entitlement, or posture-baseline changes exceed your administrative scope.\n- TLS-decryption breakage requires a global do-not-decrypt change or PKI work.\n\n## 8. Prevention Tips\n- Document each published private app: hostname(s), segment, owning connector, and entitled groups.\n- Deploy connectors in **redundant pairs** per segment so a single connector failure doesn't black-hole an app.\n- Pre-stage the SWG root CA and required posture (encryption, EDR, OS baseline) in the device image so new endpoints pass on day one.\n- Roll out policy changes to a pilot ring first; keep a maintained do-not-decrypt list for known cert-pinned apps.\n- Monitor connector/PoP health and policy-deny trends proactively, not reactively.\n\n## 9. User-Friendly Explanation\n\"SASE/SSE replaces the old 'connect to the VPN and you're inside the whole network' model. Instead, every time you open an app, the service checks who you are and whether your device is healthy, then connects you to **only that app** — nothing else. So if one app won't open while everything else works, it's usually a permission, device-health, or app-routing check, not a broken internet connection. We look at the access logs to see exactly which check said no, and fix that.\"\n\n## 10. Internal Technician Notes\n- ZTNA vs legacy VPN: VPN grants broad network-layer access after one auth; ZTNA grants per-application, identity- and posture-aware access with continuous evaluation and no inbound exposure (outbound connectors only). Reduces lateral movement.\n- Triage order for \"can't reach internal app\": entitlement → connector health → DNS/name resolution via the service → posture → inspection/bypass → routing/overlap. Most app-specific failures are connector or entitlement; most \"everything broken\" failures are agent/PoP reachability.\n- Captive portals and double-VPN/host-firewall stacks are frequent remote-user culprits.\n- TLS decryption: cert-pinned native apps (and some auth flows) fail inspection — maintain a curated bypass list rather than disabling inspection globally.\n- DNS is a common silent failure: private hostnames must resolve through the ZTNA path; split-DNS or public resolution to a dead IP looks like an \"app down.\"\n\n## 11. Related KB Articles\n- l2-vpn-001 — Legacy VPN client connection issues\n- l2-dns-001 — Internal DNS resolution problems\n- l2-azure-ad-001 — Conditional Access / identity policy blocks\n- l2-network-troubleshoot-001 — Structured network triage methodology\n\n## 12. Keywords / Search Tags\nsase, sse, ztna, zero trust network access, ztna vs vpn, secure web gateway, casb, fwaas, agent not connecting, cant reach internal app, posture policy blocking, split tunnel, client certificate, connector down, identity denied"
  },
  {
   "slug": "l2-sharepoint-001-permissions",
   "path_rel": "knowledge-base\\L2\\l2-sharepoint-001-permissions.md",
   "title": "\"SharePoint Online: permissions, broken inheritance, sharing audit\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-sharepoint-001\ntitle: \"SharePoint Online: permissions, broken inheritance, sharing audit\"\ncategory: sharepoint\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 30\naudience: admin\nprerequisites: [\"SharePoint Admin\", \"Site Collection Admin\"]\nos_scope: [\"SharePoint Online\"]\nkeywords:\n  - sharepoint\n  - permissions\n  - broken inheritance\n  - access denied\n  - sharing audit\n  - link sharing\n  - everyone except external\n  - guests\nrelated_articles:\n  - l1-onedrive-003\n  - l2-azure-ad-001\nescalation_trigger: \"Site collection-wide permission corruption, or external sharing risk audit, or compliance review\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# SharePoint permissions and sharing\n\n## 1. Symptoms\n- \"You don't have access to this page\".\n- File visible in search but locked when opened.\n- External user can't access shared file.\n- Inherited permissions don't propagate down.\n- \"Stop sharing\" doesn't fully revoke.\n\n## 2. Causes\n1. Item-level \"Stop inheriting permissions\" set unintentionally.\n2. Sharing link expired.\n3. Guest user not invited / still pending.\n4. \"Everyone except external users\" filter excluded a guest.\n5. Sensitivity label restricting access.\n6. SharePoint admin policy blocks anonymous links.\n\n## 3. Resolution\n**Broken inheritance:**\n- Site → Settings → Site permissions → check inheritance level.\n- Item → Manage access → \"Advanced\" → \"Restore inheritance\" if intentional break wasn't required.\n\n**Sharing audit:**\n- Microsoft Purview audit log → search for `SharingSet`, `SharingInvitationCreated`, `AnonymousLinkCreated`.\n- Bulk report: SharePoint admin → Reports → External sharing.\n\n**External user trouble:**\n- Confirm invitation in user's email; resend if needed.\n- Verify external sharing setting at tenant + site level (more restrictive wins).\n- Guest user objects in Entra → check status `Accepted`.\n\n**Sensitivity label clash:**\n- Confirm user has access to the label per Purview.\n- Or remove label if mis-applied.\n\n## 4. Verification\n- Affected user opens file successfully.\n- No new audit alerts.\n- Inheritance restored where appropriate.\n\n## 5. Escalation\n- Compliance violation suspected.\n- Site collection corruption.\n- → L3.\n\n## 6. Prevention\n- Use security groups, not individual users.\n- Default external sharing to \"Only people in organization\" unless business needs broader.\n- Sensitivity labels with rationale documented.\n- Quarterly access review.\n- Don't grant Everyone except external users to highly sensitive sites.\n\n## 7. Notes\n- SharePoint vs OneDrive — both share underlying engine but policies differ.\n- Tenant external sharing > site collection > library > item — most restrictive applies.\n- \"Anyone with the link\" vs \"People in your organization\" vs \"Specific people\" — communicate the difference clearly.\n- Microsoft 365 Groups ownership flows to the site — adding/removing owners affects access.\n\n## 8. Related Articles\n- l1-onedrive-003 — Sync conflicts\n- l2-azure-ad-001 — Conditional Access on SharePoint\n\n## 9. Keywords\nsharepoint, permissions, broken inheritance, access denied, sharing audit, link sharing, everyone except external, guests"
  },
  {
   "slug": "l2-sso-001-onboard-user-and-app",
   "path_rel": "knowledge-base\\L2\\l2-sso-001-onboard-user-and-app.md",
   "title": "\"SSO onboarding: add a user to an app, or connect a new SaaS app to SSO\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-sso-001\ntitle: \"SSO onboarding: add a user to an app, or connect a new SaaS app to SSO\"\ncategory: sso\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 45\naudience: technician\nos_scope: [\"N/A — cloud/identity\"]\nprerequisites: [\"Entra ID (Azure AD) admin or delegated app-admin role\", \"Admin access to the target SaaS app\", \"Change approved per access-request policy\"]\nkeywords:\n  - sso onboarding\n  - add user to app\n  - assign app\n  - new saas app sso\n  - saml setup\n  - scim provisioning\n  - entra enterprise application\n  - okta assign\n  - single sign-on access\nrelated_articles:\n  - l2-onboarding-001\n  - l3-sso-saml-001\n  - l1-browser-003\nescalation_trigger: \"Custom SAML claim mapping, federation/trust changes, or tenant-wide identity policy changes — design-level work for L3 identity engineering.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# SSO onboarding — grant a user access, or wire up a new app\n\n## 1. Symptoms / Requests\n- \"Please give <user> access to <app> via SSO.\"\n- \"We bought a new SaaS tool — set up single sign-on so people log in with their work account.\"\n- New hire can't see an app on their My Apps / launcher.\n- \"Just-in-time\" account isn't being created in the app when the user signs in.\n\n## 2. Likely Causes / Context\n1. **User not assigned** to the Enterprise Application (or not in the assigned group).\n2. **App not yet integrated** — no SAML/OIDC trust configured between the IdP (Entra ID / Okta) and the SaaS app.\n3. **Provisioning gap** — SAML alone authenticates but doesn't create the account; the app needs **SCIM** or JIT to provision the user.\n4. **Group-based assignment** mismatch — user not in the security group that grants the app.\n5. **Conditional Access / license** blocks (no app license, or a CA policy requiring compliant device/MFA not met).\n6. **Attribute/claim mismatch** — the app keys users on an attribute the IdP isn't sending (e.g., expects `mail`, IdP sends UPN).\n\n## 3. Questions To Ask (Intake)\n1. Is the app **already integrated** with SSO, or brand new?\n2. Are you adding **one user**, or onboarding a **whole app/team**?\n3. What does the app expect as the unique identifier — email, UPN, employee ID?\n4. Does the app need **automatic account creation** (SCIM/JIT), or do accounts already exist there?\n5. Who is the app owner / has admin in the SaaS side for the metadata exchange?\n6. Is there a license to assign, and any Conditional Access requirement?\n\n## 4. Triage Steps\n1. Confirm the request is **approved** per the access policy (don't grant app access ad hoc).\n2. In Entra ID → **Enterprise applications**, search for the app — does it already exist?\n3. If it exists: check **Users and groups** (is the user/group assigned?) and **Provisioning** (is SCIM on and healthy?).\n4. Verify the user has any required **license** and meets **Conditional Access** (device compliant, MFA registered).\n\n## 5. Resolution Steps\n**A) Add an existing user to an already-integrated app (most common):**\n1. Entra ID → Enterprise applications → select the app → **Users and groups** → **Add user/group**.\n2. Prefer adding the user to the **security group** that grants the app (group-based access) rather than a direct assignment — it scales and audits cleanly.\n3. Assign the correct **role** if the app exposes app roles.\n4. If the app uses **SCIM provisioning**, confirm the user appears in **Provisioning → on-demand provision** (provision them on demand to avoid waiting for the sync cycle).\n5. Confirm a **license** is assigned if the app requires one.\n\n**B) Onboard a brand-new SaaS app to SSO (SAML):**\n1. Entra ID → Enterprise applications → **New application** → search the gallery; if present, add it (pre-built claims). If not, \"Create your own application\" → non-gallery.\n2. **Single sign-on → SAML.** Exchange metadata with the app owner:\n   - Give the app the **IdP metadata / Login URL / Entity ID / signing certificate**.\n   - Enter the app's **Reply URL (ACS)**, **Identifier (Entity ID)**, and **Sign-on URL**.\n3. Set **Attributes & Claims** to match what the app keys on (commonly NameID = `user.mail` or `user.userprincipalname`).\n4. Download the **federation metadata XML** (or Base64 cert) and hand it to the app owner to finish their side.\n5. Assign the pilot user/group under **Users and groups** and test.\n\n**C) Turn on automatic provisioning (SCIM) so accounts auto-create:**\n1. App → **Provisioning** → mode **Automatic** → enter the app's **Tenant URL** and **Secret Token** (from the SaaS admin).\n2. **Test Connection**, map attributes, set scope to \"assigned users and groups\", then turn provisioning **On**.\n\n## 6. Verification Steps\n- The user sees the app tile at **https://myapps.microsoft.com** and can launch it.\n- Sign-in completes end-to-end into the app (not just the IdP) without a redirect loop.\n- For SCIM/JIT: the user's account now exists in the SaaS app with correct attributes/role.\n- Entra ID → **Sign-in logs** shows a successful interactive sign-in to that app for the user.\n- Removing a test user from the group revokes access (de-provision verified) before go-live.\n\n## 7. Escalation Trigger\n- App requires **custom claim transformations**, certificate/federation trust changes, or multiple identifiers.\n- Tenant-wide **Conditional Access** or identity-policy changes are needed.\n- Redirect loops or signature/cert errors that need IdP↔SP protocol debugging (→ l3-sso-saml-001).\n- → Escalate to **L3 identity engineering** for SAML/OIDC design and federation work.\n\n## 8. Prevention Tips\n- Always grant app access via **groups**, not direct user assignment — easier joiner/mover/leaver handling.\n- Tie app groups to the **onboarding** workflow (l2-onboarding-001) so new hires get the right apps automatically.\n- Prefer **SCIM** over JIT where supported, so deprovisioning is automatic at offboarding.\n- Keep a record of each app's ACS URL, Entity ID, cert expiry, and app owner; calendar the **signing-cert renewal**.\n\n## 9. User-Friendly Explanation\n\"Single sign-on means you log in once with your work account and the app just lets you in — no separate password. To give you access we add you to the group that's allowed into that app; if the app also needs an account created on its side, our system provisions it automatically. For a brand-new app we set up a trust between our login system and the vendor once, then everyone gets in the same easy way. You'll find your apps at the My Apps portal.\"\n\n## 10. Internal Technician Notes\n- Group-based assignment requires Entra ID P1+; without it you assign users directly.\n- NameID format mismatch is the #1 cause of \"authenticates but app says user not found\" — confirm the SP's expected identifier.\n- SCIM on-demand provisioning skips the (default 40-min) sync cycle for urgent onboards.\n- For non-gallery apps, watch Reply URL exact-match (trailing slash, http vs https) — a frequent silent failure.\n- Document cert expiry; an expired SAML signing cert breaks the whole app for all users (calendar a renewal task).\n- Conditional Access \"require compliant device\" will block onboarding from an unmanaged machine — verify before blaming the SSO config.\n\n## 11. Related KB Articles\n- l2-onboarding-001 — New user onboarding\n- l3-sso-saml-001 — SAML troubleshooting (protocol-level)\n- l1-browser-003 — SAML/SSO redirect loop\n\n## 12. Keywords / Search Tags\nsso onboarding, add user to app, assign app, new saas app sso, saml setup, scim provisioning, entra enterprise application, okta assign, single sign-on access, my apps, conditional access, app role, federation metadata"
  },
  {
   "slug": "l2-vip-support-001-white-glove-workflow",
   "path_rel": "knowledge-base\\L2\\l2-vip-support-001-white-glove-workflow.md",
   "title": "\"VIP / executive / white-glove support workflow\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-vip-support-001\ntitle: \"VIP / executive / white-glove support workflow\"\ncategory: vip-support\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 30\naudience: admin\nos_scope: [\"Multi-platform\"]\nprerequisites: [\"VIP list maintained\", \"after-hours on-call rota\"]\nkeywords:\n  - vip\n  - executive support\n  - white glove\n  - c-suite\n  - board member\n  - personal assistant\n  - desk-side\n  - priority response\n  - vvip\n  - travel support\n  - speakers needed at event\nrelated_articles:\n  - l2-onboarding-001\n  - l3-security-001\n  - l1-mfa-001\nescalation_trigger: \"VIP issue impacting board meeting, earnings call, customer demo, or live event in next 4 hours\"\nlast_updated: 2026-05-08\nversion: 1.0\n---\n\n# VIP / white-glove support\n\n## 1. Symptoms / triggers\n- CEO assistant calls about a Teams meeting that won't connect.\n- CFO can't open a spreadsheet during a board prep session.\n- VP travelling internationally, VPN failed, demo in 90 minutes.\n- Executive's spouse / family member needs help on a personal device they use for work.\n- Board observer joining the network for the first time.\n\n## 2. Likely causes (procedurally, not diagnostically)\n1. The technical problem is usually L1, but the time pressure is L3.\n2. VIP is using a non-standard device or app for the first time.\n3. Stakes (earnings call, customer demo, regulator) raise the cost of any miss.\n4. VIPs rarely run troubleshooting steps themselves — they expect the tech to drive.\n5. Outage may be on the network/SaaS side, not their device.\n\n## 3. Questions to ask the EA / VIP directly\n1. What's the deadline (precise time + timezone)?\n2. Is this from their work device, personal device, or hotel/conference network?\n3. Are others affected (assume \"no\" until proven — VIPs notice everything).\n4. Can we schedule a ride-along (you on the call) or do they need silent support?\n5. What's the fallback if we can't fix in time — different device, dial-in, postpone?\n\n## 4. Triage rules\n1. **Confirm priority** — VIP issue with a deadline = always P1, even if technically minor.\n2. **Two-tech rule** — assign a second tech to the queue so a backup exists.\n3. **Direct dial** — never put a VIP through ticketing; you take it personally.\n4. **Document silently** — write the ticket *after* the call, not during.\n5. **Bias to redundancy** — give them two paths to success (e.g., \"your laptop is fixing, here's a phone dial-in for the same call as a backup\").\n\n## 5. Resolution playbook\n**During the call:**\n1. Calm, low-jargon voice. Mirror their pace. No \"have you tried turning it off and on\" without context.\n2. Lead with a fallback: \"While we fix this, here's how to join from your phone in 30 seconds.\"\n3. If you're remote-controlling, narrate: \"I'm clicking Settings, then Devices.\"\n4. If hardware issue and >30 min from deadline, dispatch desk-side immediately.\n5. If software issue, fix on the device — never reinstall an app on the VIP's machine in the middle of a deadline session.\n\n**After resolution:**\n1. Send a 2-line follow-up email: what happened, what we did, what to watch for.\n2. File a P1 ticket with the resolution.\n3. After-action review with whichever VIP / EA was involved.\n4. Add the root cause to the VIP profile (e.g., \"headset's bluetooth flakey above 80% battery\").\n\n## 6. Verification\n- VIP confirms the meeting/demo went through.\n- No follow-up complaint within 24 hours.\n- The issue is captured in the VIP profile so the next tech sees the pattern.\n\n## 7. Escalation trigger\n- Outage is wider than the VIP — declare a P1 incident, run l3-security-001 if it could be a breach.\n- Issue requires vendor (Microsoft, Cisco, etc.) — open vendor P1 ticket immediately, don't wait for next-business-day.\n- VIP is travelling and locked out of MFA — admin reset path, see l1-mfa-001 + identity-proof the VIP via a known-trusted second channel.\n\n## 8. Prevention\n- Maintain a VIP profile per executive: device, travel pattern, recurring issues, EA contact, preferred call channel.\n- Pre-stage a known-good loaner device for execs travelling international.\n- Quarterly \"drill\" with the EA — confirm dial-ins, MFA recovery, VPN profile still working.\n- Pre-publish dial-in numbers and backup devices in the EA's runbook.\n- Keep an executive-only Teams channel for IT to push status updates during outages.\n\n## 9. User-friendly explanation\n\"We treat VIP support like an emergency room — known patient, known stakes, no waiting. We pick up the phone, we drive the fix, and we make sure there's a backup path so the meeting still happens. After it's fixed, we write up what went wrong and add it to a profile so the next time it never gets that close.\"\n\n## 10. Internal technician notes\n- VIP list lives under HR + IT joint-ownership; refresh after every org chart change.\n- Auto-route inbound calls from the VIP / EA phone numbers to the L2 queue, never L1.\n- For C-suite, build a Conditional Access policy that *excludes* their accounts from the most aggressive risk policies (with compensating controls — token-bound device, hardware key) so they're never blocked at a wedding/demo/board meeting.\n- Have a \"break-glass\" admin password sealed with a date stamp; if a tech opens it during a VIP incident, force a password rotation after.\n- Telemetry: tag VIP tickets with `vip=true` so they show up on a separate SLA report.\n\n## 11. Related KB articles\n- l1-mfa-001 — MFA recovery (VIPs hit this most).\n- l2-onboarding-001 — New executive provisioning.\n- l3-security-001 — Incident response (most VIP issues escalate here).\n\n## 12. Keywords / search tags\nvip, executive support, white glove, c-suite, board member, personal assistant, desk-side, priority response, vvip, travel support, ceo, cfo, coo, board meeting, demo"
  },
  {
   "slug": "l2-vpn-001-gateway-and-certs",
   "path_rel": "knowledge-base\\L2\\l2-vpn-001-gateway-and-certs.md",
   "title": "\"VPN gateway, certificates, and Always-On profile management\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-vpn-001\ntitle: \"VPN gateway, certificates, and Always-On profile management\"\ncategory: vpn\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 45\naudience: admin\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\nprerequisites: [\"VPN gateway admin\", \"PKI / cert authority access\"]\nkeywords:\n  - vpn gateway\n  - certificate expired\n  - aovpn\n  - always on vpn\n  - device tunnel\n  - user tunnel\n  - rras\n  - ikev2\nrelated_articles:\n  - l1-vpn-001\n  - l3-networking-001\nescalation_trigger: \"Gateway capacity exhausted, or PKI compromise, or fleet-wide cert reissuance\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# VPN gateway, certs, Always-On profile management\n\n## 1. Symptoms\n- Multiple users / devices fail to connect.\n- \"Certificate validation failed\" on AnyConnect / GlobalProtect / AOVPN.\n- Always-On VPN device tunnel up but user tunnel fails.\n- Connection succeeds but routes wrong / DNS wrong.\n- Concurrent user limit hit.\n\n## 2. Common Causes\n1. Server cert expired or chain broken.\n2. CRL / OCSP unreachable from internet.\n3. Client cert expired or revoked.\n4. License / concurrent connection cap.\n5. Routing / split-tunnel ACL change.\n6. AOVPN profile XML out of sync after Intune push.\n\n## 3. Resolution Pathways\n**Server cert renewal:**\n1. Generate CSR on gateway (or use ACME if supported).\n2. Sign via internal PKI or public CA.\n3. Install on gateway; chain order matters.\n4. Restart VPN listener service.\n5. Verify with `openssl s_client -connect vpn.company.com:443 -showcerts`.\n\n**Client cert reissue (corporate PKI):**\n1. Confirm `Computer` cert template's autoenroll GPO/Intune SCEP config.\n2. Trigger renewal: `certutil -pulse` or wait for auto-renew threshold.\n3. Verify cert chain on client: `certmgr.msc → Personal → Certificates`.\n4. Push new profile to client if cert subject changed.\n\n**CRL / OCSP unreachable:**\n- Confirm CDP URL in cert is internet-reachable (publish CRL to a CDN / public web server).\n- For internal-only CRL, ensure VPN gateway can reach it pre-tunnel.\n\n**AOVPN profile drift:**\n- Pull current profile XML from working device: `Get-VpnConnection -AllUserConnection | Out-File`.\n- Compare to source XML in Intune.\n- Repush profile via Intune; force sync on client.\n\n**Capacity exhausted:**\n- License: check vendor portal — increase if undersized.\n- Tunnel concurrency: scale gateway out (redundant gateways behind load balancer).\n\n## 4. Verification\n- Test users sign in cleanly.\n- Cert chain valid + expiry >90 days out.\n- `Get-NetIPConfiguration` on client shows VPN tunnel adapter with correct DNS suffix.\n- Internal site loads (DNS resolves through tunnel).\n\n## 5. Escalation Trigger\n- PKI compromise (issue revocation lists, mass reissue).\n- Gateway HA failover misbehavior.\n- Concurrent capacity issue requires capex.\n- → Escalate to **L3 / Architecture**.\n\n## 6. Prevention\n- Monitor cert expiry — at 90/30/7-day thresholds.\n- Document AOVPN profile XML in source control.\n- Keep gateway firmware on N or N-1.\n- Use ACME for public-facing gateway certs (auto-renewal).\n- Capacity planning quarterly.\n\n## 7. Internal Notes\n- AnyConnect logs (server side): `/var/log/asa.log`, `show vpn-sessiondb`.\n- AOVPN debug: `Microsoft-Windows-VPN-Client/Operational` log; `Get-VpnConnection -Name <name> | fl`.\n- Device tunnel runs as SYSTEM, requires machine cert; user tunnel requires user cert (or EAP-TLS).\n- For RRAS: `netsh ras show authmode` and `netsh ras set tracing * enabled`.\n- Conditional Access for VPN: tag the VPN app, require compliant device — keeps external/managed boundaries clear.\n\n## 8. Related Articles\n- l1-vpn-001 — User-facing VPN troubleshooting\n- l3-networking-001 — Network architecture deep dive\n\n## 9. Keywords\nvpn gateway, certificate expired, aovpn, always on vpn, device tunnel, user tunnel, rras, ikev2"
  },
  {
   "slug": "l2-wifi-survey-001-wireless-site-survey",
   "path_rel": "knowledge-base\\L2\\l2-wifi-survey-001-wireless-site-survey.md",
   "title": "\"Wireless site survey and Wi-Fi coverage/performance remediation\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"wifi site survey\"",
    "\"wireless coverage\"",
    "\"wifi dead zone\"",
    "\"co-channel interference\"",
    "\"rssi snr targets\"",
    "\"channel utilization\"",
    "\"2.4 vs 5 vs 6 ghz\"",
    "\"ap placement\"",
    "\"predictive survey\"",
    "\"passive survey\"",
    "\"active survey\"",
    "\"wifi roaming issues\"",
    "\"channel width\"",
    "\"slow wifi remediation\"",
    "\"ap density\""
   ],
   "compliance": [],
   "content": "---\nid: l2-wifi-survey-001\ntitle: \"Wireless site survey and Wi-Fi coverage/performance remediation\"\ncategory: network\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 90\naudience: it-technician\nos_scope: [\"Windows 11\",\"Windows 10\",\"macOS\"]\nprerequisites: []\nkeywords: [\"wifi site survey\",\"wireless coverage\",\"wifi dead zone\",\"co-channel interference\",\"rssi snr targets\",\"channel utilization\",\"2.4 vs 5 vs 6 ghz\",\"ap placement\",\"predictive survey\",\"passive survey\",\"active survey\",\"wifi roaming issues\",\"channel width\",\"slow wifi remediation\",\"ap density\"]\nrelated_articles: [\"l2-wifi-001\",\"l2-network-troubleshoot-001\",\"l2-switch-001\",\"l2-dns-001\"]\nescalation_trigger: \"Coverage/capacity gaps require additional access points, cabling, or AP hardware/firmware changes beyond on-site adjustment, or RF interference comes from an uncontrollable external source.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Wireless site survey and Wi-Fi remediation\n\n## 1. Symptoms\n- Users report slow Wi-Fi, drops, or \"no signal\" in specific areas (dead zones).\n- Calls/video drop while walking between rooms or floors (roaming problems).\n- Wi-Fi is fine when empty but unusable when the area is full (capacity problem).\n- One band works, another doesn't; devices cling to a far AP.\n- Throughput is far below the link rate the client reports.\n\n## 2. Likely Causes\n1. **Coverage gaps:** too few APs, poor placement, or signal attenuated by walls/metal/glass.\n2. **Capacity:** too many clients per AP / per channel for the band's airtime.\n3. **Interference:** co-channel (same channel reused too densely) or adjacent-channel (overlapping channels), plus non-Wi-Fi RF.\n4. **Band/channel design:** overuse of 2.4 GHz, channel widths too wide causing overlap, DFS flaps.\n5. **Roaming:** APs at too-high power so clients \"stick,\" or missing roaming assistance features.\n6. **Backhaul:** uplink/switch/PoE constraint, not the RF at all.\n\n## 3. Questions To Ask User\n1. Where exactly is the problem — specific rooms/floors, or everywhere?\n2. What time/condition — always, only when busy, or only while moving?\n3. Which devices/bands are affected (phones, laptops; 2.4/5/6 GHz)?\n4. What changed recently — new walls/furniture, more people, new AP, firmware update, a new neighbor's network?\n5. What are the actual symptoms — no connection, connects but slow, or drops/roaming?\n\n## 4. Troubleshooting Steps\n**Decide the survey type:**\n- **Predictive (design):** model coverage from a floor plan with wall materials before installing — used for new builds/redesigns.\n- **Passive:** walk the space listening to RF (no association) to map RSSI, SNR, channel use, and rogue/neighbor APs — fastest for diagnosing existing coverage.\n- **Active:** associate to the SSID and measure real throughput, loss, latency, and roaming as you walk — confirms user experience and validates a fix.\n\n**Methodology:**\n1. Define goals and target zones; get an accurate scaled floor plan.\n2. Run a **passive** survey to baseline RSSI/SNR, channel utilization, and interference; identify dead zones and co/adjacent-channel overlap.\n3. Run an **active** survey through the problem path to capture throughput, retries, and roaming behavior.\n4. Inventory the RF environment: neighboring networks, DFS radar events, non-Wi-Fi sources (microwaves, BT, cameras).\n5. Check backhaul: AP uplink negotiated speed, PoE budget, switch port errors, controller/AP load.\n\n**Targets to compare against (typical design goals):**\n- **RSSI:** ≥ -65 dBm for voice/video; ≥ -70 dBm for general data at the cell edge.\n- **SNR:** ≥ 25 dB for voice/high throughput; ≥ 20 dB acceptable for data.\n- **Channel utilization:** keep below ~40–50% busy; sustained higher means a capacity/interference problem.\n- **Co-channel overlap:** minimize cells on the same channel hearing each other above ~-85 dBm.\n\n## 5. Resolution Steps\n1. **Band strategy:** treat **2.4 GHz** as coverage-only (use channels **1/6/11** at low density, often reduced power or disabled radios), put capacity on **5 GHz**, and use **6 GHz** (Wi-Fi 6E/7) for clean, high-capacity zones where clients support it.\n2. **Channel width:** prefer **20 or 40 MHz** on 5 GHz in dense deployments — wider 80/160 MHz channels boost peak speed but cause overlap and co-channel contention. Reserve wide channels for low-density/6 GHz.\n3. **AP placement & density:** place APs for **cell overlap (~15–20%)** without excessive co-channel reuse; favor more APs at **lower power** over fewer at high power. Avoid mounting above hard ceilings/metal; keep away from large RF blockers.\n4. **Tune power:** lower 2.4 GHz and trim 5 GHz TX power so cells are appropriately sized and clients roam instead of sticking.\n5. **Reduce interference:** re-channelize to break co/adjacent-channel overlap; eliminate or relocate non-Wi-Fi sources; handle DFS flapping by selecting stable channels where radar is frequent.\n6. **Fix roaming:** ensure consistent SSID/security across APs, enable roaming-assist features (e.g. 802.11k/v/r where clients support them), and right-size cells so handoff happens.\n7. **Fix backhaul:** correct uplink speed/duplex, PoE budget, and switch errors before blaming RF.\n8. **Validate** with a fresh active survey along the same path.\n\n## 6. Verification Steps\n- Post-change passive/active survey shows target RSSI/SNR met across the problem zones with no remaining dead spots.\n- Channel utilization is within target during a busy period.\n- Roaming test (walk the path on a call) shows clean handoffs without drops.\n- Real throughput/latency measured on the active survey meets the use-case requirement.\n- User confirms the issue is resolved during normal load.\n\n## 7. Escalation Trigger\n- The fix requires **additional APs, new cabling/PoE capacity, or hardware/firmware changes** beyond on-site tuning. Escalate to **network engineering / procurement** with the survey heatmaps and recommended AP count/placement.\n- Interference originates from a source outside your control (neighboring tenant, external radar).\n- Capacity demand exceeds what the current AP/controller model can serve.\n\n## 8. Prevention Tips\n- Survey **before** occupancy changes (renovations, added staff, new dense areas), not only after complaints.\n- Keep an as-built map of AP locations, channels, power, and uplinks; re-validate after any AP/firmware change.\n- Standardize on a clean channel plan and disable unneeded 2.4 GHz radios in dense areas.\n- Right-size for capacity (clients/AP and airtime), not just coverage bars.\n- Re-survey periodically; the RF environment drifts as neighbors and clients change.\n\n## 9. User-Friendly Explanation\n\"Wi-Fi problems usually aren't 'the internet is slow' — they're about radio coverage and crowding. We walk the space with survey tools to measure how strong and how clean the signal is in each area, find dead zones and channels that are stepping on each other, then adjust where the access points are, how loud they broadcast, and which channels they use. Sometimes the fix is tuning what's there; sometimes we genuinely need another access point in a weak spot.\"\n\n## 10. Internal Technician Notes\n- RSSI is absolute signal (dBm, closer to 0 is stronger); SNR is signal above noise (dB, higher is better) and is often the real throughput limiter in noisy environments.\n- Co-channel interference (CCI) = same channel cells contending for airtime (slows everyone via CSMA/CA); adjacent-channel interference (ACI) = overlapping channels raising the noise floor — ACI is worse and is what 1/6/11-only planning on 2.4 GHz avoids.\n- Wider channels (80/160 MHz) reduce the number of non-overlapping channels available — a classic cause of self-inflicted CCI in dense offices. Narrower channels + more APs usually beats fewer wide-channel APs for capacity.\n- DFS channels (5 GHz) can flap on radar detection; in airport/weather-radar proximity prefer non-DFS or accept the trade-off.\n- 6 GHz (6E/7) offers wide clean spectrum but shorter range and client-support gaps; design as a capacity overlay, not sole coverage.\n- Always confirm wired backhaul/PoE before RF tuning — a 100 Mbps-negotiated uplink or PoE starvation masquerades as \"bad Wi-Fi.\"\n\n## 11. Related KB Articles\n- l2-wifi-001 — Wi-Fi client connection and authentication issues\n- l2-network-troubleshoot-001 — Structured network triage methodology\n- l2-switch-001 — Switch port, PoE, and uplink troubleshooting\n- l2-dns-001 — Internal DNS resolution problems\n\n## 12. Keywords / Search Tags\nwifi site survey, wireless coverage, wifi dead zone, co-channel interference, rssi snr targets, channel utilization, 2.4 vs 5 vs 6 ghz, ap placement, predictive survey, passive survey, active survey, roaming, channel width, ap density, slow wifi"
  },
  {
   "slug": "l2-windows-001-profile-rebuild",
   "path_rel": "knowledge-base\\L2\\l2-windows-001-profile-rebuild.md",
   "title": "\"Windows user profile corrupted / temp profile / rebuild\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-windows-001\ntitle: \"Windows user profile corrupted / temp profile / rebuild\"\ncategory: windows\nsupport_level: L2\nseverity: high\nestimated_time_minutes: 45\naudience: admin\nprerequisites: [\"Local admin on user device\", \"Domain admin if AD/AAD-joined\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - profile corrupted\n  - temp profile\n  - profile rebuild\n  - we can't sign in to your account\n  - user shell folders\n  - regedit profilelist\nrelated_articles:\n  - l1-windows-006\n  - l2-active-directory-001\nescalation_trigger: \"Roaming profile / FSLogix corruption affecting multiple users\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Windows user profile rebuild\n\n## 1. Symptoms\n- \"We can't sign in to your account\" → temporary profile loaded.\n- Desktop empty after sign-in.\n- Apps don't see user data.\n- Profile folder bloated / locked.\n- Specific user has issues; another user on same PC fine.\n\n## 2. Diagnostic\n- Event Viewer → Application → Source = User Profile Service.\n- ProfileList registry: `HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\ProfileList\\<SID>`.\n- `.bak` suffix on user's SID key = corrupted load.\n\n## 3. Resolution\n**Standard rebuild (single user):**\n1. Sign out user; sign in as local admin.\n2. Back up user's data: `C:\\Users\\<user>\\` → external location (Documents, Desktop, AppData if needed).\n3. Open System Properties → Advanced → User Profiles → Settings → select profile → Delete.\n4. Or via registry: delete `ProfileList\\<SID>` and `ProfileList\\<SID>.bak` (if present).\n5. Reboot.\n6. User signs in fresh — new profile created.\n7. Restore data from backup into new profile.\n8. Reconfigure Office accounts, OneDrive, etc.\n\n**For OneDrive users (cleaner):**\n- Their OneDrive Known Folders (Desktop, Docs, Pictures) restore automatically once they sign back in.\n- Outlook OST rebuilds from server.\n- Browser data may need fresh sign-in / sync.\n\n**FSLogix profile issues (RDS / AVD):**\n- Take container offline (admin action).\n- Mount VHD(X) on tech workstation, validate or extract.\n- Replace with fresh container if corrupt.\n\n## 4. Verification\n- User signs in to permanent profile (not temp).\n- Documents, settings, and apps work.\n- ProfileList no `.bak` keys for this user.\n- Event log clean.\n\n## 5. Escalation\n- Multiple users hitting same issue → roaming/FSLogix infra.\n- Domain controller side ACL/group issue.\n- → L3.\n\n## 6. Prevention\n- For shared PCs, use proper OneDrive Known Folder Move.\n- Don't store work-critical data in C:\\Users\\<u>\\.\n- Patch UPHCLEAN-related issues (legacy, but still occasional).\n- For RDS, monitor container performance + size.\n\n## 7. Notes\n- Profile size cap: nothing inherent, but oversized profiles slow logon dramatically. Trim AppData regularly.\n- Temp profile warning: `notify` event 1530 in Application log when profile not unloading cleanly.\n- ProfileList .bak: indicator profile load failed; rename procedure: rename SID to SID.old, rename SID.bak to SID, sign in.\n- OneDrive Known Folder Move + Office apps tied to MSA make profile rebuild far less destructive.\n\n## 8. Related\n- l1-windows-006 — App won't open (sometimes profile-symptom)\n- l2-active-directory-001 — Identity foundational\n\n## 9. Keywords\nprofile corrupted, temp profile, profile rebuild, we can't sign in to your account, user shell folders, regedit profilelist"
  },
  {
   "slug": "l3-backup-dr-002-immutable-storage",
   "path_rel": "knowledge-base\\L3\\l3-backup-dr-002-immutable-storage.md",
   "title": "\"Immutable / air-gapped backup design (anti-ransomware)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-backup-dr-002\ntitle: \"Immutable / air-gapped backup design (anti-ransomware)\"\ncategory: backup-dr\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 60\naudience: technician\nprerequisites: [\"Backup admin\", \"Storage admin\"]\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - immutable backup\n  - air gap\n  - object lock\n  - ransomware proof\n  - 3-2-1-1-0\n  - veeam hardened repository\n  - aws s3 object lock\n  - azure backup vault\nrelated_articles:\n  - l3-disaster-recovery-001\n  - l2-malware-001\nescalation_trigger: \"Active ransomware event, restore validation failure, immutable tier compromised\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Immutable / air-gapped backup design\n\n## 1. Why\nRansomware deletes or encrypts backups before encrypting prod. Immutable + air-gapped tiers survive.\n\n## 2. Architecture options\n- **Object Lock (S3, Azure Blob immutable, GCS):** time-bound lock prevents delete/overwrite, even by admin with credentials.\n- **Veeam Hardened Repository (Linux):** XFS reflinks + Linux-only access, immutable flag.\n- **Tape (LTO):** physical air gap when removed from library.\n- **Snapshot replication to isolated tenant / VPC:** access only via break-glass.\n- **Vendor PBBA (Data Domain Retention Lock, Rubrik LiveSync):** policy-based immutability.\n\n## 3. Design\n- Tier 1 (operational): fast restore, standard storage. RTO short.\n- Tier 2 (immutable): protected against logical attack. RPO acceptable.\n- Tier 3 (air gap / offline): worst-case recovery. Long retrieval time, full integrity guarantee.\n\n## 4. Operational discipline\n- Test restores monthly (random sample).\n- Validate immutability flag set as expected.\n- Separate credential domain for backup admins; no overlap with prod admin.\n- MFA + PIM for backup tooling.\n- Monitor for delete attempts.\n\n## 5. Restore procedure (post-ransomware)\n1. Identify clean restore point (predates compromise).\n2. Restore to isolated rebuild environment.\n3. Verify integrity (checksums).\n4. Scan for IoCs before reconnecting to network.\n5. Restore service with elevated monitoring for 30+ days.\n\n## 6. Verification\n- Immutability flag verified on every protected backup chain.\n- Restore test successful (full app + data + access).\n- Air-gapped tier inventory matches expectations.\n\n## 7. Escalation\n- Immutable tier compromised — major incident.\n- Restore validation fails — DR plan invalid.\n- → IR + DR runbook activation.\n\n## 8. Prevention\n- Defense in depth: immutability + offline + monitoring.\n- Don't rely on a single technology.\n- Document chain-of-custody for offline tier.\n- Rotate keys / credentials.\n\n## 9. Notes\n- Time-bound vs governance-mode object lock — pick based on legal hold needs.\n- Cloud-tier immutability not silver bullet — credentials still attackable.\n- Consider 7-day immutability minimum for operational tier; 30-90d for compliance.\n\n## 10. Related Articles\n- l3-disaster-recovery-001 — Full DR runbook\n- l2-malware-001 — Ransomware triage\n\n## 11. Keywords\nimmutable backup, air gap, object lock, ransomware proof, 3-2-1-1-0, veeam hardened repository, aws s3 object lock, azure backup vault"
  },
  {
   "slug": "l3-business-continuity-001-dr-bc-plan",
   "path_rel": "knowledge-base\\L3\\l3-business-continuity-001-dr-bc-plan.md",
   "title": "\"Disaster Recovery & Business Continuity program (planning + invocation)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-business-continuity-001\ntitle: \"Disaster Recovery & Business Continuity program (planning + invocation)\"\ncategory: continuity\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 240\naudience: it-technician\nos_scope: [\"All\"]\nprerequisites: []\nkeywords:\n  - business continuity\n  - disaster recovery\n  - business impact analysis\n  - rto rpo\n  - dr tiers\n  - failover failback\n  - restore testing\n  - tabletop exercise\n  - declare a disaster\n  - runbook\n  - bcp\n  - recovery objectives\nrelated_articles:\n  - l3-disaster-recovery-001\n  - l3-backup-dr-002\n  - l3-security-001\n  - l3-virtualization-001\nescalation_trigger: \"Declaring a disaster and invoking failover is a management decision; engage executive leadership, the BC/DR owner, and affected vendors before invoking, and whenever recovery objectives (RTO/RPO) are at risk of being missed.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Disaster Recovery & Business Continuity program (planning + invocation)\n\n## 1. Symptoms\n- No documented, tested DR/BC plan, or one that is stale, untested, or owned by no one.\n- An outage/disaster is unfolding and it's unclear who decides to \"declare a disaster,\" in what order to recover, or what the targets are.\n- Backups exist but restores have never been proven; recovery objectives (RTO/RPO) are undefined or unrealistic.\n- Audit, insurance, or customer due-diligence asks for a BC/DR plan that doesn't exist or can't be evidenced.\n- DR site/replication present but failover/failback procedures are unwritten or never rehearsed.\n\n## 2. Likely Causes\n- BC/DR treated as a document to file, not a tested, living capability.\n- No Business Impact Analysis (BIA), so priorities, dependencies, and tolerable downtime/data-loss are unknown.\n- Backups not validated, immutable, or offsite; recovery assumed rather than proven.\n- Organizational growth/change outpaced the plan; new systems and dependencies never added.\n- Unclear roles, authority, and communications, so even good technical recovery stalls on decisions.\n\n## 3. Questions To Ask User\n- What are the most critical business processes, and how long can each be down (RTO) and how much data loss is tolerable (RPO)?\n- What systems/data/vendors do those processes depend on (including upstream/third-party services)?\n- Where are backups, are they immutable/offsite, and when was a restore last successfully tested?\n- Is there a DR site or replication, and have failover/failback ever been rehearsed?\n- Who has authority to declare a disaster and invoke DR, and who must be notified (staff, customers, regulators)?\n- Are there contractual/regulatory recovery or notification obligations?\n- When was the plan last reviewed and tabletop-tested?\n\n## 4. Troubleshooting Steps\n> Planning is collaborative and human-led; invocation during a real disaster is a management decision. ARIA helps build, document, and maintain the program and supports coordination during invocation — it does not unilaterally declare disasters or execute failover.\n1. **Run/refresh a Business Impact Analysis (BIA):** rank business processes by criticality, map dependencies (systems, data, people, vendors), and capture maximum tolerable downtime and data loss.\n2. **Set RTO/RPO per system from the BIA** (recovery-time and recovery-point objectives) so targets are explicit and realistic, not aspirational.\n3. **Assign DR tiers:** match each system to a recovery tier (e.g., hot/warm/cold) and recovery strategy proportional to its RTO/RPO and cost.\n4. **Inventory current recovery capability** (backups, replication, DR site, runbooks) and identify gaps against the objectives — especially unproven restores.\n5. **Clarify decision authority and roles** for declaring a disaster, plus the communications/notification matrix (staff, customers, regulators, vendors).\n6. **Assess realism:** confirm objectives are achievable with current capability, or flag the gap to leadership for investment.\n\n## 5. Resolution Steps\n> Section 5 covers building the program and the invocation sequence for a senior engineer / DR owner. Declaring a disaster and any failover/failback are management-authorized; vendor engagement is noted.\n1. **Author tiered DR runbooks** with explicit recovery order (dependencies first), step-by-step actions, owners, and verification points (align technical runbooks with l3-disaster-recovery-001).\n2. **Validate backups and prove restores:** schedule regular restore tests to verified-clean, immutable/offline copies (l3-backup-dr-002). An untested backup is not a recovery capability.\n3. **Document and rehearse failover AND failback:** failback is frequently neglected and is where unrehearsed plans fail — plan the return to primary, not just the jump to DR.\n4. **Define the disaster-declaration process:** criteria, the authorized decision-maker(s), invocation trigger, and the communications plan. **Declaration and invocation are leadership decisions**, not technician calls.\n5. **Run tabletop exercises** (and, where feasible, live failover tests) at least periodically; capture findings and remediate the plan.\n6. **Invocation (during a real event):** confirm the declaration from the authorized decision-maker → activate the comms plan and roles → execute runbooks in recovery order → engage vendors (cloud, storage, hypervisor) where required → meet RTO/RPO and validate before returning to service → plan failback once primary is healthy.\n7. **Maintain the program:** review after every change/incident and on a fixed cadence; keep contacts, dependencies, and objectives current.\n\n## 6. Verification Steps\n- A current BIA exists with agreed RTO/RPO per critical system, signed off by business owners.\n- Tiered runbooks exist with recovery order, owners, and verification steps; stored accessibly (and out-of-band).\n- Backups validated by recent successful restore tests to clean/immutable copies; results recorded.\n- Failover and failback procedures documented and exercised; last tabletop/live-test date current.\n- Disaster-declaration authority, roles, and communications matrix defined and known to participants.\n- During invocation: declared by the authorized party, runbooks executed in order, RTO/RPO met and verified, and a failback plan in place.\n\n## 7. Escalation Trigger\nDeclaring a disaster and invoking failover are management decisions — engage executive leadership and the BC/DR owner to declare, and notify affected vendors, customers, and regulators per the communications plan. Escalate immediately whenever recovery objectives (RTO/RPO) are at risk of being missed, when restores fail during invocation, or when the event is also a security incident (coordinate with l3-security-001).\n\n## 8. Prevention Tips\n- Treat BC/DR as a tested capability, not a binder: regular restore tests and tabletop/live exercises are the program.\n- Keep the BIA, dependency map, and RTO/RPO current as the business changes; add new systems to the plan at onboarding.\n- Use immutable/offsite backups and verify them; assume primary infrastructure can be fully lost (including to ransomware).\n- Document and rehearse failback, not just failover.\n- Store the plan, runbooks, and contact lists out-of-band so they're reachable when primary systems and email are down.\n- Pre-define disaster-declaration authority and the communications matrix so decisions don't stall mid-crisis.\n- Review the plan after every incident and on a fixed schedule; close gaps with owners and due dates.\n\n## 9. User-Friendly Explanation\nBusiness continuity is your plan for keeping the business running when something major breaks — a fire, a flood, a cyberattack, a cloud outage. We start by figuring out which activities matter most and how long they can pause and how much recent data you can afford to lose. From there we decide how each system should be protected and recovered, write clear step-by-step recovery guides, and — crucially — actually test that backups restore and that we can switch to a backup site and back again. We also agree in advance who has the authority to \"declare a disaster\" and how we'll communicate. A plan that's never tested tends to fail when you need it, so practice is the whole point.\n\n## 10. Internal Technician Notes\n- The BIA drives everything: no BIA means RTO/RPO and tiering are guesses. Get business sign-off on the objectives.\n- \"We have backups\" is not recovery — only a tested restore is. Untested backups are the single most common false sense of security.\n- Failback is the neglected half. Many plans rehearse failover and have no idea how to get back to primary cleanly.\n- Declaration authority and comms must be pre-agreed; technical recovery often stalls on \"who decides?\" not on technology.\n- Store plans/runbooks/contacts out-of-band — they're useless if they live only on the systems that are down.\n- If the disaster is a security incident, coordinate with l3-security-001 (recover from clean/immutable backups, don't restore the compromise back).\n\n## 11. Related KB Articles\n- l3-disaster-recovery-001 — Technical DR runbook this program operationalizes\n- l3-backup-dr-002 — Immutable/offline backups the program depends on\n- l3-security-001 — When the disaster is a cyber incident\n- l3-virtualization-001 — Failover of virtualized workloads during invocation\n\n## 12. Keywords / Search Tags\nbusiness continuity, disaster recovery, business impact analysis, rto rpo, dr tiers, failover failback, restore testing, tabletop exercise, declare a disaster, runbook, bcp, recovery objectives"
  },
  {
   "slug": "l3-certificates-001-pki",
   "path_rel": "knowledge-base\\L3\\l3-certificates-001-pki.md",
   "title": "\"Internal PKI / cert lifecycle / autoenroll / OCSP\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-certificates-001\ntitle: \"Internal PKI / cert lifecycle / autoenroll / OCSP\"\ncategory: certificates\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 90\naudience: technician\nprerequisites: [\"AD CS / PKI admin\", \"Network access to CA tier\"]\nos_scope: [\"Windows Server\"]\nkeywords:\n  - pki\n  - certificate authority\n  - ad cs\n  - autoenroll\n  - crl\n  - ocsp\n  - subordinate ca\n  - root ca\n  - hsm\n  - revoke\nrelated_articles:\n  - l3-sso-saml-001\n  - l2-vpn-001\nescalation_trigger: \"CA compromise, root CA recovery, mass cert reissue\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Internal PKI lifecycle\n\n## 1. Architecture\n- Offline Root CA (powered off, in safe).\n- Online Subordinate Issuing CA(s) for day-to-day issuance.\n- HSM-protected keys for any production CA.\n- CRL Distribution Point (CDP) and AIA / OCSP responder published over HTTP (not LDAP) for broad reachability.\n- Templates: device, user, code-signing, server-auth — each with appropriate key length, validity, EKUs.\n\n## 2. Common operations\n**Auto-enrollment for users / devices:**\n- Configure GPO: Computer Configuration → Windows Settings → Security Settings → Public Key Policies → Certificate Services Client - Auto-Enrollment.\n- Template ACL: Read + Enroll + Autoenroll for the security group.\n- Renewal threshold typically at 80% of validity.\n\n**Revocation:**\n- `certutil -revoke <serial>` then publish CRL: `certutil -CRL`.\n- Verify CRL published to CDP URL.\n- For public-trust certs, contact issuing CA.\n\n**Reissue compromised CA:**\n- Document scope.\n- Issue new offline root if root compromised.\n- Re-issue subordinates.\n- Mass reissue endpoint certs.\n- Mass deploy new root cert via GPO.\n- Old CRLs continue to apply until expiry.\n\n**OCSP responder:**\n- High-availability OCSP saves CRL download bandwidth.\n- Configure `Online Responder` role; revocation provider points to CA database.\n\n## 3. Verification\n- New cert template enrolls cleanly.\n- Revocation propagates within CRL publishing interval.\n- OCSP responder green; clients hit it (not CRL) for typical revocation checks.\n- Audit log captures issuance + revocation.\n\n## 4. Escalation\n- CA compromise — full IR + new infrastructure.\n- HSM failure — vendor recovery.\n- Cross-forest trust cert chain breakage.\n\n## 5. Prevention\n- Offline root, never connected.\n- HSM for issuing CA keys.\n- Quarterly DR drill: simulate sub-CA failure + recovery.\n- Document templates + ACLs in source control.\n- Cert lifecycle monitoring (Keyfactor, Venafi, or PowerShell).\n- Don't let any cert (server or sub-CA) silently expire.\n\n## 6. Notes\n- Root CA validity 20 years typical; sub-CA 10 years; end-entity 1–3 years.\n- Don't issue SHA-1; modern CAs SHA-256+.\n- Avoid wildcard certs unless necessary; SAN-based preferred.\n- Public + private trust mixed: maintain separation; no public chain on internal HTTPS endpoints unless required.\n\n## 7. Related Articles\n- l3-sso-saml-001 — Cert validation in SAML\n- l2-vpn-001 — VPN cert chain\n\n## 8. Keywords\npki, certificate authority, ad cs, autoenroll, crl, ocsp, subordinate ca, root ca, hsm, revoke"
  },
  {
   "slug": "l3-certificates-002-ca-expiry",
   "path_rel": "knowledge-base\\L3\\l3-certificates-002-ca-expiry.md",
   "title": "\"Certificate Authority / critical certificate expiry\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-certificates-002\ntitle: \"Certificate Authority / critical certificate expiry\"\ncategory: pki\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 180\naudience: it-technician\nos_scope: [\"Windows Server\", \"Linux\", \"Network Appliances\", \"All\"]\nprerequisites: []\nkeywords:\n  - ca certificate expired\n  - root ca expiry\n  - issuing ca expiry\n  - crl expired\n  - mass validation failure\n  - certificate renewal\n  - rekey\n  - cross-sign\n  - code signing expiry\n  - 802.1x failure\n  - vpn certificate\n  - tls handshake failure\nrelated_articles:\n  - l3-certificates-001\n  - l3-sso-saml-001\n  - l3-security-001\n  - l3-networking-001\nescalation_trigger: \"Engage PKI lead, the certificate vendor/public CA, and management when a root or issuing CA is expiring/expired, a CRL has lapsed causing mass failures, or a re-key/cross-sign is required across the fleet.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Certificate Authority / critical certificate expiry\n\n## 1. Symptoms\n- Sudden, broad authentication/TLS failures across many systems at once (a hallmark of CA or CRL expiry, not a single leaf cert).\n- Browsers/clients report certificate **expired**, **revoked**, or **untrusted issuer**.\n- VPN, Wi-Fi (802.1x/EAP-TLS), or RADIUS clients can no longer connect.\n- Code-signed apps/drivers/scripts blocked or warned as untrusted.\n- Services fail to start or talk to each other (mutual TLS) after a known cert/CA date passes.\n- CRL/OCSP checks fail \"hard,\" so even valid leaf certs are rejected.\n\n## 2. Likely Causes\n- **Root or issuing (subordinate) CA certificate expired**, invalidating the entire chain beneath it — high blast radius.\n- **CRL expired** (the Certificate Revocation List wasn't re-published before its nextUpdate), so clients doing hard revocation checks reject everything.\n- A high-value **leaf certificate expired** (wildcard, load-balancer, RADIUS server, code-signing, SAML signing) affecting many dependents.\n- OCSP responder down/expired causing revocation-check failures.\n- Renewal automation (ACME/autoenroll) silently broke; nobody noticed until expiry.\n- Clock skew making valid certs appear not-yet-valid or expired.\n\n## 3. Questions To Ask User\n- When did failures start, and is there a known cert/CA/CRL expiry date matching that time?\n- Is one service affected or many at once (the latter points to CA or CRL, not a leaf cert)?\n- Which exact certificate is implicated — leaf, issuing CA, root CA, or the CRL/OCSP — and where is it published?\n- Was anything changed recently (CA migration, automation change, time/NTP change)?\n- Is this an internal PKI (AD CS, see l3-certificates-001) or a public/third-party CA, or both in the chain?\n- What is the business impact and which services must come back first?\n- Do we have the CA admin credentials/HSM access and (for public certs) the vendor/CA account to perform an emergency reissue?\n\n## 4. Troubleshooting Steps\n> L3 triage. CA-tier and HSM operations are senior/PKI-lead work. ARIA identifies the failing certificate/CRL and documents scope; it does not autonomously re-key or re-issue CA certificates.\n1. **Inspect the actual chain** on a failing endpoint: identify which certificate in the chain (leaf → issuing CA → root) is expired/untrusted, and capture not-before/not-after dates and serials.\n2. **Distinguish CA/CRL expiry from leaf expiry by blast radius.** Many unrelated services failing together strongly indicates a CA or CRL problem; a single service failing indicates a leaf cert.\n3. **Check the CRL and OCSP.** Confirm CRL nextUpdate hasn't passed and the OCSP responder is healthy — an expired CRL alone can cause mass validation failures.\n4. **Verify time/NTP** on clients and CA/responder; clock skew mimics expiry.\n5. **Map the dependency surface** of the implicated cert/CA: which services, devices, VPN/Wi-Fi, code-signing, and federations rely on it. This scopes the emergency change.\n6. **Confirm whether keys can be reused (renew/re-key with same key) or must be rotated**, and where the private keys/HSM live, before any reissue is attempted.\n\n## 5. Resolution Steps\n> Section 5 is for a senior engineer / PKI lead. Public-trust and HSM-backed CA operations require vendor/CA engagement — called out inline.\n1. **Expired/expiring leaf certificate:** Renew or re-key it through the existing CA (internal AD CS per l3-certificates-001, or the public CA), deploy to all dependents, and restart/reload the consuming services.\n2. **Expired CRL (fastest, highest-impact fix):** Re-publish a fresh CRL from the issuing CA to all CDP locations and confirm clients pick it up. This often restores mass functionality immediately without touching any leaf cert.\n3. **Issuing (subordinate) CA expiry:** Renew the subordinate CA certificate from the root (renew with existing or new key per policy), publish the new CA cert into trust stores, then renew/re-issue leaf certs as needed. **PKI lead drives this; engage vendor if HSM-backed.**\n4. **Root CA expiry (highest blast radius):** This is a planned, human-led operation — generate/renew the root, distribute the new root to all trust stores (GPO/MDM/manual), and **cross-sign** old↔new where possible so existing chains keep validating during transition. **Mandatory: PKI lead + management approval; vendor engagement for public roots and HSM.**\n5. **Public/third-party certificate or CA:** Perform emergency reissue through the **public CA/vendor** account; you cannot self-sign these. Engage the vendor's emergency/expedited process.\n6. **Restore the renewal automation** (ACME/autoenroll) so this does not recur, and document the new expiry dates.\n\n## 6. Verification Steps\n- Failing endpoints now present a complete, valid, in-date chain (leaf → issuing CA → root all trusted and unexpired).\n- CRL shows a fresh nextUpdate and is reachable at every CDP; OCSP responder healthy; revocation checks pass.\n- Affected services (TLS, VPN, 802.1x/RADIUS, code-signing, SAML/federation) all reconnect and operate.\n- New root/issuing CA cert present in all required trust stores across the fleet (spot-check multiple OS/device types).\n- No clients still pinned to or caching the old expired artifact; clocks/NTP in sync.\n- Renewal automation re-enabled and a monitoring alert exists for upcoming expiries.\n\n## 7. Escalation Trigger\nEngage the PKI lead, certificate vendor/public CA, and management when a root or issuing CA is expired/expiring, when a lapsed CRL is causing fleet-wide failures, when a re-key/cross-sign or root distribution is needed, or when HSM-backed key operations are involved. Root CA renewal and cross-signing are planned, approval-gated, human-led operations — never improvise them under pressure alone.\n\n## 8. Prevention Tips\n- Maintain a monitored inventory of every CA, CRL, OCSP responder, and high-value leaf certificate with expiry alerting well in advance (multiple thresholds).\n- Treat **CRL nextUpdate** as a monitored expiry too — lapsed CRLs cause outages as surely as expired certs.\n- Plan root/issuing CA renewal windows years ahead; never let a CA reach its last months unmanaged.\n- Automate leaf renewal (ACME/autoenroll) and alert when automation fails, not only when certs expire.\n- Pre-stage and test cross-signing for root rollovers so transitions are seamless.\n- Keep CA recovery procedures, HSM access, and vendor contacts documented and rehearsed (tie to l3-certificates-001 DR drills).\n- Sync time/NTP everywhere; skew turns valid certs into outages.\n\n## 9. User-Friendly Explanation\nDigital certificates are like ID cards that let your systems trust each other and encrypt traffic. Each has an expiry date, and they're arranged in a chain — if the \"master\" card (the Certificate Authority) or the public \"revocation list\" expires, every ID card under it stops being trusted all at once, which is why so many things broke together. The fix is to renew the right card in the chain and make sure every device gets the updated trust information. For the top-level master certificate, we plan carefully and often run old and new in parallel so nothing drops while we transition, and for purchased certificates we go through the vendor.\n\n## 10. Internal Technician Notes\n- Blast radius is the diagnostic shortcut: many things failing at once = CA or CRL, not a leaf cert. Check the CRL nextUpdate early — re-publishing a CRL is often the fastest mass fix.\n- Re-publishing a fresh CRL can restore validation immediately even before any cert is renewed — try it when an expired CRL is the cause.\n- Root CA renewal = cross-sign + trust-store distribution + management approval. Don't attempt it ad hoc; coordinate with the PKI lead per l3-certificates-001.\n- Public/third-party certs cannot be self-renewed — you must go through the issuing CA/vendor's emergency process.\n- After resolution, fix the automation that allowed the expiry, and add/verify the expiry monitoring so it never recurs.\n- Watch for hard-fail revocation checking: an OCSP/CRL outage can break valid certs; understand the clients' soft-fail vs hard-fail behavior.\n\n## 11. Related KB Articles\n- l3-certificates-001 — Internal PKI lifecycle, AD CS, autoenroll, OCSP\n- l3-sso-saml-001 — Certificate validation in SAML / federation\n- l3-security-001 — If expiry coincides with or masks a CA compromise\n- l3-networking-001 — VPN/802.1x/RADIUS dependencies on certificates\n\n## 12. Keywords / Search Tags\nca certificate expired, root ca expiry, issuing ca expiry, crl expired, mass validation failure, certificate renewal, rekey, cross-sign, code signing expiry, 802.1x failure, vpn certificate, tls handshake failure"
  },
  {
   "slug": "l3-cloud-001-azure-tenant-design",
   "path_rel": "knowledge-base\\L3\\l3-cloud-001-azure-tenant-design.md",
   "title": "\"Azure tenant + subscription design / landing zones\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-cloud-001\ntitle: \"Azure tenant + subscription design / landing zones\"\ncategory: cloud\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 120\naudience: technician\nprerequisites: [\"Azure global admin or owner-tier\"]\nos_scope: [\"Azure\"]\nkeywords:\n  - azure\n  - tenant\n  - subscription\n  - landing zone\n  - management groups\n  - azure policy\n  - rbac\n  - cost management\n  - identity\nrelated_articles:\n  - l3-security-001\n  - l3-networking-001\nescalation_trigger: \"Tenant restructure, sovereignty constraint, M&A integration\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Azure tenant + subscription design\n\n## 1. Hierarchy\n- Tenant (Entra) — top-level identity boundary.\n- Management groups → enable policy/RBAC inheritance.\n- Subscriptions → billing and access boundary.\n- Resource groups → application boundary.\n- Resources.\n\n## 2. Landing zone (Microsoft Cloud Adoption Framework)\n- Platform subscriptions (identity, mgmt, connectivity).\n- Workload (landing zone) subscriptions per app or BU.\n- Sandbox subscriptions for experimentation, no peering to prod.\n\n## 3. Identity\n- One Entra tenant per company; multi-tenant only for separations of legal entity.\n- Privileged Identity Management (PIM) for time-bound elevation.\n- Conditional Access protects all admin paths.\n- Entra ID Governance for access reviews + access packages.\n\n## 4. RBAC\n- Use built-in roles. Custom roles only when required.\n- Assign at lowest scope necessary.\n- Avoid Owner / Contributor at subscription unless justified.\n- Separate workload teams from platform teams.\n\n## 5. Policy\n- Azure Policy enforces compliance: tagging, locations, SKU restrictions.\n- Initiatives bundle policies (CIS, ISO, custom).\n- Audit-first, then enforce.\n- Inheritance from MG → SUB → RG.\n\n## 6. Cost management\n- Tagging baseline: env, owner, costcenter, app.\n- Budgets per subscription with alerts.\n- Reservations + savings plans for stable workloads.\n- Monthly review with Finance.\n\n## 7. Network\n- Hub-and-spoke standard. Hub in connectivity sub.\n- Azure Firewall or NVA in hub.\n- Private endpoints for PaaS.\n- DNS private zones tied to hub.\n- ExpressRoute or VPN to on-prem.\n\n## 8. M&A / restructure\n- Tenant migrations are painful — plan months ahead.\n- Use B2B for short-term cross-tenant access.\n- Cross-tenant sync (CTS) for identity continuity.\n- Subscription transfer between tenants with care + validation.\n\n## 9. Verification\n- Landing zone deployed via IaC (Bicep / Terraform).\n- Policies in compliance.\n- RBAC reviewed.\n- Cost trending healthy.\n- DR + backup tested.\n\n## 10. Related\n- l3-security-001 — IR scope\n- l3-networking-001 — Network architecture\n\n## 11. Keywords\nazure, tenant, subscription, landing zone, management groups, azure policy, rbac, cost management, identity"
  },
  {
   "slug": "l3-disaster-recovery-001-runbook",
   "path_rel": "knowledge-base\\L3\\l3-disaster-recovery-001-runbook.md",
   "title": "\"Disaster recovery runbook: RTO/RPO, restore order, validation\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-disaster-recovery-001\ntitle: \"Disaster recovery runbook: RTO/RPO, restore order, validation\"\ncategory: backup-dr\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 240\naudience: technician\nprerequisites: [\"DR plan owner\", \"Backup system admin\", \"Storage admin\"]\nos_scope: [\"All\"]\nkeywords:\n  - disaster recovery\n  - dr\n  - rto\n  - rpo\n  - veeam\n  - rubrik\n  - cohesity\n  - immutable\n  - 3-2-1\n  - tabletop\n  - bcp\nrelated_articles:\n  - l3-security-001\n  - l2-malware-001\nescalation_trigger: \"Real disaster, ransomware-induced restore, regulatory deadline\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Disaster recovery runbook\n\n## 1. Plan design\n- **RTO (Recovery Time Objective):** how fast you must be back. Per app/tier.\n- **RPO (Recovery Point Objective):** how much data you can lose. Per app/tier.\n- **Tier matrix:** Tier 1 (RTO 1h / RPO 5m), Tier 2 (4h/1h), Tier 3 (24h/24h).\n\n## 2. Backup architecture (3-2-1-1-0)\n- **3** copies of data.\n- On **2** different media.\n- **1** offsite.\n- **1** offline / immutable / air-gapped.\n- **0** errors after restore validation.\n\n## 3. Restore order (typical enterprise)\n1. **Identity** — DCs / Entra / SSO.\n2. **DNS / DHCP** — foundational.\n3. **Storage / file shares.**\n4. **Database tier (Tier 1 apps).**\n5. **App servers (Tier 1).**\n6. **Email / collaboration.**\n7. **Tier 2 apps.**\n8. **End-user workstations** (often re-image, not restore).\n\n## 4. Activation\n1. Declare DR per chain of command.\n2. Stand up war room.\n3. Communicate to stakeholders.\n4. Begin restore in priority order.\n5. Validate at each step before proceeding.\n6. Track RTO clock vs targets.\n\n## 5. Validation\n- App functional (not just \"service running\").\n- Data integrity check (checksums vs known-good).\n- Access controls preserved.\n- Monitoring restored.\n- User acceptance test for primary workflows.\n\n## 6. Common pitfalls\n- Backups not restorable — discovered only on disaster day.\n- DNS / AD circular dependency.\n- License servers / KMS missing from priority list.\n- Network configs not in backup.\n- Underestimated RTO due to network/storage bandwidth.\n\n## 7. Tabletop / drill\n- Quarterly tabletop with leadership.\n- Annual full restore drill in isolated environment.\n- Document time taken vs RTO; flag gaps.\n\n## 8. Special considerations\n- **Ransomware DR:** assume backups may be compromised; restore from immutable / air-gapped tier; validate before reconnecting to prod network.\n- **Cloud DR:** test cross-region failover; validate IAM / endpoints.\n- **Data sovereignty:** restore region must comply with regulation.\n\n## 9. Related Articles\n- l3-security-001 — IR (often paired with DR)\n- l2-malware-001 — Malware preceding DR\n\n## 10. Keywords\ndisaster recovery, dr, rto, rpo, veeam, rubrik, cohesity, immutable, 3-2-1, tabletop, bcp"
  },
  {
   "slug": "l3-endpoint-001-edr-strategy",
   "path_rel": "knowledge-base\\L3\\l3-endpoint-001-edr-strategy.md",
   "title": "\"Endpoint security architecture: EDR + AppLocker/WDAC + Windows Hardening\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-endpoint-001\ntitle: \"Endpoint security architecture: EDR + AppLocker/WDAC + Windows Hardening\"\ncategory: endpoint\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 90\naudience: technician\nprerequisites: [\"Endpoint security architect\", \"Defender / 3rd-party EDR admin\"]\nos_scope: [\"Windows 10\", \"Windows 11\"]\nkeywords:\n  - edr\n  - applocker\n  - wdac\n  - device guard\n  - credential guard\n  - hvci\n  - bitlocker\n  - hardening\n  - cis\n  - stig\nrelated_articles:\n  - l2-endpoint-001\n  - l3-security-001\nescalation_trigger: \"Strategic shift, vendor selection, mass roll-out planning\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Endpoint security architecture\n\n## 1. Layered model\n- **Identity:** Phishing-resistant MFA, PIM, Conditional Access.\n- **Device:** Compliance, BitLocker, TPM, Secure Boot, HVCI, Credential Guard.\n- **OS hardening:** CIS / STIG baselines, ASR, AV, EDR.\n- **App control:** AppLocker (legacy) or WDAC (modern) — block unsigned/unauthorized.\n- **Browser:** SmartScreen, isolation, web filter.\n- **Telemetry:** EDR + SIEM + XDR.\n- **User awareness:** Phishing training, reporting tools.\n\n## 2. EDR selection\n- Defender for Endpoint native to Microsoft stack — best integration, lowest cost when bundled.\n- 3rd party (CrowdStrike, SentinelOne) — strong if heterogeneous OS or mature SOC integration.\n- Don't run two EDRs in active mode — they fight.\n\n## 3. WDAC rollout\n- Audit mode 60-90 days.\n- Build allow list from observed binaries (managed installer + ISG).\n- Block unsigned scripts, unsigned executables, vulnerable drivers.\n- Enforce mode by ring: pilot → wave → fleet.\n- Exceptions documented + signed off.\n\n## 4. Hardening baselines\n- CIS L1/L2 — sensible defaults.\n- STIG — for regulated environments.\n- Microsoft Security Compliance Toolkit baselines.\n- Apply via Intune; audit compliance.\n\n## 5. BitLocker + TPM\n- Tenant-wide encryption.\n- Pre-boot PIN for high-value users (architects, executives).\n- Recovery keys escrowed.\n- Encrypt OS + data drives.\n\n## 6. Credential Guard / HVCI\n- Credential Guard isolates LSASS — defeats most credential dumping.\n- HVCI (Hypervisor-protected Code Integrity) enforces driver signing in kernel.\n- Default in Win11; enable explicitly on Win10.\n- Validate driver compat before fleet rollout.\n\n## 7. Browser isolation\n- Microsoft Edge with Application Guard for untrusted sites (legacy; deprecated path).\n- Modern: containerization (Mandiant Sandbox / vendor RBI) for high-risk users.\n- SmartScreen always on.\n\n## 8. Verification\n- Compliance dashboard 95%+.\n- WDAC enforcing, audit log clean.\n- BitLocker 100% on managed.\n- Credential Guard / HVCI enabled and reporting.\n- EDR coverage 100%, alerts triaged within SLA.\n\n## 9. Escalation\n- Vendor regression breaking compatibility.\n- WDAC enforcement breaking critical app.\n- → Architecture review.\n\n## 10. Related Articles\n- l2-endpoint-001 — ASR rules\n- l3-security-001 — IR\n\n## 11. Keywords\nedr, applocker, wdac, device guard, credential guard, hvci, bitlocker, hardening, cis, stig"
  },
  {
   "slug": "l3-endpoint-002-configuration-drift",
   "path_rel": "knowledge-base\\L3\\l3-endpoint-002-configuration-drift.md",
   "title": "\"Endpoint configuration drift: detecting and remediating managed devices that no longer match baseline\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-endpoint-002\ntitle: \"Endpoint configuration drift: detecting and remediating managed devices that no longer match baseline\"\ncategory: endpoint\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 90\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\nprerequisites: [\"Intune/MDM admin\", \"Understanding of configuration profiles, compliance, and security baselines\", \"Reporting access (Intune/Defender/Log Analytics)\"]\nkeywords:\n  - configuration drift\n  - endpoint drift\n  - baseline drift\n  - policy not applied\n  - compliance regression\n  - settings reverted\n  - config drift remediation\n  - intune baseline\n  - desired state\nrelated_articles:\n  - l2-intune-001\n  - l2-endpoint-001\n  - l3-endpoint-001\nescalation_trigger: \"This IS the L3 article. Engage vendor support only for confirmed MDM platform/agent defects after remediation patterns are exhausted.\"\nlast_updated: 2026-05-26\nversion: 1.0\n---\n\n# Endpoint configuration drift — detect and remediate\n\n## 1. Symptoms\n- Devices that were compliant now report **Not compliant** or **Error/Conflict** on policies.\n- Security settings (BitLocker, Defender, firewall, ASR rules) silently revert to non-baseline values.\n- A subset of the fleet shows different applied settings than the rest despite identical assignment.\n- Audits find local changes (registry, local admins, disabled services) diverging from desired state.\n- Newly enrolled devices match baseline; older ones have \"rotted\" over months.\n\n## 2. Likely Causes\n1. **Conflicting policies** — two profiles set the same CSP/setting differently → \"Conflict,\" last-writer or none wins.\n2. **Local/manual changes** by users or scripts overriding MDM where the CSP allows local precedence.\n3. **GPO vs. MDM tug-of-war** on co-managed/hybrid devices (group policy re-asserting old values).\n4. **Failed/partial policy application** — device offline at sync, token expiry, or CSP error left settings half-applied.\n5. **Assignment scope changes** — a device left/was removed from a group, so a profile stopped applying without being \"removed.\"\n6. **Baseline version skew** — security baseline updated centrally but some devices still on the prior version.\n7. **Third-party agents** (legacy AV, RMM) reverting security settings.\n\n## 3. Questions / Scoping\n1. What is the **authoritative baseline** (which profiles + security baseline version define \"correct\")?\n2. Is the fleet **co-managed** (Intune + ConfigMgr/GPO) or Intune-only?\n3. Drift on **specific settings** or broad? Which CSPs/areas?\n4. Drift correlated with **OS version, hardware model, or enrollment date**?\n5. Any recent **policy edits, baseline bumps, or group membership changes**?\n\n## 4. Detection / Triage Steps\n1. **Establish desired state explicitly:** export the assigned configuration profiles, compliance policies, and security baseline version that define correct.\n2. **Run the drift report:** Intune → Devices → Monitor → **Configuration/Compliance** reports; filter Error/Conflict/Not applicable. Endpoint security → Security baselines → versions and per-setting status.\n3. **Inspect a drifted device locally:**\n   - Windows: Settings → Access work or school → Info → Sync + view policy report; `dsregcmd /status`; Event Viewer → EnterpriseMgmt (MDM Diagnostics, `mdmdiagnosticstool.exe -area DeviceEnrollment;DeviceProvisioning -cab out.cab`).\n   - Check `gpresult /h` on co-managed devices to spot GPO re-asserting values.\n4. **Correlate:** group the drifted set by OS/model/enrollment date/baseline version to find the common factor.\n5. **Identify conflicts:** Intune per-setting status shows \"Conflict\" with the two competing profiles — that's your root cause for those settings.\n\n## 5. Remediation Steps\n**Resolve policy conflicts (do this first):**\n1. Consolidate duplicate settings to a **single source of truth** profile; remove the same CSP from competing profiles.\n2. Prefer **security baselines** for security settings; don't also set them in ad-hoc config profiles.\n\n**Re-converge co-managed devices:**\n1. Decide authority per workload (Intune vs. ConfigMgr) and set the **co-management workload sliders** accordingly so one system owns each area.\n2. Remove the legacy **GPO** that re-asserts a setting MDM now owns (GPO generally wins on hybrid devices for the same setting).\n\n**Force re-application:**\n1. Trigger an MDM **Sync** (Company Portal / Settings) or run the EnterpriseMgmt scheduled sync task; for compliance, use **on-demand** evaluation.\n2. For stubborn CSP errors, remove and re-assign the profile to the group, or use a **remediation script** (Intune → Remediations: a detection + fix scriptpair) to enforce desired state on a schedule — this is the durable answer to recurring local drift.\n\n**Handle third-party reverts:**\n1. Identify the agent reverting settings (Defender vs. legacy AV both managing the firewall, etc.) and decommission/whitelist appropriately.\n\n**Re-baseline laggards:**\n1. Move devices on an old security-baseline version to the current version (assign the new baseline, retire the old), validate no new conflicts.\n\n## 6. Verification Steps\n- Drift/compliance report shows the target devices return to **Compliant**, with **0 Conflict** on the affected CSPs.\n- A previously drifted setting is confirmed correct on a sample device locally (registry/CSP value matches baseline).\n- The remediation script's **detection** reports \"compliant\" on the next run (no fix needed) across the fleet.\n- A deliberate test change on a pilot device is **auto-corrected** within the next remediation cycle (proves desired-state enforcement, not just one-time fix).\n\n## 7. Escalation Trigger\n- Confirmed **MDM agent / CSP defect** reproducible after conflicts and GPO contention are eliminated → open a vendor (Microsoft) support case with MDM diagnostics CAB.\n- Drift caused by an unmanaged change-control gap → route to the **change-management process**, not a technical fix.\n\n## 8. Prevention Tips\n- **One setting, one owner:** never set the same CSP in two profiles; use security baselines for security settings.\n- Deploy **Intune Remediations** (detect+fix scripts) for the handful of settings prone to local drift — continuous desired-state enforcement.\n- Version and document baselines; roll updates in **rings** (pilot → broad) and retire old versions promptly.\n- On hybrid devices, decide GPO-vs-MDM authority deliberately and document it; avoid dual ownership.\n- Schedule periodic drift audits (monthly) rather than discovering it during an incident.\n\n## 9. User-Friendly Explanation (for stakeholders)\n\"Over time, managed devices can quietly drift away from our security standard — a setting gets changed locally, two policies fight over the same option, or an old device never picked up the latest baseline. We detect that with reporting, find the common cause, remove the conflict, and put a self-healing check in place so the setting corrects itself automatically from now on. The outcome is the fleet reliably matching the approved security baseline, with proof in the compliance reports.\"\n\n## 10. Internal Technician Notes\n- `mdmdiagnosticstool.exe -area \"DeviceEnrollment;DeviceProvisioning;Autopilot\" -cab C:\\temp\\mdm.cab` then review the report HTML — fastest per-CSP application/error view on Windows.\n- Conflict resolution order is not \"newest wins\" reliably — Intune marks Conflict and may apply nothing; eliminate duplicates rather than relying on precedence.\n- Remediations (Proactive Remediations) require the corresponding license tier; the detect/fix PowerShell pair is the canonical desired-state-config pattern for Intune.\n- Co-management: BitLocker/Defender/firewall workload ownership is set centrally; a device can show Intune as \"managed\" while ConfigMgr still owns a workload.\n- macOS drift: compare against the assigned `.mobileconfig`; settings the user can change locally need a managed (forced) profile, not a default.\n\n## 11. Related KB Articles\n- l2-intune-001 — Device compliance\n- l2-endpoint-001 — Defender / ASR\n- l3-endpoint-001 — EDR strategy\n\n## 12. Keywords / Search Tags\nconfiguration drift, endpoint drift, baseline drift, policy not applied, compliance regression, settings reverted, config drift remediation, intune baseline, desired state, proactive remediations, co-management, csp conflict, mdmdiagnosticstool"
  },
  {
   "slug": "l3-enterprise-001-msp-architecture",
   "path_rel": "knowledge-base\\L3\\l3-enterprise-001-msp-architecture.md",
   "title": "\"Enterprise / MSP architecture: multi-tenant operations, segregation, automation\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-enterprise-001\ntitle: \"Enterprise / MSP architecture: multi-tenant operations, segregation, automation\"\ncategory: enterprise\nsupport_level: L3\nseverity: medium\nestimated_time_minutes: 90\naudience: technician\nprerequisites: [\"MSP / IT services architect\"]\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - msp\n  - multi tenant\n  - lighthouse\n  - delegated administration\n  - psa\n  - rmm\n  - automation\n  - itil\n  - itsm\nrelated_articles:\n  - l3-cloud-001\n  - l3-security-001\nescalation_trigger: \"Cross-tenant breach, contractual SLA breach, regulatory change\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# MSP / enterprise architecture\n\n## 1. Operating model\n- **Tools:** PSA (ConnectWise / Autotask / Kaseya BMS) + RMM (Datto, NinjaOne, N-able) + ticketing + remote access + documentation (IT Glue, Hudu).\n- **Process:** ITIL incident / problem / change / request flows.\n- **Tiers:** L1 dispatch, L2 engineering, L3 architecture, vCIO.\n- **Metrics:** First-touch resolution, SLA adherence, CSAT, MRR per client.\n\n## 2. Multi-tenant architecture\n- Per-client isolation: separate Entra tenants when possible (regulatory) or per-tenant boundaries within a single MSP tenant.\n- **Microsoft Lighthouse / Partner Center** for delegated access — better than shared admin accounts.\n- GDAP (Granular Delegated Admin Privileges) — least-privilege, time-bound.\n- Per-client documentation, separation of credentials.\n- No shared admin user across customers.\n\n## 3. Automation playbooks\n- Onboarding: new client tenant build via IaC.\n- New user: from PSA ticket → Entra + Intune via PowerShell / Graph.\n- Offboarding: same automation chain in reverse.\n- Patching: RMM + WUFB rings.\n- Backup: immutable + monitored with alerting.\n- Reporting: SLA dashboards per client.\n\n## 4. Security operations\n- 24/7 SOC (in-house or partnered).\n- SIEM ingesting from all tenants.\n- IR runbook adapted per client tier (premium vs base).\n- Tabletop with each client annually.\n\n## 5. Commercial discipline\n- MSA + SOW per client; SLA tiers documented.\n- Service catalog with sticky pricing.\n- Recurring revenue focus: managed services, not break-fix.\n- Quarterly business reviews with each client.\n- vCIO function for strategic clients.\n\n## 6. Scaling\n- Document everything; no tribal knowledge.\n- Automate the top 20 ticket categories — that's where 80% of L1 time goes.\n- Right-size org: ~1 tech per 50–80 endpoints managed.\n- Specialize: cloud, security, networking experts; not generalists at scale.\n- KPIs: utilization, revenue per tech, churn, CSAT.\n\n## 7. Compliance\n- Per-client compliance (HIPAA, SOX, PCI, ISO) reflected in stack + processes.\n- Audit-ready evidence collection automated.\n- Contracts include data handling + breach notification clauses.\n\n## 8. Verification\n- Per-client SLAs met.\n- Security posture per client measurable.\n- Automation rate increasing (manual ticket time decreasing).\n- Profitable per-client P&L.\n\n## 9. Related\n- l3-cloud-001 — Cloud landing zones (per client)\n- l3-security-001 — IR runbook (per client)\n\n## 10. Keywords\nmsp, multi tenant, lighthouse, delegated administration, psa, rmm, automation, itil, itsm"
  },
  {
   "slug": "l3-forensics-001-forensic-preservation",
   "path_rel": "knowledge-base\\L3\\l3-forensics-001-forensic-preservation.md",
   "title": "\"Digital forensic evidence preservation during a suspected breach\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-forensics-001\ntitle: \"Digital forensic evidence preservation during a suspected breach\"\ncategory: security\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 180\naudience: it-technician\nos_scope: [\"All\"]\nprerequisites: []\nkeywords:\n  - forensic preservation\n  - order of volatility\n  - memory image\n  - disk image\n  - chain of custody\n  - do not power off\n  - isolate not wipe\n  - incident response firm\n  - evidence integrity\n  - hashing\n  - timeline analysis\n  - tipping off the attacker\nrelated_articles:\n  - l3-security-001\n  - l3-security-002\n  - l3-endpoint-001\n  - l3-disaster-recovery-001\nescalation_trigger: \"Stop and engage the external IR firm, legal/privacy counsel, cyber-insurance, and (where applicable) law enforcement before remediating; do not power off, re-image, or alter suspect systems until evidence is preserved.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Digital forensic evidence preservation during a suspected breach\n\n## 1. Symptoms\n- A breach is suspected or confirmed (ransomware note, data-exfil alert, web-shell, attacker tooling, anomalous privileged activity).\n- EDR/SIEM alerts or a third party (vendor, partner, law enforcement, extortion email) indicate compromise.\n- Strong instinct on the floor to \"just reboot/re-image/clean it\" — which would destroy the evidence needed to understand scope.\n- Unknown blast radius: it isn't yet clear which systems, accounts, or data are involved.\n\n## 2. Likely Causes\n- Active or recent intrusion: credential theft, lateral movement, persistence, ransomware staging, or data theft.\n- This article applies whenever the cause is under investigation — the goal is to preserve the ability to determine root cause, scope, and impact, not to assume one.\n\n## 3. Questions To Ask User\n- What was observed, when, and by whom — what's the first indicator and timestamp?\n- Which systems/accounts/data look involved, and how critical/sensitive are they?\n- Has anyone already rebooted, logged in, run AV scans, deleted files, or re-imaged anything (i.e., already altered evidence)?\n- Is the attacker possibly still active (don't tip them off — avoid obvious \"we caught you\" actions)?\n- Do we have cyber-insurance, a retained IR firm, and legal/privacy counsel to engage now?\n- Are there regulatory or contractual breach-notification obligations likely in scope?\n- Where are the relevant logs (endpoint, network, cloud, identity) and what is their retention?\n\n## 4. Troubleshooting Steps\n> This is a STOP-and-preserve posture. ARIA's role is to triage, document, isolate, and escalate — NOT to remediate, clean, or power off. Improper handling can destroy evidence and harm legal/insurance standing. Engage the IR firm/legal before invasive action.\n1. **Pause the urge to \"fix it.\"** Do not power off, reboot, re-image, run cleanup/AV remediation, or delete anything on suspect systems — these destroy volatile and on-disk evidence.\n2. **Isolate, don't wipe.** Contain at the network level (EDR network-isolation, switch port/VLAN quarantine, or pull the network cable) so the system stays powered and intact but can't spread or be controlled remotely. Powered-on isolation preserves memory.\n3. **Respect order of volatility** when planning collection: most volatile first — memory/RAM, running processes, network connections, then disk, then archived logs/backups. Capture the perishable evidence before it's gone.\n4. **Preserve logs and identity/cloud trails** that age out: endpoint, firewall/NetFlow, DNS, proxy, mail, and cloud/identity audit logs. Extend retention and export copies before rotation deletes them.\n5. **Avoid tipping off the attacker.** Don't make changes that broadcast detection (mass password resets, blocking their C2 in an obvious way) before IR has a containment plan — premature moves can trigger destruction or acceleration. IR/leadership choose the timing.\n6. **Document everything contemporaneously** (who/what/when/why) — this record is litigation- and insurance-relevant.\n\n## 5. Resolution Steps\n> Section 5 is for a senior responder, ideally the external IR firm. Acquisition must preserve integrity (write-blocking, hashing, custody). Mandatory human/vendor/legal engagement is called out.\n1. **Engage the external IR firm, legal/privacy counsel, and cyber-insurance now.** Insurance often dictates approved vendors and notification timing; legal involvement helps preserve privilege. This step gates the rest.\n2. **Acquire volatile data first:** capture a memory image from the live, isolated system using forensically sound tooling before any shutdown; record running processes/connections. Memory is lost the instant power is removed.\n3. **Acquire disk images** as forensic (bit-for-bit) copies using write-blocking; compute and record cryptographic hashes of each image to prove integrity. Work from copies — never investigate on the original.\n4. **Establish chain of custody:** label evidence, record every handler/transfer with timestamps, and store securely. Gaps in custody can render evidence unusable.\n5. **Preserve cloud/SaaS and identity evidence** (audit logs, sign-in logs, mailbox/audit exports, snapshots) per provider guidance before retention windows expire.\n6. **Build the timeline** from preserved sources to establish initial access, scope, and impact — this drives the eventual eradication/recovery in l3-security-001, which only proceeds once evidence is secured and IR approves.\n7. **Coordinate law-enforcement notification** where applicable through legal — do not contact attackers; preserve any extortion communications as evidence.\n\n## 6. Verification Steps\n- Suspect systems isolated but intact (still powered where memory was needed); no remediation/reboot/re-image occurred prematurely.\n- Memory and disk images acquired with recorded hashes that verify; originals untouched and secured.\n- Chain-of-custody records complete and continuous for every evidence item.\n- Volatile and short-retention logs (endpoint/network/cloud/identity) exported and preserved before rotation.\n- IR firm, legal, and cyber-insurance engaged and steering; notification obligations being tracked by counsel.\n- Investigation timeline underway; no actions taken that tipped off the attacker ahead of the containment plan.\n\n## 7. Escalation Trigger\nStop and escalate before any remediation: engage the external IR firm, legal/privacy counsel, and cyber-insurance immediately, and law enforcement where applicable (via legal). Do not power off, reboot, re-image, run cleanup, or make attacker-visible changes until volatile and disk evidence is preserved and IR approves the containment/eradication plan. When in doubt, preserve and call IR — destroyed evidence cannot be recovered.\n\n## 8. Prevention Tips\n- Pre-arrange an IR retainer, cyber-insurance, and legal counsel, with contacts in an out-of-band runbook (assume email/identity may be compromised).\n- Maintain robust, centralized, tamper-resistant logging with sufficient retention across endpoint, network, cloud, and identity (you can't reconstruct what wasn't logged).\n- Have forensic acquisition tooling and trained staff (or vendor on call); never improvise acquisition during a live incident.\n- Define and train the \"isolate-don't-wipe, don't-power-off, preserve-first\" posture so responders don't reflexively clean systems.\n- Use immutable/offline backups (l3-disaster-recovery-001 / l3-backup-dr-002) so recovery doesn't depend on destroying evidence.\n- Run tabletop exercises that explicitly practice evidence preservation and chain of custody.\n\n## 9. User-Friendly Explanation\nWhen we suspect a break-in, the natural reaction is to wipe the affected computer and move on — but that's like scrubbing a crime scene before investigators arrive. We need to find out how the attacker got in, what they touched, and whether they're still inside, and that evidence lives in the computer's memory and disk. So we keep affected systems powered but cut off from the network, make exact protected copies (with a tracked chain of custody, like an evidence bag), and preserve the logs before they age out. We also avoid obvious moves that would warn the attacker we've noticed. Specialists — an incident-response firm, your lawyers, and your cyber-insurer — guide this, and only then do we clean up and recover.\n\n## 10. Internal Technician Notes\n- The cardinal sins: powering off, rebooting, re-imaging, or running AV \"cleanup\" on a suspect host before imaging. Memory dies with power; on-disk artifacts die with re-image.\n- Isolate ≠ wipe. Network-isolate (EDR/VLAN/cable) while keeping power on to preserve RAM. Capture memory before any shutdown.\n- Order of volatility: RAM/processes/connections → disk → archived logs/backups. Grab the perishable stuff first.\n- Chain of custody and image hashing are what make evidence usable later — sloppiness here can void it for insurance/legal/court.\n- Don't tip off the attacker: hold loud containment (mass resets, obvious C2 blocks) until IR sets the timing, or they may destroy data or accelerate.\n- Engage IR/legal/insurance before remediating — insurance may mandate vendors and notification timing, and legal involvement helps preserve privilege. Eradication/recovery happens in l3-security-001 after evidence is secured.\n\n## 11. Related KB Articles\n- l3-security-001 — Incident response runbook (containment/eradication/recovery after preservation)\n- l3-security-002 — Zero-day response that may pivot into a breach\n- l3-endpoint-001 — EDR isolation and endpoint telemetry used for preservation\n- l3-disaster-recovery-001 — Clean recovery from immutable backups post-investigation\n\n## 12. Keywords / Search Tags\nforensic preservation, order of volatility, memory image, disk image, chain of custody, do not power off, isolate not wipe, incident response firm, evidence integrity, hashing, timeline analysis, tipping off the attacker"
  },
  {
   "slug": "l3-hybrid-ad-001-aad-connect",
   "path_rel": "knowledge-base\\L3\\l3-hybrid-ad-001-aad-connect.md",
   "title": "\"Hybrid AD: Azure AD Connect / Cloud Sync / password writeback\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-hybrid-ad-001\ntitle: \"Hybrid AD: Azure AD Connect / Cloud Sync / password writeback\"\ncategory: active-directory\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 90\naudience: technician\nprerequisites: [\"AD admin\", \"Entra global admin\"]\nos_scope: [\"Windows Server\"]\nkeywords:\n  - azure ad connect\n  - aad connect\n  - hybrid identity\n  - sync\n  - password hash sync\n  - pass-through auth\n  - federation\n  - cloud sync\n  - writeback\nrelated_articles:\n  - l2-active-directory-001\n  - l3-sso-saml-001\nescalation_trigger: \"Sync engine corruption, federation outage, mass attribute conflict\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Hybrid AD architecture\n\n## 1. Sync options\n- **Azure AD Connect (full):** Heavy-weight, highly customizable, on-prem server. EOS 2027.\n- **Cloud Sync:** Lightweight agents, multi-forest, auto-update. Microsoft direction for new deployments.\n- **Federation (ADFS / Ping):** legacy auth path; minimize for security + agility — prefer cloud auth (PHS or PTA).\n\n## 2. Auth modes\n- **Password Hash Sync (PHS):** simplest; cloud auth. Recommended for most.\n- **Pass-through Auth (PTA):** auth happens on-prem; agents on DCs. Use if compliance requires no password hash in cloud.\n- **Federated (ADFS):** enterprise-class; complex; consider replacing.\n\n## 3. Common operations\n**Re-run sync after change:**\n- `Start-ADSyncSyncCycle -PolicyType Delta` (small change).\n- `Start-ADSyncSyncCycle -PolicyType Initial` (full; long for big tenants).\n\n**Filter scope:**\n- Sync rules + OU filtering. Don't sync service accounts that don't need cloud presence.\n\n**Conflicts:**\n- Source of authority defaults to AD for synced attributes; resolve duplicate UPNs / proxyAddresses on-prem first.\n\n**Password writeback:**\n- Required for SSPR to write changes back to AD.\n- Permission: AAD Connect service account needs Reset Password + Change Password on sync OUs.\n\n## 4. Health\n- Microsoft Entra Health → Connect Health.\n- Monitor sync errors daily.\n- Cert/firmware on AAD Connect server current.\n- Backup / image of AAD Connect server.\n- Failover: staging mode on second server.\n\n## 5. Migration to Cloud Sync\n- Plan: assess sync rules complexity (Cloud Sync is more constrained but simpler).\n- Run side-by-side in pilot; cut over OUs incrementally.\n- AAD Connect → Cloud Sync coexistence supported.\n\n## 6. Verification\n- Sync errors zero.\n- New / changed users appear in cloud within 30 min.\n- Password writeback working (test SSPR).\n- Connect Health green.\n\n## 7. Escalation\n- Sync engine corruption.\n- Mass duplicate-attribute conflicts.\n- Federation outage (ADFS).\n- → Microsoft case + L3 architecture.\n\n## 8. Prevention\n- Document sync filters + sync rules.\n- Don't customize sync rules without compelling reason — reduces upgrade surface.\n- Move to Cloud Sync where possible.\n- Phase out ADFS in favor of cloud auth.\n- Monthly review of sync errors.\n\n## 9. Notes\n- AAD Connect EOS 2027 — plan migration now.\n- Cloud Sync supports multi-forest natively.\n- For federation, certificate rollover is critical — automate or alert.\n- Group writeback (preview) lets cloud groups land in AD.\n\n## 10. Related Articles\n- l2-active-directory-001 — Account ops\n- l3-sso-saml-001 — Federation\n\n## 11. Keywords\nazure ad connect, aad connect, hybrid identity, sync, password hash sync, pass-through auth, federation, cloud sync, writeback"
  },
  {
   "slug": "l3-migration-001-tenant-migration",
   "path_rel": "knowledge-base\\L3\\l3-migration-001-tenant-migration.md",
   "title": "\"Microsoft 365 / Google Workspace tenant-to-tenant migration\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-migration-001\ntitle: \"Microsoft 365 / Google Workspace tenant-to-tenant migration\"\ncategory: m365\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 240\naudience: it-technician\nos_scope: [\"Microsoft 365\", \"Google Workspace\", \"Cloud\"]\nprerequisites: []\nkeywords:\n  - tenant to tenant migration\n  - m365 migration\n  - google workspace migration\n  - domain move\n  - upn smtp coexistence\n  - mail onedrive sharepoint teams\n  - cutover vs staged\n  - mx autodiscover dns\n  - throttling\n  - rollback planning\n  - migration tooling\n  - post-cutover validation\nrelated_articles:\n  - l3-hybrid-ad-001\n  - l3-cloud-001\n  - l3-certificates-002\n  - l3-business-continuity-001\nescalation_trigger: \"Engage the migration-tooling vendor and the platform vendor (Microsoft/Google) for unresolved throttling, identity/domain-move conflicts, or data-integrity issues; escalate to project sponsor before any irreversible cutover step.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Microsoft 365 / Google Workspace tenant-to-tenant migration\n\n## 1. Symptoms\n- A business event (merger, acquisition, divestiture, rebrand, consolidation) requires moving users and data between two cloud tenants.\n- Two tenants must temporarily coexist (mail routing, free/busy, directory) during the move.\n- Risk areas surface: a domain can only live in one tenant at a time; large mailboxes/drives; Teams/SharePoint structures; external sharing; throttling on bulk migration.\n- Post-move complaints: missing mail/permissions, broken Teams/SharePoint links, mail mis-routing, or sign-in confusion.\n\n## 2. Likely Causes\n- **Identity/domain constraints:** a custom domain (and its UPNs/SMTP addresses) can be verified in only one tenant at a time, forcing careful sequencing.\n- Incomplete discovery: unknown mailboxes, shared/resource mailboxes, distribution/M365 groups, guests, OneDrive/SharePoint sites, Teams, and third-party app integrations.\n- DNS/mail-flow dependencies: MX, Autodiscover, SPF/DKIM/DMARC, and CNAMEs must move in step with the cutover.\n- Platform **throttling** limiting bulk migration throughput.\n- Permission/sharing structures (SharePoint/Teams, OneDrive sharing links, group memberships) not being re-created in the target.\n- No coexistence plan, so mail and collaboration break during the transition window.\n\n## 3. Questions To Ask User\n- What's the business driver and the hard deadline/constraints (e.g., domain handover date)?\n- Source and target platforms (M365↔M365, M365↔Google, Google↔M365) and tenant sizes?\n- Full inventory: how many users, mailbox/drive sizes, shared/resource mailboxes, groups, Teams, SharePoint sites, guests, and integrated apps?\n- Domain handling: which domains move, what's the coexistence need (free/busy, mail routing) and for how long?\n- Cutover style preference and tolerance for downtime: big-bang cutover vs staged/batched?\n- Identity model: cloud-only, or synced from on-prem AD/AAD Connect (tie to l3-hybrid-ad-001)?\n- Acceptable maintenance windows, comms plan, and what \"rollback\" means if a batch fails?\n\n## 4. Troubleshooting Steps\n> L3 migrations are project-led and human-driven. ARIA assists with discovery, documentation, validation, and coordination; senior engineers run the migration and own irreversible cutover decisions, with vendor support where needed.\n1. **Discovery & inventory first.** Enumerate every object: users, mailboxes (incl. shared/resource), groups, OneDrive, SharePoint sites, Teams, guests, app registrations/integrations, and sizes. Gaps here cause the worst post-cutover surprises.\n2. **Map identity & namespace.** Decide source→target UPN/SMTP mapping, how the custom domain(s) move (one tenant at a time), and whether on-prem AD/AAD Connect is involved (l3-hybrid-ad-001). Plan temporary routing domains for coexistence.\n3. **Choose migration approach:** cutover/big-bang (simpler, more downtime, smaller orgs) vs staged/batched (coexistence, less disruption, more complex). Match to size, deadline, and downtime tolerance.\n4. **Plan coexistence:** mail routing between tenants, free/busy/calendar sharing, and directory sync during the transition; define how long both tenants must interoperate.\n5. **Select tooling** (a reputable third-party tenant-to-tenant migration tool, generically) for mailboxes/OneDrive/SharePoint/Teams, and confirm it handles permissions, versions, and Teams structures.\n6. **Account for throttling:** plan batch sizes/windows and tooling concurrency to work within platform limits; pilot to measure realistic throughput.\n7. **Build the DNS/mail-flow cutover plan** (MX, Autodiscover, SPF/DKIM/DMARC, CNAMEs) with TTLs lowered ahead of time.\n\n## 5. Resolution Steps\n> Section 5 is for a senior engineer running the project. Irreversible steps (domain move, MX cutover) require sponsor sign-off; vendor engagement is noted.\n1. **Prepare the target tenant:** licensing, provisioned users/groups, SharePoint/Teams scaffolding, security/compliance settings, and verified routing domains.\n2. **Pilot migration:** migrate a representative pilot group end-to-end (mail, OneDrive, SharePoint, Teams), validate fidelity and permissions, and measure throughput vs throttling. Fix issues before scaling.\n3. **Pre-stage bulk data:** run incremental/pre-sync passes so the final delta at cutover is small (lowers downtime). Stagger batches within throttling limits.\n4. **Stand up coexistence:** enable cross-tenant mail routing and free/busy so users in both tenants interoperate during a staged move.\n5. **Cutover (the irreversible part — sponsor sign-off):** schedule the maintenance window; perform the final delta sync; **move the custom domain** (remove from source, verify in target) and **cut MX/Autodiscover/SPF/DKIM/DMARC/CNAME DNS** to the target. Sequence carefully — the domain can exist in only one tenant at this moment.\n6. **Engage vendors for blockers:** the migration-tool vendor for fidelity/permission/throttling issues; Microsoft/Google for tenant-side domain-move, throttling, or routing problems.\n7. **Hold a rollback plan:** keep the source tenant intact and data retained until validation passes; define per-batch rollback (re-point routing back, re-enable source) so a failed batch doesn't strand users. True cutover rollback is costly — minimize risk with pilot + pre-staging rather than relying on it.\n\n## 6. Verification Steps\n- Mail flows correctly to/from the target tenant; no NDRs or mis-routing; SPF/DKIM/DMARC valid; Autodiscover resolves; no mail looping between tenants.\n- Mailboxes, OneDrive, SharePoint, and Teams content migrated with correct permissions, versions, and structures (spot-check across user types).\n- Distribution/M365 groups, shared/resource mailboxes, and guest access function as expected.\n- Users sign in with the correct UPN/SMTP; the custom domain is verified only in the target and removed from source.\n- Pilot/batch validation sign-offs recorded; no orphaned or duplicated objects.\n- Integrated apps re-authorized and working; source tenant retained per rollback/retention plan until acceptance.\n\n## 7. Escalation Trigger\nEngage the migration-tooling vendor for data-fidelity/permission/throttling issues and the platform vendor (Microsoft/Google) for domain-move conflicts, tenant-side throttling, or mail-routing problems. Escalate to the project sponsor before any irreversible cutover step (domain move, MX change) and whenever a batch fails validation or data integrity is in question.\n\n## 8. Prevention Tips\n- Invest heavily in discovery — the inventory you miss is the outage you get. Re-run discovery close to cutover to catch drift.\n- Always pilot before bulk; validate fidelity, permissions, and throughput, and tune batch sizes to throttling limits.\n- Lower DNS TTLs days ahead so MX/Autodiscover cutover propagates quickly.\n- Pre-stage/pre-sync data so the cutover delta (and downtime) is minimal.\n- Plan coexistence explicitly for staged moves; don't let mail/free-busy break mid-migration.\n- Keep the source tenant and data intact until post-cutover validation and user acceptance are complete.\n- Communicate clearly to users (new sign-in/UPN, what to expect, support channel) and provide a cutover-day runbook and comms.\n\n## 9. User-Friendly Explanation\nMoving your organization from one cloud tenant to another (for a merger, sale, or rebrand) is like relocating an entire office: people, email, files, shared sites, and chats all have to move without losing anything or breaking how you work. The tricky parts are identity (your email domain can only \"live\" in one place at a time, so the switch has to be timed precisely) and the sheer volume of data, which the platforms deliberately rate-limit. We reduce risk by inventorying everything, testing with a small pilot group, pre-copying data so the final switch is quick, and keeping the old tenant intact until we've confirmed the new one works. There's a short, planned window where email cuts over to the new home.\n\n## 10. Internal Technician Notes\n- Discovery is the make-or-break phase; the missed shared mailbox / Teams site / app integration is the classic post-cutover incident.\n- Domain identity is the hard constraint: a custom domain can be verified in only one tenant — sequence the remove-from-source / verify-in-target and DNS cutover tightly.\n- Pre-stage with incremental syncs so the cutover delta is small; this is the main lever for low downtime.\n- Throttling is real — pilot to measure throughput, then size batches/windows accordingly; don't promise timelines before measuring.\n- Rollback of a completed cutover is expensive; prefer to de-risk (pilot + pre-stage + per-batch rollback) and keep the source retained until acceptance.\n- For synced identity, coordinate with l3-hybrid-ad-001 (AAD Connect/UPN/source-of-authority) before touching domains.\n\n## 11. Related KB Articles\n- l3-hybrid-ad-001 — AAD Connect / hybrid identity and UPN considerations\n- l3-cloud-001 — Target tenant design and configuration\n- l3-certificates-002 — Cert/SAML federation dependencies affected by namespace change\n- l3-business-continuity-001 — Cutover risk, rollback, and downtime planning\n\n## 12. Keywords / Search Tags\ntenant to tenant migration, m365 migration, google workspace migration, domain move, upn smtp coexistence, mail onedrive sharepoint teams, cutover vs staged, mx autodiscover dns, throttling, rollback planning, migration tooling, post-cutover validation"
  },
  {
   "slug": "l3-network-ddos-001-ddos-response",
   "path_rel": "knowledge-base\\L3\\l3-network-ddos-001-ddos-response.md",
   "title": "\"DDoS attack response (volumetric / protocol / application-layer)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-network-ddos-001\ntitle: \"DDoS attack response (volumetric / protocol / application-layer)\"\ncategory: network-security\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 180\naudience: it-technician\nos_scope: [\"Network\", \"Cloud\", \"All\"]\nprerequisites: []\nkeywords:\n  - ddos attack\n  - volumetric attack\n  - protocol attack\n  - application layer ddos\n  - layer 7\n  - scrubbing center\n  - bgp blackhole\n  - rate limiting\n  - geo blocking\n  - cdn waf\n  - isp engagement\n  - syn flood\nrelated_articles:\n  - l3-security-001\n  - l3-networking-001\n  - l3-security-002\n  - l3-disaster-recovery-001\nescalation_trigger: \"Engage the ISP and DDoS-protection/scrubbing vendor immediately when attack volume approaches link/edge capacity or an application-layer attack evades on-box mitigation; loop in security leadership for any extortion/ransom-DDoS note.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# DDoS attack response (volumetric / protocol / application-layer)\n\n## 1. Symptoms\n- Sudden saturation of internet links; legitimate users can't reach services; severe latency/packet loss.\n- Firewall/load-balancer/edge devices at high CPU, session-table or connection-limit exhaustion.\n- Spikes in SYN/UDP/ICMP, reflected/amplified traffic, or a flood of HTTP(S) requests to expensive endpoints.\n- Web apps slow or down while infrastructure links look \"only moderately\" loaded (signature of an application-layer attack).\n- Monitoring/NetFlow shows a steep, anomalous traffic ramp, often from many distributed sources; sometimes an extortion/ransom-DDoS note arrives.\n\n## 2. Likely Causes\n- **Volumetric attack** — raw bandwidth flood (UDP/ICMP flood, DNS/NTP/memcached reflection-amplification) aiming to saturate the pipe.\n- **Protocol/state-exhaustion attack** — SYN flood, fragmented packets, or connection floods exhausting firewall/LB state tables.\n- **Application-layer (L7) attack** — low-bandwidth but high-impact floods of valid-looking requests (HTTP GET/POST, expensive queries, login/search endpoints) that evade simple volume thresholds.\n- Targeting of unprotected origin IPs that bypass an existing CDN/WAF.\n- Sometimes a smokescreen for a parallel intrusion (correlate with l3-security-001).\n\n## 3. Questions To Ask User\n- Which services are affected, and are the network links saturated or are the servers/app the bottleneck?\n- When did it start, and what does monitoring/NetFlow show (traffic type, ports, source spread, requests/sec)?\n- Is the attack hitting a CDN/WAF front end or the origin directly?\n- Do we have a DDoS-protection service or scrubbing arrangement, and an ISP contact for emergency mitigation?\n- Has any extortion/ransom note been received (do not engage attackers; involve leadership/legal)?\n- What is the business/revenue impact and which services must stay reachable as priority?\n- Is there any sign of a concurrent intrusion (this can be a distraction)?\n\n## 4. Troubleshooting Steps\n> L3 triage and coordination. The most effective DDoS mitigation usually happens upstream (ISP/scrubbing/CDN), not on your edge device. ARIA documents the attack profile and coordinates vendor/ISP engagement; senior engineers execute mitigations.\n1. **Classify the attack type quickly** (volumetric vs protocol vs application-layer) from NetFlow/logs — the mitigation differs sharply, and on-box fixes do nothing against a saturated upstream pipe.\n2. **Determine where it lands:** origin directly vs through the CDN/WAF. If the origin IP is exposed, that bypass is the core problem.\n3. **Measure scale vs capacity.** If volume approaches your link or edge-device capacity, on-premises mitigation cannot win — upstream help is required (go to escalation early).\n4. **Identify attack signatures** (ports, protocols, source ASNs/geos, target URLs, user-agents) to feed ISP/scrubbing/WAF rules.\n5. **Protect availability of priority services** — confirm what must stay up and whether non-critical services can be shed to preserve capacity.\n6. **Check for a parallel intrusion**; ensure logging/monitoring keeps running so the DDoS doesn't blind detection.\n\n## 5. Resolution Steps\n> Section 5 is for a senior network/security engineer, frequently in a bridge with the ISP and DDoS vendor. Upstream engagement is mandatory at scale.\n1. **Engage the ISP and DDoS-protection/scrubbing vendor early** to divert traffic through scrubbing (often via DNS redirection or BGP advertisement to the scrubbing center) and to apply upstream filtering. This is the primary lever for volumetric attacks.\n2. **Volumetric:** request upstream rate-limiting/filtering; as a blunt last resort, **remote-triggered black-hole (RTBH)** of the targeted IP at the ISP drops all traffic to it (it sacrifices that IP to save the rest of the network — a deliberate trade-off, decided with the ISP).\n3. **Protocol/state-exhaustion:** enable SYN cookies, tune connection/rate limits, drop malformed/fragmented traffic, and lean on stateful protections at the edge/scrubber.\n4. **Application-layer (L7):** front the service with a CDN/WAF; apply rate-limiting, challenge/CAPTCHA or JS challenges, bot management, and targeted rules for the abused endpoints. Hide/relocate the origin and restrict it to accept only CDN/WAF traffic.\n5. **Tactical filters:** apply geo/ACL/source filtering only when it reliably separates attack from legitimate traffic — the goal is keeping real users up, so avoid over-broad blocks that cause self-inflicted outage.\n6. **If exploited as cover for intrusion,** run incident response in parallel (l3-security-001). For ransom-DDoS, **do not communicate with or pay attackers without leadership/legal** direction.\n\n## 6. Verification Steps\n- Legitimate traffic flows normally; service latency/availability back to baseline for priority services.\n- Attack traffic is being absorbed/scrubbed upstream; edge devices (firewall/LB) back to healthy CPU/state-table levels.\n- Origin no longer directly reachable by attack traffic (CDN/WAF-only ingress confirmed where applicable).\n- Mitigations are documented and reversible; over-broad geo/ACL blocks reviewed to confirm they aren't dropping real users.\n- Monitoring/logging intact; no evidence of a concurrent breach (or IR handling it).\n- ISP/vendor case documented; post-incident review scheduled.\n\n## 7. Escalation Trigger\nEngage the ISP and DDoS-protection/scrubbing vendor immediately once attack volume approaches link/edge capacity, or when an application-layer attack evades on-box mitigation. Black-holing an IP and any DNS/BGP redirection are coordinated with the ISP/vendor. Involve security leadership and legal for any extortion/ransom-DDoS, and invoke l3-security-001 if a concurrent intrusion is suspected.\n\n## 8. Prevention Tips\n- Put public services behind a CDN/WAF with DDoS protection; keep origin IPs hidden and lock the origin to accept only CDN/WAF traffic.\n- Pre-arrange DDoS-protection/scrubbing service and an ISP escalation contact, with the runbook and contract details documented before an attack.\n- Right-size and harden edge devices (connection/rate limits, SYN protection); avoid being your own bottleneck.\n- Close reflection/amplification exposure (no open DNS/NTP resolvers/memcached; BCP38 anti-spoofing upstream where possible).\n- Build NetFlow/telemetry-based anomaly detection so attacks are seen and classified fast.\n- Provision headroom/autoscaling for application tiers and cache aggressively to blunt L7 attacks.\n- Run DDoS tabletop drills and validate the scrubbing/redirection path works before you need it.\n\n## 9. User-Friendly Explanation\nA DDoS attack floods your services with junk traffic from many sources to crowd out real users — like a mob jamming the doors of a shop. There are three flavors: brute-force \"fill the pipe\" floods, attacks that exhaust your equipment's capacity to track connections, and sneaky ones that send normal-looking requests to overwhelm the application. The most effective defense usually happens upstream, so we engage your internet provider and a DDoS-protection service to filter the bad traffic before it reaches you, while keeping real customers connected. In extreme cases we may temporarily sacrifice a single attacked address to protect everything else. We never negotiate with or pay attackers.\n\n## 10. Internal Technician Notes\n- Classify first (volumetric / protocol / L7) — mitigations don't transfer, and an on-box rule against a saturated pipe is wasted effort. Upstream (ISP/scrubbing/CDN) is the real lever at scale.\n- Exposed origin IP that bypasses the CDN/WAF is the most common own-goal; relocating/locking the origin is often the single biggest win.\n- RTBH black-holing is a sacrifice play (you drop all traffic to the target IP) — coordinate with the ISP and reserve for when it protects the wider network.\n- Beware over-broad geo/ACL blocks: the objective is keeping legitimate users up, not just dropping packets.\n- DDoS can be a smokescreen — keep monitoring running and watch for a parallel breach (l3-security-001).\n- Ransom-DDoS: no contact/payment without leadership + legal. Capture the note as evidence.\n\n## 11. Related KB Articles\n- l3-security-001 — Incident response if DDoS masks an intrusion\n- l3-networking-001 — Edge/network architecture and capacity context\n- l3-security-002 — Parallel emergency response patterns\n- l3-disaster-recovery-001 — Availability/failover if services must be relocated\n\n## 12. Keywords / Search Tags\nddos attack, volumetric attack, protocol attack, application layer ddos, layer 7, scrubbing center, bgp blackhole, rate limiting, geo blocking, cdn waf, isp engagement, syn flood"
  },
  {
   "slug": "l3-networking-001-architecture",
   "path_rel": "knowledge-base\\L3\\l3-networking-001-architecture.md",
   "title": "\"Network architecture: segmentation, zero trust, hub-and-spoke / SD-WAN\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-networking-001\ntitle: \"Network architecture: segmentation, zero trust, hub-and-spoke / SD-WAN\"\ncategory: networking\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 90\naudience: technician\nprerequisites: [\"Network architect\"]\nos_scope: [\"Multi-vendor\"]\nkeywords:\n  - network architecture\n  - segmentation\n  - zero trust\n  - sd-wan\n  - hub spoke\n  - microsegmentation\n  - vlans\n  - firewall\n  - nva\nrelated_articles:\n  - l2-networking-001\n  - l3-security-001\nescalation_trigger: \"Architectural change, vendor hardware EOL, mass remediation\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Network architecture: design + evolution\n\n## 1. Principles\n- **Default deny.** All traffic blocked unless allowed.\n- **Segmentation by trust zone.** Public / DMZ / Corp / Restricted / Crown jewels.\n- **Microsegmentation east-west** — limit lateral movement.\n- **Identity in the data plane** — Zero Trust.\n- **Encrypt everywhere** — TLS / mTLS / IPsec.\n- **Observability as a primary requirement** — flow logs, NetFlow, packet capture taps.\n\n## 2. Topology patterns\n**Hub-and-spoke (cloud / Azure):**\n- Hub VNet contains shared services (firewall, VPN, AD).\n- Spokes peer to hub; no spoke-spoke.\n- Hub firewall enforces inter-spoke policy.\n\n**SD-WAN:**\n- Replaces MPLS for branch connectivity.\n- Centralized policy, dynamic path selection.\n- Encryption + telemetry built-in.\n\n**Zero Trust:**\n- No implicit trust based on network location.\n- Per-request authentication + authorization.\n- Continuous verification.\n\n## 3. Migration considerations\n- Identify crown jewels first; segment them tightly.\n- Phase the rollout — never big-bang for prod.\n- Document existing flows before policy change (NetFlow / capture-based).\n- Monitor for drops post-change; have rollback plan.\n- User experience matters — Zero Trust shouldn't add friction.\n\n## 4. Capacity + performance\n- Right-size: bandwidth, firewall throughput, VPN concurrent sessions.\n- Plan for 2x peak headroom.\n- Monitor utilization; capex at 70%.\n- Avoid bottlenecks at choke points (firewall, NVA, gateway).\n\n## 5. Failover\n- HA pairs for firewall, VPN gateway.\n- BGP for dynamic routing where possible.\n- ECMP for multipath.\n- Test failover quarterly (planned outage drill).\n\n## 6. Vendor selection\n- Single-vendor simpler; multi-vendor avoids lock-in.\n- Right-size: don't buy enterprise iron for SMB needs.\n- Support contracts, end-of-life dates, replacement cadence.\n\n## 7. Observability\n- NetFlow / sFlow / IPFIX exports.\n- Packet capture tap or SPAN ports at key chokepoints.\n- SIEM ingestion for security signals.\n- Network performance monitoring (NPM) for end-to-end latency, loss.\n\n## 8. Related Articles\n- l2-networking-001 — Operational troubleshooting\n- l3-security-001 — Network is in scope of IR\n\n## 9. Keywords\nnetwork architecture, segmentation, zero trust, sd-wan, hub spoke, microsegmentation, vlans, firewall, nva"
  },
  {
   "slug": "l3-security-001-incident-response",
   "path_rel": "knowledge-base\\L3\\l3-security-001-incident-response.md",
   "title": "\"Security incident response runbook (P1 cyber incident)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-security-001\ntitle: \"Security incident response runbook (P1 cyber incident)\"\ncategory: security\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 240\naudience: technician\nprerequisites: [\"SOC / IR lead authority\", \"MDE/Sentinel/Defender XDR access\", \"Forensic tooling\"]\nos_scope: [\"All\"]\nkeywords:\n  - incident response\n  - cyber incident\n  - p1\n  - soc\n  - kill chain\n  - mttc\n  - mttd\n  - exfiltration\n  - lateral movement\n  - tabletop\nrelated_articles:\n  - l2-malware-001\n  - l1-email-001\n  - l3-disaster-recovery-001\nescalation_trigger: \"Always engage executive leadership for P1; engage cyber-insurance, legal, external IR firm\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# Security incident response runbook\n\n## 1. Phases (NIST 800-61)\n1. **Preparation** — runbook, contacts, tooling, retainers.\n2. **Detection & Analysis** — confirm incident, scope.\n3. **Containment** — short-term + long-term.\n4. **Eradication** — remove root cause + persistence.\n5. **Recovery** — restore systems + monitoring.\n6. **Lessons Learned** — postmortem + improvements.\n\n## 2. Severity matrix\n- **P1**: Ransomware, active data exfil, exec account takeover, AD compromise. Activate full IR, engage legal/insurance/external firm.\n- **P2**: Malware on single endpoint, suspected phishing victim, single account compromise. SOC handles.\n- **P3**: Policy violation, suspicious-but-bounded activity. Investigate and document.\n- **P4**: Awareness / informational.\n\n## 3. P1 immediate actions (first 60 min)\n1. Activate IR bridge (call line) + Slack/Teams war room.\n2. Assign roles: IC (incident commander), Comms, Tech Lead, Scribe, Liaison (legal/exec).\n3. Snapshot scope: affected systems, users, data classifications.\n4. Containment decisions:\n   - Isolate compromised endpoints (MDE → Isolate).\n   - Disable compromised accounts (Entra → Block sign-in + revoke sessions).\n   - Block IoCs (firewall, MDE indicators).\n   - Optional: full network segmentation if lateral spread suspected.\n5. Preserve evidence — full disk image of compromised hosts via forensic tool.\n6. Notify cyber-insurance (within 24h typical policy).\n7. Notify executive leadership.\n8. Engage external IR firm if retainer or per-incident.\n\n## 4. Key investigation queries\n- MDE Hunting: process tree of suspicious binary (`DeviceProcessEvents`).\n- Sentinel: sign-in anomalies, mailbox rule changes, SharePoint sharing spikes.\n- Audit log: privileged ops, group changes, app consents.\n- Mailflow trace for BEC.\n- DNS logs for C2 callbacks.\n\n## 5. Eradication checklist\n- Remove malware persistence (autoruns, services, scheduled tasks, WMI subscriptions).\n- Reset credentials for affected and adjacent accounts.\n- Reset KRBTGT twice (separated by replication interval) if AD compromise suspected.\n- Revoke / re-issue certificates if PKI involved.\n- Patch the entry vector.\n\n## 6. Recovery\n- Restore from clean backup (immutable / offline preferred).\n- Re-image endpoints rather than clean.\n- Monitor restored systems with elevated logging for 30 days.\n- Phased return to service with sign-off gates.\n\n## 7. Lessons learned\n- Schedule postmortem within 14 days of close.\n- Blameless format.\n- Action items: owner + due date + measurable outcome.\n- Update runbook + detections.\n- Tabletop exercise quarterly.\n\n## 8. Communication\n- Internal: factual updates every 2h during active phase.\n- External (customers, partners): only after legal+exec approval.\n- Regulators: per jurisdiction (GDPR 72h, HIPAA, SEC 4-day rule, etc.).\n- Media: never without comms lead; one spokesperson.\n\n## 9. Tooling (recommended)\n- EDR: Microsoft Defender for Endpoint.\n- SIEM: Microsoft Sentinel or Splunk.\n- Forensic: KAPE, Velociraptor, FTK.\n- Network: Zeek, Wireshark.\n- Communication: out-of-band (signal/phone) if email compromised.\n\n## 10. Compliance / legal\n- Document everything contemporaneously — IR is litigation-relevant.\n- Chain of custody for evidence.\n- Privilege: engage legal early to preserve attorney-client privilege over investigation.\n- Cyber-insurance triggers timing of notifications, vendor selection.\n\n## 11. Related Articles\n- l2-malware-001 — Triage at L2\n- l1-email-001 — Phishing entry point\n- l3-disaster-recovery-001 — Recovery infra\n\n## 12. Keywords\nincident response, cyber incident, p1, soc, kill chain, mttc, mttd, exfiltration, lateral movement, tabletop"
  },
  {
   "slug": "l3-security-002-zero-day-fleet-patch",
   "path_rel": "knowledge-base\\L3\\l3-security-002-zero-day-fleet-patch.md",
   "title": "\"Zero-day / actively-exploited vulnerability emergency fleet response\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-security-002\ntitle: \"Zero-day / actively-exploited vulnerability emergency fleet response\"\ncategory: security\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 240\naudience: it-technician\nos_scope: [\"All\"]\nprerequisites: []\nkeywords:\n  - zero day\n  - actively exploited\n  - cisa kev\n  - cvss\n  - emergency patch\n  - compensating control\n  - virtual patching\n  - ring deployment\n  - ioc hunting\n  - exploited in the wild\n  - emergency change\n  - out of band update\nrelated_articles:\n  - l3-security-001\n  - l3-endpoint-001\n  - l3-forensics-001\n  - l3-network-ddos-001\nescalation_trigger: \"Engage security leadership/CISO, the affected vendor, and (if exploitation is confirmed internally) the incident-response process the moment an actively-exploited zero-day is suspected to affect exposed assets.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Zero-day / actively-exploited vulnerability emergency fleet response\n\n## 1. Symptoms\n- A vendor advisory or threat feed reports a vulnerability **actively exploited in the wild** (often added to a known-exploited catalog such as CISA KEV).\n- A widely deployed product in your fleet (edge appliance, VPN, mail/web server, hypervisor, browser, OS component) is named.\n- No patch yet exists, or an out-of-band emergency patch was just released ahead of the normal cycle.\n- Possible early signs of compromise on exposed assets: unexpected outbound connections, new accounts/web-shells, anomalous auth, or EDR/IDS alerts matching the published IOCs.\n\n## 2. Likely Causes\n- A newly disclosed flaw with public or in-the-wild exploit code and no/limited vendor fix at disclosure time.\n- Internet-facing or high-value assets running the affected, unpatched version.\n- Patch gaps from deferred maintenance, unmanaged/shadow assets, or end-of-life software with no fix path.\n- The vulnerability is reachable given current exposure (open ports, enabled feature, default config) — exposure, not mere presence, drives risk.\n\n## 3. Questions To Ask User\n- Which product/version is named, and do we run it — where, and is it internet-facing?\n- Is it confirmed exploited in the wild (KEV/vendor), and what is the CVSS plus real exploitability for our exposure?\n- Is a patch available now, and is there a vendor-recommended interim mitigation if not?\n- Are there any current signs of compromise on the candidate assets (alerts, IOCs, anomalies)?\n- What is the business impact of patching urgently (downtime, reboot) vs the risk of waiting?\n- Who can approve an emergency change outside the normal window, and who must be notified?\n- Do we have complete asset inventory/coverage to be confident we found every affected instance?\n\n## 4. Troubleshooting Steps\n> ARIA's role here is to triage, document, and coordinate — gather facts, build the exposure picture, and stage the change. Humans (security leadership) decide; senior engineers execute. ARIA does not autonomously push emergency changes or take production offline.\n1. **Confirm the advisory from authoritative sources** (vendor advisory + known-exploited catalog). Record CVE, affected versions, exploit status, and IOCs.\n2. **Answer \"am I exposed?\"** Inventory affected products/versions, prioritizing internet-facing and high-value assets. Note that exposure depends on reachability/config, not just presence of the software.\n3. **Prioritize by real risk:** exploited-in-wild + internet-facing + sensitive data = top ring. Use CVSS as input, not the sole driver.\n4. **Identify the response option:** vendor patch available now, vendor-provided interim mitigation, or, if neither, a compensating control (block the port/feature, WAF/IPS virtual-patch signature, disable the vulnerable component, network-isolate).\n5. **Look for prior compromise BEFORE assuming patching is enough.** Hunt the published IOCs/TTPs (web-shells, new accounts, persistence, anomalous outbound). If exploited assets are found, pivot to incident response (l3-security-001 / l3-forensics-001) — patching a compromised box does not evict the attacker.\n6. **Stage the emergency change package** (targets, method, rollback, validation) for approval.\n\n## 5. Resolution Steps\n> Section 5 is senior-engineer execution under an approved emergency change. Decision authority and vendor engagement points are mandatory where noted.\n1. **Apply interim mitigations immediately on exposed assets** where no patch exists or patching will take time: restrict access (ACL/firewall/geo), disable the vulnerable feature, deploy WAF/IPS virtual-patch signatures, or isolate. Document each compensating control.\n2. **Invoke the emergency change process** (not the normal cycle) with **security leadership/CISO approval**. Capture risk acceptance, rollback plan, and comms.\n3. **Deploy the patch in rings (ring-0 → broad):** pilot on a small, representative ring to catch breakage, then accelerate to the full fleet. For critical internet-facing assets, prioritize speed over broad pilot soak — leadership owns that trade-off.\n4. **Engage the vendor** for guidance/fixed builds, especially appliances and anything where the mitigation or upgrade path is non-obvious; follow vendor severity-1 channels.\n5. **If compromise is confirmed**, stop treating this as patching and follow the **incident-response runbook (l3-security-001)** and forensic preservation (l3-forensics-001) — contain, preserve evidence, then eradicate and recover. Do not wipe assets you may need as evidence.\n6. **Track unpatched/EOL stragglers** with continued compensating controls and a remediation/replacement plan; nothing exposed should be left both unpatched and unmitigated.\n\n## 6. Verification Steps\n- Every affected, in-scope asset is patched to the fixed version or covered by a documented compensating control — with no exposed gaps.\n- Authenticated vulnerability scans / vendor checks confirm the fix on a representative sample (and re-scan after reboots).\n- IOC hunt completed across the relevant estate with results recorded; no signs of active exploitation remain (or IR is running if there were).\n- Mitigations that were temporary are removed only after the real patch is verified.\n- Asset inventory reconciled so no affected instance was missed (including shadow/unmanaged assets).\n- Emergency change documented with approvals, timeline, and lessons-learned captured.\n\n## 7. Escalation Trigger\nEscalate to security leadership/CISO and engage the vendor the moment an actively-exploited zero-day plausibly affects exposed assets — and invoke the incident-response process (l3-security-001) immediately if any indicator of actual compromise is found. Emergency changes that risk production downtime require explicit risk-acceptance from leadership; ARIA coordinates and documents but does not approve or self-execute these.\n\n## 8. Prevention Tips\n- Maintain a complete, continuously updated asset inventory (you can only protect what you can see) including internet-facing exposure mapping.\n- Subscribe to vendor advisories and known-exploited catalogs; wire alerting into the triage process.\n- Pre-define and rehearse the emergency/out-of-band change process and approval chain, so it's fast under pressure.\n- Reduce attack surface continuously: minimize internet-facing services, retire EOL software, enforce least functionality.\n- Keep EDR/IDS/WAF in place so virtual-patching and IOC hunting are possible when no patch exists.\n- Adopt ring-based patch rings and tested rollback so emergency deploys are low-drama.\n- Run periodic tabletop exercises for \"actively-exploited zero-day in a core product.\"\n\n## 9. User-Friendly Explanation\nA \"zero-day\" is a security hole that attackers are using right now, sometimes before the vendor even has a fix. The danger isn't just having the affected software — it's whether attackers can reach it (like internet-facing systems). Our job is to find every place we run it, decide what's most at risk, and either patch immediately or put up a temporary barrier (block access or turn off the risky feature) until a patch exists. We also check whether anyone already broke in — because patching a system that's already compromised doesn't remove the intruder. Some steps mean brief downtime; leadership weighs that against the risk of waiting.\n\n## 10. Internal Technician Notes\n- Exposure > presence. Prioritize internet-facing and high-value first; CVSS is input, \"exploited in the wild + reachable\" is the real driver.\n- Always hunt IOCs before declaring victory — patching a box that's already owned just locks the attacker in with you. Found compromise = pivot to l3-security-001 / l3-forensics-001, don't wipe.\n- When there's no patch, compensating controls (block port/feature, virtual-patch, isolate) buy time and are legitimate first responses.\n- Use the *emergency* change process with leadership risk-acceptance — don't shoehorn this into the normal cycle, and don't skip rollback planning.\n- ARIA documents and coordinates; humans approve and decide on downtime. Keep a contemporaneous record (it may become IR-relevant).\n- Don't forget EOL/shadow assets — they're the common \"missed\" instance that stays exploited.\n\n## 11. Related KB Articles\n- l3-security-001 — Incident response runbook (pivot here if exploited)\n- l3-forensics-001 — Evidence preservation if a host is compromised\n- l3-endpoint-001 — EDR strategy enabling IOC hunting / containment\n- l3-network-ddos-001 — Parallel network-layer attack response patterns\n\n## 12. Keywords / Search Tags\nzero day, actively exploited, cisa kev, cvss, emergency patch, compensating control, virtual patching, ring deployment, ioc hunting, exploited in the wild, emergency change, out of band update"
  },
  {
   "slug": "l3-server-001-windows-server-roles",
   "path_rel": "knowledge-base\\L3\\l3-server-001-windows-server-roles.md",
   "title": "\"Windows Server: role health, patching strategy, sysprep / reference image\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-server-001\ntitle: \"Windows Server: role health, patching strategy, sysprep / reference image\"\ncategory: servers\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 60\naudience: technician\nprerequisites: [\"Server admin\"]\nos_scope: [\"Windows Server 2019/2022/2025\"]\nkeywords:\n  - windows server\n  - server role\n  - patching\n  - cluster\n  - storage spaces direct\n  - sconfig\n  - server core\n  - sysprep\nrelated_articles:\n  - l3-disaster-recovery-001\n  - l2-deployment-001\nescalation_trigger: \"Cluster split-brain, storage corruption, datacenter-wide outage\"\nlast_invalidated: 2026-05-07\nversion: 1.0\n---\n\n# Windows Server operations\n\n## 1. Patching strategy\n- Rings: Dev → QA → Pilot prod (1 server per role) → Wave 1 (50%) → Wave 2 (100%).\n- Reboot windows align with maintenance windows.\n- For clusters: drain → patch → validate → next.\n- Skip a month at most — never go >60d on prod.\n- Baseline via Update Compliance / Defender Vulnerability Management.\n\n## 2. Server roles + monitoring\n- DCs: replication, time, FRS/SYSVOL.\n- File servers: shares, dedup, capacity.\n- Hyper-V: cluster health, storage, snapshots cleared.\n- ADFS: federation, claims.\n- DNS/DHCP/IIS/SQL — each with role-appropriate baselines.\n\n## 3. Reference image / build\n- Server Core preferred for security + footprint (no GUI, less attack surface).\n- Use DSC / Ansible / configuration as code, not snowflakes.\n- Sysprep + capture for golden image (rare with Azure / cloud-first).\n- Document per-role hardening (CIS baseline applied).\n\n## 4. Cluster operations (S2D, FCI)\n- Drain: `Suspend-ClusterNode -Drain` before patch.\n- Validate health: `Get-ClusterFaultDomain`, `Get-ClusterPhysicalDisk`.\n- Storage: `Get-StoragePool`, `Get-VirtualDisk` health = Healthy.\n- Repair: `Repair-VirtualDisk` with caution; large rebuilds take hours.\n- Quorum: dynamic quorum + cloud witness for small clusters.\n\n## 5. Verification\n- Roles healthy per dashboard.\n- Patches applied per ring.\n- Backups validated.\n- DR drill annually.\n\n## 6. Escalation\n- Cluster split-brain.\n- Storage Spaces Direct corruption.\n- Datacenter outage.\n\n## 7. Prevention\n- Inventory + lifecycle plan per server.\n- Move toward cloud-native services where economically sensible (retire on-prem servers).\n- Automate everything; reduce snowflakes.\n- Capacity + performance baselines.\n- Don't let servers age out of support.\n\n## 8. Notes\n- Windows Server 2025 + Hot Patching reduces reboot frequency for some roles.\n- For SQL FCI vs AG vs Azure SQL MI — pick by RTO/RPO + cost.\n- For RDS, separate Connection Broker, Gateway, Session Hosts; don't co-locate.\n\n## 9. Related\n- l3-disaster-recovery-001 — DR\n- l2-deployment-001 — Deployment\n\n## 10. Keywords\nwindows server, server role, patching, cluster, storage spaces direct, sconfig, server core, sysprep"
  },
  {
   "slug": "l3-sso-saml-001-saml-troubleshoot",
   "path_rel": "knowledge-base\\L3\\l3-sso-saml-001-saml-troubleshoot.md",
   "title": "\"SSO / SAML / OIDC: federation troubleshooting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-sso-saml-001\ntitle: \"SSO / SAML / OIDC: federation troubleshooting\"\ncategory: sso-saml\nsupport_level: L3\nseverity: high\nestimated_time_minutes: 60\naudience: technician\nprerequisites: [\"IdP admin\", \"SP / app config access\"]\nos_scope: [\"Multi-platform\"]\nkeywords:\n  - sso\n  - saml\n  - oidc\n  - federation\n  - identity provider\n  - service provider\n  - assertion\n  - claims\n  - jwt\n  - okta\n  - entra\n  - certificate rollover\nrelated_articles:\n  - l2-azure-ad-001\n  - l3-security-001\nescalation_trigger: \"Federation-wide outage, IdP cert compromise, SAML response replay attack\"\nlast_updated: 2026-05-07\nversion: 1.0\n---\n\n# SSO / SAML / OIDC troubleshooting\n\n## 1. Symptoms\n- SAML \"AssertionConsumerService URL mismatch\".\n- \"Certificate validation failure\" / cert expired in IdP.\n- \"Authentication succeeded but app says unauthorized\".\n- \"Login loop\" — IdP and SP redirect endlessly.\n- Claims missing / wrong format.\n\n## 2. Diagnostic\n- Capture SAML / OIDC trace: SAML-tracer Firefox / Chrome ext, or browser DevTools network.\n- Decode SAML assertion: Base64 → XML; or jwt.io for OIDC tokens.\n- Verify timestamps (not before / not on or after).\n- Verify signatures with IdP cert.\n- Verify Audience / Issuer / Subject.\n\n## 3. Common fixes\n**ACS URL mismatch:**\n- Update SP SAML config to exact ACS URL expected by IdP and vice-versa. Trailing slash matters.\n\n**Cert expired:**\n- IdP cert rollover: generate new cert at IdP, distribute via metadata.\n- SP imports new cert from updated metadata URL.\n- Coordinate cutover; some SPs support multiple sig certs.\n\n**Claims wrong:**\n- IdP attribute mapping: ensure correct user attribute → SAML claim name.\n- For Entra, custom claims via Enterprise application → User attributes & claims.\n- For OIDC, ensure scopes requested match what app expects.\n\n**Subject NameID:**\n- Format mismatch — most apps want `emailAddress` or `persistent`. Check SP requirements.\n\n**Login loop:**\n- Typically Audience / Issuer mismatch — check both configs.\n- Or session cookie blocked / SameSite issue on browser.\n\n## 4. Verification\n- User signs in cleanly; SAML trace shows clean assertion.\n- App receives expected claims.\n- Certs valid + monitored for renewal.\n- Failure rate <0.1% over 24h.\n\n## 5. Escalation\n- IdP outage → IdP vendor.\n- App vendor non-compliance with SAML spec.\n- Replay attack indicator → security incident.\n\n## 6. Prevention\n- Monitor cert expiry — 90/30/7 alerts.\n- Use metadata URL not static cert (auto-pull for rollover).\n- Maintain test users for each app.\n- Inventory of all SAML/OIDC apps + integration owners.\n- Document each app's claim mapping.\n\n## 7. Notes\n- SAML clock skew: IdP and SP clocks must be within 5 min.\n- Encrypted assertions: require SP private key for decoding; harder to debug.\n- Just-in-Time provisioning: ensure attributes present before user's first login.\n- For Microsoft Entra: SAML for legacy SaaS, OIDC preferred for new.\n\n## 8. Related Articles\n- l2-azure-ad-001 — Conditional Access often gates SSO apps\n- l3-security-001 — Replay / token theft\n\n## 9. Keywords\nsso, saml, oidc, federation, identity provider, service provider, assertion, claims, jwt, okta, entra, certificate rollover"
  },
  {
   "slug": "l3-storage-001-raid-san-rebuild",
   "path_rel": "knowledge-base\\L3\\l3-storage-001-raid-san-rebuild.md",
   "title": "\"RAID array / SAN disk failure and rebuild\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-storage-001\ntitle: \"RAID array / SAN disk failure and rebuild\"\ncategory: storage\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 240\naudience: it-technician\nos_scope: [\"Windows Server\", \"Linux\", \"VMware ESXi\", \"SAN/Storage Appliance\"]\nprerequisites: []\nkeywords:\n  - raid degraded\n  - raid rebuild\n  - failed disk\n  - hot spare\n  - unrecoverable read error\n  - ure\n  - second drive failure\n  - san multipath\n  - lun offline\n  - controller cache battery\n  - storage vendor support\n  - do not initialize array\nrelated_articles:\n  - l3-disaster-recovery-001\n  - l3-backup-dr-002\n  - l3-virtualization-001\n  - l3-server-001\nescalation_trigger: \"Engage the storage/array vendor immediately if a second disk fails during rebuild, the array is reported failed/offline, the controller or cache is suspect, or any procedure would re-initialize, recreate, or reformat the array.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# RAID array / SAN disk failure and rebuild\n\n## 1. Symptoms\n- Storage controller or SAN management console reports an array/disk group as **Degraded**, **Critical**, or **Failed/Offline**.\n- One or more physical disks show **Failed**, **Predictive Failure (SMART)**, **Foreign**, or **Missing**.\n- Audible controller alarm; amber/red drive bay LEDs.\n- On hosts: datastores/volumes go read-only, disappear, or throw I/O errors; VMs pause or crash; databases report torn pages or corruption.\n- SAN: paths flapping, LUN(s) inaccessible from some or all initiators, multipath showing reduced/failed paths.\n- Severe latency or throughput collapse while an array runs in degraded mode or rebuilds.\n\n## 2. Likely Causes\n- Single physical disk failure putting a redundant array (RAID 1/5/6/10) into degraded mode.\n- Second disk failure (or an Unrecoverable Read Error, URE) during a rebuild — common on large-capacity drives because the rebuild must read every sector of the surviving members.\n- RAID controller cache battery/BBU or flash-backup failure causing write-cache to disable (performance) or, in a bad-shutdown scenario, lost cached writes (corruption).\n- RAID controller, expander, backplane, or SAS/SATA cabling fault presenting as multiple \"failed\" disks that are not actually dead.\n- Firmware mismatch or bug on controller/disks/expander.\n- SAN-side: multipath misconfiguration, fabric/zoning change, LUN masking error, or storage processor (SP) failover event.\n- A \"foreign config\" appearing after disks/controller were moved or after a controller replacement.\n\n## 3. Questions To Ask User\n- What exactly does the management console/alarm say — which array, which disk(s), and what state (degraded vs failed vs offline)?\n- When did it start, and did anything change just before (firmware update, disk swap, power event, fabric change, host reboot)?\n- Is there a hot-spare configured, and has a rebuild already started automatically?\n- Has anyone already pulled, reseated, or replaced a drive — or clicked anything in the array tool?\n- What is running on this storage (production VMs, databases, file shares) and what is the business impact right now?\n- What is the backup situation — last successful backup, where it lives, and has a restore ever been tested?\n- Do we have an active support contract with the array/SAN vendor and the entitlement details to open a severity-1 case?\n\n## 4. Troubleshooting Steps\n> L3 triage only. Do NOT initialize, recreate, clear the foreign config, or reformat the array. Those actions are frequently irreversible and destroy data. ARIA triages, documents, and escalates; a senior storage engineer (with vendor support) performs invasive recovery.\n1. **Stop and assess before touching hardware.** Capture the full controller/SAN status, event logs, and a screenshot of the array state. Note disk serials, slots, and the exact reported condition of each member.\n2. **Determine degraded vs failed.** A *degraded* redundant array is still serving data on its remaining parity/mirror; a *failed* array has lost more members than its redundancy tolerates and is offline. The recovery path is very different — get this right first.\n3. **Assess rebuild risk before any rebuild begins.** On RAID 5 with large drives, a single additional URE during rebuild can fail the whole rebuild. If a rebuild has not auto-started, confirm a verified backup exists before initiating one.\n4. **Check for \"phantom\" multi-disk failures.** If several disks failed simultaneously, suspect the controller, expander, backplane, or cabling rather than the disks. Multiple genuine simultaneous disk deaths are rare; a shared-component fault is more likely — do not assume the data is lost.\n5. **Verify controller cache/battery health.** A failed BBU/flash-backup disables write-back cache and can indicate cached writes were at risk during the event. Record its state; do not force-clear cache.\n6. **SAN/multipath checks.** Confirm fabric zoning, LUN masking, and multipath (MPIO/native) path state. A LUN \"outage\" is often a connectivity/path problem, not a disk problem — validate from multiple hosts.\n7. **Confirm backup recoverability early**, in parallel, so a restore decision can be made quickly if recovery is not safe.\n\n## 5. Resolution Steps\n> Sections 5 steps are for a senior engineer, typically in a live session with the vendor. Mandatory human/vendor engagement is called out inline.\n1. **Single failed disk, array still degraded-but-redundant (the safe path):**\n   - Confirm the replacement disk meets vendor spec (size/type/firmware). Identify the correct physical slot using the management tool's locate/blink function — never by guessing.\n   - Replace the failed disk; allow the controller to rebuild onto the new disk (or onto the hot-spare, then copyback). Monitor rebuild progress and watch for additional errors.\n   - Keep the array on backup power and avoid heavy I/O during rebuild to reduce the chance of a URE-triggered second failure.\n2. **Second failure or URE during rebuild, or array reported FAILED/OFFLINE:** STOP. **Engage the storage/array vendor's severity-1 support immediately.** Do not attempt to force-online, re-initialize, or recreate the array — these typically destroy any chance of vendor-led recovery and the data.\n3. **Suspected controller / backplane / cabling fault:** Replace the suspect component **under vendor guidance**. After a controller swap, import the existing/foreign configuration only as directed by the vendor — never clear it blindly.\n4. **Cache/BBU fault:** Replace the battery/flash-backup module per vendor procedure; the vendor confirms whether any cached writes were lost and whether a filesystem/database consistency check is required.\n5. **SAN path/LUN issue:** Correct zoning/masking/multipath; bring paths back; have the vendor confirm SP/controller health before returning the LUN to production.\n6. **If recovery is not safe or not possible — restore from backup:** This is a management decision (data loss/RPO vs downtime). Restore to healthy hardware/array from the most recent verified backup, then validate integrity before returning to production.\n\n## 6. Verification Steps\n- Array/disk group reports **Optimal/Healthy**; all member disks **Online**; no hot-spare consumed without copyback completing.\n- Rebuild/copyback completed at 100% with no media/URE errors logged.\n- Controller cache/BBU healthy and write-back re-enabled (if appropriate).\n- SAN: all expected multipaths present and active/optimal from every host; LUN(s) online and read/write.\n- Host/filesystem/database consistency check clean (chkdsk/fsck, DB DBCC/integrity check) where a bad shutdown or cache loss occurred.\n- Applications, VMs, and file shares back online; latency/throughput normal; recent backup succeeds post-recovery.\n\n## 7. Escalation Trigger\nEngage the storage/array vendor's severity-1 support immediately if: a second disk fails or a URE occurs during rebuild; the array is reported failed/offline; the controller, cache/BBU, backplane, or expander is suspect; a \"foreign config\" appears after hardware changes; or any contemplated action would initialize, recreate, clear, or reformat the array. Engage management for the restore-vs-recover business decision and any potential data-loss event.\n\n## 8. Prevention Tips\n- Use RAID levels matched to capacity and risk: prefer RAID 6 (or RAID 10) over RAID 5 for large-capacity drives because of rebuild-time URE exposure.\n- Configure and test hot-spares; verify copyback works.\n- Monitor SMART/predictive-failure and replace at-risk disks proactively, before a hard failure.\n- Keep controller, disk, and expander firmware on vendor-recommended levels (in a maintenance window, tested).\n- Verify BBU/flash-backup health on a schedule; replace aging batteries proactively.\n- Maintain (and **regularly test**) backups that are independent of this array; the rebuild risk means backups are the real safety net.\n- Document the array layout, disk serials/slots, and vendor support entitlements before an incident.\n- For SAN: document zoning, masking, and multipath; validate redundancy by failing paths during a planned test.\n\n## 9. User-Friendly Explanation\nYour storage system spreads data across several disks with built-in redundancy, so it can survive a disk failing. Right now a disk has failed (or is at risk), and the system is running without its safety margin. Replacing a disk and letting it rebuild is usually routine — but on large disks the rebuild is a stressful read of everything left, and a second problem during that window is the dangerous part. To protect your data, we are being deliberate: we will not \"reset\" or recreate the storage, because that can erase everything. If recovery looks risky, we bring in the storage vendor and may restore from backup instead. The priority is your data, not speed.\n\n## 10. Internal Technician Notes\n- The single most important rule: **never initialize/recreate/clear-foreign-config to \"fix\" a failed array.** That is the classic data-loss mistake. When in doubt, stop and call the vendor.\n- Degraded ≠ failed. Confirm the actual state before acting; the wrong assumption leads to the wrong (sometimes destructive) action.\n- Treat simultaneous multi-disk \"failures\" as a controller/backplane/cabling fault until proven otherwise — don't write the data off.\n- RAID is availability, not backup. A verified, independent, tested backup is what actually saves the customer here.\n- Record disk serials/slots and use locate LEDs; pulling the wrong drive from a degraded array turns a recoverable event into a total loss.\n- Get the vendor case opened early with logs attached; severity-1 entitlement and a support contract are prerequisites — verify them before the incident, not during.\n\n## 11. Related KB Articles\n- l3-disaster-recovery-001 — DR runbook / recovery infrastructure\n- l3-backup-dr-002 — Immutable / offline backup the restore depends on\n- l3-virtualization-001 — Hypervisor cluster impacted by datastore/LUN outage\n- l3-server-001 — Host-side roles and filesystem consistency\n\n## 12. Keywords / Search Tags\nraid degraded, raid rebuild, failed disk, hot spare, unrecoverable read error, ure, second drive failure, san multipath, lun offline, controller cache battery, storage vendor support, do not initialize array"
  },
  {
   "slug": "l3-virtualization-001-hypervisor-cluster-down",
   "path_rel": "knowledge-base\\L3\\l3-virtualization-001-hypervisor-cluster-down.md",
   "title": "\"Hypervisor cluster down (vSphere / Hyper-V failover cluster)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l3-virtualization-001\ntitle: \"Hypervisor cluster down (vSphere / Hyper-V failover cluster)\"\ncategory: virtualization\nsupport_level: L3\nseverity: critical\nestimated_time_minutes: 240\naudience: it-technician\nos_scope: [\"VMware ESXi / vCenter\", \"Windows Server Hyper-V / Failover Cluster\"]\nprerequisites: []\nkeywords:\n  - hypervisor cluster down\n  - vsphere ha\n  - host isolation\n  - quorum loss\n  - witness failure\n  - datastore apd pdl\n  - csv offline\n  - vcenter down\n  - split brain\n  - failover cluster\n  - shared storage outage\n  - staged recovery order\nrelated_articles:\n  - l3-storage-001\n  - l3-disaster-recovery-001\n  - l3-networking-001\n  - l3-server-001\nescalation_trigger: \"Engage the hypervisor and storage vendors (severity-1) if shared storage is in APD/PDL, cluster quorum/witness is lost, the management plane is down, or there is any risk of split-brain — do not force VMs online on multiple hosts.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n# Hypervisor cluster down (vSphere / Hyper-V failover cluster)\n\n## 1. Symptoms\n- Multiple VMs unreachable; HA did not restart them, or restarted them in a loop.\n- Hosts show **Not Responding**, **Isolated**, **Disconnected**, or in Hyper-V **Down/Quarantined/Paused**.\n- vCenter / Failover Cluster Manager unreachable, or the cluster reports **no quorum**.\n- Datastores show **All Paths Down (APD)** or **Permanent Device Loss (PDL)**; Cluster Shared Volumes (CSV) in **Online (No Access)/Failed/Redirected** state.\n- VMs paused-critical (Hyper-V) or in an invalid/inaccessible state (vSphere).\n- Cluster events showing isolation responses, failover storms, or witness/quorum loss.\n\n## 2. Likely Causes\n- Shared storage outage (SAN/iSCSI/NFS/vSAN) causing APD/PDL or CSV loss — the most common root cause of a whole-cluster outage.\n- Management/cluster network partition: hosts can't reach each other or the witness → isolation, quorum loss, or split-brain risk.\n- Quorum/witness failure (file-share/disk/cloud witness offline) dropping the cluster below the votes needed to stay online.\n- Management plane failure: vCenter (and its DB/PSC) down, or the cluster service hung on key nodes.\n- Power event or correlated host failure exceeding HA admission-control capacity.\n- Firmware/driver/patch mismatch after a maintenance window left nodes incompatible.\n- vSAN/storage-policy degradation taking objects below required availability.\n\n## 3. Questions To Ask User\n- What changed in the last 24–48h (patching, firmware, storage work, network change, power event)?\n- Which is down — hosts, the shared storage, the management plane (vCenter/cluster), or the network between them?\n- How many hosts and how many nodes are affected vs healthy, and is the witness/quorum resource reachable?\n- Are VMs hard-down, or running-but-unreachable? Any reports of the same VM appearing on two hosts (split-brain)?\n- What is the storage backend and is it reporting healthy from its own console?\n- What is the business impact and which workloads are top priority to recover first?\n- Do we have active severity-1 support entitlements with the hypervisor and storage vendors?\n\n## 4. Troubleshooting Steps\n> L3 triage. Do NOT force VMs to power on across multiple hosts and do NOT force quorum blindly — both can cause split-brain and data corruption. ARIA documents and escalates; a senior engineer drives recovery, with vendors where indicated.\n1. **Establish the failure domain first.** Decide whether the root issue is storage, network/quorum, management plane, or compute. Recovering in the wrong order makes things worse.\n2. **Check shared storage health from the storage console**, not just the hosts. Confirm whether you are seeing APD (transient, paths may return) vs PDL (device declared permanently lost). Cross-reference with l3-storage-001 if the array/SAN itself is degraded.\n3. **Check cluster networking and witness reachability.** Identify management-network partitions and confirm the witness/quorum resource is online. Quorum loss and isolation almost always trace back to network or witness.\n4. **Assess split-brain risk explicitly.** If nodes lost contact with each other but retained storage, two nodes could try to own the same VM/volume. Treat preventing split-brain as higher priority than speed.\n5. **Check the management plane.** A down vCenter/cluster service hides state but does not by itself stop running VMs — separate \"we can't see it\" from \"it's actually down.\"\n6. **Confirm HA/admission-control state** (vSphere) or **node quarantine/failover thresholds** (Hyper-V) to understand why HA did or didn't act.\n7. **Inventory which VMs are genuinely down vs unreachable** so the recovery order can prioritize business-critical workloads.\n\n## 5. Resolution Steps\n> Staged recovery order: **storage → network/quorum → cluster/management → VMs.** Section 5 is for a senior engineer; vendor engagement points are mandatory where noted.\n1. **Restore shared storage first.** Resolve the SAN/iSCSI/NFS/vSAN outage (see l3-storage-001). For PDL, follow the vendor's device-removal/re-add procedure. **Do not bring VMs up until storage is confirmed stable** — restarting on flaky storage causes corruption.\n2. **Restore cluster network and quorum.** Heal the management-network partition; bring the witness back. Recompute quorum only after connectivity is genuinely restored. **Force quorum only as a last resort and ideally with vendor guidance**, having first confirmed no other partition is also alive (split-brain prevention).\n3. **Recover the management plane.** Bring vCenter (and its DB/PSC) or the cluster service back; validate it sees true, consistent state before issuing power operations.\n4. **Bring hosts back into the cluster** cleanly (exit maintenance/isolation), confirming each sees storage and the network correctly and is firmware/patch-compatible.\n5. **Power on VMs in priority order, on one owner each.** Let HA/the cluster place them, or place manually — but ensure each VM starts on exactly one host. Verify guest health before moving to the next tier.\n6. **If storage data integrity is in doubt or recovery is unsafe**, this becomes a DR decision: fail over to the DR site or restore from backup (see l3-disaster-recovery-001 / l3-backup-dr-002) — a management call weighing RTO/RPO.\n\n## 6. Verification Steps\n- All hosts/nodes **Connected/Up**, out of isolation/maintenance, and quorum healthy with the witness online.\n- Datastores/CSVs **online and read/write** from all expected hosts; multipath fully restored.\n- vCenter / Failover Cluster Manager healthy and showing consistent state; no orphaned or duplicated VM registrations.\n- HA / admission control re-enabled and reporting sufficient failover capacity.\n- All priority VMs running on a single owner each, guests healthy, applications validated; no split-brain artifacts.\n- Backups/replication resumed and a fresh backup succeeds post-recovery.\n\n## 7. Escalation Trigger\nEngage the hypervisor and storage vendors at severity-1 when shared storage is in APD/PDL, quorum/witness is lost, the management plane is down, firmware/patch incompatibility blocks rejoin, or there is any split-brain risk. Never force VMs online on multiple hosts or force quorum without confirming no competing partition is live. Escalate to management for any DR-invocation or potential data-corruption decision.\n\n## 8. Prevention Tips\n- Redundant, isolated management/heartbeat networks; redundant storage paths (multipath) end to end.\n- A reliable, monitored quorum witness (file-share/cloud witness) and tested quorum behavior.\n- Set HA admission control / failover capacity so the cluster can actually absorb the planned number of host failures.\n- Patch and update firmware in rolling maintenance windows; keep all nodes on compatible, vendor-supported levels.\n- Protect the management plane (vCenter HA / clustered management, backed-up DB) and store its recovery procedure out-of-band.\n- Run periodic failover and DR tests; validate that HA restarts VMs and that the cluster survives a witness loss.\n- Monitor vSAN/storage-policy compliance and remediate degraded objects promptly.\n\n## 9. User-Friendly Explanation\nYour servers run as virtual machines on a cluster of physical hosts that share common storage and are designed to cover for each other if one fails. Right now something broke the cluster's foundation — usually the shared storage or the network the hosts use to coordinate — so the safety automation either couldn't act or couldn't act safely. We recover deliberately and in order: fix the storage, then the host coordination, then the management tools, and only then start the virtual machines — each on exactly one host. Rushing risks \"split-brain,\" where two hosts fight over the same data and corrupt it. If the foundation can't be trusted, we fail over to the disaster-recovery copy instead.\n\n## 10. Internal Technician Notes\n- Recovery order is everything: **storage → network/quorum → cluster/management → VMs.** Powering VMs onto unstable storage is a top cause of corruption.\n- APD vs PDL matters: APD may self-heal when paths return; PDL needs the vendor device-removal/re-add flow. Don't treat them the same.\n- \"I can't see it\" (vCenter/cluster down) is not the same as \"it's down.\" Confirm actual VM/storage state before acting.\n- Split-brain prevention beats speed. Never force-online a VM on a second host or force quorum without proving no other partition is alive.\n- Tie storage faults to l3-storage-001 — do not attempt array recovery here; that path has its own do-not-initialize rules.\n- Have severity-1 entitlements verified ahead of time for both hypervisor and storage vendors; open cases early with logs.\n\n## 11. Related KB Articles\n- l3-storage-001 — Underlying RAID/SAN failure feeding the datastore/LUN outage\n- l3-disaster-recovery-001 — DR invocation / failover to recovery site\n- l3-networking-001 — Management/heartbeat network partition root cause\n- l3-server-001 — Host OS roles and guest-level validation\n\n## 12. Keywords / Search Tags\nhypervisor cluster down, vsphere ha, host isolation, quorum loss, witness failure, datastore apd pdl, csv offline, vcenter down, split brain, failover cluster, shared storage outage, staged recovery order"
  },
  {
   "slug": "l1-mac-legacy-001-older-macos-stuck-on-1015",
   "path_rel": "knowledge-base\\legacy\\l1-mac-legacy-001-older-macos-stuck-on-1015.md",
   "title": "\"Older Mac stuck on macOS 10.13-10.15 — app compatibility and security\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mac-legacy-001\ntitle: \"Older Mac stuck on macOS 10.13-10.15 — app compatibility and security\"\ncategory: macos\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"macOS 10.13 High Sierra\", \"macOS 10.14 Mojave\", \"macOS 10.15 Catalina\"]\ntech_generation: legacy\nyear_range: \"2017-2020 (Apple security updates ended 2022)\"\neol_status: \"Apple last released security updates for macOS 11 Big Sur Sept 2023. macOS 10.15 Catalina and earlier no longer receive ANY security updates. Browsers and most apps have dropped support — Chrome 120+, Firefox 117+, Safari (capped at the OS version).\"\nprerequisites: []\nkeywords:\n  - macos\n  - mac os\n  - high sierra\n  - mojave\n  - catalina\n  - intel mac\n  - macbook pro 2015\n  - macbook air 2014\n  - imac 2013\n  - opencore legacy patcher\n  - 32 bit apps\n  - kernel extensions\n  - notarization\nrelated_articles:\n  - l1-mac-001-kernel-panic-spinning-beach-ball\n  - l1-windows-legacy-001-windows-7-still-running\n  - l1-office-legacy-001\nescalation_trigger: \"Mac is being used for sensitive business work AND cannot be upgraded; recommend hardware replacement or OpenCore Legacy Patcher per technician judgment.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Older Mac stuck on macOS 10.13-10.15 — app compatibility and security\n\n## 1. Symptoms\n- \"This app cannot be installed on this version of macOS.\"\n- Chrome / Firefox / Edge prompts that updates have stopped on this Mac.\n- Banking site, video conferencing app, or business SaaS shows \"browser not supported.\"\n- Some apps that used to work now crash on launch (\"32-bit app, no longer supported\" after Catalina).\n- Mac is from 2013-2017 and stuck on the highest macOS its hardware natively supports.\n\n## 2. Likely Causes\n1. **Apple dropped hardware support.** macOS Monterey (12) dropped 2013-2015 Macs. macOS Sonoma (14) dropped 2017 Macs. macOS Sequoia (15) dropped 2018 MacBook Air / 2017 Mac Pro.\n2. **32-bit apps no longer launch** on macOS 10.15+ (anything pre-2019 from a vendor that didn't update).\n3. **Browser EOL on old macOS** — Chrome capped at version 116 on macOS 10.15 (Catalina). New web standards (WebGPU, OAuth flows with Passkeys) fail.\n4. **Banks / payroll providers / health platforms** have minimum browser requirements and reject older browsers.\n\n## 3. Questions To Ask User\n1. Exact Mac model and year? Apple menu → About This Mac → look for \"MacBook Pro (16-inch, 2019)\" etc.\n2. macOS version? Apple menu → About This Mac → e.g. \"macOS Catalina 10.15.7\".\n3. What specific app or website is failing?\n4. Are you the original owner, or did you inherit this Mac?\n5. Is the data on this Mac backed up to iCloud, Time Machine, or external drive?\n\n## 4. Troubleshooting Steps\n1. Check whether the Mac can be upgraded to a newer supported macOS: Apple menu → System Settings/Preferences → Software Update.\n2. If \"Your Mac is up to date\" — that's the maximum macOS Apple offers for this hardware.\n3. Check app vendor for a version compatible with the Mac's macOS — sometimes they keep a legacy version on a separate download page.\n4. For browser issues: try Firefox ESR (Extended Support Release) — sometimes goes further back than Chrome.\n\n## 5. Resolution Steps\n\n**Path A — Upgrade to the latest supported macOS for the hardware (preferred):**\n1. System Settings → Software Update → install the offered upgrade.\n2. Back up first via Time Machine to an external drive.\n3. Verify essential apps still work post-upgrade before retiring the old install.\n\n**Path B — Replace the Mac (recommended for business-critical use):**\n- Mac mini M4 ($599) is the cheapest path to a current Mac that will get OS support through ~2032.\n- MacBook Air M3 ($999-1,299) for portability.\n- All current Macs are Apple Silicon — confirm any business app has an Apple Silicon native or Rosetta-compatible build before buying.\n\n**Path C — OpenCore Legacy Patcher (technician judgment, NOT for compliance / regulated use):**\n1. Free open-source tool that patches macOS Ventura / Sonoma onto Macs Apple dropped (2009-2017 hardware).\n2. Risks: kernel patches may be unstable; Apple updates may break the patch; no Apple support; some peripherals (T2 chip Macs, certain Wi-Fi cards) lose features.\n3. Reasonable for personal / home use or single-purpose machines. Do NOT use for regulated data or production line.\n\n**Path D — Browser + app workarounds (until budget allows replacement):**\n1. Switch to Firefox ESR for sites that reject Chrome 116.\n2. Use webmail / web-based versions of apps instead of native (Outlook web, Zoom web client, etc.).\n3. Move banking / sensitive sites to a phone or a modern computer.\n4. **Never enter banking credentials on an unsupported OS** — keyloggers / malware risk is real.\n\n## 6. Verification Steps\n- After Path A upgrade: System Settings → Software Update shows \"macOS [N] is up to date\".\n- Critical apps launch and function (test the top 3 the user named).\n- Browser passes a TLS check at https://www.howsmyssl.com — should report TLS 1.3.\n\n## 7. Escalation Trigger\n- Mac handles regulated data (HIPAA, PCI, GDPR) and cannot be upgraded → mandatory replacement, escalate cost/timing decision.\n- OpenCore Legacy Patcher candidate but customer has no IT-savvy user on site → schedule technician install rather than self-serve.\n- Apple Silicon transition: business has 5+ Macs needing simultaneous refresh → procurement + deployment plan, L2 owns.\n\n## 8. Prevention Tips\n- **Mac lifecycle:** plan for 5-7 years per Mac in business use.\n- **Buy Apple Silicon now, not Intel** — Apple has fully moved to Apple Silicon; future-proofing.\n- **AppleCare+** extends warranty but does not extend OS support — still pay attention to OS EOL.\n- **Vendor compatibility check before Mac purchase** — confirm Apple Silicon native versions of QuickBooks, Photoshop, your specific industry apps.\n\n## 9. User-Friendly Explanation\nYour Mac is from before Apple started using their newer chips. Apple stopped giving it security updates a couple of years ago, and websites are starting to refuse to load. You've got three real choices: upgrade to a newer macOS if your Mac will take it (free, 30 minutes), replace the Mac with a current model (best for security, $600-1,300), or limp along by using different browsers for specific sites (risky for banking and work data).\n\n## 10. Internal Technician Notes\n- macOS support matrix (current as of 2026-05-11):\n  - macOS 15 Sequoia: 2018+ MacBook Air, 2018+ MacBook Pro, 2019+ iMac, M1+ Mac mini, 2019 Mac Pro\n  - macOS 14 Sonoma: 2018+ MacBook Air/Pro, 2019+ iMac, 2018 Mac mini, 2019 Mac Pro\n  - macOS 13 Ventura: 2017+ iMac/Pro/MBP, 2018+ MacBook Air/mini, 2019 Mac Pro\n- 32-bit app sunset: macOS 10.15 Catalina is last to run 32-bit apps. Big Sur (11) drops 32-bit kernel + userland fully.\n- Kernel extensions (kexts) deprecated in macOS 11 Big Sur in favor of System Extensions. Many legacy security/print/storage products still use kexts and won't load on modern macOS.\n- OpenCore Legacy Patcher project: https://dortania.github.io/OpenCore-Legacy-Patcher/ — reasonable code quality, active maintenance, but unsupported by Apple.\n- Notarization required for apps distributed outside Mac App Store since macOS 10.15. Older versions of legacy apps may not run cleanly even after upgrade.\n\n## 11. Related KB Articles\n- `l1-mac-001` — Mac kernel panic / spinning beach ball\n- `l1-windows-legacy-001` — Windows 7 still running\n- `l1-office-legacy-001` — Office 2010/2013 mail\n\n## 12. Keywords / Search Tags\nmacos, high sierra, mojave, catalina, big sur, monterey, ventura, sonoma, sequoia, intel mac, apple silicon, opencore legacy patcher, kernel extensions, 32-bit apps, notarization, rosetta, macbook pro 2015, macbook air 2014, imac 2013"
  },
  {
   "slug": "l1-office-legacy-001-office-2010-2013-mail-stopped",
   "path_rel": "knowledge-base\\legacy\\l1-office-legacy-001-office-2010-2013-mail-stopped.md",
   "title": "\"Office 2010 / 2013 Outlook stopped sending or receiving mail in 2026\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-office-legacy-001\ntitle: \"Office 2010 / 2013 Outlook stopped sending or receiving mail in 2026\"\ncategory: outlook\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 30\naudience: end-user\nos_scope: [\"Windows 7\", \"Windows 10\", \"Windows 11\"]\ntech_generation: legacy\nyear_range: \"2010-2023 (Microsoft EOL Office 2010: 2020-10-13; Office 2013: 2023-04-11)\"\neol_status: \"Office 2010 EOL 2020-10-13. Office 2013 EOL 2023-04-11. Neither receives security updates or Microsoft 365 / Exchange Online connectivity guarantees.\"\nprerequisites: []\nkeywords:\n  - office 2010\n  - office 2013\n  - outlook 2010\n  - outlook 2013\n  - basic auth deprecation\n  - exchange online\n  - imap\n  - smtp\n  - modern auth\n  - oauth\n  - tls 1.0\n  - tls 1.1\n  - cipher suite\nrelated_articles:\n  - l1-outlook-001-not-receiving-emails\n  - l1-outlook-002-cant-send-emails\n  - l1-windows-legacy-001-windows-7-still-running\nescalation_trigger: \"Customer is dependent on Office 2010/2013 with no upgrade budget AND needs to keep using Microsoft 365 / Exchange Online; engineering needs to design a relay or migration path.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Office 2010 / 2013 Outlook stopped sending or receiving mail in 2026\n\n## 1. Symptoms\nOutlook 2010 or Outlook 2013 suddenly stopped sending or receiving mail. Repeated password prompts. \"0x800CCC0E\" or \"0x800CCC0F\" errors. \"Cannot connect to server\" messages. Worked fine last week. Customer says \"nothing changed.\"\n\n## 2. Likely Causes\n1. **Microsoft turned off Basic Authentication for Exchange Online** (rolled out in waves 2022-2023, fully off for nearly all tenants by end of 2023). Outlook 2010 + 2013 cannot do Modern Auth / OAuth 2.0 to M365.\n2. **TLS 1.0 / 1.1 deprecated** at the mail provider. Many SMTP / IMAP providers (Microsoft, Gmail, Yahoo) require TLS 1.2 or 1.3. Outlook 2010 ships with TLS 1.0 only by default.\n3. **Cipher suite mismatch** — old Outlook can't negotiate modern ciphers (especially after Windows 7 endpoint).\n4. **Account credentials changed** at the provider (MFA enrolled, password rotation).\n\n## 3. Questions To Ask User\n1. What exact version of Office? (Outlook → File → Office Account → About Outlook → look for \"Microsoft® Outlook® 2010\" or \"2013\".)\n2. What email provider? (Microsoft 365 / Exchange Online, Gmail, Yahoo, GoDaddy, custom domain?)\n3. When did it last work?\n4. Did you recently enable two-factor / two-step / MFA on this email?\n5. Is this Outlook the only mail app, or do you also have it on a phone that's working?\n\n## 4. Troubleshooting Steps\n1. Confirm version: File → Office Account → About Outlook.\n2. Try webmail (outlook.com, gmail.com, etc.) — confirm credentials still work and mail is arriving there. If yes, the problem is the Outlook client, not the account.\n3. Check Windows TLS settings: open Internet Options → Advanced tab → scroll to Security section → confirm \"Use TLS 1.2\" is checked. If missing, this is Windows 7 / Win 8 — see Internal Notes.\n\n## 5. Resolution Steps\n\n**Path A — Replace Outlook 2010/2013 with a supported client (preferred and almost always required):**\n1. **Best:** install Microsoft 365 Apps (subscription) or buy Office 2021 / 2024 perpetual license. New Outlook supports Modern Auth out of the box.\n2. **Free fallbacks:** Outlook on the Web (https://outlook.office.com), or eM Client free tier (supports OAuth to M365 / Gmail).\n3. Re-import old PST: in new Outlook, File → Open & Export → Import/Export → Import from another program → Outlook Data File (.pst) → point to old PST.\n4. Set up the account fresh using auto-discovery (just enter email + password, modern client handles OAuth redirect).\n\n**Path B — Use IMAP / SMTP via an app password (works only on Gmail-style providers, NOT M365):**\n1. Sign in to the email provider's web UI.\n2. Enable 2FA on the account.\n3. Generate an \"app password\" (Google: Security → App passwords; Yahoo: Account Security → Generate app password).\n4. In Outlook 2010/2013: Account Settings → Change → use IMAP server settings with the app password.\n5. **Note:** Microsoft 365 / Exchange Online does NOT issue app passwords for Outlook 2010/2013 — Path A is required.\n\n**Path C — On-prem mail relay (for businesses that genuinely can't upgrade):**\n1. Stand up a small SMTP relay (hMailServer, Postfix, or Exchange 2019 in mailbox-less hybrid mode) on a modern Windows Server.\n2. Configure the legacy Outlook to send through the relay over plain SMTP / no TLS or TLS 1.0.\n3. Relay authenticates to M365 with Modern Auth on the outbound leg.\n4. Inbound: configure transport rules to forward to a shared mailbox the legacy client reads via POP3 over the relay.\n5. This is non-trivial L2/L3 work — escalate.\n\n## 6. Verification Steps\n- New Outlook receives mail within 60 seconds of webmail receiving it.\n- Send a test email out, confirm it arrives at an external address (e.g., gmail).\n- No more password prompts within first hour.\n\n## 7. Escalation Trigger\n- Customer refuses Path A and is on Microsoft 365 → only Path C works → escalate to L2/L3 to design the relay.\n- Customer has 10+ users on Office 2010/2013 → migration project, not a ticket.\n- PST files larger than 50 GB → split + import requires staged plan.\n\n## 8. Prevention Tips\n- Treat any office suite older than 5 years as \"scheduled for replacement, not for ongoing support.\"\n- Microsoft 365 Apps subscription auto-updates, so this scenario never repeats once migrated.\n- Keep PST backups outside the user's profile (OneDrive or external) — easy import to new client when needed.\n\n## 9. User-Friendly Explanation\nYour Outlook is from 2010 or 2013. Microsoft and email providers turned off the older way of signing in last year, and the old Outlook can't talk to the new system. The fix is to install a current version of Outlook — your emails, contacts, and calendar will all come with you. We can do it now and you'll be sending mail again within 20 minutes.\n\n## 10. Internal Technician Notes\n- Win 7 TLS 1.2 registry enablement: `HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\WinHttp` → DWORD `DefaultSecureProtocols` = `0x0A00` (TLS 1.1 + 1.2). Reboot.\n- Win 7 + Office 2010 also needs KB3140245 + the SchUseStrongCrypto registry keys for .NET to honor TLS 1.2.\n- Microsoft basic auth disablement reference: Microsoft Tech Community announcement Oct 2022, fully enforced by 2023. Tenants can no longer re-enable via support ticket.\n- Exchange Online connection state: PowerShell `Get-AuthServer` and `Test-OAuthConnectivity` from Exchange Management Shell.\n- Customers on legacy on-prem Exchange 2010/2013/2016 hit the same wall once they migrate to M365 hybrid.\n\n## 11. Related KB Articles\n- `l1-outlook-001` — Outlook not receiving emails\n- `l1-outlook-002` — Outlook can't send emails\n- `l1-windows-legacy-001` — Windows 7 still running\n\n## 12. Keywords / Search Tags\noffice 2010, office 2013, outlook 2010, outlook 2013, basic auth, modern auth, oauth, exchange online, tls 1.2, 0x800ccc0e, 0x800ccc0f, app password, imap, smtp, eol, legacy office"
  },
  {
   "slug": "l1-printer-legacy-001-older-printer-drivers-failing",
   "path_rel": "knowledge-base\\legacy\\l1-printer-legacy-001-older-printer-drivers-failing.md",
   "title": "\"Older HP / Brother / Canon printer stops printing after Windows update\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-printer-legacy-001\ntitle: \"Older HP / Brother / Canon printer stops printing after Windows update\"\ncategory: printer\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\ntech_generation: legacy\nyear_range: \"Hardware 2008-2017; affected by Windows print stack rewrite 2021+\"\neol_status: \"Windows print spooler hardened after PrintNightmare (CVE-2021-34527). Microsoft Universal Print Driver replaced many vendor V3 drivers. Many pre-2017 printer drivers are unsigned or unmaintained.\"\nprerequisites: [\"Local admin to install / remove drivers\"]\nkeywords:\n  - hp laserjet\n  - brother hl\n  - canon pixma\n  - print spooler\n  - printnightmare\n  - v3 driver\n  - v4 driver\n  - universal print driver\n  - mopria\n  - airprint\n  - usb printer\n  - network printer\n  - print queue stuck\nrelated_articles:\n  - l1-printer-001-not-printing\n  - l1-printer-002-prints-garbage\n  - l2-printers-001-server-management\nescalation_trigger: \"Multiple printers fail across the office after a Windows feature update; or the vendor has marked the model 'end of support'; or the customer is on Win Server with print sharing affected.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Older HP / Brother / Canon printer stops printing after Windows update\n\n## 1. Symptoms\nPrinter worked fine for years. After a Windows update (often a feature update like 23H2 → 24H2 → 25H1) it stopped printing. Print jobs sit in the queue. Or print queue clears but nothing comes out. Sometimes Windows says \"Driver is unavailable\" in the printer settings.\n\n## 2. Likely Causes\n1. **Driver isolation / V3 driver blocked.** Post-PrintNightmare hardening (2021+) restricts non-administrator driver installs and removes Type 3 (kernel-mode) drivers in many cases.\n2. **Vendor stopped releasing Windows drivers.** Common cutoff: HP printers pre-2010 (LaserJet 1018, 1020, 3050 — no signed Win 11 driver). Brother HL-2070/2140 series. Canon PIXMA MP/iP series before 2012.\n3. **Universal Print Driver pulled.** Microsoft removed several inbox V3 drivers for older models in 22H2 / 23H2.\n4. **Print spooler service crashed** and won't restart.\n5. **IPP / WSD discovery broke** after feature update — printer appears but won't print.\n\n## 3. Questions To Ask User\n1. Exact printer model and approximate year purchased? (Model on a sticker on the back.)\n2. Connected via USB, Ethernet, or Wi-Fi?\n3. Did Windows update recently? (Settings → Windows Update → Update history.)\n4. Does the printer work from any other device (phone, another PC)?\n5. Are there other printers in the office and are they all affected?\n\n## 4. Troubleshooting Steps\n1. **Print test page from the device itself** (button combo on the printer) to confirm hardware works.\n2. **Print from a phone using AirPrint / Mopria** to confirm network + printer health.\n3. **Restart the Print Spooler service** on the PC: `services.msc` → Print Spooler → Restart.\n4. **Clear the print queue:**\n   - Stop Print Spooler service.\n   - Delete files in `C:\\Windows\\System32\\spool\\PRINTERS\\`.\n   - Start Print Spooler.\n5. **Run Windows printer troubleshooter:** Settings → System → Troubleshoot → Other troubleshooters → Printer → Run.\n\n## 5. Resolution Steps\n\n**Path A — Use vendor's latest universal driver (preferred):**\n1. Download HP Universal Print Driver (UPD) PCL6 or PostScript from HP support site. Works for most HP devices 2005 onward.\n2. For Brother: download \"Brother Universal Printer Driver\" from brother.com support.\n3. For Canon: try Canon Generic Plus PCL6 / UFR II driver.\n4. Install the universal driver. Add the printer using the new driver: Settings → Bluetooth & devices → Printers & scanners → Add device → \"The printer I want isn't listed\" → Add a local printer or network printer with manual settings.\n\n**Path B — Force inbox / Microsoft IPP driver (when vendor has no Win 11 driver):**\n1. Settings → Printers & scanners → Add device → \"The printer I want isn't listed\".\n2. Select \"Add a printer using an IP address or hostname\".\n3. Device type: \"TCP/IP Device\". Enter printer IP. Wait for detection.\n4. When prompted for driver: pick **Microsoft IPP Class Driver** or **Generic / Text Only**.\n5. Test print.\n\n**Path C — USB-only printer with no signed driver:**\n1. Buy a small print server (TP-Link TL-WPS510U, StarTech NETPRINT2) or convert via a Raspberry Pi running CUPS.\n2. The print server speaks IPP / IPPS to Windows — bypasses the vendor driver dependency entirely.\n3. On the PC, add the printer as an IPP network printer using Microsoft IPP Class Driver.\n\n**Path D — Replace the printer (recommended for pre-2012 models being used in a business):**\n1. Modern entry-level laser: Brother HL-L2460DW ($230). Modern entry-level inkjet: HP OfficeJet Pro 8135e ($230).\n2. Both support AirPrint, Mopria, IPP — no driver hell on any OS.\n\n## 6. Verification Steps\n- Test print from Notepad succeeds.\n- Test print from Word succeeds (richer format).\n- Reboot the PC. Print again — confirms driver persists.\n- Check Event Viewer → Microsoft → Windows → PrintService → Operational — no errors logged.\n\n## 7. Escalation Trigger\n- Five or more PCs affected after the same Windows update → group policy / driver deployment fix, not per-PC.\n- Customer is in a regulated industry (medical, legal) and the old printer must stay (some prescription pads / legal forms are tied to specific printers) → L2/L3 design isolation.\n- Print spooler keeps crashing after every reboot → corrupt installation, may need OS reset.\n\n## 8. Prevention Tips\n- **Buy new printers from vendors with multi-OS / universal driver commitment** — Brother, HP Enterprise series, Lexmark, Xerox.\n- **Wi-Fi / Ethernet IPP printers** outlast USB-only printers by years on the driver compatibility curve.\n- **Subscribe to vendor support bulletins** for the model — they announce EOL before Windows breaks compatibility.\n\n## 9. User-Friendly Explanation\nYour printer is older than the latest Windows version, and Microsoft tightened up how Windows talks to printers a few years back to stop hackers. We've got three options: a) use a universal driver from the printer maker, b) trick Windows into talking to it through a different protocol, or c) replace the printer with one that just works. The first one is free and usually works within 15 minutes.\n\n## 10. Internal Technician Notes\n- PrintNightmare hardening: KB5005033 (Aug 2021) introduced Point-and-Print restriction. KB5005652 made non-admin Point-and-Print install fail by default.\n- Registry key for relaxed Point-and-Print (not recommended, but possible): `HKLM\\Software\\Policies\\Microsoft\\Windows NT\\Printers\\PointAndPrint` → `RestrictDriverInstallationToAdministrators` DWORD = 0.\n- HP UPD download (current): https://support.hp.com/us-en/drivers/universal-print-driver\n- Brother universal driver supports PCL emulation across most HL/MFC/DCP models post-2008.\n- Canon Generic Plus PCL6 covers imageRUNNER ADVANCE series + most consumer PIXMA 2014+.\n- For CUPS on Raspberry Pi: `apt install cups`, add user to lpadmin group, share via `cupsctl --share-printers --remote-any` and add the printer to Win 11 as an IPP network printer at `http://<pi-ip>:631/printers/<name>`.\n\n## 11. Related KB Articles\n- `l1-printer-001` — Printer not printing (modern)\n- `l1-printer-002` — Printer prints garbage\n- `l2-printers-001` — Print server management\n\n## 12. Keywords / Search Tags\nhp laserjet, brother hl, canon pixma, printnightmare, v3 driver, v4 driver, universal print driver, upd, ipp, mopria, airprint, print spooler, cups, raspberry pi print server, point and print, kb5005033, kb5005652"
  },
  {
   "slug": "l1-windows-legacy-001-windows-7-still-running",
   "path_rel": "knowledge-base\\legacy\\l1-windows-legacy-001-windows-7-still-running.md",
   "title": "\"Windows 7 still running in 2026 — security risk, isolation, and safe operation\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-legacy-001\ntitle: \"Windows 7 still running in 2026 — security risk, isolation, and safe operation\"\ncategory: windows\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 25\naudience: end-user\nos_scope: [\"Windows 7\"]\ntech_generation: legacy\nyear_range: \"2009-2020 (Microsoft EOL 2020-01-14)\"\neol_status: \"Microsoft mainstream support ended 2015-01-13; extended support ended 2020-01-14; ESU paid program ended 2023-01-10. No further security patches.\"\nprerequisites: []\nkeywords:\n  - windows 7\n  - win7\n  - end of life\n  - eol\n  - extended security updates\n  - esu\n  - legacy lob\n  - line of business\n  - air-gap\n  - network isolation\n  - retro hardware\nrelated_articles:\n  - l1-windows-001-blue-screen-stop-error\n  - l2-network-legacy-001-wpa2-only-router-replacement\n  - l3-security-001\nescalation_trigger: \"Network-connected Win 7 box handling regulated data (PII/PHI/PCI), or refusing to migrate, or showing signs of compromise.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Windows 7 still running in 2026 — security risk, isolation, and safe operation\n\n## 1. Symptoms\nCustomer has at least one PC still running Windows 7 — often because a single legacy line-of-business (LOB) application, an old industrial control system, or a specialized peripheral (POS terminal, lab instrument, machine controller) won't run on anything newer. Sometimes the user has been told \"don't touch this one\" and doesn't know why.\n\n## 2. Likely Causes\n1. **Legacy LOB app** built for Win 7 with no Win 10/11 port path (very common in small medical, dental, legal, machine shops).\n2. **Vendor-locked peripheral** with no signed Win 10/11 driver.\n3. **Cost / inertia** — owner doesn't want to spend on the migration.\n4. **Lost vendor** — the original software vendor went out of business; no migration available.\n\n## 3. Questions To Ask User\n1. Is this PC connected to the office network or the internet?\n2. What specific app or device needs Windows 7? Get exact app name + version.\n3. Does this PC store or process any customer data, financial data, or PHI?\n4. Is the original software vendor still in business?\n5. When was the last time this PC was backed up?\n\n## 4. Troubleshooting Steps\n1. **Confirm the Win 7 install is genuinely needed.** Many \"needs Win 7\" apps actually run on Win 10/11 in Compatibility Mode (right-click app → Properties → Compatibility tab → Run this program in compatibility mode for: Windows 7).\n2. **Check vendor for an updated version.** Search vendor site for \"Windows 11\" or \"Windows 10\" support page.\n3. **Try the app inside a Windows 7 virtual machine on a modern host** (Hyper-V on Win 11 Pro, or VMware Workstation Player). VM isolation gets the security benefit without the migration.\n\n## 5. Resolution Steps\n\n**Path A — Migrate off Windows 7 (preferred):**\n1. Buy a Windows 11 license + capable hardware (TPM 2.0, Secure Boot, 8 GB RAM minimum, 256 GB SSD).\n2. Re-install / upgrade the LOB app if a newer version exists. Pay vendor for upgrade if needed.\n3. Test on the new machine for 5 business days before retiring the Win 7 box.\n\n**Path B — Isolate Windows 7 (when migration is genuinely blocked):**\n1. **Disconnect from the internet.** Pull the Ethernet cable. Disable the Wi-Fi adapter in Device Manager.\n2. **Move to an isolated VLAN.** On the router/switch, assign this PC's MAC to a VLAN with no internet route and no access to other internal devices except the specific server/printer it needs.\n3. **Disable unused services:** RDP, SMB v1, remote registry, Windows Remote Management. Open `services.msc` and set each to Disabled.\n4. **Local user only.** Don't domain-join. Don't use the same password as any modern account.\n5. **USB lockdown.** Block USB mass storage in Group Policy (`gpedit.msc` → Computer Configuration → Administrative Templates → System → Removable Storage Access → Removable Disks: Deny all access).\n6. **Block outbound traffic.** Windows Firewall → Outbound rules → Block all programs except the specific LOB app's required endpoints.\n7. **Image the disk monthly** so a hardware failure doesn't kill the LOB app for good. Use Macrium Reflect Free (still supports Win 7) or a simple `dd` image to an external drive.\n\n**Path C — Virtualize Windows 7 on a modern host:**\n1. P2V (physical-to-virtual) using Disk2VHD (Microsoft Sysinternals) or VMware Converter.\n2. Move the VHDX/VMDK file to a Windows 11 host running Hyper-V or VMware Workstation Player.\n3. Boot the VM. Set its virtual network to \"Internal only\" (no external NAT).\n4. Connect the legacy peripheral via USB passthrough on the host.\n\n## 6. Verification Steps\n- For Path A: LOB app runs correctly on Win 11 for 5 consecutive business days.\n- For Path B: PC has no internet (`ping 8.8.8.8` fails), no access to other internal subnets, and no external login attempts on local accounts.\n- For Path C: VM boots, app runs, snapshot saved, host machine has Windows 11 security baseline.\n\n## 7. Escalation Trigger\n- Win 7 box handles regulated data (HIPAA, PCI-DSS, GDPR) AND cannot be migrated within 30 days.\n- Box shows signs of compromise: unexplained outbound traffic, unknown processes, modified hosts file.\n- Vendor is unreachable AND the app fails on every modern OS — engineering review needed to assess full replacement vs reverse-engineering.\n\n## 8. Prevention Tips\n- **Inventory all Win 7 boxes today.** Every business has at least one and they often don't realize it.\n- **Budget annual line item** for legacy migration so it doesn't get postponed forever.\n- **Vendor due diligence on every new LOB purchase:** require written support commitment to current OS for at least 5 years.\n\n## 9. User-Friendly Explanation\nThis computer is running Windows 7. Microsoft stopped fixing security holes in it back in 2020, which means hackers can break into it more easily than newer computers. If it's the only machine running a specific program you need, we can either upgrade you to Windows 11 with the same program, or isolate this PC from the internet so it stays safe. We'll explain both options and the cost so you can decide.\n\n## 10. Internal Technician Notes\n- ESU keys for Win 7 stopped being issued 2023-01-10. Microsoft has not extended further.\n- Genuine Microsoft Win 7 ISOs still available via VLSC for orgs with existing licenses, otherwise rely on archived media.\n- 0patch.com offers paid micropatches for Win 7 critical CVEs — viable Path-B hardening add-on for ~$25/year/endpoint.\n- For Path C, Hyper-V Enhanced Session does not work with Win 7 guests. Use Basic Session only. RDP into the VM if you need clipboard / display redirection.\n- Common LOB app categories still stuck on Win 7: dental practice management (Eaglesoft 16 and earlier, Dentrix G6), legal accounting (PCLaw 14 and earlier), machine shop CNC controllers (FANUC pre-2015), retail POS (older Aldelo, Restaurant Manager).\n\n## 11. Related KB Articles\n- `l1-windows-001` — BSOD on Windows 10/11\n- `l2-network-legacy-001` — WPA2-only router replacement\n- `l3-security-001` — Security incident response\n\n## 12. Keywords / Search Tags\nwindows 7, win7, end of life, eol, extended security updates, esu, legacy lob, line of business, air-gap, network isolation, retro hardware, hyper-v, vmware, p2v, disk2vhd"
  },
  {
   "slug": "l2-network-legacy-001-wpa2-only-router-replacement",
   "path_rel": "knowledge-base\\legacy\\l2-network-legacy-001-wpa2-only-router-replacement.md",
   "title": "\"Office router is WPA2-PSK only — modern devices misbehave, Wi-Fi 6/7 clients drop\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l2-network-legacy-001\ntitle: \"Office router is WPA2-PSK only — modern devices misbehave, Wi-Fi 6/7 clients drop\"\ncategory: networking\nsupport_level: L2\nseverity: medium\nestimated_time_minutes: 60\naudience: technician\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: legacy\nyear_range: \"Router 2010-2018; Wi-Fi 5 era pre-WPA3\"\neol_status: \"WPA2-PSK still works but loses to KRACK (2017) and is deprecated by WPA3 (2018+). Many enterprise / banking VPN clients now refuse to connect from WPA2-PSK networks.\"\nprerequisites: [\"Admin access to the office router and ISP gateway\"]\nkeywords:\n  - wpa2\n  - wpa3\n  - wi-fi 6\n  - wi-fi 6e\n  - wi-fi 7\n  - krack\n  - psk\n  - sae\n  - opportunistic wireless encryption\n  - mesh\n  - guest network\n  - vlan\n  - dual band\n  - tri band\n  - mlo\nrelated_articles:\n  - l1-wifi-001-cant-connect\n  - l2-networking-001-deep-troubleshoot\n  - l3-networking-001-architecture\nescalation_trigger: \"Office has 30+ devices, multi-floor coverage, or any compliance requirement (PCI-DSS 4.0 requires WPA3 by Mar 2025); design with structured cabling + APs not consumer router.\"\nlast_updated: 2026-05-11\nversion: 1.0\n---\n\n# Office router is WPA2-PSK only — replacement to WPA3 / Wi-Fi 6/7\n\n## 1. Symptoms\n- Newer phones (iPhone 15+, Pixel 9+) randomly drop Wi-Fi or fail to authenticate.\n- VPN clients (Cisco AnyConnect, GlobalProtect, NordLayer) refuse to connect citing \"insecure network.\"\n- Wi-Fi 6 / 6E laptops connect but get poor throughput vs claimed speeds.\n- iOS 17+ shows \"Weak Security\" / \"Privacy Warning\" under Wi-Fi network name.\n- Streaming meetings (Zoom, Teams) glitch under load.\n\n## 2. Likely Causes\n1. **Router is WPA2-PSK only**, often a 2014-2018 consumer router (Linksys EA-series, ASUS RT-AC, TP-Link Archer C7, Netgear Nighthawk R7000).\n2. **2.4 GHz crowding** in dense office buildings — old routers have limited channel options.\n3. **No 6 GHz band** — Wi-Fi 6E and Wi-Fi 7 clients can't use their fastest band on a WPA2 router.\n4. **Single SSID for everything** — IoT devices, guests, and corporate traffic share one network.\n\n## 3. Questions To Ask Customer\n1. Router make/model and approximate year purchased?\n2. Number of users + estimated total devices (phones, laptops, printers, cameras, IoT)?\n3. Office square footage and number of floors?\n4. Internet plan speed?\n5. Compliance requirements (PCI, HIPAA, SOC 2)?\n6. Budget range for a refresh?\n\n## 4. Diagnostic Steps\n1. Log into the router admin page (usually 192.168.1.1 or 192.168.0.1).\n2. Note: model, firmware version, supported encryption modes (WPA2-PSK, WPA2/WPA3 mixed, WPA3-SAE).\n3. From a Win 11 laptop, run `netsh wlan show interfaces` → confirm \"Authentication\" line (will show WPA2-Personal if router is WPA2-only).\n4. From iPhone: Settings → Wi-Fi → tap (i) next to the network — if it says \"Weak Security\", router is WPA/WPA2 mixed or WPA2-TKIP.\n5. Run a site survey using WiFi Analyzer (Android) or NetSpot (mac/win) — check 2.4/5/6 GHz channel usage and signal levels.\n\n## 5. Resolution Steps\n\n**Path A — Replace consumer router with prosumer Wi-Fi 6E / 7 mesh (most offices < 5,000 sq ft):**\n1. Pick a mesh kit:\n   - **TP-Link Deco BE85** (Wi-Fi 7, $999/3-pack) — best value for 4,000-6,000 sq ft.\n   - **eero Pro 7** (Wi-Fi 7, $599-1,499) — easiest setup, Amazon ecosystem.\n   - **Ubiquiti UniFi Express 7 Pro** (Wi-Fi 7, $279 per AP + $199 dream router) — best for offices wanting VLANs and growth.\n2. Set 3 SSIDs minimum:\n   - `iisupp-corp` — WPA3-SAE only, VLAN 10\n   - `iisupp-iot` — WPA2/WPA3 mixed (some smart devices still need WPA2), VLAN 20, isolated\n   - `iisupp-guest` — WPA3-SAE + captive portal, VLAN 30, internet-only\n3. Configure band steering: prefer 6 GHz for Wi-Fi 6E/7 clients, 5 GHz for older devices, 2.4 GHz only for IoT.\n4. Enable MLO (Multi-Link Operation) for Wi-Fi 7 clients — gives 30%+ latency improvement on video calls.\n\n**Path B — UniFi structured deployment (offices > 5,000 sq ft, multi-floor, or compliance):**\n1. UniFi Dream Machine Pro Max + 3-6 U7 Pro APs ($1,400-3,000 hardware).\n2. Cat6A drops to each AP location, PoE+ injectors or PoE switch.\n3. Site-to-site VPN to remote workers, RADIUS for 802.1X enterprise auth on `iisupp-corp` SSID.\n4. ~2-day install for licensed cable + AP placement.\n\n**Path C — Cheapest stop-gap (until budget allows replacement):**\n1. Buy a single ASUS RT-AX86U Pro ($230) — Wi-Fi 6, supports WPA3.\n2. Replace ISP-supplied router. Keep ISP modem in bridge mode.\n3. Configure: WPA3-SAE primary SSID + WPA2/WPA3 transitional for legacy IoT.\n\n## 6. Verification Steps\n- iPhone shows no \"Weak Security\" warning on `iisupp-corp`.\n- Speedtest on Wi-Fi 7 laptop: at least 70% of wired throughput within 30 ft of an AP.\n- VPN clients (AnyConnect, GlobalProtect) connect without security warnings.\n- Roaming test: walk across the office on a continuous Zoom call — no drop.\n\n## 7. Escalation Trigger\n- More than one floor, more than 50 users, or any compliance audit pending → escalate to network design (L3).\n- Building has unique RF challenges (steel framing, glass partitions, microwave ovens near APs) → site survey before install.\n- Customer wants 802.1X enterprise auth, RADIUS, certificate-based onboarding → L3 + AD/Entra integration.\n\n## 8. Prevention Tips\n- **Replace office Wi-Fi every 5-7 years** even if it \"still works\" — Wi-Fi standards leap every 5 years.\n- **Always deploy at least 3 SSIDs** from day one — corp / IoT / guest.\n- **Budget annual line item** for Wi-Fi refresh; it's infrastructure, not a one-time buy.\n- **Subscribe to vendor firmware update bulletins** — WPA2 KRACK was patched at the firmware level, many routers never got the fix.\n\n## 9. User-Friendly Explanation\nYour office Wi-Fi router is using a security standard from 2004. Most of your newer phones and laptops know it's old and complain about it, and your VPN apps may refuse to use it. We can swap in a modern mesh system with proper office, guest, and smart-device networks — phones stop warning, the Wi-Fi gets faster, and your team stops wrestling with the connection. The mid-range option lands around $1,000 for hardware plus an afternoon to set up.\n\n## 10. Internal Technician Notes\n- WPA3-SAE handshake reference: IETF RFC 7664 (Dragonfly).\n- Wi-Fi 7 features that depend on WPA3: MLO (Multi-Link Operation), 4K-QAM, 320 MHz channel width in 6 GHz.\n- PCI-DSS 4.0 requirement: WPA3 mandatory for cardholder networks effective March 2025 (replacing PCI-DSS 3.2.1's WPA2 minimum).\n- iOS 17+ Privacy Warning triggers on: WPA/WPA2 mixed mode, WPA2-TKIP (not AES), no PMF (Protected Management Frames).\n- Transitional WPA2/WPA3 mode runs both for IoT compatibility; pure WPA3-SAE is the goal once IoT migrated.\n- VLAN tagging requires a managed switch — most ISP routers don't tag, so APs handle VLANs in software.\n\n## 11. Related KB Articles\n- `l1-wifi-001` — Can't connect to Wi-Fi\n- `l2-networking-001` — Network deep troubleshoot\n- `l3-networking-001` — Network architecture\n\n## 12. Keywords / Search Tags\nwpa2, wpa3, sae, krack, wi-fi 6, wi-fi 6e, wi-fi 7, mlo, mesh router, ubiquiti, unifi, eero, tp-link deco, captive portal, vlan, ssid, band steering, 802.1x, weak security, pmf, pci-dss"
  },
  {
   "slug": "README",
   "path_rel": "knowledge-base\\README.md",
   "title": "",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "# ARIA Knowledge Base\n\nEnterprise-grade structured KB library for ARIA AI Assistant.\nDesigned for AI orchestration, semantic retrieval, and human readability.\n\n## Structure\n\n```\nknowledge-base/\n├── _meta/                  Schema, template, indexes, manifest\n│   ├── _schema.md          KB article schema (every field defined)\n│   ├── _template.md        Blank template — copy when authoring new articles\n│   ├── manifest.json       Machine-readable catalog of every article\n│   ├── routing.md          Triage rules — symptoms → article IDs\n│   ├── escalation-matrix.md  When to bump L1→L2→L3 / human technician\n│   └── index-by-keyword.md Keyword → article ID lookup\n│\n├── L1/                     Tier-1: end-user-facing, no admin rights required\n│   └── (Windows, Outlook, M365, Teams, OneDrive, Wi-Fi, printers,\n│        password resets, MFA basics, browser, email basics, slow PCs,\n│        basic file recovery, drivers basics)\n│\n├── L2/                     Tier-2: admin/escalation engineer, tenant access\n│   └── (VPN, Intune, Azure AD, Active Directory, DNS, DHCP, BitLocker,\n│        drivers advanced, performance deep-dive, RDP, networking,\n│        SharePoint admin, permissions, malware triage, endpoint config,\n│        onboarding, device deployment)\n│\n├── L3/                     Tier-3: senior engineer / architect\n│   └── (Servers, security architecture, SSO/SAML, certificates,\n│        cloud services, enterprise infra, backup/DR, hybrid AD,\n│        federation, network architecture, incident response)\n│\n└── general-assistant/      Non-IT user assistance — ARIA's broader value\n    └── (Online shopping, product comparison, scam/phishing detection,\n         safe checkout, vendor research, booking, form filling,\n         senior-friendly support, simple-language explanation patterns)\n```\n\n## File naming\n\n```\n{level}-{category}-{NNN}-{slug}.md\n```\n\nExamples:\n- `l1-windows-001-blue-screen-stop-error.md`\n- `l2-azure-ad-014-conditional-access-block-loop.md`\n- `l3-backup-dr-007-veeam-failover-orchestration.md`\n- `ga-shopping-003-detect-fake-checkout-page.md`\n\n## Article format\n\nEvery article follows the 15-field schema in `_meta/_schema.md`.\nEach file has YAML frontmatter (machine-parseable) + Markdown body (human-readable).\nThis dual format lets ARIA's orchestrator retrieve by metadata while still\nproducing clean responses to end users.\n\n## How ARIA uses this KB\n\n1. **Intent classification** — incoming user query is classified and routed via `_meta/routing.md`.\n2. **Retrieval** — orchestrator searches by `keywords`, `category`, and `support_level` from `manifest.json`.\n3. **Response synthesis** — ARIA reads the matched article(s) and rewrites the relevant sections using the `user_friendly_explanation` field as the tone anchor.\n4. **Escalation** — if the issue matches an `escalation_trigger`, ARIA flags for human handoff per `_meta/escalation-matrix.md`.\n\n## Author guidelines\n\n- **Use the schema.** Every field is mandatory — even if \"N/A\" — to keep retrieval deterministic.\n- **Symptoms first, theory last.** Users describe what they see, not what they think is wrong.\n- **Never expose unsafe admin commands** to L1 readers. Gate destructive steps behind L2/L3.\n- **Always include verification.** \"It works\" must be objectively testable.\n- **Cite escalation triggers explicitly.** No silent assumptions.\n- **Keep articles modular.** One symptom cluster per article. Cross-reference with `related_articles`.\n\n## Versioning\n\nThis KB is the source of truth for ARIA's IT brain. Treat changes as you would\nproduction code: peer-review article edits, bump the version field on substantive\nrevision, and let the manifest regenerate.\n\n---\n\n**Owner:** Integrated IT Support Inc.\n**Product:** ARIA — Real-Time AI Assistant\n**Last full build:** 2026-05-07"
  },
  {
   "slug": "l3-aadconnect-001-group-memberships-lost-overnight",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-aadconnect-001-group-memberships-lost-overnight.md",
   "title": "Hybrid identity sync failures - AAD Connect",
   "vertical": "any",
   "tier": "l3",
   "intent_codes": [
    "AADCONNECT.HYBRID",
    "AADCONNECT.FAIL"
   ],
   "keywords": [
    "aadconnect",
    "hybrid",
    "on-prem",
    "cloud",
    "identity",
    "sync"
   ],
   "compliance": [
    ""
   ],
   "content": "---\ntitle: Hybrid identity sync failures - AAD Connect\nvertical: any\ntier: l3\nintent_codes: [AADCONNECT.HYBRID, AADCONNECT.FAIL]\nkeywords: [aadconnect, hybrid, on-prem, cloud, identity, sync]\ncompliance: []\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nUsers in a hybrid environment lose access, sync drifts, or authentication fails between on-premises and Microsoft 365 / Entra ID. Symptoms vary by service but the root cause is almost always identity sync, certificate trust, or connector misconfiguration.\n\n## What is happening (1-line cause)\n\nA trust boundary between on-prem and cloud has broken: sync object, federation token, soft-match, or certificate chain.\n\n## Fix — try these in order\n\n### 1. Pinpoint which side is the source of truth\n\nOpen Entra ID admin center → Hybrid management → check the connector health for **aadconnect**. Note the last successful sync timestamp and any error codes. Compare against the on-prem system event log for the same window. The side that changed first is the trigger.\n\n**Escalation:** if no error visible in either log, ARIA escalates to a senior tech for packet capture (>15 min troubleshoot).\n\n### 2. Force a sync / re-issue the trust\n\nOn the on-prem AAD Connect server:\n```powershell\nStart-ADSyncSyncCycle -PolicyType Delta\nGet-ADSyncConnectorRunStatus\n```\n\nIf the sync completes but the issue persists, escalate trust re-issue:\n```powershell\nSet-MsolDirSyncEnabled -EnableDirSync $false\n# Wait 72 hours then re-enable — destructive, requires Ahmad approval\n```\n\n**Escalation:** the second command is destructive. ARIA does NOT execute. Must be approved by tenant admin AND scoped to a maintenance window.\n\n### 3. Verify the cert / federation chain\n\nFor SAML / federation issues:\n```powershell\nGet-MsolFederationProperty -DomainName <yourdomain>\n```\n\nCheck that the signing cert is not expired and that the federation URL is reachable from the user network. Test from a clean device on a different network if user reports issue from a specific location.\n\n**Escalation:** open ticket with identity vendor (Microsoft / Okta / Ping) with the trace + collect HAR file from the user browser.\n\n## Compliance reminder\n\nHybrid identity work touches authentication trust. Document every change in the per-tenant audit log via /.netlify/functions/aria-tenant-audit. Schedule changes outside business hours. Notify all users 24h ahead.\n\n## Related entries\n\n- [[l3-aadconnect-001-group-memberships-lost-overnight]]\n- [[l3-saml-001-okta-saml-to-salesforce-broken]]"
  },
  {
   "slug": "l3-aadconnect-002-immutableID-collision-after-merger",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-aadconnect-002-immutableID-collision-after-merger.md",
   "title": "On-prem AD to Entra ID soft-match collision",
   "vertical": "any",
   "tier": "l3",
   "intent_codes": [
    "AADCONNECT.HYBRID",
    "AADCONNECT.FAIL"
   ],
   "keywords": [
    "aadconnect",
    "hybrid",
    "on-prem",
    "cloud",
    "identity",
    "sync"
   ],
   "compliance": [
    ""
   ],
   "content": "---\ntitle: On-prem AD to Entra ID soft-match collision\nvertical: any\ntier: l3\nintent_codes: [AADCONNECT.HYBRID, AADCONNECT.FAIL]\nkeywords: [aadconnect, hybrid, on-prem, cloud, identity, sync]\ncompliance: []\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nUsers in a hybrid environment lose access, sync drifts, or authentication fails between on-premises and Microsoft 365 / Entra ID. Symptoms vary by service but the root cause is almost always identity sync, certificate trust, or connector misconfiguration.\n\n## What is happening (1-line cause)\n\nA trust boundary between on-prem and cloud has broken: sync object, federation token, soft-match, or certificate chain.\n\n## Fix — try these in order\n\n### 1. Pinpoint which side is the source of truth\n\nOpen Entra ID admin center → Hybrid management → check the connector health for **aadconnect**. Note the last successful sync timestamp and any error codes. Compare against the on-prem system event log for the same window. The side that changed first is the trigger.\n\n**Escalation:** if no error visible in either log, ARIA escalates to a senior tech for packet capture (>15 min troubleshoot).\n\n### 2. Force a sync / re-issue the trust\n\nOn the on-prem AAD Connect server:\n```powershell\nStart-ADSyncSyncCycle -PolicyType Delta\nGet-ADSyncConnectorRunStatus\n```\n\nIf the sync completes but the issue persists, escalate trust re-issue:\n```powershell\nSet-MsolDirSyncEnabled -EnableDirSync $false\n# Wait 72 hours then re-enable — destructive, requires Ahmad approval\n```\n\n**Escalation:** the second command is destructive. ARIA does NOT execute. Must be approved by tenant admin AND scoped to a maintenance window.\n\n### 3. Verify the cert / federation chain\n\nFor SAML / federation issues:\n```powershell\nGet-MsolFederationProperty -DomainName <yourdomain>\n```\n\nCheck that the signing cert is not expired and that the federation URL is reachable from the user network. Test from a clean device on a different network if user reports issue from a specific location.\n\n**Escalation:** open ticket with identity vendor (Microsoft / Okta / Ping) with the trace + collect HAR file from the user browser.\n\n## Compliance reminder\n\nHybrid identity work touches authentication trust. Document every change in the per-tenant audit log via /.netlify/functions/aria-tenant-audit. Schedule changes outside business hours. Notify all users 24h ahead.\n\n## Related entries\n\n- [[l3-aadconnect-001-group-memberships-lost-overnight]]\n- [[l3-saml-001-okta-saml-to-salesforce-broken]]"
  },
  {
   "slug": "l3-aadconnect-006-staging-server-failover",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-aadconnect-006-staging-server-failover.md",
   "title": "AAD Connect staging server failover",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "aad connect",
    "staging server",
    "failover"
   ],
   "compliance": [],
   "content": "---\ntitle: AAD Connect staging server failover\ncategory: enterprise\nsupport_level: L3\nseverity: critical\naudience: senior-it\nkeywords: [aad connect, staging server, failover]\ncreated: 2026-06-18\nescalation_trigger: Primary sync server is down and cloud identity changes are stalled.\n---\n# AAD Connect staging server failover\n\n## Symptom\n\nThe requester reports a enterprise support issue that matches: aad connect, staging server, failover.\n\n## What ARIA should do first\n\nConfirm export/import status, validate staging mode, switch only during approved window, and capture connector run history.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Primary sync server is down and cloud identity changes are stalled.\n\n## Support tier\n\nDefault tier: L3. Default severity: critical. Article ID: l3-aadconnect-006-staging-server-failover."
  },
  {
   "slug": "l3-dns-006-split-brain-m365-records",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-dns-006-split-brain-m365-records.md",
   "title": "Split-brain DNS breaks Microsoft 365 records",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "split brain dns",
    "m365",
    "autodiscover"
   ],
   "compliance": [],
   "content": "---\ntitle: Split-brain DNS breaks Microsoft 365 records\ncategory: dns\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [split brain dns, m365, autodiscover]\ncreated: 2026-06-18\nescalation_trigger: Internal users resolve different records than external users.\n---\n# Split-brain DNS breaks Microsoft 365 records\n\n## Symptom\n\nThe requester reports a dns support issue that matches: split brain dns, m365, autodiscover.\n\n## What ARIA should do first\n\nCompare internal/external DNS for autodiscover, MX, SPF, DKIM, Teams, and federation endpoints.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Internal users resolve different records than external users.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-dns-006-split-brain-m365-records."
  },
  {
   "slug": "l3-exchange-001-hybrid-mailflow-broken-onprem-365",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-exchange-001-hybrid-mailflow-broken-onprem-365.md",
   "title": "Exchange hybrid coexistence mail flow broken",
   "vertical": "any",
   "tier": "l3",
   "intent_codes": [
    "EXCHANGE.HYBRID",
    "EXCHANGE.FAIL"
   ],
   "keywords": [
    "exchange",
    "hybrid",
    "on-prem",
    "cloud",
    "identity",
    "sync"
   ],
   "compliance": [
    ""
   ],
   "content": "---\ntitle: Exchange hybrid coexistence mail flow broken\nvertical: any\ntier: l3\nintent_codes: [EXCHANGE.HYBRID, EXCHANGE.FAIL]\nkeywords: [exchange, hybrid, on-prem, cloud, identity, sync]\ncompliance: []\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nUsers in a hybrid environment lose access, sync drifts, or authentication fails between on-premises and Microsoft 365 / Entra ID. Symptoms vary by service but the root cause is almost always identity sync, certificate trust, or connector misconfiguration.\n\n## What is happening (1-line cause)\n\nA trust boundary between on-prem and cloud has broken: sync object, federation token, soft-match, or certificate chain.\n\n## Fix — try these in order\n\n### 1. Pinpoint which side is the source of truth\n\nOpen Entra ID admin center → Hybrid management → check the connector health for **exchange**. Note the last successful sync timestamp and any error codes. Compare against the on-prem system event log for the same window. The side that changed first is the trigger.\n\n**Escalation:** if no error visible in either log, ARIA escalates to a senior tech for packet capture (>15 min troubleshoot).\n\n### 2. Force a sync / re-issue the trust\n\nOn the on-prem AAD Connect server:\n```powershell\nStart-ADSyncSyncCycle -PolicyType Delta\nGet-ADSyncConnectorRunStatus\n```\n\nIf the sync completes but the issue persists, escalate trust re-issue:\n```powershell\nSet-MsolDirSyncEnabled -EnableDirSync $false\n# Wait 72 hours then re-enable — destructive, requires Ahmad approval\n```\n\n**Escalation:** the second command is destructive. ARIA does NOT execute. Must be approved by tenant admin AND scoped to a maintenance window.\n\n### 3. Verify the cert / federation chain\n\nFor SAML / federation issues:\n```powershell\nGet-MsolFederationProperty -DomainName <yourdomain>\n```\n\nCheck that the signing cert is not expired and that the federation URL is reachable from the user network. Test from a clean device on a different network if user reports issue from a specific location.\n\n**Escalation:** open ticket with identity vendor (Microsoft / Okta / Ping) with the trace + collect HAR file from the user browser.\n\n## Compliance reminder\n\nHybrid identity work touches authentication trust. Document every change in the per-tenant audit log via /.netlify/functions/aria-tenant-audit. Schedule changes outside business hours. Notify all users 24h ahead.\n\n## Related entries\n\n- [[l3-aadconnect-001-group-memberships-lost-overnight]]\n- [[l3-saml-001-okta-saml-to-salesforce-broken]]"
  },
  {
   "slug": "l3-exchange-006-hybrid-modern-auth-loop",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-exchange-006-hybrid-modern-auth-loop.md",
   "title": "Exchange hybrid modern auth loop",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "exchange hybrid",
    "modern auth",
    "oauth"
   ],
   "compliance": [],
   "content": "---\ntitle: Exchange hybrid modern auth loop\ncategory: exchange\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [exchange hybrid, modern auth, oauth]\ncreated: 2026-06-18\nescalation_trigger: Outlook loops after hybrid auth or certificate change.\n---\n# Exchange hybrid modern auth loop\n\n## Symptom\n\nThe requester reports a exchange support issue that matches: exchange hybrid, modern auth, oauth.\n\n## What ARIA should do first\n\nCheck OAuth config, virtual directories, federation trust, and EXO service principal status before resetting auth.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Outlook loops after hybrid auth or certificate change.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-exchange-006-hybrid-modern-auth-loop."
  },
  {
   "slug": "l3-intune-006-autopilot-hybrid-join-timeout",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-intune-006-autopilot-hybrid-join-timeout.md",
   "title": "Autopilot hybrid join timeout",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "intune",
    "autopilot",
    "hybrid join"
   ],
   "compliance": [],
   "content": "---\ntitle: Autopilot hybrid join timeout\ncategory: endpoint\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [intune, autopilot, hybrid join]\ncreated: 2026-06-18\nescalation_trigger: Devices fail enrollment after domain join or connector timeout.\n---\n# Autopilot hybrid join timeout\n\n## Symptom\n\nThe requester reports a endpoint support issue that matches: intune, autopilot, hybrid join.\n\n## What ARIA should do first\n\nValidate Intune connector health, OU permissions, line-of-sight to DC, ESP timeout, and device object cleanup.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Devices fail enrollment after domain join or connector timeout.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-intune-006-autopilot-hybrid-join-timeout."
  },
  {
   "slug": "l3-pki-001-tls-cert-expired-internal-app",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-pki-001-tls-cert-expired-internal-app.md",
   "title": "Certificate expiry on internal application",
   "vertical": "any",
   "tier": "l3",
   "intent_codes": [
    "PKI.HYBRID",
    "PKI.FAIL"
   ],
   "keywords": [
    "pki",
    "hybrid",
    "on-prem",
    "cloud",
    "identity",
    "sync"
   ],
   "compliance": [
    ""
   ],
   "content": "---\ntitle: Certificate expiry on internal application\nvertical: any\ntier: l3\nintent_codes: [PKI.HYBRID, PKI.FAIL]\nkeywords: [pki, hybrid, on-prem, cloud, identity, sync]\ncompliance: []\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nUsers in a hybrid environment lose access, sync drifts, or authentication fails between on-premises and Microsoft 365 / Entra ID. Symptoms vary by service but the root cause is almost always identity sync, certificate trust, or connector misconfiguration.\n\n## What is happening (1-line cause)\n\nA trust boundary between on-prem and cloud has broken: sync object, federation token, soft-match, or certificate chain.\n\n## Fix — try these in order\n\n### 1. Pinpoint which side is the source of truth\n\nOpen Entra ID admin center → Hybrid management → check the connector health for **pki**. Note the last successful sync timestamp and any error codes. Compare against the on-prem system event log for the same window. The side that changed first is the trigger.\n\n**Escalation:** if no error visible in either log, ARIA escalates to a senior tech for packet capture (>15 min troubleshoot).\n\n### 2. Force a sync / re-issue the trust\n\nOn the on-prem AAD Connect server:\n```powershell\nStart-ADSyncSyncCycle -PolicyType Delta\nGet-ADSyncConnectorRunStatus\n```\n\nIf the sync completes but the issue persists, escalate trust re-issue:\n```powershell\nSet-MsolDirSyncEnabled -EnableDirSync $false\n# Wait 72 hours then re-enable — destructive, requires Ahmad approval\n```\n\n**Escalation:** the second command is destructive. ARIA does NOT execute. Must be approved by tenant admin AND scoped to a maintenance window.\n\n### 3. Verify the cert / federation chain\n\nFor SAML / federation issues:\n```powershell\nGet-MsolFederationProperty -DomainName <yourdomain>\n```\n\nCheck that the signing cert is not expired and that the federation URL is reachable from the user network. Test from a clean device on a different network if user reports issue from a specific location.\n\n**Escalation:** open ticket with identity vendor (Microsoft / Okta / Ping) with the trace + collect HAR file from the user browser.\n\n## Compliance reminder\n\nHybrid identity work touches authentication trust. Document every change in the per-tenant audit log via /.netlify/functions/aria-tenant-audit. Schedule changes outside business hours. Notify all users 24h ahead.\n\n## Related entries\n\n- [[l3-aadconnect-001-group-memberships-lost-overnight]]\n- [[l3-saml-001-okta-saml-to-salesforce-broken]]"
  },
  {
   "slug": "l3-pki-006-ndes-scep-profile-failure",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-pki-006-ndes-scep-profile-failure.md",
   "title": "NDES SCEP certificate profile failure",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ndes",
    "scep",
    "certificate",
    "intune"
   ],
   "compliance": [],
   "content": "---\ntitle: NDES SCEP certificate profile failure\ncategory: certificates\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [ndes, scep, certificate, intune]\ncreated: 2026-06-18\nescalation_trigger: Managed devices cannot receive certificates for Wi-Fi or VPN.\n---\n# NDES SCEP certificate profile failure\n\n## Symptom\n\nThe requester reports a certificates support issue that matches: ndes, scep, certificate, intune.\n\n## What ARIA should do first\n\nValidate NDES service account, connector cert, profile OIDs, CRL reachability, and Intune certificate connector.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Managed devices cannot receive certificates for Wi-Fi or VPN.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-pki-006-ndes-scep-profile-failure."
  },
  {
   "slug": "l3-saml-001-okta-saml-to-salesforce-broken",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-saml-001-okta-saml-to-salesforce-broken.md",
   "title": "SSO SAML troubleshooting - Okta to Salesforce",
   "vertical": "any",
   "tier": "l3",
   "intent_codes": [
    "SAML.HYBRID",
    "SAML.FAIL"
   ],
   "keywords": [
    "saml",
    "hybrid",
    "on-prem",
    "cloud",
    "identity",
    "sync"
   ],
   "compliance": [
    ""
   ],
   "content": "---\ntitle: SSO SAML troubleshooting - Okta to Salesforce\nvertical: any\ntier: l3\nintent_codes: [SAML.HYBRID, SAML.FAIL]\nkeywords: [saml, hybrid, on-prem, cloud, identity, sync]\ncompliance: []\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nUsers in a hybrid environment lose access, sync drifts, or authentication fails between on-premises and Microsoft 365 / Entra ID. Symptoms vary by service but the root cause is almost always identity sync, certificate trust, or connector misconfiguration.\n\n## What is happening (1-line cause)\n\nA trust boundary between on-prem and cloud has broken: sync object, federation token, soft-match, or certificate chain.\n\n## Fix — try these in order\n\n### 1. Pinpoint which side is the source of truth\n\nOpen Entra ID admin center → Hybrid management → check the connector health for **saml**. Note the last successful sync timestamp and any error codes. Compare against the on-prem system event log for the same window. The side that changed first is the trigger.\n\n**Escalation:** if no error visible in either log, ARIA escalates to a senior tech for packet capture (>15 min troubleshoot).\n\n### 2. Force a sync / re-issue the trust\n\nOn the on-prem AAD Connect server:\n```powershell\nStart-ADSyncSyncCycle -PolicyType Delta\nGet-ADSyncConnectorRunStatus\n```\n\nIf the sync completes but the issue persists, escalate trust re-issue:\n```powershell\nSet-MsolDirSyncEnabled -EnableDirSync $false\n# Wait 72 hours then re-enable — destructive, requires Ahmad approval\n```\n\n**Escalation:** the second command is destructive. ARIA does NOT execute. Must be approved by tenant admin AND scoped to a maintenance window.\n\n### 3. Verify the cert / federation chain\n\nFor SAML / federation issues:\n```powershell\nGet-MsolFederationProperty -DomainName <yourdomain>\n```\n\nCheck that the signing cert is not expired and that the federation URL is reachable from the user network. Test from a clean device on a different network if user reports issue from a specific location.\n\n**Escalation:** open ticket with identity vendor (Microsoft / Okta / Ping) with the trace + collect HAR file from the user browser.\n\n## Compliance reminder\n\nHybrid identity work touches authentication trust. Document every change in the per-tenant audit log via /.netlify/functions/aria-tenant-audit. Schedule changes outside business hours. Notify all users 24h ahead.\n\n## Related entries\n\n- [[l3-aadconnect-001-group-memberships-lost-overnight]]\n- [[l3-saml-001-okta-saml-to-salesforce-broken]]"
  },
  {
   "slug": "l3-saml-006-signing-cert-rollover",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-saml-006-signing-cert-rollover.md",
   "title": "SAML signing certificate rollover failure",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "saml",
    "signing certificate",
    "sso"
   ],
   "compliance": [],
   "content": "---\ntitle: SAML signing certificate rollover failure\ncategory: sso-saml\nsupport_level: L3\nseverity: critical\naudience: senior-it\nkeywords: [saml, signing certificate, sso]\ncreated: 2026-06-18\nescalation_trigger: Users are locked out after IdP or SP certificate rollover.\n---\n# SAML signing certificate rollover failure\n\n## Symptom\n\nThe requester reports a sso-saml support issue that matches: saml, signing certificate, sso.\n\n## What ARIA should do first\n\nCompare active signing cert thumbprint, metadata URL, clock skew, and rollback path with app owner approval.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Users are locked out after IdP or SP certificate rollover.\n\n## Support tier\n\nDefault tier: L3. Default severity: critical. Article ID: l3-saml-006-signing-cert-rollover."
  },
  {
   "slug": "l3-security-006-token-replay-investigation",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-security-006-token-replay-investigation.md",
   "title": "Token replay investigation in hybrid tenant",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "token replay",
    "security",
    "hybrid identity"
   ],
   "compliance": [],
   "content": "---\ntitle: Token replay investigation in hybrid tenant\ncategory: security\nsupport_level: L3\nseverity: critical\naudience: senior-it\nkeywords: [token replay, security, hybrid identity]\ncreated: 2026-06-18\nescalation_trigger: Risky sign-ins show impossible travel, token reuse, or session persistence.\n---\n# Token replay investigation in hybrid tenant\n\n## Symptom\n\nThe requester reports a security support issue that matches: token replay, security, hybrid identity.\n\n## What ARIA should do first\n\nRevoke sessions, rotate credentials, collect sign-in logs, preserve evidence, and escalate to incident response.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Risky sign-ins show impossible travel, token reuse, or session persistence.\n\n## Support tier\n\nDefault tier: L3. Default severity: critical. Article ID: l3-security-006-token-replay-investigation."
  },
  {
   "slug": "l3-sharepoint-006-cross-tenant-migration-permission",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-sharepoint-006-cross-tenant-migration-permission.md",
   "title": "SharePoint cross-tenant migration permission failure",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "sharepoint",
    "migration",
    "permissions"
   ],
   "compliance": [],
   "content": "---\ntitle: SharePoint cross-tenant migration permission failure\ncategory: sharepoint\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [sharepoint, migration, permissions]\ncreated: 2026-06-18\nescalation_trigger: Migrated sites lose access or inherit wrong permissions.\n---\n# SharePoint cross-tenant migration permission failure\n\n## Symptom\n\nThe requester reports a sharepoint support issue that matches: sharepoint, migration, permissions.\n\n## What ARIA should do first\n\nFreeze migration batch, compare source/target ACLs, validate mapping file, and restore from backup if required.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Migrated sites lose access or inherit wrong permissions.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-sharepoint-006-cross-tenant-migration-permission."
  },
  {
   "slug": "l3-teams-006-direct-routing-sbc-down",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-teams-006-direct-routing-sbc-down.md",
   "title": "Teams Direct Routing SBC down",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "teams direct routing",
    "sbc",
    "voice"
   ],
   "compliance": [],
   "content": "---\ntitle: Teams Direct Routing SBC down\ncategory: teams\nsupport_level: L3\nseverity: critical\naudience: senior-it\nkeywords: [teams direct routing, sbc, voice]\ncreated: 2026-06-18\nescalation_trigger: Inbound/outbound calling is unavailable for one or more offices.\n---\n# Teams Direct Routing SBC down\n\n## Symptom\n\nThe requester reports a teams support issue that matches: teams direct routing, sbc, voice.\n\n## What ARIA should do first\n\nCheck SBC TLS cert, SIP options, firewall, carrier status, Teams PSTN gateway state, and emergency calling impact.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Inbound/outbound calling is unavailable for one or more offices.\n\n## Support tier\n\nDefault tier: L3. Default severity: critical. Article ID: l3-teams-006-direct-routing-sbc-down."
  },
  {
   "slug": "l3-vpn-006-conditional-access-device-state",
   "path_rel": "knowledge-base\\tier3-hybrid\\l3-vpn-006-conditional-access-device-state.md",
   "title": "VPN conditional access device-state mismatch",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "vpn",
    "conditional access",
    "device compliance"
   ],
   "compliance": [],
   "content": "---\ntitle: VPN conditional access device-state mismatch\ncategory: vpn\nsupport_level: L3\nseverity: high\naudience: senior-it\nkeywords: [vpn, conditional access, device compliance]\ncreated: 2026-06-18\nescalation_trigger: Compliant devices fail VPN or SAML sign-in.\n---\n# VPN conditional access device-state mismatch\n\n## Symptom\n\nThe requester reports a vpn support issue that matches: vpn, conditional access, device compliance.\n\n## What ARIA should do first\n\nCheck device ID, Entra compliance, VPN SAML claims, certificate chain, and CA policy report-only logs.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Compliant devices fail VPN or SAML sign-in.\n\n## Support tier\n\nDefault tier: L3. Default severity: high. Article ID: l3-vpn-006-conditional-access-device-state."
  },
  {
   "slug": "t4-aigov-001-ai-agent-governance-framework",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-001-ai-agent-governance-framework.md",
   "title": "\"AI Agent Governance Framework for the Enterprise\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ai agent governance\"",
    "\"autonomous agent policy\"",
    "\"ai risk tiering\"",
    "\"human in the loop\"",
    "\"nist ai rmf\"",
    "\"iso 42001\"",
    "\"agent inventory\"",
    "\"agent ownership\"",
    "\"ai guardrails\"",
    "\"approval workflow\"",
    "\"agentic ai controls\"",
    "\"ai governance framework\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-001\ntitle: \"AI Agent Governance Framework for the Enterprise\"\ncategory: ai-governance\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: high\nestimated_time_minutes: 90\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ai agent governance\",\"autonomous agent policy\",\"ai risk tiering\",\"human in the loop\",\"nist ai rmf\",\"iso 42001\",\"agent inventory\",\"agent ownership\",\"ai guardrails\",\"approval workflow\",\"agentic ai controls\",\"ai governance framework\"]\nrelated_articles: [\"t4-aigov-002\",\"t4-aigov-003\",\"t4-aigov-005\",\"t4-aigov-006\"]\nescalation_trigger: \"An autonomous agent is operating in production with write/financial/customer-facing scope and no documented owner, risk tier, or approval gate.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- Autonomous or semi-autonomous AI agents are running in the business with no central record of what they do or who owns them.\n- Teams cannot answer \"which agents can take actions on their own, and what is the worst thing they could do?\"\n- Agents have broad permissions (email send, file write, code deploy, payments) with no approval gate or human review.\n- Leadership asks for an \"AI risk posture\" and IT has no inventory, no risk tiers, and no policy to point to.\n- Auditors, insurers, or customers request evidence of AI oversight and none exists.\n\n## 2. Likely Causes\n- Rapid bottom-up adoption: individual teams stood up agents (scripts, copilots, RPA-plus-LLM bots) faster than governance could form.\n- No defined ownership model — agents inherit a developer's personal credentials instead of a managed service identity.\n- Absence of a risk-tiering scheme, so a low-risk summarizer and a high-risk payment agent are treated identically.\n- No mapping to a recognized framework (e.g., NIST AI Risk Management Framework, ISO/IEC 42001) to anchor controls.\n- Guardrails (scope limits, human-in-the-loop, spend caps) were never required as a condition of going live.\n\n## 3. Questions To Ask User\n- How many AI agents do you know about, and is there a written list? Who maintains it?\n- For each agent: what can it *do* on its own (read-only vs. write vs. financial vs. customer-facing)?\n- Whose identity/credentials does each agent use — a managed service account or a person's login?\n- Are there any approval steps or human review before an agent's action takes effect?\n- Has anything gone wrong (wrong email sent, wrong record updated, runaway cost)?\n- Do you have any compliance, insurance, or contractual obligation that references AI oversight?\n\n## 4. Troubleshooting Steps\n1. **Build an inventory.** Enumerate every agent: name, purpose, trigger, tools/APIs it can call, data it touches, identity it uses, and current owner. Treat anything calling an LLM with action capability as in-scope.\n2. **Assign ownership.** Every agent must have a named business owner and a named technical owner. No owner = candidate for shutdown.\n3. **Risk-tier each agent.** A simple 3-tier model: Tier 1 (read-only / advisory, low blast radius), Tier 2 (writes to internal systems, reversible), Tier 3 (financial, customer-facing, irreversible, or safety-relevant). Tier drives required controls.\n4. **Map controls to a framework.** Use NIST AI RMF functions (Govern, Map, Measure, Manage) and ISO/IEC 42001 concepts as *references* to structure controls — do not claim certification or compliance.\n5. **Check guardrails per tier.** Confirm scope limits, least privilege, human-in-the-loop where required, logging, and spend caps exist for each agent at its tier.\n\n## 5. Resolution Steps\n1. Publish an **AI Agent Register** (the inventory) as the single source of truth; require new agents to be registered before production use.\n2. Adopt a **tiered control matrix**:\n   - Tier 1: registration, basic logging, owner named.\n   - Tier 2: above + scoped service identity, audit trail (see t4-aigov-003), rollback plan.\n   - Tier 3: above + mandatory human-in-the-loop approval, spend guardrails (see t4-aigov-004), incident runbook (see t4-aigov-002), and sign-off by the business owner before launch.\n3. Implement an **approval gate**: a lightweight intake/review where a new or changed Tier 2/3 agent is assessed against the matrix before it can act.\n4. Require **human-in-the-loop** for irreversible or high-impact actions — the agent proposes, a human confirms.\n5. Document the **policy** (1–3 pages): scope, definitions, tiers, required controls per tier, owner responsibilities, and the review cadence (e.g., quarterly).\n6. Schedule a **recurring review** of the register and tiers; retire or re-scope agents that no longer have a clear owner or purpose.\n\n## 6. Verification Steps\n- Every known agent appears in the register with owner, purpose, tier, and identity.\n- Each Tier 3 agent has a documented human-in-the-loop gate that you can demonstrate.\n- A spot check of one agent confirms its real permissions match its registered scope (no over-provisioning).\n- The policy document exists, is approved, and names a review cadence.\n- A new test agent cannot reach production without passing the approval gate.\n\n## 7. Escalation Trigger\nEscalate to L3 / security leadership if an autonomous agent is operating in production with write, financial, or customer-facing scope and has no documented owner, no risk tier, or no approval gate — or if an ungoverned agent already took an action with real business or customer impact.\n\n## 8. Prevention Tips\n- Make registration mandatory: \"no register entry, no production.\"\n- Default new agents to the lowest privilege and lowest tier; require justification to raise scope.\n- Bake guardrails into templates so new agents inherit logging, scope limits, and spend caps by default.\n- Review the register on a fixed cadence and after any incident.\n- Keep the framework mapping (NIST AI RMF / ISO 42001) as living references, revisited as those documents evolve.\n\n## 9. User-Friendly Explanation\nThink of AI agents like new employees who can act on the company's behalf. You would not let a new hire send payments or email customers on day one without knowing who they are, what they are allowed to do, and who supervises them. AI agent governance is simply giving every agent a job description, a manager, a permission level, and — for the risky ones — a \"check with a human first\" rule. It is not about slowing things down; it is about knowing what your agents can do before something goes wrong.\n\n## 10. Internal Technician Notes\n- Anchor everything to the register; it is the artifact auditors and insurers will ask for.\n- NIST AI RMF and ISO/IEC 42001 are **references** for structuring controls. Never state or imply the client is \"certified\" or \"compliant\" — these articles are advisory/readiness only.\n- The Aperture dashboard concept (see t4-aigov-003) is a natural home for the live agent inventory and per-agent action logs.\n- Tier 3 = irreversible/financial/customer-facing/safety. When in doubt, tier up.\n- This article pairs with the IR runbook (t4-aigov-002), audit trail (t4-aigov-003), spend guardrails (t4-aigov-004), and agent identity lifecycle (t4-aigov-005).\n\n## 11. Related KB Articles\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-003 — AI Agent Audit Trail & Observability\n- t4-aigov-004 — AI / Agent Spend Guardrails\n- t4-aigov-005 — Agent Identity Onboarding & Offboarding\n- t4-aigov-006 — Shadow-AI Discovery\n\n## 12. Keywords / Search Tags\nai agent governance, autonomous agent policy, ai risk tiering, human in the loop, NIST AI RMF, ISO/IEC 42001, agent inventory, agent register, ai guardrails, approval gate, agentic ai controls, least privilege agents"
  },
  {
   "slug": "t4-aigov-002-ai-agent-incident-response",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-002-ai-agent-incident-response.md",
   "title": "\"AI Agent Incident Response Runbook\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ai agent incident response\"",
    "\"agent misbehavior\"",
    "\"revoke agent credentials\"",
    "\"disable agent\"",
    "\"blast radius\"",
    "\"rollback agent actions\"",
    "\"ai root cause analysis\"",
    "\"containment runbook\"",
    "\"rogue agent\"",
    "\"agentic incident\"",
    "\"kill switch\"",
    "\"ai ir runbook\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-002\ntitle: \"AI Agent Incident Response Runbook\"\ncategory: ai-governance\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: critical\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ai agent incident response\",\"agent misbehavior\",\"revoke agent credentials\",\"disable agent\",\"blast radius\",\"rollback agent actions\",\"ai root cause analysis\",\"containment runbook\",\"rogue agent\",\"agentic incident\",\"kill switch\",\"ai ir runbook\"]\nrelated_articles: [\"t4-aigov-001\",\"t4-aigov-003\",\"t4-aigov-005\",\"t4-aithreat-001\"]\nescalation_trigger: \"An agent has taken or is taking irreversible, financial, or customer-impacting actions, or its containment is uncertain.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- An AI agent took a wrong or unexpected action (sent the wrong email, modified/deleted records, made a purchase, deployed code, escalated privileges).\n- An agent is looping, spamming actions, or burning API/cost at an abnormal rate.\n- An agent's outputs suddenly changed character (off-policy, manipulated, leaking data) — possible prompt injection (see t4-aithreat-001).\n- Users or customers report receiving something the business did not intend to send.\n- Monitoring/alerts fired on anomalous agent behavior or spend.\n\n## 2. Likely Causes\n- A flawed instruction, tool, or change pushed the agent off its intended path.\n- Prompt injection or poisoned/untrusted content steered the agent (see t4-aithreat-001).\n- Over-broad permissions let a small error become a large impact (no least privilege).\n- Missing human-in-the-loop on an irreversible action.\n- An upstream dependency (model, API, data source) changed behavior.\n- A loop/retry bug caused runaway actions or cost.\n\n## 3. Questions To Ask User\n- What did the agent do, and when did it start? Is it still running right now?\n- Which systems, records, customers, or funds were touched?\n- Whose credentials/identity does the agent use, and can we disable them immediately?\n- Are the actions reversible, and is there a backup or audit log?\n- Did any external/untrusted content reach the agent (email, web page, document, ticket)?\n- Who is the named owner of this agent (per the register, t4-aigov-001)?\n\n## 4. Troubleshooting Steps\n1. **Confirm scope of activity.** Pull the agent's recent action/tool-call log (see t4-aigov-003) to see exactly what it did and is doing.\n2. **Identify the identity.** Determine the service identity/token the agent uses so you can cut it off precisely.\n3. **Determine reversibility.** Classify each action as reversible (record edit with history) or irreversible (payment, external send, deletion).\n4. **Look for a cause vector.** Check whether untrusted input, a recent change, or a dependency shift triggered the behavior.\n\n## 5. Resolution Steps\nFollow the IR phases in order. Speed of containment beats perfect diagnosis.\n1. **Contain (immediately):**\n   - Disable the agent (stop the process / flip its kill switch / disable the schedule).\n   - **Revoke its credentials and tokens** so it cannot act even if it restarts.\n   - Cut tool/API access (disable the service account, rotate the key).\n2. **Assess blast radius:**\n   - Enumerate every action taken in the incident window using the audit trail.\n   - List affected systems, records, customers, and any money moved.\n   - Flag irreversible actions for manual remediation/notification.\n3. **Roll back / remediate:**\n   - Restore changed/deleted data from history or backup.\n   - Recall or correct erroneous communications where possible; notify affected parties for what cannot be recalled.\n   - Reverse or dispute financial actions through the appropriate channel.\n4. **Root cause:**\n   - Determine *why* the agent acted wrongly (instruction flaw, injection, permission gap, missing human gate, dependency change).\n   - Capture a timeline and the triggering input.\n5. **Recover safely:**\n   - Fix the root cause, tighten permissions, add/restore guardrails, and add a human-in-the-loop gate if the action was irreversible.\n   - Re-enable the agent only after the owner signs off.\n6. **Document & learn:**\n   - Write the incident up; feed lessons back into the governance framework (t4-aigov-001) and update the runbook.\n\n## 6. Verification Steps\n- The agent is provably stopped and its credentials/tokens are revoked (test that it cannot act).\n- The full list of actions in the incident window is reconstructed and accounted for.\n- Reversible actions are rolled back; irreversible ones have owners and remediation/notification plans.\n- A documented root cause exists with a corrective action.\n- The agent only resumes after fix + owner sign-off; new guardrails are confirmed active.\n\n## 7. Escalation Trigger\nEscalate to L3 / security leadership and the agent's business owner immediately if the agent took or is taking irreversible, financial, or customer-impacting actions, if containment is uncertain, or if prompt injection / external compromise is suspected (then also engage the security IR process).\n\n## 8. Prevention Tips\n- Pre-build a **kill switch** and credential-revocation path for every Tier 2/3 agent — do not improvise during an incident.\n- Enforce least privilege so a single error has a small blast radius.\n- Require human-in-the-loop on irreversible actions (see t4-aigov-001).\n- Keep tamper-evident action logs so blast-radius assessment is fast (see t4-aigov-003).\n- Run a tabletop exercise: practice containing a misbehaving agent before it happens.\n- Alert on anomalous action rate and spend (see t4-aigov-004).\n\n## 9. User-Friendly Explanation\nIf an AI agent starts doing the wrong thing, treat it like a tool that has gone haywire: first pull the plug, then take away its keys so it cannot restart and do more. After it is safely stopped, you figure out everything it touched, undo what you can, warn anyone affected by what you can't undo, and find out *why* it went wrong so it does not happen again. The order matters — stop first, investigate second.\n\n## 10. Internal Technician Notes\n- \"Revoke creds/tokens\" is the non-negotiable second step after disable; a stopped agent that can re-auth is not contained.\n- Blast-radius assessment depends entirely on having an audit trail (t4-aigov-003). If logging is weak, that is a finding to fix post-incident.\n- If injection is the cause, this becomes a security incident — pivot to t4-aithreat-001 mitigations and the org's security IR process.\n- Aperture-style dashboards can surface the per-agent action timeline used for blast radius.\n- Always re-enable behind an owner sign-off; never silently restart a contained agent.\n\n## 11. Related KB Articles\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aigov-003 — AI Agent Audit Trail & Observability\n- t4-aigov-005 — Agent Identity Onboarding & Offboarding\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n\n## 12. Keywords / Search Tags\nai agent incident response, agent misbehavior, revoke agent credentials, disable agent, kill switch, blast radius, rollback agent actions, ai root cause, containment runbook, rogue agent, agentic incident, ai ir runbook"
  },
  {
   "slug": "t4-aigov-003-ai-agent-audit-trail",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-003-ai-agent-audit-trail.md",
   "title": "\"AI Agent Audit Trail & Observability\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ai agent audit trail\"",
    "\"agent observability\"",
    "\"tool call logging\"",
    "\"agent accountability\"",
    "\"tamper evident logs\"",
    "\"log retention\"",
    "\"agent decision logging\"",
    "\"aperture dashboard\"",
    "\"ai action log\"",
    "\"traceability\"",
    "\"agent telemetry\"",
    "\"explainability\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-003\ntitle: \"AI Agent Audit Trail & Observability\"\ncategory: ai-governance\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: high\nestimated_time_minutes: 75\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ai agent audit trail\",\"agent observability\",\"tool call logging\",\"agent accountability\",\"tamper evident logs\",\"log retention\",\"agent decision logging\",\"aperture dashboard\",\"ai action log\",\"traceability\",\"agent telemetry\",\"explainability\"]\nrelated_articles: [\"t4-aigov-001\",\"t4-aigov-002\",\"t4-aigov-004\",\"t4-aigov-005\"]\nescalation_trigger: \"A Tier 2/3 agent is taking actions with no retrievable, tamper-evident record of what it did or why.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- After an agent acts, no one can reconstruct *what* it did, *why*, or *which tools/APIs it called*.\n- During an incident, blast-radius assessment stalls because logs are missing, incomplete, or scattered.\n- Agent logs exist but are editable/deletable by the same identity the agent runs as (no tamper evidence).\n- Compliance/audit asks \"show me this agent's decisions for last quarter\" and the data is not retained.\n- No dashboard shows live agent activity; problems are noticed only by their side effects.\n\n## 2. Likely Causes\n- Agents were built to *act* but not to *record*; logging was an afterthought.\n- Logs capture model text but not the structured decision, the inputs, or the tool calls.\n- No centralized, append-only store — logs live in scattered files or ephemeral console output.\n- No retention policy, so records age out (or never existed).\n- The agent's own identity can modify its logs (no separation of duties / tamper evidence).\n\n## 3. Questions To Ask User\n- For a given agent action, can you currently retrieve who triggered it, the input, the reasoning, the tool calls, and the result?\n- Where do agent logs live, and who can edit or delete them?\n- How long are agent logs kept, and is that driven by a policy or by chance?\n- Is there a single place (dashboard) to see live agent activity across the fleet?\n- Do any agents handle regulated data that carries specific logging/retention obligations?\n\n## 4. Troubleshooting Steps\n1. **Inventory current logging** per agent: what is captured, where, and for how long.\n2. **Identify gaps** against the \"what to capture\" list (section 5): missing inputs, missing tool calls, missing outcomes.\n3. **Check tamper exposure:** can the agent's runtime identity alter or delete its own logs? If yes, that is a priority finding.\n4. **Check retrievability:** time how long it takes to answer \"what did agent X do on date Y?\" Slow or impossible = inadequate.\n\n## 5. Resolution Steps\n1. **Define what to capture per agent action (minimum set):**\n   - Timestamp, agent ID/version, and triggering identity/event.\n   - Input/context the agent received (sanitized of secrets/PII where required).\n   - The decision/plan and, where feasible, the reasoning or chosen path.\n   - Each tool/API call: name, parameters (redacted as needed), and result.\n   - Final action taken and its outcome (success/failure).\n   - Cost/tokens consumed (ties to t4-aigov-004).\n2. **Centralize** logs into an append-only store the agent cannot retroactively edit.\n3. **Make it tamper-evident:** use write-once/append-only storage or hash-chaining/signing so any alteration is detectable. Separate the log-writer identity from the agent's action identity.\n4. **Set retention** per a written policy aligned to business/compliance needs (e.g., a defined number of months/years); document the basis.\n5. **Build observability:** a dashboard (the Aperture concept fits here) showing live agent activity, per-agent action timelines, error/anomaly indicators, and spend.\n6. **Wire to IR:** ensure the audit trail is the first source consulted during incident response (t4-aigov-002) for blast-radius assessment.\n\n## 6. Verification Steps\n- For a sample action, you can retrieve the full chain: trigger → input → decision → tool calls → outcome.\n- Attempting to alter a past log entry is detectable (hash/signature/append-only confirms tamper evidence).\n- The agent's own identity cannot silently delete or rewrite its logs.\n- Retention matches the documented policy.\n- The dashboard shows current agent activity and supports drilling into a single action.\n\n## 7. Escalation Trigger\nEscalate to L3 if a Tier 2/3 (write/financial/customer-facing) agent is acting with no retrievable, tamper-evident record of what it did or why — this blocks both accountability and incident response.\n\n## 8. Prevention Tips\n- Treat logging as a launch requirement, not an add-on: \"no audit trail, no Tier 2/3 production.\"\n- Log structured events (not just free text) so they are queryable.\n- Redact secrets and sensitive content at write time; observability must respect privacy.\n- Keep the log-writer separate from the agent identity to preserve tamper evidence.\n- Review retention and dashboard coverage during periodic governance reviews (t4-aigov-001).\n\n## 9. User-Friendly Explanation\nAn audit trail is the agent's \"flight recorder.\" For every action it takes, you want a record of what it was asked, what it decided, what tools it used, and what happened — stored somewhere it cannot quietly erase. When something goes wrong, this record lets you see exactly what occurred and how far it spread. A dashboard then turns those records into a live view so you can watch your agents the way you watch any other critical system.\n\n## 10. Internal Technician Notes\n- Tamper-evidence options without new runtime deps: append-only storage plus a hash chain (each entry hashes the previous) is a defensible, hand-rolled pattern; or sign entries.\n- The minimum capture set is also the data IR needs — design once, serve both accountability and t4-aigov-002.\n- Aperture is the natural visualization layer; conceptually tie per-agent timelines and spend into it.\n- Watch privacy invariants: logs must be sanitized/content-blind where the platform requires it. Do not let observability become a data-leak channel.\n- Cost/token capture here feeds the spend guardrails article (t4-aigov-004).\n\n## 11. Related KB Articles\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-004 — AI / Agent Spend Guardrails\n- t4-aigov-005 — Agent Identity Onboarding & Offboarding\n\n## 12. Keywords / Search Tags\nai agent audit trail, agent observability, tool call logging, agent accountability, tamper-evident logs, log retention, agent decision logging, aperture dashboard, ai action log, traceability, agent telemetry, explainability"
  },
  {
   "slug": "t4-aigov-004-ai-spend-guardrails",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-004-ai-spend-guardrails.md",
   "title": "\"AI / Agent Spend Guardrails\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ai spend guardrails\"",
    "\"token cost runaway\"",
    "\"api budget caps\"",
    "\"per agent quota\"",
    "\"rate limiting\"",
    "\"finops for ai\"",
    "\"llm cost control\"",
    "\"spend alerting\"",
    "\"runaway agent cost\"",
    "\"ai budget\"",
    "\"cost anomaly\"",
    "\"model cost governance\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-004\ntitle: \"AI / Agent Spend Guardrails\"\ncategory: ai-governance\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: medium\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ai spend guardrails\",\"token cost runaway\",\"api budget caps\",\"per agent quota\",\"rate limiting\",\"finops for ai\",\"llm cost control\",\"spend alerting\",\"runaway agent cost\",\"ai budget\",\"cost anomaly\",\"model cost governance\"]\nrelated_articles: [\"t4-aigov-001\",\"t4-aigov-002\",\"t4-aigov-003\",\"t4-aigov-005\"]\nescalation_trigger: \"Agent/API spend is climbing with no cap or kill switch, or a single agent has already exceeded its budget by a large multiple.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- AI/API bills are rising unpredictably and no one can attribute cost to specific agents.\n- A single agent looped or retried and ran up a large, unexpected charge.\n- There are no per-agent budgets, rate caps, or quotas — every agent can spend without limit.\n- No alert fires until the invoice arrives.\n- Finance asks \"what is driving AI cost?\" and IT cannot break it down.\n\n## 2. Likely Causes\n- No budget/quota model: agents call paid APIs with shared keys and no ceiling.\n- Loop/retry bugs or chatty prompts multiply token usage.\n- No rate limiting, so an agent can fire calls as fast as the API allows.\n- Cost is not tagged per agent, so attribution and accountability are impossible.\n- No alerting on spend velocity — only on the final total.\n\n## 3. Questions To Ask User\n- Which agents call paid AI/APIs, and do they share keys or use per-agent keys?\n- Is there any per-agent budget, rate cap, or daily/monthly quota today?\n- How is cost attributed back to individual agents or teams?\n- What alerting exists, and at what thresholds?\n- Has any agent ever caused a cost spike? What stopped it?\n\n## 4. Troubleshooting Steps\n1. **Attribute current spend.** Map each paid call path to a specific agent/key. If keys are shared, that is the first gap to close.\n2. **Find the cost drivers.** Identify the top agents by spend and check for loops, retries, oversized context, or unnecessarily large models.\n3. **Check for any existing cap.** Determine whether any ceiling or rate limit exists at all (often none).\n4. **Check alerting.** Confirm whether anything notifies before the bill, and at what threshold.\n\n## 5. Resolution Steps\n1. **Give each agent its own key/identity** so cost is attributable (ties to t4-aigov-005).\n2. **Set per-agent budgets and quotas:** a daily and monthly cap per agent, sized to its job. Tier 3 agents get tighter scrutiny.\n3. **Enforce rate caps:** maximum calls per minute/hour to blunt runaway loops.\n4. **Add hard kill behavior:** when an agent hits its budget cap, it pauses/disables rather than continuing — a spend kill switch (coordinate with t4-aigov-002).\n5. **Instrument cost in the audit trail:** record tokens/cost per action (t4-aigov-003) so spend is queryable per agent.\n6. **Alert on velocity, not just totals:** notify when spend rate or call rate is anomalous, well before the budget is exhausted.\n7. **Apply FinOps practice for AI:** regular cost reviews, right-size models (smaller/cheaper where adequate), cache where safe, and trim oversized context to cut tokens.\n\n## 6. Verification Steps\n- Each agent's spend is attributable to its own key/identity.\n- Per-agent daily and monthly caps and rate caps are configured and tested (a test agent hitting its cap pauses).\n- Spend/token cost appears per action in the audit trail.\n- A velocity alert fires in a test before the budget is exhausted.\n- A cost report can break spend down by agent/team.\n\n## 7. Escalation Trigger\nEscalate to L3 / finance owner if agent or API spend is climbing with no cap or kill switch in place, or if a single agent has already exceeded its budget by a large multiple (possible loop or abuse — also check t4-aigov-002).\n\n## 8. Prevention Tips\n- Default every new agent to a conservative budget and rate cap; require justification to raise it.\n- Never share API keys across agents — attribution depends on per-agent identity.\n- Make \"cap + kill switch + alert\" a launch requirement for any paid-API agent.\n- Right-size models and context; the cheapest controllable cost is the call you do not make.\n- Review AI spend on the same cadence as governance reviews (t4-aigov-001).\n\n## 9. User-Friendly Explanation\nAI agents cost money every time they \"think\" or call a paid service. Without limits, a small bug can make an agent spend in a loop and run up a surprising bill. Spend guardrails are like giving each agent a prepaid card with a daily and monthly limit, a speed limit on how fast it can spend, and a text alert if it starts spending too quickly — plus an automatic stop when it hits its cap. You get the benefits of agents without bill shock.\n\n## 10. Internal Technician Notes\n- Per-agent keys are the linchpin: without them, neither budgets nor attribution work cleanly.\n- The spend kill switch should integrate with the IR kill switch (t4-aigov-002) so \"stop spending\" and \"stop acting\" are coherent.\n- Token/cost capture lives in the audit trail (t4-aigov-003) — build once, use for both observability and FinOps.\n- \"FinOps for AI\" = the same cost-visibility/right-sizing discipline applied to model and API usage.\n- Velocity alerting catches runaway loops far earlier than total-based alerts.\n\n## 11. Related KB Articles\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-003 — AI Agent Audit Trail & Observability\n- t4-aigov-005 — Agent Identity Onboarding & Offboarding\n\n## 12. Keywords / Search Tags\nai spend guardrails, token cost runaway, api budget caps, per-agent quota, rate limiting, finops for ai, llm cost control, spend alerting, runaway agent cost, ai budget, cost anomaly, model cost governance"
  },
  {
   "slug": "t4-aigov-005-agent-identity-lifecycle",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-005-agent-identity-lifecycle.md",
   "title": "\"Agent Identity Onboarding & Offboarding\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"agent identity lifecycle\"",
    "\"non-human identity\"",
    "\"service account agent\"",
    "\"least privilege\"",
    "\"secret rotation\"",
    "\"deprovisioning agent\"",
    "\"machine identity\"",
    "\"credential management\"",
    "\"agent offboarding\"",
    "\"scoped tokens\"",
    "\"identity governance\"",
    "\"orphaned credentials\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-005\ntitle: \"Agent Identity Onboarding & Offboarding\"\ncategory: ai-governance\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: high\nestimated_time_minutes: 75\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"agent identity lifecycle\",\"non-human identity\",\"service account agent\",\"least privilege\",\"secret rotation\",\"deprovisioning agent\",\"machine identity\",\"credential management\",\"agent offboarding\",\"scoped tokens\",\"identity governance\",\"orphaned credentials\"]\nrelated_articles: [\"t4-aigov-001\",\"t4-aigov-002\",\"t4-aigov-003\",\"t4-aigov-004\",\"t4-aigov-006\"]\nescalation_trigger: \"A retired agent's credentials are still active, or an agent is running on a human's personal login or an over-privileged shared account.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- Agents authenticate using a developer's personal credentials or a broad shared account.\n- Retired/decommissioned agents still have live keys, tokens, or accounts that nobody disabled.\n- No one can list which non-human (agent/service) identities exist or what they can access.\n- Secrets are hard-coded, never rotated, and stored in plaintext or source.\n- An agent's permissions far exceed what its job requires (no least privilege).\n\n## 2. Likely Causes\n- Agents were stood up quickly using whatever credentials were handy.\n- No onboarding process that issues a dedicated, scoped identity per agent.\n- No offboarding process, so credentials outlive the agent (orphaned identities).\n- Secrets management was never formalized — keys in config files, repos, or chat.\n- Permissions were granted broadly \"to make it work,\" never tightened.\n\n## 3. Questions To Ask User\n- Does each agent have its own dedicated service/non-human identity, or does it borrow a person's or shared login?\n- Where are agent secrets stored, and how often are they rotated?\n- When an agent is retired, what process disables its identity and revokes its keys?\n- Can you produce a list of all agent identities and their permissions?\n- Are any agents running with admin/broad rights they do not need?\n\n## 4. Troubleshooting Steps\n1. **Enumerate non-human identities** tied to agents: accounts, service principals, API keys, tokens.\n2. **Map each to an agent and owner** (cross-reference the register, t4-aigov-001). Flag any identity with no live agent — likely orphaned.\n3. **Review permissions** for each: compare granted scope to the agent's actual job. Flag over-privilege.\n4. **Review secret handling:** where stored, how rotated, who can read them.\n\n## 5. Resolution Steps\n1. **Onboarding (issue):** Every agent gets a dedicated, named non-human/service identity — never a person's login, never a broad shared account.\n2. **Least privilege:** Grant only the specific scopes/tools the agent needs for its job; deny by default and add narrowly.\n3. **Secrets management:** Store credentials in a secrets store (not in code/config/chat). Use short-lived, scoped tokens where possible.\n4. **Rotation:** Define and automate a rotation schedule for keys/secrets; rotate immediately on suspected compromise or after an incident (t4-aigov-002).\n5. **Lifecycle binding:** Tie the identity's existence to the agent's lifecycle in the register — created when the agent is approved, reviewed periodically.\n6. **Offboarding (deprovision):** When an agent is retired or re-scoped, disable its identity, revoke and delete its keys/tokens, and remove its access. Confirm no orphaned credentials remain.\n7. **Attribution:** Per-agent identities also enable cost attribution (t4-aigov-004) and clean audit trails (t4-aigov-003).\n\n## 6. Verification Steps\n- Every agent uses a dedicated non-human identity, not a personal or broad shared account.\n- Each identity's permissions match its job (spot-check confirms no excess scope).\n- Secrets live in a secrets store and have a rotation schedule that has actually run.\n- A test offboarding leaves no live keys/tokens for the retired agent (re-auth fails).\n- No orphaned agent identities remain in the directory/key inventory.\n\n## 7. Escalation Trigger\nEscalate to L3 / security if a retired agent's credentials are still active, if an agent is running on a human's personal login, or if an agent holds over-privileged or admin rights it does not need — each is a standing breach risk.\n\n## 8. Prevention Tips\n- \"One agent, one scoped identity\" — enforce at onboarding.\n- Bind identity creation and destruction to the agent register so offboarding is never skipped.\n- Prefer short-lived, scoped tokens over long-lived static keys.\n- Rotate secrets on a schedule and after any incident.\n- Run periodic access reviews to catch privilege creep and orphaned identities (overlaps with shadow-AI discovery, t4-aigov-006).\n\n## 9. User-Friendly Explanation\nTreat each AI agent like a staff member with their own badge. Give it its own login (not a person's), only the access it actually needs, and keys that get changed regularly and kept in a safe place. When the agent is no longer used, deactivate its badge and take back its keys — the same way you would offboard an employee who leaves. The biggest risk is a \"ghost\" agent whose login still works long after the agent is gone.\n\n## 10. Internal Technician Notes\n- Orphaned credentials are a top finding in AI environments — they are quiet until abused. Tie identity lifecycle to the register so retirement forces deprovisioning.\n- Per-agent identity is the foundation that makes audit trails (t4-aigov-003) and spend attribution (t4-aigov-004) work; sell these together.\n- Least privilege directly limits IR blast radius (t4-aigov-002).\n- \"Non-human identity\" / \"machine identity\" is the industry term — use it when scoping with clients.\n- Shadow-AI discovery (t4-aigov-006) often surfaces unmanaged identities to bring into this lifecycle.\n\n## 11. Related KB Articles\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-003 — AI Agent Audit Trail & Observability\n- t4-aigov-004 — AI / Agent Spend Guardrails\n- t4-aigov-006 — Shadow-AI Discovery\n\n## 12. Keywords / Search Tags\nagent identity lifecycle, non-human identity, service account agent, least privilege, secret rotation, deprovisioning agent, machine identity, credential management, agent offboarding, scoped tokens, identity governance, orphaned credentials"
  },
  {
   "slug": "t4-aigov-006-shadow-ai-discovery",
   "path_rel": "knowledge-base\\tier4\\t4-aigov-006-shadow-ai-discovery.md",
   "title": "\"Shadow-AI Discovery\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"shadow ai\"",
    "\"unsanctioned ai tools\"",
    "\"browser extension risk\"",
    "\"ai data leakage\"",
    "\"ai discovery\"",
    "\"saas ai sprawl\"",
    "\"sanctioning workflow\"",
    "\"unapproved ai\"",
    "\"data loss prevention\"",
    "\"ai usage visibility\"",
    "\"rogue ai apps\"",
    "\"employee ai tools\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aigov-006\ntitle: \"Shadow-AI Discovery\"\ncategory: ai-governance\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: ai-governance\nseverity: high\nestimated_time_minutes: 75\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"shadow ai\",\"unsanctioned ai tools\",\"browser extension risk\",\"ai data leakage\",\"ai discovery\",\"saas ai sprawl\",\"sanctioning workflow\",\"unapproved ai\",\"data loss prevention\",\"ai usage visibility\",\"rogue ai apps\",\"employee ai tools\"]\nrelated_articles: [\"t4-aigov-001\",\"t4-aigov-005\",\"t4-aithreat-001\",\"t4-aithreat-002\"]\nescalation_trigger: \"An unsanctioned AI tool is found to have received sensitive, regulated, or customer data.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- Employees are using AI chatbots, copilots, agents, or browser extensions that IT never approved or knows about.\n- Sensitive data (customer records, code, contracts, PII) may be getting pasted into external AI tools.\n- New AI browser extensions appear on managed devices.\n- Unexpected AI-related SaaS charges or signups show up.\n- Leadership cannot answer \"what AI tools are our people actually using?\"\n\n## 2. Likely Causes\n- Easy, free, self-serve AI tools let anyone adopt them without IT.\n- No approved-AI list, so employees do not know what is sanctioned.\n- Browser extension stores make adding AI helpers a one-click action.\n- Remote/BYOD blurs the boundary of what IT can see.\n- A genuine productivity need that sanctioned tools have not yet met.\n\n## 3. Questions To Ask User\n- Do you have an approved-AI list, and do employees know it exists?\n- What visibility do you have into web traffic, browser extensions, and SaaS signups?\n- Are people handling sensitive/regulated data that must not leave the org?\n- Have any AI-related charges or signups appeared that IT did not authorize?\n- Is there a process to request and approve a new AI tool today?\n\n## 4. Troubleshooting Steps\n1. **Discover via multiple methods (triangulate):**\n   - Network/web egress: identify traffic to known AI service domains.\n   - Endpoint/browser: enumerate installed browser extensions and desktop AI apps on managed devices.\n   - SaaS/identity: review SSO/OAuth grants and expense/billing for AI signups.\n   - Survey: ask teams what they use (people often disclose when not punished).\n2. **Catalog findings:** tool, who uses it, for what, and what data flows to it.\n3. **Assess data-leak risk:** flag any tool that may have received sensitive/regulated/customer data as high priority.\n4. **Check for agent-like tools** that take actions (not just chat) — these also need identity governance (t4-aigov-005).\n\n## 5. Resolution Steps\n1. **Triage each discovered tool:** sanction, restrict, or block, based on risk and data handling.\n2. **Run the sanctioning workflow** for tools worth keeping:\n   - Assess vendor data handling/retention and where data goes.\n   - Define allowed use and what data may/may not be entered.\n   - Bring it under governance: owner, register entry (t4-aigov-001), and identity/permissions if it acts (t4-aigov-005).\n   - Approve and add to the published approved-AI list.\n3. **Block or restrict** high-risk or non-compliant tools (extension allow/deny lists, egress controls, DLP rules on sensitive data).\n4. **Provide a sanctioned alternative** so the underlying need is met — shadow AI thrives where official tools are missing.\n5. **Publish the approved-AI list and a simple request path** so future adoption flows through IT instead of around it.\n6. **For confirmed data exposure,** treat it as a data incident (notify, assess scope; coordinate with t4-aithreat-001 if injection/exfil is involved).\n\n## 6. Verification Steps\n- A consolidated inventory of discovered AI tools exists with users, purpose, and data flows.\n- Each tool has a disposition: sanctioned / restricted / blocked.\n- Sanctioned tools appear on a published approved-AI list and in the governance register.\n- High-risk tools are demonstrably blocked or restricted (test the control).\n- A working request-and-approve path for new AI tools is documented and communicated.\n\n## 7. Escalation Trigger\nEscalate to L3 / security and data-privacy leadership if an unsanctioned AI tool is found to have received sensitive, regulated, or customer data — treat as a potential data-exposure incident.\n\n## 8. Prevention Tips\n- Publish a clear approved-AI list and an easy request path; make the sanctioned route the path of least resistance.\n- Use DLP and egress visibility to catch sensitive data heading to AI services.\n- Manage browser extensions with allow/deny lists on managed devices.\n- Rediscover on a cadence — shadow AI regrows; treat discovery as recurring, not one-time.\n- Educate staff on *why* limits exist (data leakage) rather than only saying \"no.\"\n\n## 9. User-Friendly Explanation\n\"Shadow AI\" is any AI tool your team uses that IT did not approve — a chatbot, a writing helper, a browser add-on. The danger is that company or customer information can quietly end up on an outside service. Discovery is simply finding out what is actually in use, deciding which tools are safe to keep, blocking the risky ones, and giving people an approved option so they do not feel they have to go around IT. The goal is enabling AI safely, not banning it.\n\n## 10. Internal Technician Notes\n- Triangulate across network, endpoint, and identity/SaaS signals — no single method finds everything.\n- The most valuable output is the approved-AI list plus an easy request path; without an alternative, blocking just pushes shadow AI further underground.\n- Agentic shadow tools (those that take actions) must be funneled into identity lifecycle (t4-aigov-005) and the register (t4-aigov-001).\n- Confirmed sensitive-data exposure = data incident; loop in privacy stakeholders. Browser AI extensions are also a prompt-injection/exfil surface (t4-aithreat-001).\n- Respect privacy when surveying staff; a non-punitive ask yields far better disclosure.\n\n## 11. Related KB Articles\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aigov-005 — Agent Identity Onboarding & Offboarding\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n- t4-aithreat-002 — AI Voice Phishing (Vishing) & Deepfake Audio\n\n## 12. Keywords / Search Tags\nshadow ai, unsanctioned ai tools, browser extension risk, ai data leakage, ai discovery, saas ai sprawl, sanctioning workflow, unapproved ai, data loss prevention, ai usage visibility, rogue ai apps, employee ai tools"
  },
  {
   "slug": "t4-aithreat-001-prompt-injection-rag-leakage",
   "path_rel": "knowledge-base\\tier4\\t4-aithreat-001-prompt-injection-rag-leakage.md",
   "title": "\"Prompt Injection & RAG/Data Leakage\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"prompt injection\"",
    "\"indirect prompt injection\"",
    "\"rag data leakage\"",
    "\"owasp llm top 10\"",
    "\"mitre atlas\"",
    "\"data exfiltration\"",
    "\"untrusted content\"",
    "\"tool abuse\"",
    "\"llm jailbreak\"",
    "\"output handling\"",
    "\"least privilege llm\"",
    "\"ai data exfil\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aithreat-001\ntitle: \"Prompt Injection & RAG/Data Leakage\"\ncategory: ai-security\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-threat\nseverity: critical\nestimated_time_minutes: 90\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"prompt injection\",\"indirect prompt injection\",\"rag data leakage\",\"owasp llm top 10\",\"mitre atlas\",\"data exfiltration\",\"untrusted content\",\"tool abuse\",\"llm jailbreak\",\"output handling\",\"least privilege llm\",\"ai data exfil\"]\nrelated_articles: [\"t4-aigov-002\",\"t4-aigov-006\",\"t4-aithreat-002\",\"t4-aithreat-003\"]\nescalation_trigger: \"An LLM-connected agent with tool or data access shows signs of following injected instructions or exfiltrating data.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- An AI assistant/agent ignores its instructions or behaves off-policy after processing a document, email, web page, or ticket.\n- Sensitive data appears in an agent's output, in an external request, or somewhere it should not go.\n- An agent performs an unexpected tool/API action it was never asked to do (send, fetch, delete, transfer).\n- Retrieved content (from a knowledge base / RAG source) seems to \"command\" the model.\n- Outputs contain hidden instructions, odd links, or attempts to disclose system prompts/secrets.\n\n## 2. Likely Causes\n- **Direct prompt injection:** a user crafts input that overrides the system instructions (\"ignore previous instructions...\").\n- **Indirect prompt injection:** untrusted content the model *retrieves or reads* (web page, email, PDF, RAG document) contains hidden instructions the model then follows. (Mapped in OWASP LLM Top 10 and MITRE ATLAS as references.)\n- **Excessive agency / tool over-permission:** the agent can call powerful tools, so an injected instruction becomes a real action (data exfil, sending, deleting).\n- **Insecure output handling:** model output is trusted and rendered/executed downstream (e.g., into a browser, shell, or SQL) enabling injection-to-action.\n- **RAG/data leakage:** the model surfaces content the requesting user should not see, or sensitive context is embedded in prompts and leaks.\n\n## 3. Questions To Ask User\n- Does the affected agent read untrusted/external content (web, email, uploaded files, tickets)?\n- What tools/APIs can it call, and how broad are those permissions?\n- Is its output rendered or executed by another system without validation?\n- What data sources feed its RAG/knowledge retrieval, and who is allowed to see that data?\n- When did the odd behavior start, and what input preceded it?\n\n## 4. Troubleshooting Steps\n1. **Capture the triggering input** from the audit trail (t4-aigov-003): the exact content the model processed before misbehaving.\n2. **Classify the vector:** direct (user prompt) vs. indirect (retrieved/embedded content).\n3. **Map the agency:** list the tools the agent can call and whether the suspect action was within its granted scope.\n4. **Trace the data path:** identify what data could have been exfiltrated and through which tool/output channel.\n5. **Check output handling:** see whether model output flows unchecked into a downstream system.\n\n## 5. Resolution Steps\nMitigations are defense-in-depth; no single control is sufficient.\n1. **Contain first** if active: treat as an incident — disable the agent and revoke tokens (t4-aigov-002).\n2. **Input handling:** separate and clearly delimit untrusted content from instructions; do not let retrieved/external text be treated as commands. Sanitize/strip active content where feasible.\n3. **Least privilege & least agency:** give the agent only the tools and data scopes it truly needs (t4-aigov-005). Remove powerful tools from agents that read untrusted content.\n4. **Human-in-the-loop** for high-impact tool actions (send, transfer, delete, deploy) so an injected instruction cannot act unattended.\n5. **Output handling:** validate, encode, and constrain model output before any downstream use; never execute or render it raw.\n6. **Isolation/sandboxing:** run tool execution in constrained environments with egress controls so exfiltration paths are limited.\n7. **RAG hygiene:** enforce per-user authorization on retrieval (the model must not surface data the user cannot access); keep secrets out of prompts/context; vet ingested documents.\n8. **Monitoring:** alert on anomalous tool calls, unexpected outbound data, and signs of instruction-override in inputs.\n9. **Test continuously:** red-team with injection payloads (reference OWASP LLM Top 10 and MITRE ATLAS techniques) before and after deploy.\n\n## 6. Verification Steps\n- Injected instructions in retrieved/external content no longer change the agent's behavior in a test.\n- The agent's tool/data scope is minimized; high-impact actions require human confirmation.\n- Model output passing to a downstream system is validated/encoded (a test injection does not execute).\n- RAG retrieval respects per-user permissions (a user cannot retrieve data they are not entitled to).\n- Monitoring fires on a simulated exfil/injection attempt.\n\n## 7. Escalation Trigger\nEscalate to L3 / security IR immediately if an LLM-connected agent with tool or data access shows signs of following injected instructions or exfiltrating data — handle as an active security incident, not a tuning issue.\n\n## 8. Prevention Tips\n- Assume any content the model reads can carry hidden instructions; never grant a content-reading agent powerful unattended tools.\n- Default to least privilege and least agency; add scope only with justification.\n- Keep secrets and sensitive context out of prompts; enforce authorization at the retrieval layer.\n- Validate all model output before downstream use.\n- Reference OWASP LLM Top 10 and MITRE ATLAS as living threat checklists; red-team regularly.\n\n## 9. User-Friendly Explanation\nPrompt injection is when text that an AI reads — a web page, an email, a document — secretly tells it to do something it should not, like leaking data or taking an unwanted action. Because the AI can be tricked by what it reads, the fixes are: do not give a reading AI dangerous powers, keep a human in the loop for risky actions, check anything the AI outputs before using it, and make sure it can only see data the person asking is allowed to see. It is the AI equivalent of \"do not blindly follow instructions a stranger slipped into your inbox.\"\n\n## 10. Internal Technician Notes\n- OWASP LLM Top 10 and MITRE ATLAS are **references** for naming techniques and structuring tests — cite them, do not claim compliance/certification.\n- The highest-leverage control is reducing *agency*: a content-reading agent with no powerful tools cannot be weaponized into action.\n- Indirect injection via RAG/retrieved docs is the under-appreciated vector; vet ingested content and isolate retrieval.\n- This frequently becomes an IR event — hand off to t4-aigov-002 for containment, and use the audit trail (t4-aigov-003) to find the triggering input and exfil path.\n- Browser-extension/shadow-AI tools (t4-aigov-006) are common injection surfaces.\n\n## 11. Related KB Articles\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-006 — Shadow-AI Discovery\n- t4-aithreat-002 — AI Voice Phishing (Vishing) & Deepfake Audio\n- t4-aithreat-003 — Deepfake Video / Executive Impersonation\n\n## 12. Keywords / Search Tags\nprompt injection, indirect prompt injection, rag data leakage, OWASP LLM Top 10, MITRE ATLAS, data exfiltration, untrusted content, tool abuse, llm jailbreak, insecure output handling, least privilege llm, excessive agency"
  },
  {
   "slug": "t4-aithreat-002-ai-vishing-deepfake-voice",
   "path_rel": "knowledge-base\\tier4\\t4-aithreat-002-ai-vishing-deepfake-voice.md",
   "title": "\"AI Voice Phishing (Vishing) & Deepfake Audio\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ai vishing\"",
    "\"voice cloning\"",
    "\"deepfake audio\"",
    "\"wire transfer fraud\"",
    "\"ceo fraud\"",
    "\"credential theft\"",
    "\"caller verification\"",
    "\"out of band verification\"",
    "\"social engineering\"",
    "\"synthetic voice\"",
    "\"phone fraud\"",
    "\"callback protocol\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aithreat-002\ntitle: \"AI Voice Phishing (Vishing) & Deepfake Audio\"\ncategory: ai-security\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-threat\nseverity: critical\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ai vishing\",\"voice cloning\",\"deepfake audio\",\"wire transfer fraud\",\"ceo fraud\",\"credential theft\",\"caller verification\",\"out of band verification\",\"social engineering\",\"synthetic voice\",\"phone fraud\",\"callback protocol\"]\nrelated_articles: [\"t4-aithreat-001\",\"t4-aithreat-003\",\"t4-aigov-006\"]\nescalation_trigger: \"A caller using a recognized voice requests an urgent wire transfer, credential reset, or MFA bypass that cannot be verified out-of-band.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A phone call or voicemail uses the recognizable voice of an executive, colleague, vendor, or family member to push an urgent request.\n- The request is high-stakes and time-pressured: wire a payment, change banking details, reset a password, read out an MFA code, or grant access.\n- The voice is convincing but the *channel* is unusual (unexpected number, \"I'm in a meeting, can't video\").\n- The caller resists verification, discourages callbacks, and stresses secrecy/urgency.\n- Finance or helpdesk reports a \"the CEO called and told me to...\" situation.\n\n## 2. Likely Causes\n- **Voice cloning:** attackers synthesize a target's voice from short public audio (calls, videos, social media) to impersonate them.\n- **Social engineering:** urgency + authority + secrecy short-circuits normal checks.\n- **Targeted intelligence:** attackers research org structure, vendors, and pending payments to make the pretext believable.\n- **Helpdesk/MFA targeting:** vishing aimed at resetting credentials or bypassing MFA to gain access.\n\n## 3. Questions To Ask User\n- What exactly was requested, and how urgent/secret did the caller insist it be?\n- What number did the call come from, and was it the expected channel for this person?\n- Did the caller avoid or resist a callback to a known number, or avoid video?\n- Has any action been taken yet (payment sent, credentials reset, code shared)?\n- Are there pending payments or vendor changes an attacker could have known about?\n\n## 4. Troubleshooting Steps\n1. **Do not act on the call's instructions** until identity is verified out-of-band.\n2. **Note red flags:** urgency, secrecy, unusual channel, pressure against verification, request type (money/credentials/access).\n3. **Check whether action already occurred.** If a payment was sent or credentials/MFA shared, pivot to incident response immediately.\n4. **Verify out-of-band:** independently reach the supposed caller via a *known* number/channel — not one the caller provided.\n\n## 5. Resolution Steps\n1. **If nothing has happened yet:** halt the request, verify out-of-band, and only proceed once identity is independently confirmed.\n2. **Callback verification:** hang up and call back on a number from your own directory/records, never a number the caller supplied.\n3. **Use a verification challenge:** a pre-agreed code word/passphrase or a question only the real person can answer (and that is not findable online).\n4. **Enforce dual-control for money/credentials:** any wire, banking-detail change, credential reset, or MFA bypass requires a second approver and out-of-band confirmation — no single-call authorization.\n5. **If action already taken (fraud in progress):**\n   - For wires: contact the bank immediately to recall/freeze; time is critical.\n   - For credentials/MFA: treat as account compromise — reset, revoke sessions/tokens, investigate access.\n   - Engage security IR and management.\n6. **Report:** preserve the voicemail/call details and report internally (and to relevant authorities/bank as appropriate).\n\n## 6. Verification Steps\n- The request was independently confirmed via a known, attacker-independent channel before any action.\n- Dual-control was applied to any financial/credential request.\n- If fraud occurred, the bank/account-recovery and IR processes were engaged without delay.\n- Staff can describe the callback protocol and the code-word challenge.\n- The incident is documented and reported per policy.\n\n## 7. Escalation Trigger\nEscalate to L3 / security and finance leadership immediately if a caller using a recognized voice requests an urgent wire transfer, banking change, credential reset, or MFA bypass that cannot be verified out-of-band — and treat any completed action as active fraud/account compromise.\n\n## 8. Prevention Tips\n- Train staff that a familiar voice is **not** proof of identity — voices can be cloned.\n- Mandate out-of-band callback verification and dual-control for all money/credential/access requests.\n- Establish family/exec/vendor **code words** for high-risk verbal requests.\n- Limit what executives' voices and details are exposed publicly where feasible.\n- Harden helpdesk identity-verification so vishing cannot drive credential/MFA resets.\n- Run simulated vishing drills.\n\n## 9. User-Friendly Explanation\nCriminals can now copy someone's voice from a few seconds of audio and call you sounding exactly like your boss or a vendor, demanding an urgent payment or password. The voice is fake even though it sounds real. The defense is simple: never act on an urgent voice request without checking through a separate channel you trust — hang up and call the person back on their known number, or use a pre-agreed code word. Real, legitimate requests will survive a quick verification; scams fall apart under it.\n\n## 10. Internal Technician Notes\n- The core control is procedural, not technical: out-of-band callback + dual-control beats any \"does it sound real?\" judgment.\n- Code-word/passphrase challenges are highly effective and cheap; push clients to adopt them for finance and exec comms.\n- Caller ID can be spoofed; the callback must use a number *you* hold, never one offered on the call.\n- Detection tools for synthetic audio exist but are not reliable enough to be the primary control — rely on process.\n- Completed wire fraud is time-critical: bank recall windows are short. For credential/MFA compromise, coordinate with t4-aithreat-001 (access abuse) and IR.\n\n## 11. Related KB Articles\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n- t4-aithreat-003 — Deepfake Video / Executive Impersonation\n- t4-aigov-006 — Shadow-AI Discovery\n\n## 12. Keywords / Search Tags\nai vishing, voice cloning, deepfake audio, wire transfer fraud, ceo fraud, credential theft, caller verification, out-of-band verification, social engineering, synthetic voice, callback protocol, code word challenge"
  },
  {
   "slug": "t4-aithreat-003-deepfake-video-impersonation",
   "path_rel": "knowledge-base\\tier4\\t4-aithreat-003-deepfake-video-impersonation.md",
   "title": "\"Deepfake Video / Executive Impersonation (BEC 2.0)\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"deepfake video\"",
    "\"executive impersonation\"",
    "\"fake video call\"",
    "\"bec 2.0\"",
    "\"business email compromise\"",
    "\"callback verification protocol\"",
    "\"out of band verification\"",
    "\"synthetic media\"",
    "\"video conference fraud\"",
    "\"liveness check\"",
    "\"ceo deepfake\"",
    "\"high risk request verification\""
   ],
   "compliance": [],
   "content": "---\nid: t4-aithreat-003\ntitle: \"Deepfake Video / Executive Impersonation (BEC 2.0)\"\ncategory: ai-security\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: ai-threat\nseverity: critical\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"deepfake video\",\"executive impersonation\",\"fake video call\",\"bec 2.0\",\"business email compromise\",\"callback verification protocol\",\"out of band verification\",\"synthetic media\",\"video conference fraud\",\"liveness check\",\"ceo deepfake\",\"high risk request verification\"]\nrelated_articles: [\"t4-aithreat-001\",\"t4-aithreat-002\",\"t4-aigov-006\"]\nescalation_trigger: \"A video call or recording of an executive directs an urgent payment, sensitive disclosure, or access change that cannot be verified out-of-band.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A live video call or recorded clip appears to show an executive/colleague directing an urgent, sensitive action (payment, data disclosure, access grant).\n- The \"executive\" on a video meeting pressures staff to act now and discourages independent verification.\n- Subtle visual oddities: unnatural blinking, lip-sync mismatch, lighting/edge artifacts around the face, stiff or looping movement, audio that does not quite match mouth movements.\n- The meeting was set up through an unusual channel or invites participants who would not normally be together.\n- Finance/staff report \"I was on a video call with the CEO and they told me to...\" — a BEC-style scenario with video added.\n\n## 2. Likely Causes\n- **Deepfake video synthesis:** attackers generate or real-time-render a convincing video likeness of a trusted person.\n- **BEC 2.0:** classic business email compromise upgraded with synthetic voice/video to defeat \"but I saw/heard them\" skepticism.\n- **Authority + urgency + secrecy:** social-engineering pressure that suppresses verification.\n- **Reconnaissance:** attackers use public video/audio and org knowledge to build a believable impersonation and pretext.\n\n## 3. Questions To Ask User\n- What was requested on the call, and how urgent/confidential was it framed?\n- How was the meeting initiated, and through what platform/invite?\n- Did you notice visual/audio anomalies (lip-sync, blinking, artifacts, lag)?\n- Did the \"executive\" resist any verification, callback, or simple liveness check?\n- Has any action been taken yet (payment, disclosure, access change)?\n\n## 4. Troubleshooting Steps\n1. **Do not act on the video's instructions** until identity is confirmed out-of-band.\n2. **Look for detection cues:** lip-sync drift, irregular blinking, facial-edge/lighting artifacts, unnatural head/body motion, audio-video desync, evasive responses to spontaneous questions.\n3. **Attempt a live liveness check** (see protocol below) — deepfakes often fail real-time, unscripted interaction.\n4. **Check whether action already occurred;** if so, pivot to incident response/fraud handling immediately.\n\n## 5. Resolution Steps\n\n### Callback-Verification Protocol (out-of-band identity verification for high-risk requests)\nUse this step-by-step procedure whenever a video/voice/message request involves money, credentials, access, or sensitive data:\n\n1. **Pause and decline to act on the spot.** State that policy requires verification for this type of request; a legitimate requester will accept this.\n2. **Do not use any contact details from the call/invite.** Treat caller ID, chat handles, and meeting links as untrusted.\n3. **Independently look up the person** in your own trusted directory (HR/IT system), not from the message.\n4. **Initiate contact yourself** on a *known* channel — call the person's known number or message them through an established internal channel.\n5. **Confirm the request** in that separate channel: \"Did you just ask me on video to wire $X / reset Y / share Z?\"\n6. **Apply a verification challenge:** a pre-agreed code word/passphrase, or a question only the real person can answer that is not discoverable online.\n7. **For high-value/irreversible actions, require dual-control:** a second authorized approver must independently confirm via their own out-of-band check before execution.\n8. **If you cannot reach the person or verification fails:** do not proceed. Escalate to security/management.\n9. **Document** the request, the cues observed, and the verification outcome.\n\n### If action was already taken (fraud in progress)\n- For payments/wires: contact the bank immediately to recall/freeze — recovery windows are short.\n- For data/access: treat as a breach — revoke access, reset credentials, investigate scope, engage IR.\n- Notify security leadership and follow incident reporting (and authorities/bank as appropriate).\n\n## 6. Verification Steps\n- The request was confirmed (or refused) via an attacker-independent channel before any action.\n- The callback-verification protocol and dual-control were applied to the high-risk request.\n- Staff can recite the protocol steps and the code-word challenge from memory.\n- If fraud occurred, bank recall and IR were engaged without delay and the event is documented.\n\n## 7. Escalation Trigger\nEscalate to L3 / security and the relevant business/finance owner immediately if a video call or recording of an executive directs an urgent payment, sensitive disclosure, or access change that cannot be verified out-of-band — and treat any completed action as active fraud/breach.\n\n## 8. Prevention Tips\n- Train staff that seeing/hearing a familiar face or voice on video is **not** proof of identity — video can be faked.\n- Make the callback-verification protocol and dual-control mandatory for all money/credential/access/data requests, regardless of who appears to ask.\n- Establish executive/finance **code words** for verbal/video authorization.\n- Encourage spontaneous liveness checks on suspicious calls (ask the person to do something unscripted).\n- Reduce unnecessary public exposure of executive video/audio where feasible.\n- Run BEC 2.0 / deepfake simulation drills so the protocol is reflexive under pressure.\n\n## 9. User-Friendly Explanation\nAttackers can now fake a video of your boss on a call, telling you to send money or hand over access — and it can look real. Because your eyes and ears can be fooled, the rule is the same as for any high-stakes request: stop, and verify through a separate, trusted channel before you act. Hang up or step away, look the person up yourself, call them on a number you already have, and use a code word. Real requests survive that check; fakes do not.\n\n## 10. Internal Technician Notes\n- The decisive control is the **callback-verification protocol** (section 5) plus dual-control — process beats trying to visually spot a deepfake, since quality keeps improving.\n- Visual cues (lip-sync, blinking, artifacts) are useful early warnings, not reliable proof; never rely on \"it looked fake/real\" as the gate.\n- \"BEC 2.0\" = traditional business email compromise enhanced with synthetic voice/video; the money-movement controls from anti-BEC programs still apply.\n- Pairs directly with t4-aithreat-002 (voice) — same out-of-band/dual-control playbook across channels.\n- Meeting links and invites are untrusted contact paths; verification must originate from the recipient using known directory data.\n\n## 11. Related KB Articles\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n- t4-aithreat-002 — AI Voice Phishing (Vishing) & Deepfake Audio\n- t4-aigov-006 — Shadow-AI Discovery\n\n## 12. Keywords / Search Tags\ndeepfake video, executive impersonation, fake video call, BEC 2.0, business email compromise, callback-verification protocol, out-of-band verification, synthetic media, video conference fraud, liveness check, ceo deepfake, dual control"
  },
  {
   "slug": "t4-endpoint-001-model-drift-auto-update-breakage",
   "path_rel": "knowledge-base\\tier4\\t4-endpoint-001-model-drift-auto-update-breakage.md",
   "title": "\"AI Model Drift & On-Device-AI Auto-Update Breakage\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"model drift\"",
    "\"on-device ai\"",
    "\"auto-update breakage\"",
    "\"model rollback\"",
    "\"model pinning\"",
    "\"ai feature regression\"",
    "\"inference accuracy\"",
    "\"copilot update\"",
    "\"local model version\"",
    "\"ml regression\"",
    "\"model validation\"",
    "\"ai workflow break\""
   ],
   "compliance": [],
   "content": "---\nid: t4-endpoint-001\ntitle: \"AI Model Drift & On-Device-AI Auto-Update Breakage\"\ncategory: endpoint\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: next-gen-endpoint\nseverity: high\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"model drift\",\"on-device ai\",\"auto-update breakage\",\"model rollback\",\"model pinning\",\"ai feature regression\",\"inference accuracy\",\"copilot update\",\"local model version\",\"ml regression\",\"model validation\",\"ai workflow break\"]\nrelated_articles: [\"t4-endpoint-002\",\"t4-endpoint-003\",\"t4-aigov-001\"]\nescalation_trigger: \"A model/AI feature update degrades a business-critical workflow and no supported pin or rollback restores it.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- An on-device or app-embedded AI feature that worked yesterday now gives worse, slower, or incorrect results after an update.\n- A workflow that depended on a specific AI behavior (summarize, classify, autofill, transcribe) breaks or changes format/output shape.\n- Accuracy \"drifts\" gradually over weeks even with no obvious update — outputs slowly diverge from expected.\n- Users report the AI \"got dumber,\" ignores prompts it used to follow, or returns a different schema downstream tooling can't parse.\n- An integration that parsed AI output now fails because the response structure changed.\n\n## 2. Likely Causes\n- **Auto-update of the model or AI runtime:** the vendor pushed a new model version or feature update that changed behavior (a regression for your use case).\n- **Data drift:** the real-world inputs have shifted away from what the model handles well (seasonality, new document types, new terminology) — the model didn't change, the world did.\n- **Concept drift:** the relationship the model learned is now stale (e.g., a category's definition changed).\n- **Runtime/dependency change:** an updated AI runtime, driver, or quantization path subtly alters numeric output.\n- **Prompt/template change** bundled with an app update that altered how the feature is invoked.\n\n## 3. Questions To Ask User\n- What exact task broke, and what does \"worse\" mean — wrong answers, wrong format, slower, or refuses?\n- When did it change, and did the app, OS, or an AI feature update around that time?\n- Is there a known-good example you can compare against (before vs. after output)?\n- Does anything downstream consume the AI output automatically (a parser, script, or integration)?\n- Is the feature cloud-backed, fully on-device, or hybrid?\n\n## 4. Troubleshooting Steps\n1. **Pin down the change window** from update/patch logs: app version, model version, runtime/driver version before and after.\n2. **Reproduce with a fixed test input** (a small golden set) and capture both old-expected and new-actual output.\n3. **Separate drift type:** if no update occurred, suspect data/concept drift; if an update lines up with the regression, suspect an update regression.\n4. **Check the runtime layer** (t4-endpoint-002 for NPU/accelerator changes) — a driver/runtime swap can shift results without a \"model\" update.\n5. **Confirm downstream contract:** if an integration broke, check whether output schema/format changed.\n\n## 5. Resolution Steps\n1. **Pin or defer the update** where the platform supports it: hold the AI feature/model at the last known-good version while you validate the new one (use managed-update controls; do not disable security updates to do this).\n2. **Roll back** to the prior model/app version if a supported rollback path exists and the regression is business-critical.\n3. **Adapt the workflow** when rollback isn't possible: update prompts/templates and any downstream parser to the new output contract.\n4. **Re-anchor expectations** for data/concept drift: refresh examples, adjust the prompt, or request a re-tuned/updated model from the vendor.\n5. **Stage and validate** future AI updates in a test ring before broad rollout (treat AI updates like any other change).\n6. **Document the known-good versions** (app + model + runtime) so the configuration is reproducible.\n\n## 6. Verification Steps\n- The golden test set produces acceptable output again (rollback/pin) or the workflow + parser handle the new output (adapt).\n- The pinned/known-good versions are recorded and enforced via your update-management tooling.\n- Downstream integrations parse current AI output without error.\n- A staging ring is in place so the next AI update is validated before production.\n\n## 7. Escalation Trigger\nEscalate to L3 / vendor when a model or AI-feature update degrades a business-critical workflow and no supported pin or rollback restores acceptable behavior, or when the regression appears to be a vendor-side model change you cannot control locally.\n\n## 8. Prevention Tips\n- Treat AI model/feature updates as changes: stage them in a test ring with a golden test set before broad deployment.\n- Maintain a recorded known-good baseline (app + model + runtime versions).\n- Build downstream integrations defensively — validate AI output shape rather than assuming it.\n- Monitor output quality over time so gradual drift is caught early, not after a failure.\n\n## 9. User-Friendly Explanation\nAI features get updated automatically, and sometimes an update makes the AI behave differently than before — even worse for a specific task you rely on. Separately, AI can slowly \"drift\" as the kinds of documents or requests it sees change over time. The fix is to identify what changed, hold the AI at a version that worked while we test the new one, and adjust the steps around it if needed. It's like a software update that changed a button you depended on — we either revert it or teach the workflow the new way.\n\n## 10. Internal Technician Notes\n- Distinguish **update regression** (a version change) from **data/concept drift** (world changed, model didn't) — the fixes differ.\n- Pinning ≠ blocking security updates. Use managed AI-feature/version controls; never freeze the whole device's patching to pin a model.\n- A runtime/driver/quantization change (t4-endpoint-002) can move numeric output without any \"model\" version bump — check that layer.\n- Keep a golden test set per AI-dependent workflow; it's the only objective drift detector.\n- Tie governance/change-control expectations to t4-aigov-001.\n\n## 11. Related KB Articles\n- t4-endpoint-002 — On-Device NPU (Copilot+/AI PC) Issues\n- t4-endpoint-003 — Self-Healing Endpoint → Human Escalation\n- t4-aigov-001 — AI Agent Governance Framework\n\n## 12. Keywords / Search Tags\nmodel drift, data drift, concept drift, on-device AI, auto-update breakage, model rollback, model pinning, AI feature regression, inference accuracy, golden test set, output contract, staged AI updates"
  },
  {
   "slug": "t4-endpoint-002-on-device-npu-issues",
   "path_rel": "knowledge-base\\tier4\\t4-endpoint-002-on-device-npu-issues.md",
   "title": "\"On-Device NPU (Copilot+/AI PC) Issues\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"npu\"",
    "\"neural processing unit\"",
    "\"copilot plus pc\"",
    "\"ai pc\"",
    "\"onnx runtime\"",
    "\"ai accelerator\"",
    "\"npu driver\"",
    "\"directml\"",
    "\"apple neural engine\"",
    "\"thermal throttling\"",
    "\"on-device inference\"",
    "\"ai feature not using npu\""
   ],
   "compliance": [],
   "content": "---\nid: t4-endpoint-002\ntitle: \"On-Device NPU (Copilot+/AI PC) Issues\"\ncategory: endpoint\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: next-gen-endpoint\nseverity: medium\nestimated_time_minutes: 50\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"npu\",\"neural processing unit\",\"copilot plus pc\",\"ai pc\",\"onnx runtime\",\"ai accelerator\",\"npu driver\",\"directml\",\"apple neural engine\",\"thermal throttling\",\"on-device inference\",\"ai feature not using npu\"]\nrelated_articles: [\"t4-endpoint-001\",\"t4-endpoint-004\",\"t4-endpoint-003\"]\nescalation_trigger: \"An NPU fault persists after driver/runtime reinstall and the device cannot run required on-device AI features.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- An AI feature that should accelerate on the NPU is slow, falls back to CPU/GPU, or fails to start.\n- Device Manager / system info shows the NPU missing, with a warning, or an outdated driver.\n- High CPU usage and fan noise during AI tasks that \"should\" be efficient on the NPU.\n- An app reports it can't find a supported AI accelerator or a runtime (e.g., ONNX Runtime) error.\n- Battery drains quickly or the device throttles during sustained AI workloads.\n\n## 2. Likely Causes\n- **Missing or outdated NPU driver** (the dedicated neural-processing-unit driver, distinct from the GPU driver).\n- **AI runtime not installed/registered** (e.g., ONNX Runtime / DirectML execution provider on Windows; the on-device ML runtime on macOS).\n- **App not configured to target the NPU** — it defaults to CPU/GPU, or the model isn't in an NPU-compatible format.\n- **Power/thermal limits:** a thermal or power-saver state throttles the accelerator; sustained loads heat-soak the device.\n- **Unsupported hardware/feature combination** — the feature requires an AI-PC-class NPU the device doesn't have, or a minimum OS build.\n\n## 3. Questions To Ask User\n- What feature/app is affected, and does it explicitly require the NPU/AI accelerator?\n- Is this a Copilot+ / AI-PC-class machine (or Apple-silicon Mac with a Neural Engine)?\n- Does the problem happen on battery only, or also plugged in (suggests power/thermal)?\n- When did it start — after a Windows/macOS update or a driver update?\n- Any error code or \"no accelerator found\" message from the app?\n\n## 4. Troubleshooting Steps\n1. **Confirm the hardware** actually has an NPU and the OS build meets the feature's minimum requirement.\n2. **Check the NPU driver** in Device Manager (Windows) / system report (macOS): present, enabled, current version, no error.\n3. **Verify the AI runtime** the app uses is installed and registered (e.g., ONNX Runtime / execution provider). Capture any runtime error text.\n4. **Test power/thermal:** repeat on AC power and in a cool state; watch whether performance recovers (points to throttling).\n5. **Check app settings** for an accelerator/device selection (NPU vs CPU vs GPU) and whether the model is in a supported format.\n\n## 5. Resolution Steps\n1. **Update the NPU driver** from the OEM/silicon vendor channel (not just generic GPU drivers); on Windows pull via the managed update channel, on macOS via OS update.\n2. **Install/repair the AI runtime** and its NPU execution provider; re-register if the app reports it missing.\n3. **Point the app at the NPU** in its settings if it defaulted to CPU/GPU; ensure the model is in an NPU-supported format/precision.\n4. **Address thermal/power:** set the device to a balanced/performance power mode for sustained AI work, ensure ventilation, and update firmware/BIOS if a thermal fix is published.\n5. **Roll back a bad driver/runtime** if the fault began right after an update, then pin to the known-good version.\n6. **Reboot** after driver/runtime changes so the accelerator re-initializes.\n\n## 6. Verification Steps\n- The NPU shows healthy in Device Manager / system report with a current driver.\n- The target AI feature runs and the app reports it is using the NPU/accelerator (not CPU fallback).\n- CPU usage and fan noise drop during the AI task vs. the failing state.\n- Performance holds on battery and AC (no thermal cliff), or the throttling cause is documented.\n\n## 7. Escalation Trigger\nEscalate to L3 / OEM when an NPU fault persists after driver and runtime reinstall, the hardware is confirmed capable but the OS won't enumerate the accelerator, or a firmware-level thermal/power fault blocks required on-device AI features.\n\n## 8. Prevention Tips\n- Keep NPU drivers and AI runtimes on the OEM/managed update channel; validate them in a test ring (ties to t4-endpoint-001).\n- Confirm device + OS build meet AI-feature minimums before promising NPU-accelerated workflows.\n- Record known-good driver/runtime versions per device model.\n- Ensure adequate cooling and an appropriate power profile for sustained on-device inference.\n\n## 9. User-Friendly Explanation\nNewer \"AI PCs\" have a special chip called an NPU that runs AI features quickly and efficiently. If its driver is missing or outdated, or the app isn't told to use it, the work falls back to the regular processor — making things slow, hot, and battery-hungry. We update the NPU's driver and the AI runtime, point the app at the NPU, and make sure the device isn't overheating or in a power-saving mode that holds it back.\n\n## 10. Internal Technician Notes\n- The NPU driver is a **separate** component from the GPU driver — updating the GPU does not update the NPU.\n- \"Works but slow\" usually means CPU/GPU fallback; confirm the app is genuinely on the NPU, not just running.\n- ONNX Runtime / DirectML execution providers (Windows) and the Apple Neural Engine path (macOS) are the common runtime layers — name them as references, don't claim certification.\n- Runtime/quantization changes here can shift AI output, which surfaces as drift in t4-endpoint-001.\n- Sustained inference is a thermal workload — heat-soak throttling masquerades as a \"driver\" problem.\n\n## 11. Related KB Articles\n- t4-endpoint-001 — AI Model Drift & On-Device-AI Auto-Update Breakage\n- t4-endpoint-004 — Local-LLM / On-Prem GPU Build-Out\n- t4-endpoint-003 — Self-Healing Endpoint → Human Escalation\n\n## 12. Keywords / Search Tags\nNPU, neural processing unit, Copilot+ PC, AI PC, ONNX Runtime, DirectML, Apple Neural Engine, AI accelerator, NPU driver, CPU fallback, thermal throttling, on-device inference"
  },
  {
   "slug": "t4-endpoint-003-self-healing-endpoint-escalation",
   "path_rel": "knowledge-base\\tier4\\t4-endpoint-003-self-healing-endpoint-escalation.md",
   "title": "\"Self-Healing Endpoint → Human Escalation\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"self-healing endpoint\"",
    "\"autonomous remediation\"",
    "\"agent handoff\"",
    "\"human escalation\"",
    "\"aria sentinel\"",
    "\"remediation rollback\"",
    "\"audit handoff\"",
    "\"restore context\"",
    "\"change record\"",
    "\"fail-safe\"",
    "\"autonomy guardrail\"",
    "\"escalation packet\""
   ],
   "compliance": [],
   "content": "---\nid: t4-endpoint-003\ntitle: \"Self-Healing Endpoint → Human Escalation\"\ncategory: endpoint\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: next-gen-endpoint\nseverity: high\nestimated_time_minutes: 45\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"self-healing endpoint\",\"autonomous remediation\",\"agent handoff\",\"human escalation\",\"aria sentinel\",\"remediation rollback\",\"audit handoff\",\"restore context\",\"change record\",\"fail-safe\",\"autonomy guardrail\",\"escalation packet\"]\nrelated_articles: [\"t4-endpoint-001\",\"t4-aigov-002\",\"t4-aigov-003\"]\nescalation_trigger: \"An autonomous remediation agent exhausts its safe actions or hits a guardrail and a human must take over with full context.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A self-healing/autonomous agent (e.g., ARIA Sentinel) flags an issue it could not resolve and requests a human.\n- An automated remediation looped, partially applied a fix, or stopped at a guardrail/confirmation gate.\n- A device is in a half-remediated state and a technician must finish or reverse the action safely.\n- The agent reports \"unknown state,\" low confidence, or repeated failed attempts.\n- An action requiring approval (high-impact tool) is queued pending a human decision.\n\n## 2. Likely Causes\n- **Out-of-scope problem:** the issue exceeds the agent's playbook or permitted actions.\n- **Guardrail hit:** the action is high-impact (data loss, reboot during work, config change) and policy requires human-in-the-loop.\n- **Low confidence / ambiguity:** the agent can't determine the correct fix with acceptable certainty.\n- **Repeated remediation failure:** the same fix applied and the symptom returned (loop), so the agent backed off by design.\n- **Dependency/environmental blocker** the agent can't touch (hardware, network, credentialed system).\n\n## 3. Questions To Ask User (and the Agent's Record)\n- What did the agent attempt, in what order, and what was the outcome of each step?\n- What state is the device in *now* vs. before remediation began (what changed)?\n- Did any partial change apply that may need reversing?\n- What guardrail or confidence threshold triggered the handoff?\n- Is the user blocked right now, and is the device safe to leave as-is?\n\n## 4. Troubleshooting Steps\n1. **Open the escalation packet / audit trail** (t4-aigov-003): pull the full action log, before/after state, and the restore/rollback context the agent captured.\n2. **Confirm current device state** independently — don't assume the agent's last-known state is still accurate.\n3. **Identify partial changes** that applied and whether they're safe to keep or must be reversed.\n4. **Determine the trigger** for the handoff (scope, guardrail, low confidence, loop) to know what the human must add.\n5. **Verify the restore point** (snapshot/backup/known-good config) exists before taking further action.\n\n## 5. Resolution Steps\n1. **Stabilize first:** if the device is in an unsafe/half-remediated state, restore to the captured known-good point before continuing.\n2. **Take a clean handoff:** the human assumes the action with the agent's full context (what was tried, why it stopped, the restore path).\n3. **Complete or reverse** the remediation manually, recording each step back into the same audit trail so the record stays continuous.\n4. **Resolve the root cause** the agent couldn't reach (out-of-scope dependency, ambiguous fault) using standard L3 procedures.\n5. **Close the loop with the agent:** mark the incident resolved, and if the case is now a known pattern, feed it back so the playbook can safely handle it next time (governance review, not silent auto-expansion of scope).\n6. **Re-enable autonomy** only after confirming the device is healthy and the guardrail logic behaved correctly.\n\n## 6. Verification Steps\n- The device is in a known-good, stable state (verified independently, not just per the agent).\n- Every human action is recorded in the continuous audit trail alongside the agent's actions.\n- Any partial/erroneous change is confirmed kept-or-reversed deliberately.\n- The handoff context (what/why/restore path) was complete enough to act on — gaps noted for improvement.\n- Autonomy is safely re-enabled or deliberately left paused with a reason.\n\n## 7. Escalation Trigger\nThis article *is* the escalation path. Escalate further (vendor/engineering) if the agent's guardrail or rollback behaved incorrectly (e.g., it left the device unsafe, lost restore context, or looped destructively) — that's an agent-defect/IR concern, route to t4-aigov-002.\n\n## 8. Prevention Tips\n- Require autonomous agents to capture before/after state and a restore path *before* acting — handoffs are only as good as that context.\n- Keep human-in-the-loop guardrails on high-impact actions; tune thresholds, don't remove them.\n- Maintain a continuous audit trail spanning both agent and human actions.\n- Review recurring handoffs to safely (and via governance) extend playbooks — never let an agent silently widen its own scope.\n\n## 9. User-Friendly Explanation\nSome endpoint problems are fixed automatically by an AI agent. When the agent isn't sure, hits a safety rule, or can't fix something, it stops and hands the job to a human — on purpose. The technician gets the full story of what the agent tried and how to undo it, makes sure the computer is in a safe state, finishes the fix, and writes down everything so there's one clean record. The handoff is a safety feature, not a failure.\n\n## 10. Internal Technician Notes\n- A clean handoff depends entirely on the agent capturing **before/after state + restore path** pre-action — verify this exists; if missing, that's a defect.\n- Never trust the agent's \"last known state\" blindly; re-check the device.\n- Keep agent and human actions in *one* continuous audit trail (t4-aigov-003) or root-cause/forensics breaks.\n- Recurring handoffs = playbook gap. Extend scope through governance review (t4-aigov-001), never by quietly granting the agent more agency.\n- Humans-first/fail-safe principle: if in doubt, restore to known-good before doing anything else.\n\n## 11. Related KB Articles\n- t4-endpoint-001 — AI Model Drift & On-Device-AI Auto-Update Breakage\n- t4-aigov-002 — AI Agent Incident Response Runbook\n- t4-aigov-003 — AI Agent Audit Trail\n\n## 12. Keywords / Search Tags\nself-healing endpoint, autonomous remediation, agent handoff, human escalation, ARIA Sentinel, remediation rollback, restore context, audit handoff, guardrail, fail-safe, escalation packet, known-good state"
  },
  {
   "slug": "t4-endpoint-004-local-llm-gpu-buildout",
   "path_rel": "knowledge-base\\tier4\\t4-endpoint-004-local-llm-gpu-buildout.md",
   "title": "\"Local-LLM / On-Prem GPU Build-Out\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"local llm\"",
    "\"on-prem gpu\"",
    "\"vram sizing\"",
    "\"quantization\"",
    "\"inference server\"",
    "\"gpu drivers\"",
    "\"cuda\"",
    "\"data privacy\"",
    "\"model serving\"",
    "\"context length\"",
    "\"gpu out of memory\"",
    "\"self-hosted ai\""
   ],
   "compliance": [],
   "content": "---\nid: t4-endpoint-004\ntitle: \"Local-LLM / On-Prem GPU Build-Out\"\ncategory: endpoint\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: next-gen-endpoint\nseverity: high\nestimated_time_minutes: 120\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"local llm\",\"on-prem gpu\",\"vram sizing\",\"quantization\",\"inference server\",\"gpu drivers\",\"cuda\",\"data privacy\",\"model serving\",\"context length\",\"gpu out of memory\",\"self-hosted ai\"]\nrelated_articles: [\"t4-endpoint-002\",\"t4-endpoint-001\",\"t4-aigov-004\"]\nescalation_trigger: \"A planned local-LLM deployment cannot meet performance, VRAM, or data-residency requirements within the available hardware budget.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A team wants to run an LLM on-premises (data-privacy/residency reasons) and needs sizing/build guidance.\n- A local model fails to load with out-of-memory (OOM) errors or runs unusably slowly.\n- Inference latency is too high, or concurrency collapses under multiple users.\n- GPU not detected by the inference runtime, or driver/toolkit version mismatch errors.\n- Output quality is poor after aggressive quantization, or context-length limits truncate inputs.\n\n## 2. Likely Causes\n- **Insufficient VRAM** for the chosen model size + precision + context length + concurrency.\n- **Quantization mismatch:** too-aggressive quantization hurts quality; or the chosen format isn't supported by the runtime/GPU.\n- **Driver/toolkit mismatch:** GPU driver and the GPU compute toolkit (CUDA on NVIDIA, or the equivalent on other vendors) versions don't align with the inference server.\n- **Serving misconfiguration:** no batching/concurrency tuning, wrong context window, single-request blocking.\n- **Under-sized plan:** hardware budget can't meet the performance + privacy requirement simultaneously.\n\n## 3. Questions To Ask User\n- Why local rather than cloud — data privacy, residency, latency, cost, or offline operation? (This sets the constraints.)\n- What model size/class and what context length do you need, and for how many concurrent users?\n- What's the acceptable latency (interactive chat vs. batch processing)?\n- What GPU(s)/VRAM is available or budgeted, and what OS/runtime?\n- What data sensitivity applies (does it have to never leave the building)?\n\n## 4. Troubleshooting / Planning Steps\n1. **Establish the privacy/residency requirement first** — it's usually the reason for on-prem and dictates that nothing egresses.\n2. **Estimate VRAM need:** model parameter count × bytes-per-parameter (precision) + KV-cache for the context length × concurrency, plus headroom. Bigger context and more concurrent users cost VRAM fast.\n3. **Pick precision/quantization** to fit VRAM while preserving acceptable quality — validate quality, don't assume.\n4. **Match the stack:** GPU + driver + compute toolkit (CUDA-or-equivalent) + inference server must be a supported, version-aligned set.\n5. **Diagnose OOM/slowness:** check VRAM headroom, batch/concurrency settings, context length, and whether the model fell back to CPU.\n\n## 5. Resolution / Build Steps\n1. **Size the hardware** to the workload: enough VRAM for model + KV-cache + concurrency + headroom; multi-GPU or model sharding if a single card can't hold it.\n2. **Install aligned drivers + compute toolkit** for the GPU vendor, matched to the inference server's requirements; pin known-good versions.\n3. **Choose serving + quantization** that fits VRAM and meets quality: validate quantized output against a golden test set before rollout (ties to t4-endpoint-001 drift practice).\n4. **Tune the inference server:** set context length deliberately, enable batching/concurrency appropriate to the GPU, cap max tokens.\n5. **Lock down data flow:** no outbound egress for the model/runtime; keep prompts/outputs on-prem; control access to the endpoint.\n6. **Plan capacity + cost:** size for peak concurrency, set spend/utilization expectations (ties to t4-aigov-004), and document the reproducible build.\n\n## 6. Verification Steps\n- The chosen model loads within VRAM with headroom (no OOM) at the target context length and concurrency.\n- Latency and throughput meet the agreed target under a realistic concurrent load test.\n- Quantized output quality passes the golden test set.\n- Driver + toolkit + server versions are aligned, pinned, and documented.\n- Data-flow verification confirms no egress; access to the inference endpoint is controlled.\n\n## 7. Escalation Trigger\nEscalate to L3 architecture / vendor when the privacy/performance/context requirements cannot be met within the hardware budget (the plan is infeasible as scoped), when multi-GPU sharding is required beyond local expertise, or when quantization can't hit acceptable quality at the available VRAM.\n\n## 8. Prevention Tips\n- Start from requirements (privacy, latency, concurrency, context) and size hardware to them — don't buy a GPU first and hope.\n- Always budget VRAM for KV-cache and concurrency, not just model weights.\n- Validate quantized quality with a golden test set before committing.\n- Pin driver/toolkit/server versions; treat upgrades as staged changes (t4-endpoint-001).\n- Confirm and document the no-egress data path — it's usually the whole reason for going local.\n\n## 9. User-Friendly Explanation\nRunning an AI model on your own hardware keeps your data in-house instead of sending it to a cloud service. To do it well, the GPU needs enough memory to hold the model plus room for the conversation, the drivers and serving software must match, and we sometimes \"compress\" (quantize) the model to fit — while checking it still answers well. We size the machine to how many people will use it and how fast it must respond, and we make sure none of the data leaves the building.\n\n## 10. Internal Technician Notes\n- VRAM math: weights (params × precision-bytes) **plus** KV-cache (scales with context length × concurrency) — the cache is what surprises people into OOM.\n- Compute toolkit is vendor-specific (CUDA on NVIDIA; ROCm or other equivalents elsewhere) — keep it generic in customer docs; cite as reference.\n- Aggressive quantization is a quality/VRAM tradeoff — always validate, never assume \"good enough.\"\n- Privacy/residency is typically the *reason* for on-prem; verify true no-egress (the runtime, telemetry, and any auto-update path).\n- Cost/utilization governance ties to t4-aigov-004; drift/version discipline ties to t4-endpoint-001.\n\n## 11. Related KB Articles\n- t4-endpoint-002 — On-Device NPU (Copilot+/AI PC) Issues\n- t4-endpoint-001 — AI Model Drift & On-Device-AI Auto-Update Breakage\n- t4-aigov-004 — AI Spend Guardrails\n\n## 12. Keywords / Search Tags\nlocal LLM, on-prem GPU, VRAM sizing, KV-cache, quantization, inference server, model serving, GPU drivers, CUDA, compute toolkit, data privacy, out of memory, context length, self-hosted AI"
  },
  {
   "slug": "t4-frontier-001-pqc-quantum-safe-migration",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-001-pqc-quantum-safe-migration.md",
   "title": "\"Post-Quantum Cryptography (PQC) / Quantum-Safe Migration\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"post-quantum cryptography\"",
    "\"pqc\"",
    "\"quantum-safe\"",
    "\"crypto-agility\"",
    "\"ml-kem\"",
    "\"ml-dsa\"",
    "\"nist pqc\"",
    "\"crypto inventory\"",
    "\"key exchange\"",
    "\"hybrid cryptography\"",
    "\"cbom\"",
    "\"tls migration\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-001\ntitle: \"Post-Quantum Cryptography (PQC) / Quantum-Safe Migration\"\ncategory: cryptography\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: high\nestimated_time_minutes: 120\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"post-quantum cryptography\",\"pqc\",\"quantum-safe\",\"crypto-agility\",\"ml-kem\",\"ml-dsa\",\"nist pqc\",\"crypto inventory\",\"key exchange\",\"hybrid cryptography\",\"cbom\",\"tls migration\"]\nrelated_articles: [\"t4-frontier-002\",\"t4-aigov-001\",\"t4-aithreat-001\"]\nescalation_trigger: \"A system uses cryptography that cannot be inventoried or upgraded, blocking a quantum-safe migration plan.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- Leadership/compliance asks \"are we quantum-safe?\" or requests a PQC readiness assessment.\n- An audit or customer questionnaire asks which cryptographic algorithms protect data and key exchange.\n- A vendor announces PQC support and you need to know whether/how to adopt it.\n- Long-lived sensitive data exists that must stay confidential for many years (raises future-decryption risk — see t4-frontier-002).\n- No one can produce a list of where cryptography is used across the estate.\n\n## 2. Likely Causes / Drivers\n- **Quantum-computing threat horizon:** a future large-scale quantum computer could break today's widely used public-key algorithms (RSA, ECC) used for key exchange and signatures.\n- **Standards maturity:** NIST has published PQC standards (referenced here as ML-KEM for key encapsulation and ML-DSA for signatures, among others) that vendors are beginning to support.\n- **Lack of crypto-agility:** systems hard-code algorithms, making future swaps difficult.\n- **No crypto inventory:** the organization doesn't know where and how cryptography is used.\n- **Long data lifetimes:** data that must remain secret beyond the quantum horizon is at risk now.\n\n## 3. Questions To Ask User\n- What data must remain confidential, and for how many years? (Long lifetimes raise urgency.)\n- Do you have any inventory of where cryptography is used (TLS, VPNs, code signing, storage, PKI)?\n- Are there compliance/customer drivers requiring a PQC roadmap?\n- How agile are your systems — can algorithms be swapped via config, or are they hard-coded?\n- Which vendors/products are in scope, and do any already offer PQC or hybrid modes?\n\n## 4. Assessment Steps\n1. **Build a cryptographic inventory (CBOM-style):** enumerate where crypto is used — TLS endpoints, VPNs, PKI/certificates, code signing, data-at-rest encryption, key stores, embedded/IoT, third-party services.\n2. **Classify by risk:** algorithm type (quantum-vulnerable public-key vs. symmetric), data sensitivity, and data lifetime.\n3. **Assess crypto-agility:** can each system change algorithms via configuration/update, or is it fixed?\n4. **Map dependencies:** identify systems you don't control (SaaS, vendor appliances) and their PQC roadmaps.\n5. **Prioritize:** long-lived, high-sensitivity, externally-exposed key exchange first (this links directly to harvest-now/decrypt-later, t4-frontier-002).\n\n## 5. Resolution / Migration-Planning Steps\n1. **Establish crypto-agility as the goal:** the objective is the *ability* to change algorithms safely, not a one-time swap.\n2. **Adopt hybrid where available:** combine a classical and a PQC algorithm so you keep current assurance while gaining quantum resistance — a common transitional pattern.\n3. **Sequence the migration:** start with high-risk/long-lived data and external key exchange; coordinate PKI, TLS, VPN, and code-signing updates.\n4. **Engage vendors:** require PQC/hybrid roadmaps from key suppliers; track support as it ships.\n5. **Test thoroughly:** PQC algorithms have larger keys/signatures — validate performance, certificate sizes, MTU/handshake impacts, and interoperability before broad rollout.\n6. **Keep symmetric crypto strong:** ensure adequate symmetric key sizes (these are far less affected) as a stopgap and ongoing baseline.\n7. **Document a roadmap** with milestones; treat as readiness/advisory work, not a compliance certification.\n\n## 6. Verification Steps\n- A crypto inventory exists and is maintained, with risk classification and data-lifetime tagging.\n- High-risk systems have a sequenced migration plan with owners and milestones.\n- Where adopted, hybrid/PQC modes are tested for interoperability and performance before production.\n- Vendor PQC roadmaps are tracked for systems you don't directly control.\n- The organization can change a cryptographic algorithm via a defined process (crypto-agility demonstrated).\n\n## 7. Escalation Trigger\nEscalate to L3 / security architecture when a system uses cryptography that cannot be inventoried or upgraded (hard-coded, unsupported, or vendor-locked) and therefore blocks the quantum-safe plan, or when high-sensitivity long-lived data has no viable migration path.\n\n## 8. Prevention Tips\n- Design new systems for crypto-agility (algorithm choice in config, not hard-coded).\n- Maintain a living cryptographic inventory as part of asset management.\n- Require PQC/hybrid roadmaps in vendor procurement now.\n- Keep symmetric key sizes robust as an ongoing baseline.\n- Reference NIST PQC standards as the authority; provide advisory/readiness guidance, never \"certified quantum-safe\" claims.\n\n## 9. User-Friendly Explanation\nToday's encryption relies on math that future quantum computers may be able to break — especially the part that exchanges keys and signs things. New \"post-quantum\" algorithms are being standardized to resist that. The first job isn't to rip-and-replace everything; it's to find everywhere we use encryption, figure out what's most at risk (especially data that must stay secret for many years), and make our systems able to switch algorithms smoothly. Then we upgrade the highest-risk pieces first, often running old and new together during the transition.\n\n## 10. Internal Technician Notes\n- The deliverable is **crypto-agility + an inventory + a prioritized roadmap** — this is advisory/readiness, never a compliance certification.\n- Cite NIST PQC standards as references (ML-KEM = key encapsulation, ML-DSA = signatures, among others) — do not assert version-specific \"compliance.\"\n- Public-key algorithms (RSA/ECC) are the quantum-vulnerable ones (key exchange, signatures); symmetric algorithms are far less affected — prioritize accordingly.\n- PQC keys/signatures are larger → test handshake size, certificate bloat, MTU/fragmentation, performance.\n- This is the parent article for t4-frontier-002 (harvest-now/decrypt-later) — prioritization logic lives there.\n\n## 11. Related KB Articles\n- t4-frontier-002 — \"Harvest-Now, Decrypt-Later\" Risk Playbook\n- t4-aigov-001 — AI Agent Governance Framework\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n\n## 12. Keywords / Search Tags\npost-quantum cryptography, PQC, quantum-safe, crypto-agility, ML-KEM, ML-DSA, NIST PQC, crypto inventory, CBOM, hybrid cryptography, key exchange, TLS migration"
  },
  {
   "slug": "t4-frontier-002-harvest-now-decrypt-later",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-002-harvest-now-decrypt-later.md",
   "title": "\"\\\"Harvest-Now, Decrypt-Later\\\" Risk Playbook\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"harvest now decrypt later\"",
    "\"hndl\"",
    "\"store now decrypt later\"",
    "\"data shelf life\"",
    "\"long-lived secrets\"",
    "\"interim controls\"",
    "\"data classification\"",
    "\"quantum risk\"",
    "\"encrypted capture\"",
    "\"forward secrecy\"",
    "\"data minimization\"",
    "\"mosca theorem\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-002\ntitle: \"\\\"Harvest-Now, Decrypt-Later\\\" Risk Playbook\"\ncategory: cryptography\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: high\nestimated_time_minutes: 75\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"harvest now decrypt later\",\"hndl\",\"store now decrypt later\",\"data shelf life\",\"long-lived secrets\",\"interim controls\",\"data classification\",\"quantum risk\",\"encrypted capture\",\"forward secrecy\",\"data minimization\",\"mosca theorem\"]\nrelated_articles: [\"t4-frontier-001\",\"t4-aigov-003\",\"t4-aithreat-001\"]\nescalation_trigger: \"Long-lived, high-sensitivity data is traversing channels an adversary could capture today and decrypt in the future, with no interim mitigation.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- Concern that encrypted data captured today could be decrypted later once quantum computing matures.\n- A risk review asks \"what data of ours is exposed to future decryption?\"\n- Highly sensitive data with a long confidentiality requirement traverses public networks or is stored long-term.\n- A customer/regulator questionnaire references harvest-now-decrypt-later (HNDL) or store-now-decrypt-later.\n- No prioritization exists for which data to protect first against the quantum horizon.\n\n## 2. Likely Causes / Drivers\n- **Capture-and-wait threat:** an adversary records encrypted traffic/data now, intending to decrypt it after quantum capability arrives.\n- **Long data shelf life:** the data's required confidentiality period extends past the expected arrival of cryptographically relevant quantum computing.\n- **Quantum-vulnerable key exchange** protecting the captured data (RSA/ECC) — see t4-frontier-001.\n- **Excess exposure:** more sensitive data than necessary is transmitted/retained, widening the harvest surface.\n- **No forward secrecy / weak transit protection** making bulk capture more valuable.\n\n## 3. Questions To Ask User\n- What categories of data must remain confidential, and for how many years (data shelf life)?\n- Where does that data travel or rest — public networks, cloud, long-term archives?\n- Who are the plausible adversaries with the patience/resources to harvest and wait?\n- Is any of this data already exposed in transit over quantum-vulnerable key exchange?\n- Could the data be minimized, shortened in retention, or kept off exposed channels?\n\n## 4. Assessment Steps\n1. **Apply the shelf-life test (Mosca-style logic, as a reference):** if (data secrecy lifetime) + (time to migrate) exceeds (time until quantum threat), the data is at risk now.\n2. **Classify and locate** long-lived, high-sensitivity data: IP, legal, health, financial, credentials/keys, government, anything with a multi-year secrecy need.\n3. **Map exposure:** which of that data crosses public/untrusted channels or sits in long-term storage an adversary could exfiltrate.\n4. **Check transit protection:** is forward secrecy in use; is the key exchange quantum-vulnerable.\n5. **Prioritize** the intersection of long lifetime + high sensitivity + current exposure as the top of the queue feeding t4-frontier-001's migration.\n\n## 5. Resolution / Mitigation Steps\n1. **Reduce exposure now (interim controls):** minimize what sensitive data is transmitted/retained, shorten retention, and keep the most sensitive data off exposed channels where possible.\n2. **Strengthen transit today:** ensure forward secrecy and strong configurations so bulk harvested traffic is less useful, and adopt hybrid/PQC key exchange where vendors support it (t4-frontier-001).\n3. **Add layered protection** for long-lived data at rest: strong symmetric encryption (less quantum-affected), access controls, and segregation of the most sensitive archives.\n4. **Prioritize the PQC migration** for the highest-risk data first, driven by the shelf-life analysis.\n5. **Tighten key management:** rotate, protect, and limit lifetime of keys that protect harvest-attractive data.\n6. **Document the risk + plan** as advisory/readiness — quantify which data is at risk and the mitigation timeline; no \"quantum-proof\" claims.\n\n## 6. Verification Steps\n- A prioritized list of harvest-at-risk data exists (long lifetime × high sensitivity × current exposure).\n- Interim controls (minimization, retention reduction, forward secrecy, strong configs) are applied to the top items.\n- The highest-risk data is queued first in the PQC migration roadmap (t4-frontier-001).\n- Symmetric protection and access controls are strengthened for long-lived archives.\n- The risk and mitigation timeline are documented for stakeholders.\n\n## 7. Escalation Trigger\nEscalate to L3 / security architecture when long-lived, high-sensitivity data is traversing channels an adversary could capture today and decrypt in the future and no interim mitigation is feasible, or when the shelf-life analysis shows the migration window has already closed for critical data.\n\n## 8. Prevention Tips\n- Run the shelf-life test on new data flows: if it must stay secret beyond the quantum horizon, design protection now.\n- Minimize and shorten retention of sensitive data — the smallest harvest surface is the cheapest control.\n- Use forward secrecy and strong transit configs everywhere by default.\n- Feed the prioritized at-risk list directly into the PQC migration roadmap.\n- Treat as readiness/advisory; avoid absolute \"future-proof\" claims.\n\n## 9. User-Friendly Explanation\nAttackers can copy your encrypted data today and simply wait until future computers can crack it — that's \"harvest now, decrypt later.\" It only matters for data that still needs to be secret years from now. So we figure out which of your data has a long secret-life, reduce how much of it is exposed, strengthen today's protection, and put that data first in line when we upgrade to quantum-safe encryption. Data that won't be sensitive in a few years isn't worth an attacker's wait.\n\n## 10. Internal Technician Notes\n- The decision tool is the shelf-life inequality (Mosca-style, cite as reference): secrecy-lifetime + migration-time vs. time-to-quantum.\n- This article is the **prioritization engine** that feeds t4-frontier-001's migration sequence.\n- Interim controls (minimization, retention cuts, forward secrecy, strong symmetric crypto) buy time before full PQC is available — emphasize them; they're actionable today.\n- Symmetric encryption is far less quantum-affected — strong symmetric + access control is a meaningful at-rest stopgap.\n- Audit trail / exfil-path awareness ties to t4-aigov-003 and t4-aithreat-001 (data leakage is the harvest vector).\n\n## 11. Related KB Articles\n- t4-frontier-001 — Post-Quantum Cryptography (PQC) / Quantum-Safe Migration\n- t4-aigov-003 — AI Agent Audit Trail\n- t4-aithreat-001 — Prompt Injection & RAG/Data Leakage\n\n## 12. Keywords / Search Tags\nharvest now decrypt later, HNDL, store now decrypt later, data shelf life, Mosca theorem, long-lived secrets, interim controls, data minimization, forward secrecy, quantum risk, data classification, encrypted capture"
  },
  {
   "slug": "t4-frontier-003-private-5g",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-003-private-5g.md",
   "title": "\"Private 5G / Private Cellular for Enterprise\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"private 5g\"",
    "\"private cellular\"",
    "\"private lte\"",
    "\"cbrs\"",
    "\"spectrum\"",
    "\"sim provisioning\"",
    "\"esim\"",
    "\"network slicing\"",
    "\"coverage planning\"",
    "\"wifi vs cellular\"",
    "\"industrial iot\"",
    "\"mobile core\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-003\ntitle: \"Private 5G / Private Cellular for Enterprise\"\ncategory: network\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: medium\nestimated_time_minutes: 90\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"private 5g\",\"private cellular\",\"private lte\",\"cbrs\",\"spectrum\",\"sim provisioning\",\"esim\",\"network slicing\",\"coverage planning\",\"wifi vs cellular\",\"industrial iot\",\"mobile core\"]\nrelated_articles: [\"t4-frontier-004\",\"t4-frontier-007\",\"t4-frontier-001\"]\nescalation_trigger: \"A private cellular deployment cannot achieve required coverage, capacity, or spectrum authorization within site constraints.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A site (warehouse, factory, campus, port) has coverage/reliability needs Wi-Fi struggles to meet and is evaluating private cellular.\n- Devices on a private 5G/LTE network fail to attach, drop sessions, or can't get an IP/data session.\n- Coverage gaps or interference in large/RF-hostile environments (metal, concrete, moving machinery).\n- SIM/eSIM provisioning or device-identity issues prevent onboarding.\n- Confusion over spectrum authorization (e.g., shared bands) and what's permitted.\n\n## 2. Likely Causes / Drivers\n- **Use-case fit:** wide-area outdoor/industrial coverage, mobility, deterministic performance, or dense IoT where Wi-Fi roaming/coverage falls short.\n- **Spectrum:** private cellular needs authorized spectrum — shared/lightly-licensed bands (CBRS in the US referenced generically) or licensed/local-licensed options vary by region.\n- **Attach/auth failures:** SIM/eSIM not provisioned in the core, wrong subscription profile, or radio not advertising the expected network.\n- **Coverage/capacity design gaps:** too few radios, poor placement, RF obstructions, or under-provisioned core/capacity.\n- **Integration gaps:** the private cellular network isn't tied cleanly into enterprise routing, DNS, and security.\n\n## 3. Questions To Ask User\n- What problem is this solving that Wi-Fi can't — coverage area, mobility, device density, determinism, or reliability?\n- What's the physical environment (size, materials, outdoor/indoor, moving equipment)?\n- What spectrum is available/authorized in your region, and do you have or need an authorization?\n- How many and what kinds of devices, and how are they identified (SIM/eSIM/embedded)?\n- How must this integrate with existing network, security, and internet egress?\n\n## 4. Troubleshooting / Planning Steps\n1. **Validate the use case vs. Wi-Fi:** confirm private cellular is justified (coverage/mobility/determinism/density) rather than a Wi-Fi tuning problem.\n2. **Confirm spectrum authorization** for the region/site (e.g., CBRS-style shared access in the US — reference only; rules vary by country).\n3. **Diagnose attach failures:** check SIM/eSIM provisioning in the mobile core, the device's subscription profile, and that the radio is broadcasting the correct network identity.\n4. **Assess coverage/capacity:** RF survey for radio count/placement; account for obstructions and device density; verify core capacity.\n5. **Check integration:** routing, IP assignment, DNS, security/segmentation, and internet egress from the private network.\n\n## 5. Resolution / Deployment Steps\n1. **Design coverage + capacity:** site-survey-driven radio placement; size the mobile core for device count and throughput; plan for mobility/handover.\n2. **Secure spectrum authorization** appropriate to the region before deploying radios.\n3. **Provision identity:** enroll SIMs/eSIMs in the core with correct subscription profiles; standardize device onboarding.\n4. **Integrate and segment:** connect the private network into enterprise routing/DNS with proper segmentation and security controls (treat IoT/OT traffic per t4-frontier-007).\n5. **Tune RF:** adjust radio placement/power for obstructions and interference; re-survey after install.\n6. **Plan resilience:** consider failover (a private network is still WAN-dependent for internet — pair with t4-frontier-004 satellite/LEO failover where appropriate).\n7. **Document the design** as advisory engineering; coordinate any regulated spectrum aspects with qualified parties.\n\n## 6. Verification Steps\n- Target devices attach reliably and maintain data sessions across the coverage area, including while mobile.\n- Coverage and capacity meet the agreed targets under realistic device load (post-install survey confirms).\n- Spectrum authorization is in place and the deployment operates within its rules.\n- The private network is correctly integrated, segmented, and secured into the enterprise.\n- Failover/resilience for internet egress is defined where required.\n\n## 7. Escalation Trigger\nEscalate to L3 / RF + carrier specialists when required coverage, capacity, or spectrum authorization cannot be achieved within site constraints, when handover/mobility fails across radios, or when regulated spectrum questions exceed in-house expertise.\n\n## 8. Prevention Tips\n- Justify private cellular against Wi-Fi with a concrete use case before investing.\n- Drive design from an RF site survey, not a guess at radio count.\n- Confirm regional spectrum rules early — authorization varies widely by country.\n- Standardize SIM/eSIM provisioning and device onboarding to avoid attach issues.\n- Plan segmentation and internet-egress resilience from day one.\n\n## 9. User-Friendly Explanation\nPrivate 5G/cellular is like having your own private cell network for a site — useful for big warehouses, factories, or outdoor areas where Wi-Fi coverage or reliability isn't enough, especially with lots of moving devices. It needs permission to use radio spectrum, special SIM cards (or eSIMs) so devices can join, and good radio placement so there are no dead zones. We design the coverage, get the spectrum sorted, enroll the devices, and connect it securely to your existing network.\n\n## 10. Internal Technician Notes\n- Lead with use-case justification — many \"we need private 5G\" requests are actually Wi-Fi design problems.\n- Spectrum rules are region-specific; CBRS is a US shared-access reference only — never state it as universal.\n- Attach failures almost always trace to SIM/eSIM provisioning or subscription-profile mismatch in the core.\n- Coverage in RF-hostile industrial sites is the hard part — survey-driven design, re-survey after install.\n- Still WAN-dependent for internet; pair with t4-frontier-004 for failover and t4-frontier-007 for OT/IoT segmentation.\n- Spectrum/regulatory aspects are advisory — coordinate with qualified/licensed parties; no compliance claims.\n\n## 11. Related KB Articles\n- t4-frontier-004 — Satellite / LEO Connectivity Failover\n- t4-frontier-007 — Robotics / Cobots / OT + Edge-Node Triage\n- t4-frontier-001 — Post-Quantum Cryptography (PQC) / Quantum-Safe Migration\n\n## 12. Keywords / Search Tags\nprivate 5G, private cellular, private LTE, CBRS, spectrum, SIM provisioning, eSIM, network slicing, coverage planning, Wi-Fi vs cellular, industrial IoT, mobile core"
  },
  {
   "slug": "t4-frontier-004-satellite-leo-failover",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-004-satellite-leo-failover.md",
   "title": "\"Satellite / LEO Connectivity Failover\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"leo satellite\"",
    "\"starlink\"",
    "\"satellite failover\"",
    "\"backup wan\"",
    "\"sd-wan failover\"",
    "\"latency jitter\"",
    "\"obstruction\"",
    "\"cgnat\"",
    "\"dual wan\"",
    "\"weather fade\"",
    "\"internet redundancy\"",
    "\"field connectivity\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-004\ntitle: \"Satellite / LEO Connectivity Failover\"\ncategory: network\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: medium\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"leo satellite\",\"starlink\",\"satellite failover\",\"backup wan\",\"sd-wan failover\",\"latency jitter\",\"obstruction\",\"cgnat\",\"dual wan\",\"weather fade\",\"internet redundancy\",\"field connectivity\"]\nrelated_articles: [\"t4-frontier-003\",\"t4-frontier-007\",\"t4-frontier-005\"]\nescalation_trigger: \"Primary WAN fails and satellite failover does not carry critical traffic, or persistent obstruction/latency makes the link unusable.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A site needs internet redundancy where wired options are limited (remote, rural, mobile, field, maritime).\n- Failover to a LEO satellite link doesn't happen, is slow to switch, or critical apps break on the backup path.\n- Intermittent drops, latency spikes, or jitter on the satellite link.\n- Outages during heavy rain/snow or when the antenna's sky view is obstructed.\n- Apps misbehave behind carrier-grade NAT (CGNAT) on the satellite service (inbound/VPN issues).\n\n## 2. Likely Causes / Drivers\n- **LEO advantages:** lower latency than legacy geostationary satellite, broad coverage where terrestrial WAN isn't available — good as backup or primary in the field.\n- **Failover not configured properly:** no SD-WAN/dual-WAN policy, health checks not detecting the primary failure, or asymmetric routing on cutover.\n- **Obstruction:** trees/buildings/structures blocking the antenna's required clear sky view.\n- **Weather fade:** heavy precipitation attenuating the signal.\n- **CGNAT/addressing:** the satellite service hands out shared/CGNAT addresses, breaking inbound connections, some VPNs, and port-forwarding.\n- **Latency/jitter sensitivity:** real-time apps (voice/video/remote-control) tolerate the variable path poorly.\n\n## 3. Questions To Ask User\n- Is satellite the backup WAN or the primary, and what traffic must survive a primary failure?\n- What's the antenna's sky view — any obstructions, and is the mount stable?\n- Do the failing apps need inbound connectivity or VPN (CGNAT-sensitive)?\n- Does the problem correlate with weather or time of day?\n- What handles failover today (router dual-WAN, SD-WAN, manual), and how fast must cutover be?\n\n## 4. Troubleshooting Steps\n1. **Confirm physical health:** antenna alignment, stable mount, and an unobstructed sky view; check the service app for obstruction/outage reports.\n2. **Baseline the link:** measure latency, jitter, and packet loss on the satellite path under normal conditions.\n3. **Test failover deliberately:** simulate a primary-WAN failure and watch whether cutover happens, how fast, and which apps survive.\n4. **Check NAT/addressing:** determine if the service uses CGNAT and whether failing apps need inbound/VPN reachability.\n5. **Correlate with weather/obstruction:** log drops against precipitation and sky-view events.\n\n## 5. Resolution Steps\n1. **Fix line-of-sight:** relocate/raise the antenna to clear obstructions; secure the mount against movement/wind.\n2. **Engineer failover:** configure SD-WAN or dual-WAN with reliable health checks so cutover is automatic and fast; prioritize critical traffic on the backup path's limited capacity.\n3. **Handle CGNAT:** where inbound/VPN is required, use an outbound-initiated/overlay approach (e.g., VPN that tolerates CGNAT) or a public-IP option from the provider if available.\n4. **Protect real-time apps:** apply QoS, accept that voice/video may degrade on the variable path, and set user expectations for failover periods.\n5. **Mitigate weather fade:** ensure adequate antenna siting; treat brief weather drops as expected and design apps to reconnect gracefully.\n6. **Document the design** including which traffic is protected, expected backup performance, and failback behavior.\n\n## 6. Verification Steps\n- A simulated primary-WAN outage triggers automatic failover within the required time, and critical apps continue.\n- The satellite link's latency/jitter/loss baseline is acceptable for the intended traffic.\n- The antenna has a clear, stable sky view with no obstruction warnings.\n- CGNAT-sensitive apps/VPNs work via the chosen approach on the satellite path.\n- Failback to primary WAN works cleanly when it recovers.\n\n## 7. Escalation Trigger\nEscalate to L3 / provider when the primary fails but satellite failover doesn't carry critical traffic, when obstruction/weather makes the link persistently unusable despite re-siting, or when CGNAT blocks a required inbound/VPN service with no provider remedy.\n\n## 8. Prevention Tips\n- Design failover with real health checks and traffic prioritization, not just a second uplink plugged in.\n- Site the antenna for a clear, stable sky view from the start; plan for weather margin.\n- Confirm CGNAT implications before relying on inbound/VPN over satellite.\n- Set user expectations: backup links are for continuity, not full primary-grade performance.\n- Test failover and failback regularly — don't discover it's broken during a real outage.\n\n## 9. User-Friendly Explanation\nLow-earth-orbit (LEO) satellite internet can keep a site online when the main connection fails, or serve remote places with no good wired option. It's much faster than old satellite but can wobble in latency, drop in heavy weather, or struggle if trees/buildings block the dish's view of the sky. We set it up so the network automatically switches to satellite when the main line dies, make sure the dish has a clear view, and confirm your important apps keep working on the backup.\n\n## 10. Internal Technician Notes\n- LEO is referenced generically (Starlink-class) — don't tie guidance to one provider's specifics.\n- The #1 silent failure is failover config: a backup uplink with no working health check/cutover policy is not redundancy.\n- CGNAT is the common app-breaker (inbound, port-forward, some VPNs) — design around it early.\n- Obstruction + weather fade are physical-layer; re-siting beats config tweaks.\n- Pairs with t4-frontier-003 (private cellular still needs internet egress) and supports field deployments (t4-frontier-005/007).\n\n## 11. Related KB Articles\n- t4-frontier-003 — Private 5G / Private Cellular for Enterprise\n- t4-frontier-007 — Robotics / Cobots / OT + Edge-Node Triage\n- t4-frontier-005 — AR / Smart-Glasses for Field & Enterprise Work\n\n## 12. Keywords / Search Tags\nLEO satellite, Starlink, satellite failover, backup WAN, SD-WAN failover, latency, jitter, obstruction, CGNAT, dual WAN, weather fade, internet redundancy"
  },
  {
   "slug": "t4-frontier-005-ar-smart-glasses",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-005-ar-smart-glasses.md",
   "title": "\"AR / Smart-Glasses for Field & Enterprise Work\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"ar glasses\"",
    "\"smart glasses\"",
    "\"augmented reality\"",
    "\"mdm enrollment\"",
    "\"remote assist\"",
    "\"heads-up display\"",
    "\"field service\"",
    "\"privacy camera\"",
    "\"device provisioning\"",
    "\"wearable endpoint\"",
    "\"see-what-i-see\"",
    "\"enterprise ar\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-005\ntitle: \"AR / Smart-Glasses for Field & Enterprise Work\"\ncategory: endpoint\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: medium\nestimated_time_minutes: 60\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"ar glasses\",\"smart glasses\",\"augmented reality\",\"mdm enrollment\",\"remote assist\",\"heads-up display\",\"field service\",\"privacy camera\",\"device provisioning\",\"wearable endpoint\",\"see-what-i-see\",\"enterprise ar\"]\nrelated_articles: [\"t4-frontier-006\",\"t4-frontier-004\",\"t4-frontier-007\"]\nescalation_trigger: \"AR devices cannot be enrolled/managed under policy, or camera/recording use conflicts with privacy requirements.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A field/operations team wants AR or smart glasses (remote assist, hands-free instructions, \"see-what-I-see\" support) and needs provisioning/management guidance.\n- Devices won't enroll into MDM, or enrolled but policies/apps don't apply.\n- Connectivity, battery, or display/tracking problems during field use.\n- Privacy concerns about the on-board camera/microphone recording people or sensitive areas.\n- Apps crash, drift in tracking, or perform poorly in certain lighting/environments.\n\n## 2. Likely Causes / Drivers\n- **Use case:** hands-free workflows — remote expert assist, guided procedures, inspection, training.\n- **Management gap:** the device's OS may not enroll into your existing MDM, or needs a specific management mode/agent.\n- **Connectivity dependence:** AR remote-assist is bandwidth- and latency-sensitive; weak Wi-Fi/cellular degrades it (pairs with t4-frontier-004 failover and t4-frontier-003 cellular).\n- **Environmental factors:** lighting, reflective/featureless surfaces, and motion affect tracking; battery/thermal limits sustained use.\n- **Privacy exposure:** always-available camera/mic raises consent, recording, and sensitive-area concerns.\n\n## 3. Questions To Ask User\n- What's the workflow — remote assist, guided steps, inspection, training?\n- What device/OS, and does it support enrollment into your current MDM or need a separate tool?\n- Where is it used (lighting, environment, connectivity) and for how long per session (battery)?\n- What gets captured by camera/mic, and who/what is in frame (privacy)?\n- What backend/app does it connect to, and how is data handled?\n\n## 4. Troubleshooting Steps\n1. **Confirm management support:** does the device OS enroll into your MDM, and in what mode (shared/kiosk/single-app)?\n2. **Verify enrollment + policy push:** device enrolled, profiles/apps applied, updates managed.\n3. **Test connectivity:** measure bandwidth/latency where used; AR assist is sensitive to both.\n4. **Check environment/tracking:** evaluate lighting, surfaces, and motion that degrade AR tracking; check battery/thermal over a real session.\n5. **Review camera/mic use** against privacy policy and the physical areas in scope.\n\n## 5. Resolution Steps\n1. **Enroll under management:** bring devices into MDM in an appropriate mode (often kiosk/single-app for field use); apply security baselines, app allow-lists, and managed updates.\n2. **Provision apps + identity:** deploy the AR/remote-assist app, configure SSO/identity, and lock down to intended use.\n3. **Ensure connectivity:** verify Wi-Fi/cellular coverage and quality where used; add failover where field reliability matters (t4-frontier-004).\n4. **Optimize the environment:** improve lighting/markers where tracking struggles; plan battery swaps/charging for long shifts.\n5. **Govern privacy:** define and enforce camera/mic policy — recording rules, consent, sensitive-area restrictions, and data handling/retention; disable capture where not permitted.\n6. **Support workflow:** document setup, common fixes, and a clean return-to-service/wipe process for shared devices.\n\n## 6. Verification Steps\n- Devices are enrolled and managed under policy, with apps and updates applying correctly.\n- The AR workflow performs acceptably in the real environment (tracking, latency, battery hold up).\n- Connectivity (and failover, if required) meets the workflow's needs.\n- Camera/mic use complies with the defined privacy policy; capture is restricted where required.\n- Shared-device handoff/wipe works cleanly between users.\n\n## 7. Escalation Trigger\nEscalate to L3 / vendor when devices cannot be enrolled or managed under your policy, when camera/recording use conflicts irreconcilably with privacy requirements, or when tracking/connectivity can't meet the workflow despite environmental fixes.\n\n## 8. Prevention Tips\n- Confirm MDM/management support before purchasing AR hardware.\n- Pilot in the real environment (lighting, motion, connectivity) before scaling.\n- Set camera/mic privacy policy up front — it's the most common adoption blocker.\n- Plan battery/charging logistics for full-shift use.\n- Treat AR remote-assist's bandwidth/latency needs as a network design input, not an afterthought.\n\n## 9. User-Friendly Explanation\nSmart glasses let workers keep their hands free while seeing instructions or sharing their view with a remote expert. To use them safely at scale, IT enrolls them like any other managed device, loads the right app and sign-in, and makes sure the Wi-Fi or cellular is strong enough. Because the glasses have a camera and microphone, we set clear rules about what can be recorded and where, to protect people's privacy.\n\n## 10. Internal Technician Notes\n- MDM support varies widely by device OS — verify enrollment mode (kiosk/single-app is common for field) before buying.\n- AR remote-assist is bandwidth + latency sensitive — tie to network design (t4-frontier-003/004).\n- Tracking degrades in poor lighting / featureless / reflective / high-motion settings — environment fixes beat config.\n- Privacy (always-on camera/mic) is the top adoption blocker — policy + technical capture controls, documented.\n- This is a wearable endpoint — overlaps t4-frontier-006 for provisioning/MDM/privacy patterns. No medical/safety claims for any health-adjacent sensing.\n\n## 11. Related KB Articles\n- t4-frontier-006 — Enterprise Wearables\n- t4-frontier-004 — Satellite / LEO Connectivity Failover\n- t4-frontier-007 — Robotics / Cobots / OT + Edge-Node Triage\n\n## 12. Keywords / Search Tags\nAR glasses, smart glasses, augmented reality, MDM enrollment, remote assist, see-what-I-see, field service, heads-up display, privacy camera, wearable endpoint, device provisioning, enterprise AR"
  },
  {
   "slug": "t4-frontier-006-wearables-enterprise",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-006-wearables-enterprise.md",
   "title": "\"Enterprise Wearables\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"enterprise wearables\"",
    "\"smartwatch mdm\"",
    "\"wearable provisioning\"",
    "\"health data privacy\"",
    "\"ble pairing\"",
    "\"wearable security\"",
    "\"companion app\"",
    "\"data minimization\"",
    "\"byod wearable\"",
    "\"sensor data\"",
    "\"wearable battery\"",
    "\"ruggedized wearable\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-006\ntitle: \"Enterprise Wearables\"\ncategory: endpoint\nsupport_level: L2\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: medium\nestimated_time_minutes: 50\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"enterprise wearables\",\"smartwatch mdm\",\"wearable provisioning\",\"health data privacy\",\"ble pairing\",\"wearable security\",\"companion app\",\"data minimization\",\"byod wearable\",\"sensor data\",\"wearable battery\",\"ruggedized wearable\"]\nrelated_articles: [\"t4-frontier-005\",\"t4-frontier-003\",\"t4-aigov-006\"]\nescalation_trigger: \"A wearable cannot be managed/secured under policy, or sensor/health data handling conflicts with privacy obligations.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A team wants smartwatches/wearables for alerts, scanning, lone-worker safety, push-to-talk, or workflow notifications and needs provisioning guidance.\n- Wearables won't enroll/manage, or rely on a companion phone that complicates management.\n- Pairing/connectivity issues (Bluetooth LE, Wi-Fi, cellular) or short battery life in the field.\n- Concern about what sensor data (location, motion, and any health-adjacent metrics) is collected and where it goes.\n- Lost/stolen wearable with corporate access and no clear wipe path.\n\n## 2. Likely Causes / Drivers\n- **Use cases:** notifications/alerts, barcode scanning, lone-worker/safety check-ins, push-to-talk, time/access.\n- **Management model:** many wearables are managed via a paired phone or a vendor console rather than directly in standard MDM — this shapes provisioning.\n- **Connectivity:** BLE pairing to a companion device, or standalone Wi-Fi/cellular; field coverage and battery limit usefulness.\n- **Data/privacy:** wearables can collect location, motion, and sometimes health-adjacent signals — handling and consent matter.\n- **Loss/theft exposure:** small, easily lost devices that may hold credentials or access.\n\n## 3. Questions To Ask User\n- What's the wearable for, and what data does it need to collect to do that job?\n- Is it standalone or paired to a phone, and how is it intended to be managed?\n- What connectivity does it use (BLE/Wi-Fi/cellular) and where is it used?\n- Does it collect any location or health-adjacent data, and what are the privacy obligations?\n- What corporate access/credentials does it hold, and what's the lost-device plan?\n\n## 4. Troubleshooting Steps\n1. **Confirm the management path:** direct MDM, companion-app management, or vendor console — and whether it meets your policy.\n2. **Verify enrollment + policy:** device enrolled/registered, security settings applied, updates managed.\n3. **Test connectivity/pairing:** BLE pairing stability, Wi-Fi/cellular coverage, and reconnect behavior.\n4. **Assess battery** over a realistic shift; identify charging logistics.\n5. **Inventory data collection:** list exactly what sensors/data the wearable + companion app gather and where it's stored/sent.\n\n## 5. Resolution Steps\n1. **Provision under management:** enroll via the supported path; apply passcode/lock, encryption where available, app controls, and managed updates.\n2. **Secure access + loss handling:** scope corporate access to the minimum; ensure a remote lock/wipe or access-revoke path for lost/stolen units.\n3. **Stabilize connectivity:** fix pairing/coverage issues; plan failover where field reliability matters (t4-frontier-004) and cellular where needed (t4-frontier-003).\n4. **Apply data minimization + privacy:** collect only what the use case needs; define storage, retention, and access for sensor data; obtain consent where required; restrict location/health-adjacent data per policy.\n5. **Plan battery/charging** logistics for shifts; standardize a clean reset/handoff for shared units.\n6. **Document** setup, common fixes, and the privacy/data-handling posture.\n\n## 6. Verification Steps\n- Wearables are enrolled/managed under policy with security settings and updates applied.\n- Pairing/connectivity is stable across the work environment; battery meets shift needs.\n- Data collection is minimized and documented; sensor/location/health-adjacent data is handled per privacy policy.\n- A lost/stolen device can be locked/wiped or have access revoked.\n- Shared-device reset/handoff works cleanly.\n\n## 7. Escalation Trigger\nEscalate to L3 / vendor when a wearable cannot be managed or secured under policy, when sensor/health-adjacent data handling conflicts with privacy obligations, or when there's no viable lost-device lock/wipe/revoke path for a device holding corporate access.\n\n## 8. Prevention Tips\n- Verify the management model and lost-device controls before purchasing.\n- Apply data minimization by default — collect only what the use case requires.\n- Decide sensor/location/health-adjacent data handling and consent up front.\n- Plan battery and charging logistics for real shifts.\n- Keep corporate access on wearables scoped to the minimum.\n\n## 9. User-Friendly Explanation\nEnterprise wearables — like rugged smartwatches — give workers quick alerts, scanning, or safety check-ins without pulling out a phone. IT manages and secures them like other devices, makes sure they pair and stay connected, and plans charging for long shifts. Because wearables can sense things like location or movement, we only collect what's needed for the job and set clear privacy rules. Important: any health-related readings are not medical-grade and aren't used for medical decisions.\n\n## 10. Internal Technician Notes\n- Management is often via companion app/vendor console, not direct MDM — confirm the path fits policy before buying.\n- Data minimization is the core privacy control; location and any health-adjacent metrics need explicit handling/consent.\n- **No medical claims** — health-adjacent sensors are not diagnostic; never present them as medical-grade.\n- Small/losable devices with access → ensure lock/wipe/revoke exists.\n- Shared-device patterns and privacy overlap heavily with t4-frontier-005 (AR/smart-glasses); shadow-AI/unmanaged companion apps tie to t4-aigov-006.\n\n## 11. Related KB Articles\n- t4-frontier-005 — AR / Smart-Glasses for Field & Enterprise Work\n- t4-frontier-003 — Private 5G / Private Cellular for Enterprise\n- t4-aigov-006 — Shadow-AI Discovery\n\n## 12. Keywords / Search Tags\nenterprise wearables, smartwatch MDM, wearable provisioning, health data privacy, BLE pairing, wearable security, companion app, data minimization, sensor data, lost device wipe, ruggedized wearable, BYOD wearable"
  },
  {
   "slug": "t4-frontier-007-robotics-cobot-ot-edge",
   "path_rel": "knowledge-base\\tier4\\t4-frontier-007-robotics-cobot-ot-edge.md",
   "title": "\"Robotics / Cobots / OT + Edge-Node Triage\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "\"robotics\"",
    "\"cobot\"",
    "\"ot security\"",
    "\"it ot convergence\"",
    "\"purdue model\"",
    "\"network segmentation\"",
    "\"edge node\"",
    "\"safety system\"",
    "\"never auto-actuate\"",
    "\"industrial control\"",
    "\"plc\"",
    "\"operational technology\""
   ],
   "compliance": [],
   "content": "---\nid: t4-frontier-007\ntitle: \"Robotics / Cobots / OT + Edge-Node Triage\"\ncategory: ot-iot\nsupport_level: L3\ntech_generation: tier-4\ntier4_pack: frontier-infra\nseverity: critical\nestimated_time_minutes: 90\naudience: it-technician\nos_scope: [\"Windows 11\",\"macOS\",\"cross-platform\"]\nprerequisites: []\nkeywords: [\"robotics\",\"cobot\",\"ot security\",\"it ot convergence\",\"purdue model\",\"network segmentation\",\"edge node\",\"safety system\",\"never auto-actuate\",\"industrial control\",\"plc\",\"operational technology\"]\nrelated_articles: [\"t4-frontier-003\",\"t4-endpoint-003\",\"t4-aigov-002\"]\nescalation_trigger: \"Any IT action could affect a robot/cobot's motion, a safety system, or live OT control — stop and involve OT/safety engineering before proceeding.\"\nlast_updated: 2026-06-24\nversion: 1.0\n---\n\n## 1. Symptoms\n- A robot/cobot or its edge controller is offline, unresponsive, or behaving abnormally and IT is asked to help.\n- An edge node (industrial PC/gateway) that mediates between OT equipment and IT systems has failed or lost connectivity.\n- Network issues between the plant floor (OT) and IT systems disrupt data collection or remote support.\n- A safety question arises: can IT touch this device while it can move or actuate?\n- Suspected security event affecting OT/edge devices.\n\n## 2. Likely Causes / Drivers\n- **IT/OT convergence:** robots, cobots, PLCs, and edge nodes increasingly connect to IT networks, so IT gets pulled into OT issues it must handle carefully.\n- **Edge-node failure:** the industrial PC/gateway crashed, lost power, has a bad disk, or dropped its network/uplink.\n- **Network/segmentation issues:** OT and IT traffic interfere, or a segmentation control is blocking required flows.\n- **Safety-system involvement:** the device can physically move/actuate; any change risks human safety.\n- **Security exposure:** flat networks or unpatched OT devices create attack surface (treat events per t4-aigov-002).\n\n## 3. Questions To Ask User (Safety First)\n- Can this device move, actuate, or control a physical process right now? If yes, IT does not touch it without OT/safety sign-off.\n- Is anyone in the device's work envelope, and is it safely stopped/locked out?\n- Is this a safety-rated system or tied to one?\n- What exactly failed — the robot itself, its controller, the edge node, or the network between OT and IT?\n- Who owns this OT equipment, and is OT/controls engineering engaged?\n\n## 4. Triage Steps (Humans-First, Never Auto-Actuate)\n1. **Confirm physical safety before anything else:** ensure the device is safely stopped and no one is at risk. IT never sends commands that could cause motion/actuation.\n2. **Scope the fault to a layer:** robot/cobot hardware, its controller/PLC, the edge node, or the IT↔OT network — IT's lane is typically the edge node and network, not the motion controller or safety system.\n3. **Engage OT/controls engineering** for anything touching the robot, PLC, or safety system — this is a joint responsibility, not an IT-only fix.\n4. **Triage the edge node** (IT-appropriate): power, boot, disk/health, OS, the data-collection/gateway service, time sync, and uplink — without altering control logic.\n5. **Check segmentation/flows:** verify required OT↔IT flows are permitted and that segmentation (reference: Purdue model layering) is intact, not the cause.\n\n## 5. Resolution Steps\n1. **Restore the edge node** within IT's scope: fix power/boot/disk/network, restart the gateway/collector service, restore from a known-good image/config — never modify control or safety logic.\n2. **Fix network/segmentation** so authorized OT↔IT flows work while keeping OT segmented from general IT (Purdue-model layering as a reference design).\n3. **Coordinate OT actions:** any change to the robot/cobot/PLC or safety system is performed or approved by OT/controls engineering, with IT supporting the network/edge side.\n4. **Validate before re-enabling motion:** the device is only returned to operation by qualified OT staff after safety checks — IT does not \"turn the robot back on.\"\n5. **Security hardening (advisory):** segment OT, restrict remote access, patch within OT change windows (with OT approval), and monitor — handle suspected incidents via t4-aigov-002.\n6. **Document** the fault, the IT-scope actions taken, and the OT-owned actions, in a shared record.\n\n## 6. Verification Steps\n- The device was kept safe throughout; no IT action caused or risked motion/actuation.\n- The edge node is healthy (boot/disk/service/uplink/time) and data flows resume.\n- Required OT↔IT network flows work while OT remains properly segmented.\n- Any robot/PLC/safety change was performed/approved by OT, and the device was returned to service only by qualified staff after safety checks.\n- A joint record captures IT-scope vs. OT-scope actions.\n\n## 7. Escalation Trigger\nStop and escalate to OT/controls + safety engineering immediately whenever any IT action could affect a robot/cobot's motion, a safety-rated system, or live OT process control. Route suspected OT security incidents to t4-aigov-002. When in doubt, do not act — safety overrides uptime.\n\n## 8. Prevention Tips\n- Define clear IT/OT boundaries in advance: IT owns the edge node + network; OT owns control/motion/safety.\n- Segment OT from IT (Purdue-model layering as reference); restrict and log remote access to OT.\n- Maintain known-good images/configs for edge nodes for fast, safe restore.\n- Patch OT only within OT-approved change windows.\n- Train IT staff on the humans-first / never-auto-actuate rule before they touch any OT environment.\n\n## 9. User-Friendly Explanation\nFactory robots, collaborative robots (\"cobots\"), and the small computers (\"edge nodes\") that connect them to the network are increasingly part of IT's world — but they can move and could hurt someone. The golden rule is humans-first: IT never sends a command that could make a robot move, and never restarts a robot itself. IT sticks to the network and the edge computer, and anything touching the robot or its safety systems is done with the operational-technology engineers. We fix the computer and network side; safety experts handle the moving parts.\n\n## 10. Internal Technician Notes\n- **Humans-first, never auto-actuate** is the non-negotiable rule — IT does not command motion or \"turn the robot back on.\"\n- IT's lane = edge node + IT↔OT network; OT's lane = robot/PLC/motion/safety. Keep the boundary explicit.\n- Use the Purdue model as a **reference** for segmentation layering — don't claim a certified architecture.\n- Edge-node triage (power/boot/disk/service/uplink/time) is standard IT and safe; control/safety logic is off-limits.\n- Self-healing/automation must respect this: no autonomous agent auto-actuates OT — ties to t4-endpoint-003's fail-safe handoff. Security incidents → t4-aigov-002. Advisory/readiness only; no safety-compliance claims.\n\n## 11. Related KB Articles\n- t4-frontier-003 — Private 5G / Private Cellular for Enterprise\n- t4-endpoint-003 — Self-Healing Endpoint → Human Escalation\n- t4-aigov-002 — AI Agent Incident Response Runbook\n\n## 12. Keywords / Search Tags\nrobotics, cobot, OT security, IT/OT convergence, Purdue model, network segmentation, edge node, safety system, never auto-actuate, industrial control, PLC, operational technology"
  },
  {
   "slug": "l1-account-state-002-disabled-locked-expired",
   "path_rel": "knowledge-base\\top50-gaps\\l1-account-state-002-disabled-locked-expired.md",
   "title": "\"Can't log in — disabled vs locked vs expired password\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-account-state-002\ntitle: \"Can't log in — disabled vs locked vs expired password\"\ncategory: authentication\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 6\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"Web\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - account locked\n  - account disabled\n  - password expired\n  - your account has been disabled\n  - too many sign-in attempts\n  - cant log in error\n  - aad_unauthorized\n  - sign-in blocked\n  - account is disabled cannot sign in\ntags:\n  - authentication\n  - account\n  - lockout\n  - top-50\nrelated: [l1-password-001-reset-and-sspr, l1-password-002-locked-after-change, l1-mfa-002-lost-authenticator-phone]\n---\n\n# Account state — what error means what\n\n### \"Your account is disabled\"\n\nYour account was actively disabled by an admin. This is different from a lockout. Reasons: you're an ex-employee, role changed, security review in progress. Self-recovery NOT possible — call IT immediately at (647) 581-3182. They confirm the reason and either re-enable or escalate to HR/security. Don't keep trying — disabled accounts won't unlock with time.\n\n### \"Account is locked due to too many sign-in attempts\"\n\nYou (or someone trying your password) hit the lockout threshold (typically 5 failures in 10 minutes). Auto-unlock in 15-30 minutes for most M365 tenants. If you need access now, call IT to manually unlock. Important: don't keep trying the password during lockout — it resets the timer. While waiting, check other devices (phone, second laptop) for an old password cached somewhere, since that's the most likely cause.\n\n### \"Your password has expired\"\n\nPassword rotation policy hit. M365 default is 90 days. Browser sign-in prompts you to set a new one inline — do it. If you signed in on a thick client (Outlook desktop, Teams app), close them all, sign in via browser at office.com first to set the new password, then thick clients pick up the new credential. New password requirements vary by tenant: common is 12+ chars, mix of upper/lower/number/symbol, no reuse of last 24.\n\n### \"AAD_Unauthorized\" or \"AADSTS50057\" — sign-in blocked\n\nEntra ID Conditional Access blocked the sign-in attempt. Common triggers: signing in from an unusual country, an unmanaged device, an outdated OS version, missing MFA, or risky-sign-in detection. Try again from your usual office or home network. If still blocked, that's L2 — admin checks the Sign-in Logs in Entra to see which Conditional Access rule fired.\n\n### Sign-in works, then immediately signs me back out\n\nToken issuance failure. Clear browser cookies for `login.microsoftonline.com` and `login.live.com`. Use a fresh InPrivate / Incognito window. If still failing, possibly stale Windows credential cache — Control Panel → Credential Manager → delete entries containing \"MicrosoftAccount\" or your email.\n\n### How to tell which state you're in — read the error verbatim\n\nThe exact wording matters. \"Disabled\" = admin action (call IT). \"Locked\" or \"too many attempts\" = wait + retry. \"Expired\" = self-service via browser. \"Blocked\" / unauthorized / AADSTS50xxx error code = Conditional Access (L2). Don't paraphrase the error when you call IT — read the message word-for-word, including any error code in parentheses.\n\n### When to escalate to L2\n\nDisabled account (immediate L2/HR). AADSTS error codes (L2 reads sign-in logs). Lockout that won't clear after 60 minutes. Password expired but reset flow won't accept any new password (likely policy mismatch). Repeated lockouts within 24 hours despite password change — see KB l1-password-002 first, then L2 if not resolved."
  },
  {
   "slug": "l1-bluetooth-002-airpods-headset-wont-reconnect",
   "path_rel": "knowledge-base\\top50-gaps\\l1-bluetooth-002-airpods-headset-wont-reconnect.md",
   "title": "\"AirPods / Bluetooth headset paired but won't connect — fix the handshake\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-bluetooth-002\ntitle: \"AirPods / Bluetooth headset paired but won't connect — fix the handshake\"\ncategory: bluetooth\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Headset has battery\", \"Headset is already paired to the device\"]\nkeywords:\n  - airpods wont connect\n  - bluetooth paired not connected\n  - headphones connected but no sound\n  - bluetooth keeps disconnecting\n  - airpods only one side working\n  - bluetooth latency\n  - cant connect airpods to pc\n  - bluetooth handover not working\n  - re-pair bluetooth\ntags:\n  - bluetooth\n  - airpods\n  - audio\n  - top-50\nrelated: [l1-bluetooth-001-pairing-failed, l1-meeting-audio-001-wrong-device, l1-windows-005-audio-no-sound]\n---\n\n# AirPods / Bluetooth headset paired but won't connect\n\n## Symptoms\n\n- AirPods in your ear, paired to MacBook + iPhone + iPad, but only randomly connect\n- Bluetooth headset shows \"Connected\" but no audio\n- Only the left or right earbud works\n- Disconnect mid-meeting and won't reconnect\n- After unpairing one device, the others stop seeing the headset\n- Constant latency / sync issues on calls\n\nThe fix depends on whether you want it on **Apple ecosystem** (AirPods + iPhone/Mac auto-switching) or **mixed** (AirPods + Windows PC) or **generic Bluetooth + anything**.\n\n## Fast path — reset the headset\n\nThis fixes 70% of \"paired but won't connect\" issues.\n\n### AirPods (1st-4th gen, Pro, Max)\n1. Put both AirPods in the case (don't close the lid).\n2. Hold the **setup button** (small button on the back of the case) for 15 seconds.\n3. The status light flashes amber, then white = factory reset.\n4. Remove from every device's Bluetooth list (Settings → Bluetooth → \"i\" icon next to AirPods → Forget This Device).\n5. Open the case next to your iPhone — the iCloud-linked pairing flow appears.\n6. Pair fresh. The pairing propagates to your other Apple devices via iCloud.\n\n### Generic Bluetooth headphones (Sony, Bose, Sennheiser, Beats, Jabra)\n- Each has its own reset procedure. Common pattern:\n  - Power off the headset.\n  - Hold power button for 10-30 seconds while off.\n  - LED flashes blue + red, indicating pairing mode and reset.\n- Check the manufacturer's manual for your specific model.\n\n### Then re-pair to each device\n\nPairing memory after reset is wiped. Set up fresh on each device.\n\n## Apple ecosystem — AirPods auto-switching not working\n\nAirPods are supposed to follow you between iPhone, iPad, Mac. When it breaks:\n\n### Requirements\n- All devices signed into same iCloud account.\n- All devices on recent OS (iOS 14+ / macOS Big Sur+).\n- \"Connect to This Mac\" / \"Connect to This iPhone\" set to **Automatically** for the device you want as priority.\n\n### Fix\n1. On Mac: System Settings → Bluetooth → click \"i\" next to AirPods → \"Connect to This Mac\" → **When Last Connected to This Mac**.\n2. On iPhone: Settings → Bluetooth → \"i\" next to AirPods → \"Connect to This iPhone\" → **When Last Connected to This iPhone**.\n3. Or set to **Automatically** for fully passive switching (less reliable).\n\n### Force switch\n- Click the speaker / volume icon in the Mac menu bar → click AirPods → \"Connect.\"\n\n### \"Sometimes only one AirPod plays\"\n- Battery imbalance — one side is way lower than the other.\n- Put both in case, charge for 15 minutes, retry.\n- If persists after charging, that AirPod may be dying. Genius Bar can replace single AirPods.\n\n## Windows PC — Bluetooth headset issues\n\nWindows has historically poor Bluetooth audio. Common issues:\n\n### \"Connected\" but no audio\n1. Right-click speaker icon in taskbar → Sound settings.\n2. Output device dropdown — pick your headset.\n3. If multiple entries for the same headset (Hands-Free vs Stereo), pick **Hands-Free** for calls/mic, **Stereo** for music-only.\n4. Inside meeting apps: explicitly set Audio device to the same entry.\n\n### Disconnects mid-call\nWindows Bluetooth stack often drops headset on apps switching profiles. Workarounds:\n1. Update Bluetooth driver via Device Manager (Windows key + X → Device Manager → Bluetooth → Right-click adapter → Update driver).\n2. Disable \"Allow the computer to turn off this device to save power\" (Properties → Power Management).\n3. If headset has a USB dongle option (Logitech, Jabra Engage), use that instead of native Bluetooth — way more reliable on Windows.\n\n### Audio is choppy / robotic / laggy\n- Windows Bluetooth bandwidth issue. Mostly fixed in Windows 11 22H2+.\n- Move closer to PC. 2.4GHz Wi-Fi router nearby can interfere.\n- Try a USB Bluetooth 5.0/5.2 dongle if your PC's built-in Bluetooth is old.\n\n## Android — headphones won't reconnect\n\n1. Settings → Connected devices → tap gear next to headset → **Forget**.\n2. Power-cycle headset + put in pairing mode.\n3. Settings → Pair new device.\n\nIf still flaky:\n- Disable + re-enable Bluetooth in Settings.\n- Restart phone.\n- Some Android OEMs (Samsung) have aggressive battery saving that kills Bluetooth — Settings → Battery → Bluetooth → don't restrict.\n\n## Edge cases\n\n### \"AirPods connect to my work Mac, not my personal Mac, when I want personal\"\n- Both Macs see them as available. AirPods are responding to whichever Mac sends the connect request first.\n- On the Mac you DON'T want it on: System Settings → Bluetooth → \"i\" next to AirPods → \"Connect to This Mac\" → **Never** (option exists on some versions).\n- Or simply put AirPods in case + close lid for 5 seconds → reopen near the Mac you want.\n\n### \"AirPods Pro 2 noise canceling stopped working\"\nDifferent issue — usually wax on the mesh. Clean with dry toothbrush. Or Settings → Bluetooth → AirPods → toggle noise canceling off + on.\n\n### \"Headset works for music but mic doesn't work in Teams\"\n- See l1-meeting-audio-001-wrong-device. It's a profile-selection issue inside the meeting app.\n\n### \"Two headsets paired, neither connects\"\n- Forget both, repair one at a time. Bluetooth pairing memory can get confused with too many devices.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Reset + repair multiple times, still fails | L2 — possibly hardware failure on adapter or headset |\n| Only happens on corporate-managed device | L2 — possibly endpoint security blocking certain BT profiles |\n| Bluetooth disappears from device entirely | L2 — driver / firmware reinstall |\n| Latest macOS update broke pairing | L2 — known macOS bugs, may need version-specific fix |\n\n## Prevention\n\n- Don't pair the same headset to 5+ devices. Pick 2-3, forget the rest.\n- Keep firmware up to date — Sony, Bose, Jabra all have companion apps with firmware updates.\n- For AirPods: keep them in the case when not in use (case charges them; case also resets handshakes).\n- For Windows + Bluetooth: invest $15 in a USB Bluetooth 5.2 dongle if your PC is older than 2021.\n\n## What ARIA can help with\n\nARIA can identify whether your issue is profile (Hands-Free vs Stereo), pairing memory (stale), hardware (one earbud), or OS-side (Windows driver) from your symptoms. ARIA cannot physically press the reset button on your headset."
  },
  {
   "slug": "l1-browser-002-default-keeps-reverting",
   "path_rel": "knowledge-base\\top50-gaps\\l1-browser-002-default-keeps-reverting.md",
   "title": "\"Default browser keeps reverting to Edge / Safari — make Chrome / Firefox stick\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-browser-002\ntitle: \"Default browser keeps reverting to Edge / Safari — make Chrome / Firefox stick\"\ncategory: browser\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"The browser you want as default is installed\"]\nkeywords:\n  - default browser reverts\n  - chrome wont stay default\n  - edge keeps opening\n  - safari default\n  - links open in wrong browser\n  - reset default browser\n  - protocol handler\n  - http https handler\n  - microsoft 365 links opening in edge\n  - outlook links open in edge\ntags:\n  - browser\n  - default\n  - top-50\nrelated: [l1-browser-001-pages-not-loading]\n---\n\n# Default browser keeps reverting — make your choice stick\n\n## Symptoms\n\n- You set Chrome (or Firefox / Brave / Arc) as default, but after a reboot Edge / Safari is back.\n- Links in Outlook / Teams open in Edge no matter what.\n- Clicking a link from email opens Edge, not your default.\n- After a Windows update, defaults reset.\n- iPhone / iPad keeps opening links in Safari even though Chrome is set.\n\nThis is mostly **Microsoft and Apple defending their browsers** + sometimes a Windows update wiping settings.\n\n## Windows 11 — make Chrome (or another browser) the real default\n\n### The right way (Windows 11 22H2 and later)\n1. **Settings → Apps → Default apps**.\n2. Search for the browser you want (e.g., \"Chrome\").\n3. Click it.\n4. **Click \"Set default\" at the top** — this is the one-click button Microsoft added in 2022.\n5. Confirm it took: scroll down, you should see \"Default for these file types and link types\" with `.htm`, `.html`, `http`, `https`, `.pdf` (optional), `.svg` (optional) all assigned to Chrome.\n\n### If \"Set default\" doesn't fully work (older Windows 11)\nManually re-assign each file type:\n1. Same Default apps screen.\n2. Under each of: `http`, `https`, `.htm`, `.html` — click the current default and pick Chrome.\n3. Some require an extra \"Switch anyway\" confirmation Windows uses to discourage you. Click it.\n\n### Make Outlook stop opening links in Edge\n\nThis is Microsoft's most-annoying default in 2024-2026. Even if your system default is Chrome, Microsoft 365 apps \"feature\" opening links in Edge to \"save your context.\"\n\n**Classic Outlook (Windows):**\n1. File → Options → Advanced.\n2. Scroll to **Link handling**.\n3. Change \"Open hyperlinks from Outlook in\" → **Default browser**.\n4. OK. Restart Outlook.\n\n**New Outlook (Windows + Mac):**\n1. Settings (gear) → **General → Web browser**.\n2. Pick \"Default browser.\"\n3. Restart Outlook.\n\n**Teams Desktop:**\n1. Profile → Settings → **General**.\n2. Look for \"Open links in\" → set to **Default browser**.\n3. Restart Teams.\n\n**Microsoft 365 web apps (browser):**\n1. M365 → Settings (gear) → \"Search Microsoft 365\" → \"Search settings.\"\n2. Under **Open links in** → \"Default browser.\"\n\n### Stop Windows Update from resetting defaults\nWindows feature updates (annual major versions) sometimes reset defaults to Edge. Workaround:\n1. After each feature update, recheck defaults.\n2. **Group Policy** (Pro/Enterprise editions only): Computer Configuration → Administrative Templates → Windows Components → File Explorer → \"Do not show the 'new application installed' notification\" — doesn't directly stop reset but reduces nag.\n3. For business: tell IT to use Intune Configuration Profile to lock browser defaults org-wide.\n\n## macOS — make Chrome the real default\n\n1. **System Settings → Desktop & Dock**.\n2. Scroll to **Default web browser**.\n3. Pick the browser you want.\n4. Done — macOS respects this consistently.\n\n### Mail.app and other Apple apps still opening Safari?\n- Restart the app.\n- If it persists, drag your Chrome icon out of Applications and back in once (forces macOS to re-index installed apps).\n\n## iOS — make Chrome / Firefox / Edge default for links\n\niOS 14+ lets you pick a non-Safari default browser.\n\n1. **Settings → Apps → Chrome (or Firefox / Edge / Brave / Arc)**.\n2. Tap **Default Browser App**.\n3. Select your choice.\n\nIf the option is missing:\n- You're on iOS < 14 — update OS.\n- The browser app isn't installed — install from App Store.\n- After install, you need to open the app once before iOS lists it as a candidate.\n\n**Note:** Even with Chrome set as default, some Apple-built apps (Mail, Messages quick-look, in-app web views in some apps) still open Safari. That's Apple, not your settings. No fix.\n\n## Android — make Chrome / Firefox / Edge / Brave default\n\n1. **Settings → Apps → Default apps → Browser app**.\n2. Pick your choice.\n3. Done.\n\nSome OEM skins (Samsung One UI, Xiaomi MIUI) bury this — search settings for \"default apps.\"\n\n## Specific edge cases\n\n### \"My PDF links open in Edge\"\nPDFs are a separate handler. Settings → Apps → Default apps → search \".pdf\" → assign to Chrome / Adobe Reader / preferred app.\n\n### \"After I install Brave / Arc, Windows nags about defaults\"\nThat's the browser's first-run prompt. If you decline, you can still set it later via Default apps.\n\n### \"I'm on a corporate-managed laptop and can't change defaults\"\nYour IT has locked it via Intune / Group Policy. Ask IT — they may have a security reason (Edge has stricter integration with Microsoft Defender / Conditional Access). Often they'll allow Chrome if you ask.\n\n### \"Slack / Discord / Notion are opening links in Edge\"\nThat's because each of those apps has its own setting (not Windows default). In each app: Settings → Advanced (or General) → \"Open links with default browser\" → On.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Defaults reset every reboot | L2 — possible policy / corporate management |\n| All file associations broken (not just browser) | L2 — registry corruption (Windows) |\n| Browser of choice not listed in Default apps | Install the browser, open it once, then return |\n| Default changes after every Windows feature update | Document and tell IT — known annoyance |\n| MDM-managed device blocks change | Ask IT — they likely have a reason |\n\n## Prevention\n\n- After any Windows feature update, spend 60 seconds verifying defaults.\n- Don't install random \"default app fixers\" from the internet — most are bloatware.\n- Keep your browser updated. Stable channel Chrome / Firefox / Edge auto-update.\n- On corporate devices, ask IT once for the official default-browser policy. Save the answer.\n\n## What ARIA can help with\n\nARIA can walk you through Default apps live, identify which app is overriding (Outlook / Teams / Slack / etc.), and give the exact path to fix each one for your OS version. ARIA cannot click \"Set default\" for you — that's a one-click action only you can do on a locked-down setting."
  },
  {
   "slug": "l1-browser-003-saml-sso-redirect-loop",
   "path_rel": "knowledge-base\\top50-gaps\\l1-browser-003-saml-sso-redirect-loop.md",
   "title": "\"SSO sign-in loops endlessly — SAML / Microsoft / Okta redirect bouncing\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-browser-003\ntitle: \"SSO sign-in loops endlessly — SAML / Microsoft / Okta redirect bouncing\"\ncategory: browser\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 6\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - sso loop\n  - saml redirect loop\n  - sign-in bouncing\n  - cant sign in to slack\n  - okta login keeps redirecting\n  - microsoft login loop\n  - too many redirects\n  - identity provider loop\n  - cookies blocked sso\ntags:\n  - browser\n  - sso\n  - authentication\n  - top-50\nrelated: [l1-m365-001-cant-sign-in, l1-browser-001-pages-not-loading, l1-mfa-002-lost-authenticator-phone]\n---\n\n# SSO sign-in loop\n\n### Browser bounces between identity provider and app forever\n\nYou click \"Sign in with Microsoft / Google / Okta\" and the browser cycles through login pages without ever landing on the app. Open a fresh InPrivate / Incognito window. Try the SSO sign-in there. If it works in private mode but not regular, your normal browser has stale cookies — clear cookies for the specific identity provider domain (see next bit).\n\n### Clear cookies for login.microsoftonline.com / okta.com / accounts.google.com\n\nChrome: click the lock icon in address bar while on the IdP login page → Site settings → Clear data. Or Settings → Privacy & security → Cookies → \"See all site data\" → search for the IdP domain → trash. Repeat for the target app domain (e.g. slack.com). Sign in fresh.\n\n### Third-party cookies blocked — most common cause in 2025+\n\nChrome and Edge are phasing out third-party cookies; SSO often relies on them. Settings → Privacy → Cookies → set to \"Block third-party cookies in Incognito\" instead of \"Block all third-party cookies.\" Or add exceptions for login.microsoftonline.com, okta.com, login.live.com, accounts.google.com. Restart browser, retry SSO.\n\n### Browser profile is in a bad state — try a different profile or browser\n\nSometimes only one Chrome profile is broken. Click profile picture top-right → switch to a different profile → try SSO there. Or open a different browser entirely (Edge, Firefox) to confirm whether the issue is profile-specific or system-wide. Profile-specific = create fresh profile, copy over what you need.\n\n### Conflicting browser extensions\n\nAd blockers (uBlock Origin, AdGuard) and privacy extensions can block SSO redirects. Disable ALL extensions: chrome://extensions → toggle each off. Try SSO. If it works, re-enable one at a time to find the culprit. Whitelist the SSO domains in the offending extension.\n\n### Clock is wrong on your device\n\nSSO uses SAML or OAuth tokens that include timestamps. If your clock is more than 5 minutes off UTC, the identity provider rejects tokens as expired or future-dated. Check: Windows Settings → Time & language → Date & time → \"Set time automatically\" ON. Mac System Settings → General → Date & Time → \"Set automatically\" ON. Restart browser after correction.\n\n### Different account is signed in to the IdP\n\nMicrosoft sign-in flow is sticky to whichever account last signed in to login.microsoftonline.com. If you have personal + work Microsoft accounts, the personal might be intercepting. Open login.microsoftonline.com → sign out completely → close all browser windows → reopen → try SSO again. Force-prompt: append `?prompt=login` to the SSO URL.\n\n### When to escalate to L2\n\nLoop persists after Incognito + cookie clear + clock check. Multiple users in your org hit the same loop today (likely IdP outage — check status of your IdP). Error code visible (AADSTS, OKTA-, GSO-) → L2 reads the IdP sign-in log. App-side SAML config broken (SP error rather than IdP) → L2/admin reconfigures."
  },
  {
   "slug": "l1-calendar-001-outlook-calendar-issues",
   "path_rel": "knowledge-base\\top50-gaps\\l1-calendar-001-outlook-calendar-issues.md",
   "title": "\"Outlook calendar problems — meetings missing, double-booked, won't sync\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-calendar-001\ntitle: \"Outlook calendar problems — meetings missing, double-booked, won't sync\"\ncategory: outlook\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - outlook calendar\n  - calendar\n  - meeting missing\n  - meeting disappeared\n  - double booked\n  - calendar sync\n  - shared calendar\n  - calendar permissions\n  - delegate\n  - free busy\n  - free/busy\n  - room calendar\n  - resource calendar\n  - calendar invite\n  - .ics\nrelated_articles:\n  - l1-outlook-001-not-receiving-emails\n  - l1-outlook-002-cant-send-emails\n  - l1-calendar-002-out-of-office-setup\nescalation_trigger: \"Calendar shows different events on different devices for the same account AND clearing cache + rebuild profile doesn't fix → Exchange Online sync issue, L2 to check mailbox database / repair calendar.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Outlook calendar problems — meetings missing, double-booked, won't sync\n\n## 1. Symptoms\n- Meeting that was on calendar yesterday is gone today.\n- Meeting shows on phone but not laptop (or vice versa).\n- You accepted a meeting but the organizer says you didn't.\n- Free/busy shows you as busy when you're not (or free when you're busy).\n- Shared calendar doesn't update.\n- Room or resource calendar shows wrong info.\n\n## 2. Step-by-Step Triage\n\n### Step 1 — Check the calendar on Outlook on the Web\n- Open a browser → `https://outlook.office.com` → sign in → click Calendar icon.\n- This is the source of truth. If meeting EXISTS in web but NOT on your phone / desktop → device sync issue. If meeting DOESN'T EXIST in web either → it was deleted (by you or someone with permission, or rule auto-processed it).\n\n### Step 2 — Devices not syncing fix\n\n**Outlook Desktop (Win/Mac):**\n1. File → Account Settings → Account Settings → click your account → Repair.\n2. Wait for repair to complete.\n3. Restart Outlook.\n4. If still missing: File → Account Settings → Account Settings → Data Files → check your `.ost` or `.olm` file location → close Outlook → rename the .ost (Win) or move .olm (Mac) → reopen Outlook → it rebuilds the cache from server.\n\n**iPhone Outlook app:**\n1. Settings (gear icon) → tap your account → Reset Account.\n2. Confirm reset. Outlook downloads everything fresh.\n\n**Android Outlook app:**\n1. Tap your profile → Settings → tap your account → Reset Account.\n\n### Step 3 — Missing or moved meeting?\n- Check Outlook **Deleted Items** folder — calendar items can land there if a rule moves invitation emails.\n- Outlook on the Web → Calendar → click the small icon at top of date → **All my calendars** → toggle each calendar on/off to see if it's just hidden.\n- Look at meeting in question's Tracking tab: if you Declined accidentally, you can re-accept from the invite email (search Sent / Deleted).\n\n### Step 4 — Double-booked? Check delegates\n- File → Account Settings → Delegate Access (Win) or Tools → Accounts → Delegation (Mac).\n- See if anyone has delegated access to your calendar — they may be accepting meetings on your behalf.\n- Remove or restrict delegates as appropriate.\n\n### Step 5 — Shared calendar not updating\n- Right-click the shared calendar → Open in New Window → File → Account Settings → Account Settings → Data Files → ensure the shared calendar is set to download full details, not just headers.\n- For Outlook Desktop: File → Options → Advanced → \"Send / Receive\" → Send/Receive Groups → check that shared mailboxes update on the same schedule.\n- If still stale: remove the shared calendar (right-click → Delete Calendar → Don't delete underlying data) → re-add via \"Open Shared Calendar.\"\n\n### Step 6 — Free / Busy wrong\n- Microsoft 365 calendar visibility is set per-user. If others see you as always \"Free\" or \"No Information\": Outlook on the Web → Settings → Calendar → Shared calendars → \"Publish a calendar\" → set visibility level.\n- For \"Busy\" when you're free: check for stuck/recurring meetings far in the future.\n\n### Step 7 — Room / resource calendar wrong\n- Resource calendars are owned by IT. If a room is showing wrong availability, it's a back-end issue.\n- Self-serve check: book a test meeting in the room from your own calendar → wait 1 min → look at the room's calendar → should appear. If not, IT needs to investigate.\n\n## 3. Verification Steps\n- Calendar shows same events on web, desktop, and mobile.\n- Free / busy displays correctly to coworkers (test by creating a draft meeting and looking at the Scheduling Assistant).\n- Shared calendar reflects recent changes within 5 minutes.\n\n## 4. When to Call IT\n- Calendar repairs / rebuilds don't restore missing meetings.\n- Mailbox is showing different event sets on different devices that won't reconcile.\n- Resource (room / equipment) calendars show wrong availability.\n- \"Items cannot be displayed\" errors with all repair attempts exhausted.\n\n## 5. Prevention Tips\n- **Accept all meetings from the invite email.** Don't drag-drop meetings from email to calendar — creates duplicates.\n- **Use Outlook on the Web** as the source of truth if devices disagree.\n- **Check delegate access quarterly** — old delegates should be removed.\n- **Don't share your calendar with \"All Details\"** to large distribution lists. \"Limited Details\" or \"Availability Only\" for most people.\n\n## 6. User-Friendly Explanation\nFirst, check Outlook on the web at outlook.office.com — that's the source of truth. If it shows what you expect, your phone or desktop isn't syncing — reset the account on that device. If it doesn't show what you expect either, the meeting was deleted or moved. We can usually recover it from Deleted Items. If multiple devices show different things and won't agree, we may need IT to repair the back-end calendar.\n\n## 7. Internal Technician Notes\n- Outlook Desktop / .ost cache rebuild: Outlook → Cancel sync → close → rename .ost in `%LocalAppData%\\Microsoft\\Outlook\\` → reopen Outlook → resync.\n- Outlook for Mac / .olm: Outlook → Preferences → Accounts → click account → \"Allow this account to deliver mail and reminders\" toggle (off, then back on).\n- Calendar repair via cmdlet (PowerShell + Exchange Online Management module): `New-MailboxRepairRequest -Identity user@company.com -CorruptionType ProvisionedFolder,SearchFolder,AggregateCounts,FolderView`\n- Stuck meeting cleanup: Folder pane → right-click → Properties → Repair (deprecated in newer Outlook). Newer: server-side via mailbox repair.\n- Free/Busy info served by Outlook Address Book + Exchange Web Services (EWS) calls. EWS calls cached for 15 minutes per default.\n- iOS Outlook reset wipes local cache. Account creds remain.\n\n## 8. Related KB Articles\n- `l1-outlook-001` — Outlook not receiving emails\n- `l1-outlook-002` — Outlook can't send emails\n- `l1-calendar-002` — Out-of-Office setup\n\n## 9. Keywords / Search Tags\noutlook calendar, calendar, meeting missing, meeting disappeared, double booked, calendar sync, shared calendar, calendar permissions, delegate, free busy, free/busy, room calendar, resource calendar, calendar invite, .ics, .ost rebuild, .olm"
  },
  {
   "slug": "l1-calendar-002-out-of-office-setup",
   "path_rel": "knowledge-base\\top50-gaps\\l1-calendar-002-out-of-office-setup.md",
   "title": "\"Out-of-Office (Automatic Replies) — set up correctly for time away\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-calendar-002\ntitle: \"Out-of-Office (Automatic Replies) — set up correctly for time away\"\ncategory: outlook\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - out of office\n  - ooo\n  - automatic replies\n  - auto reply\n  - away from desk\n  - vacation\n  - autoresponder\n  - vacation responder\n  - delegate\n  - inbox rules\nrelated_articles:\n  - l1-calendar-001-outlook-calendar-issues\n  - l1-outlook-001-not-receiving-emails\nescalation_trigger: \"User can't set OOO because the option is greyed out in all interfaces — likely admin policy blocking. Escalate to L2 for tenant config check.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Out-of-Office (Automatic Replies) — set up correctly for time away\n\n## 1. Symptoms\nUser going on vacation / leave / travel. Wants Outlook to auto-reply to incoming emails with an away message + redirect urgent contacts.\n\n## 2. Step-by-Step Setup — Microsoft 365 / Exchange Online\n\n### Best path: Outlook on the Web (works everywhere, syncs to all devices)\n\n**Step 1 — Open Outlook on the Web.**\n- Browser → `https://outlook.office.com` → sign in.\n\n**Step 2 — Open Settings.**\n- Click the **gear icon** (top right) → click **View all Outlook settings** at the bottom of the side panel.\n- *(What you should see: A settings panel slides in. If it shows just a few options, click \"View all\" at the bottom.)*\n\n**Step 3 — Navigate to Automatic Replies.**\n- Left pane: **Mail** → **Automatic replies**.\n\n**Step 4 — Toggle ON.**\n- Click **Turn on automatic replies**.\n\n**Step 5 — Set time range (optional but recommended).**\n- Check **Send replies only during a time period**.\n- Pick start date and end date.\n- *(Why: ensures OOO turns OFF automatically when you return. People hate \"OOO until further notice\" replies coming back in March.)*\n\n**Step 6 — Compose the internal reply (people in your org).**\n- Write a clear message. Example:\n  - *Hello, I'm out of the office from [start] to [end]. For urgent matters please contact [colleague name] at [email]. Otherwise I'll respond when I'm back.*\n- Keep it short — most people just need to know you're away and when you're back.\n\n**Step 7 — Compose the external reply (optional).**\n- Toggle **Send replies outside your organization**.\n- Decide: All external senders or only contacts.\n- Write a slightly shorter external version (less personal info, no internal phone numbers).\n\n**Step 8 — Save.**\n- Click **Save**.\n- *(What you should see: A confirmation toast \"Automatic replies are turned on\" and the toggle stays green.)*\n\n### Outlook Desktop (Win/Mac) — alternative path\n\n**Win:**\n1. File → Automatic Replies.\n2. Select \"Send automatic replies.\"\n3. Set date range, internal message, external message.\n4. OK.\n\n**Mac:**\n1. Tools menu → Automatic Replies.\n2. Same fields.\n\n### Mobile Outlook (iOS / Android)\n\n1. Profile (top-left) → **Settings** (gear).\n2. Tap your account → **Automatic Replies**.\n3. Toggle on → set dates + message.\n4. Save.\n\n## 3. Common OOO Mistakes\n\n- **No end date.** Set one. Avoid \"OOO until further notice\" sticking forever.\n- **No urgent contact.** Always give an alternate human or team.\n- **Too much detail externally.** Don't tell strangers exactly when your house will be empty.\n- **Internal jargon in external version.** Write external version in plain language.\n- **Auto-forwarding to personal email.** Common bad pattern — defeats company security. Use a colleague instead.\n\n## 4. Verification Steps\n- Send yourself a test email from a personal Gmail / iCloud account.\n- You should receive the external auto-reply within 1-2 minutes.\n- Send from another work email (a coworker can help) — you should receive the internal version.\n- Bonus: open Outlook → confirm the orange OOO banner appears at the top of your mailbox.\n\n## 5. Additional Coverage (for longer absences)\n\nFor longer than ~5 days, set up these in addition to OOO:\n\n1. **Calendar block.** Block your calendar from start to end as \"Out of Office\" (not \"Busy\") so meetings auto-decline / route to delegates.\n2. **Delegate.** Outlook Web → Settings → General → Delegation → add a delegate. Choose: Send on my behalf only OR Send as me.\n3. **Slack / Teams status.** Set the matching away status with same dates in Slack and Teams.\n4. **Phone voicemail.** Update voicemail greeting.\n5. **Calendar handoff.** Send a heads-up to your top 5-10 frequent collaborators.\n\n## 6. When to Call IT\n- The OOO option is greyed out / not available → admin policy blocking. IT must enable in tenant config.\n- Auto-reply not actually sending to external senders → check tenant's anti-spam outbound rules (admin level).\n- OOO sending duplicate replies to the same person — rare bug, IT to repair mailbox.\n\n## 7. Prevention Tips\n- **Set OOO BEFORE you leave**, not from the airport.\n- **Test it before leaving.** Send yourself a test from a personal account.\n- **Use the time range feature** so it auto-disables.\n\n## 8. User-Friendly Explanation\nGo to outlook.office.com → click the gear icon → search for \"Automatic replies\" → toggle it on → set start and end dates → write your message → save. Test it by sending yourself an email from your personal account. The internal version is for coworkers, the external version is for everyone outside the company. Always include an end date and a backup contact.\n\n## 9. Internal Technician Notes\n- OOO state stored in mailbox as `OOFConfig` MAPI property + retrieved via EWS / Graph.\n- Admin tenant policy: Exchange Admin Center → Mail flow → Remote domains → can disable external OOO globally.\n- For shared mailbox OOO: only the primary delegate with Full Access + Send As can set OOO from web; alternate path is PowerShell `Set-MailboxAutoReplyConfiguration` (Exchange Online Management module).\n- Group / distribution list mailboxes have no OOO (they're not mailboxes).\n- OOO de-duplication: Exchange Online suppresses sending the same OOO message to the same sender within a 24-hour window per default.\n- Mobile Outlook OOO writes through Graph API → identical to web behavior.\n\n## 10. Related KB Articles\n- `l1-calendar-001` — Outlook calendar issues\n- `l1-outlook-001` — Outlook not receiving emails\n\n## 11. Keywords / Search Tags\nout of office, ooo, automatic replies, auto reply, away message, vacation responder, autoresponder, delegate, time off, leave, vacation, holiday"
  },
  {
   "slug": "l1-calendar-003-invites-missing-or-duplicating",
   "path_rel": "knowledge-base\\top50-gaps\\l1-calendar-003-invites-missing-or-duplicating.md",
   "title": "\"Meeting invites missing, duplicating, or showing on wrong calendar\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-calendar-003\ntitle: \"Meeting invites missing, duplicating, or showing on wrong calendar\"\ncategory: calendar\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\", \"Web\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Outlook / Calendar app installed and signed in\"]\nkeywords:\n  - meeting invite missing\n  - cant find calendar event\n  - duplicate meeting\n  - event shows twice\n  - meeting on wrong calendar\n  - shared calendar issue\n  - declined invite still appears\n  - outlook calendar not syncing\n  - teams meeting in outlook calendar\n  - recurring meeting wrong\ntags:\n  - calendar\n  - outlook\n  - meetings\n  - top-50\nrelated: [l1-calendar-001-outlook-calendar-issues, l1-calendar-002-out-of-office-setup, l1-outlook-001-not-receiving-emails]\n---\n\n# Meeting invites missing, duplicating, or on wrong calendar — fix\n\n## Symptoms\n\n- Colleague says \"I sent the invite\" — you never see it\n- Same meeting appears twice in your calendar\n- Recurring meeting shows on some days but not others\n- Meeting on your personal calendar instead of work\n- Declined a meeting but it still appears on your calendar\n- Outlook on phone shows event, desktop doesn't (or vice versa)\n- Shared/team calendar event missing for one person, visible for others\n\nMost calendar issues fall into 4 root causes. Identify which → fix.\n\n## Root cause 1 — Invite went to a different folder\n\n### \"I never got the invite\"\nCheck (in this order):\n1. **Junk / Spam folder.** Many corporate filters mis-classify meeting invites, especially from external senders.\n2. **Other inbox folder.** Rules may have moved it. Outlook → search the sender's name.\n3. **Conference room calendar** (if the meeting room is the organizer). Sometimes Teams meetings invite the room, not you.\n4. **Wrong email address.** Did the sender use your old address? Check \"To:\" line if you find the invite.\n\n**Fix:** ask the sender to re-send. Or check the org's distribution list — you may have been removed.\n\n### \"Outlook doesn't show it, but I see the invite in email\"\nThe invite landed but wasn't processed. Could be:\n- You're on Outlook mobile that's out of sync — pull to refresh.\n- Outlook desktop is offline — File → Account Info → check connection status.\n- The .ics attachment is corrupt — ask sender to re-send.\n\n## Root cause 2 — Duplicate events\n\n### Common reasons\n1. **Imported a calendar twice.** Common when migrating between systems.\n2. **Multiple email clients syncing the same calendar.** iCloud + Outlook + Google all subscribed to the same work calendar.\n3. **iCloud showing your work calendar via subscription.**\n4. **Teams meeting + Outlook meeting + Calendar app all displaying the same event.**\n\n### Fix — find the duplicate source\n\n**On iPhone:**\n1. Settings → Calendar → Accounts.\n2. Look at each account — is your work calendar showing up under both iCloud AND your Exchange account?\n3. Turn off \"Calendars\" sync on one of them.\n4. Restart Calendar app — duplicates should clear.\n\n**On Outlook desktop:**\n1. View → Folder Pane → Folder List.\n2. Look at the calendar folders — duplicates often hide under multiple account groups.\n3. Right-click the duplicate → \"Remove from view\" (doesn't delete, just hides).\n\n**On macOS Calendar:**\n1. Calendar → Settings → Accounts.\n2. Each account has calendar checkboxes. Uncheck the duplicate source.\n\n### \"Same meeting shows at different times\"\nTime zone issue. Check:\n- Outlook → File → Options → Calendar → Time zones — confirm your zone is correct.\n- iPhone: Settings → General → Date & Time → \"Set Automatically\" ON.\n\n## Root cause 3 — Shared calendar / delegate issue\n\n### \"Boss's calendar isn't showing\"\n1. Outlook → File → Open & Export → Other User's Folder → type their email → Calendar.\n2. Or right-click \"My Calendars\" → Add Calendar → From Address Book.\n3. Permissions: they need to share with you. Ask them: \"Right-click your calendar → Sharing Permissions → add me with Reviewer or Editor access.\"\n\n### \"I'm a delegate but can't accept invites for them\"\nDelegate permissions need to be set up on the BOSS's account, not yours:\n- Boss's Outlook → File → Account Settings → Delegate Access → Add → you → Set permissions.\n- Then in your Outlook: invite arrives → accept → boss's calendar updates.\n\n## Root cause 4 — Recurring meeting weirdness\n\n### \"Recurring meeting shows on most days but not all\"\nLikely: organizer modified a single instance and the modification deleted that occurrence.\n- Look in email for \"Updated meeting\" or \"Canceled meeting\" from organizer.\n- Or recurring meeting hit its end date.\n\n### \"I declined one instance, but the whole series disappeared\"\nThis used to happen — declining a single instance sometimes deleted the series. Modern Outlook handles it correctly. If your Outlook is old, update.\n\n### \"Recurring meeting moved by 1 hour after DST\"\nTime zone of organizer ≠ time zone of meeting. Fix: organizer needs to recreate the series with explicit time zone. Annoying but standard issue.\n\n## Specific scenarios\n\n### \"Calendar invite shows in Teams but not Outlook\"\nTeams calendar IS the Outlook calendar — they should always match. If they don't:\n- Outlook is offline — File → Send/Receive → All Folders.\n- Or your Outlook profile is out of sync. Restart Outlook. If still off, repair the profile (Control Panel → Mail → Profiles → Repair).\n\n### \"I declined but it still appears in my calendar\"\nYou declined but didn't actually remove. By default, declined meetings stay on calendar for visibility.\n- Outlook → File → Options → Calendar → \"When I respond to a meeting request, delete the original message from my Inbox\" — toggle.\n- Or right-click the declined event → Delete.\n\n### \"Phone shows invite, laptop doesn't\"\nAlmost always a sync lag. Force sync:\n- Outlook: File → Send/Receive → All Folders.\n- iPhone: pull-down refresh in Calendar app.\n- Wait 60 seconds.\n\n### \"Meeting on personal Outlook calendar instead of work\"\nYou accepted from your personal email. Sender sent to both. Accept from work email instead. Delete the personal-calendar event.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Calendar entirely out of sync, not just one event | L1 — restart + force sync, then L2 if persists |\n| Delegate permissions don't appear after setup | L2 — Exchange / Entra calendar permissions issue |\n| Calendar disappears after Outlook update | L2 — profile repair |\n| Recurring meetings constantly recreating themselves | L2 — possibly a corrupt event needs admin Powershell |\n| Multiple users in same org report missing invites | L2 — Exchange transport rule or service issue |\n\n## Prevention\n\n- Use **one** calendar client per device — don't sync Outlook + iCloud + Google all to the same screen.\n- Set your default account in Outlook to your work email.\n- Don't accept invites from email previews — open the actual invite to make sure it adds to the right calendar.\n- Keep your Outlook updated (especially mobile — old versions have known sync bugs).\n\n## What ARIA can help with\n\nARIA can walk you through identifying which of the 4 root causes applies, navigating each fix step-by-step, and clarify whether the issue is sender-side or receiver-side. ARIA cannot accept invites on your behalf (that's an explicit user action)."
  },
  {
   "slug": "l1-camera-003-being-used-by-other-app",
   "path_rel": "knowledge-base\\top50-gaps\\l1-camera-003-being-used-by-other-app.md",
   "title": "\"Camera says 'in use by another app' — release the lock\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-camera-003\ntitle: \"Camera says 'in use by another app' — release the lock\"\ncategory: webcam\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - camera in use\n  - camera being used by another app\n  - cant access camera\n  - webcam locked\n  - release camera\n  - camera unavailable\n  - 0xa00f4243\n  - other app is using your camera\ntags:\n  - webcam\n  - camera\n  - top-50\nrelated: [l1-webcam-001-camera-not-working, l1-webcam-002-virtual-background-filter, l1-meeting-audio-001-wrong-device]\n---\n\n# Camera locked by another app\n\n### \"Your camera is being used by another application\"\n\nAnother app has an exclusive camera hold. Most common culprits in 2026: Microsoft Teams (background process), Zoom in system tray, an open browser tab with camera permission, OBS / Streamlabs, Snap Camera. Quit them all. Windows: Task Manager → end any ms-teams.exe, Zoom.exe, OBS64.exe. Mac: ⌘+Option+Esc → force quit. Retry the camera in your target app.\n\n### Restart the camera-using app, not the camera\n\nAfter releasing the lock, the new app sometimes still can't grab it because of a stale device handle. Fix: fully quit the app that needs camera, wait 10 seconds, reopen. Don't just minimize — fully quit. Then try again. Camera usually grants on the second try.\n\n### Browser tabs holding camera silently\n\nChrome / Edge keep camera permission for open tabs even when the page seems idle. Click the camera icon in the browser address bar of the active tab → see which tabs have camera open. Or chrome://settings/content/camera → review allowed sites and block any you don't actively need. Close stale tabs.\n\n### Snap Camera is installed — known cause of camera lock-up\n\nSnap Camera (the filter app) registers itself as a virtual camera and frequently jams the real camera device. If you don't actively use Snap Camera: uninstall it. If you do: completely quit it from the system tray before opening meeting apps. Don't let it auto-start with Windows.\n\n### Camera works on built-in but not on USB webcam (or vice versa)\n\nMultiple cameras → app picks the wrong one or refuses both. In the meeting app's video settings, explicitly select the camera you want. In Windows: Settings → Bluetooth & devices → Cameras → click the camera → \"Disable\" the one you don't want, leaving only one active. Restart the meeting app.\n\n### Camera physical privacy shutter is closed\n\nMany laptops (ThinkPad, HP EliteBook, Dell Latitude) have a sliding privacy shutter over the lens. Visually check the webcam. If lens is covered, slide it open. The OS still reports \"camera detected\" because the device is electronically online, but no image gets through.\n\n### Error code 0xA00F4243 — TROUBLEDLIST (Windows)\n\nSpecific Windows error meaning camera driver is in conflict with a service. Quick fix: Settings → Privacy & security → Camera → toggle \"Camera access\" OFF → ON. This bounces the camera service. If still fails: Device Manager → Cameras → right-click your camera → Disable → wait 10 sec → Enable.\n\n### When to escalate to L2\n\nCamera unavailable across every app, every restart, every browser. Camera shows in Device Manager with yellow exclamation mark (driver issue). Camera works in Voice Recorder but fails everywhere else. Brand-new laptop, camera never worked — possibly hardware DOA, return for replacement."
  },
  {
   "slug": "l1-clock-001-time-drift-breaking-sign-ins",
   "path_rel": "knowledge-base\\top50-gaps\\l1-clock-001-time-drift-breaking-sign-ins.md",
   "title": "\"Clock is wrong — breaking sign-ins, certs, and meeting times\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-clock-001\ntitle: \"Clock is wrong — breaking sign-ins, certs, and meeting times\"\ncategory: system\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 4\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - clock wrong\n  - time off\n  - cert error\n  - your connection is not private\n  - sign-in failed time skew\n  - kerberos clock skew\n  - cant sign in microsoft\n  - calendar showing wrong time\n  - time sync failed\ntags:\n  - system\n  - time\n  - authentication\n  - top-50\nrelated: [l1-browser-003-saml-sso-redirect-loop, l1-m365-001-cant-sign-in]\n---\n\n# Clock drift breaking sign-ins\n\n### \"Your connection is not private\" — NET::ERR_CERT_DATE_INVALID\n\nYour clock is more than 5 minutes off real time. SSL certs are date-bound; browser thinks they're expired or future-dated. Open Settings → fix clock first, then retry the site. Don't click \"Proceed anyway\" — fixing the time fixes every site at once.\n\n### Windows clock keeps drifting — re-sync to time.windows.com\n\nSettings → Time & language → Date & time → \"Set time automatically\" should be ON. Click \"Sync now\" under \"Additional settings\" — pulls fresh time from Microsoft's servers. If sync fails, switch source: same page → click the time server dropdown → try `pool.ntp.org` or `time.nist.gov`. Apply, sync again.\n\n### Mac clock drift\n\nSystem Settings → General → Date & Time → \"Set time and date automatically\" ON. Source defaults to `time.apple.com`. If sync silently fails, run `sudo sntp -sS time.apple.com` in Terminal — forces a sync with output you can read. Restart if clock still wrong after.\n\n### Sign-in failures right after I left a different time zone\n\nTime zone is correct but the clock's offset got stuck. Restart the machine — usually fixes it. Or toggle time zone Settings → Date & time → set time zone manually wrong → back to correct → resync.\n\n### iPhone / Android — calendar showing wrong meeting times\n\nTime zone of your phone is wrong. iOS: Settings → General → Date & Time → set automatic. Android: Settings → System → Date & time → automatic. If you fly often: keep \"Automatic time zone\" ON; iOS uses GPS + cellular to detect zone changes.\n\n### Domain-joined PC — Kerberos clock skew error\n\nDomain controllers enforce strict clock sync (5 min max). If you see \"Kerberos clock skew\" or \"time difference too great\" in logs, your machine isn't syncing with the domain. Admin cmd: `w32tm /resync /force`. If still skewed, `w32tm /config /update /manualpeerlist:dc01.company.local /syncfromflags:manual` (replace with your DC). Then resync.\n\n### Battery-pulled-laptop clock reset to 2009 or 2001\n\nMotherboard CMOS battery is dying. Time resets on every boot. Replace CMOS battery (CR2032 coin cell, $3, takes 5 min if you can open the laptop OR a tech does it). Until replaced: enable \"Set time automatically\" — clock will be wrong at boot but corrects within seconds online.\n\n### When to escalate to L2\n\nTime sync fails on every server (network blocking NTP port 123 outbound). Multiple PCs in office show wrong time → upstream NTP server problem, L2 checks. Domain-joined PC shows persistent Kerberos skew despite manual resync → AD time hierarchy is broken, L2/AD admin fixes from the top down."
  },
  {
   "slug": "l1-conference-001-conference-room-av-not-working",
   "path_rel": "knowledge-base\\top50-gaps\\l1-conference-001-conference-room-av-not-working.md",
   "title": "\"Conference room AV not working — projector, mic, camera, Teams Room\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-conference-001\ntitle: \"Conference room AV not working — projector, mic, camera, Teams Room\"\ncategory: hardware\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - conference room\n  - meeting room\n  - av\n  - audio video\n  - projector\n  - tv\n  - teams room\n  - zoom room\n  - microphone\n  - mic\n  - camera\n  - poly\n  - logitech rally\n  - crestron\n  - hdmi\n  - dongle\n  - airplay\n  - miracast\n  - chromecast\nrelated_articles:\n  - l1-display-001-external-monitor-not-detected\n  - l1-teams-001-audio-not-working\n  - l1-teams-002-wont-load-stuck-splash\nescalation_trigger: \"Conference room hardware physically dead (no power, no display) OR scheduled meeting starting in <5 min and ALL options failing → call IT emergency line for in-person help.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Conference room AV not working\n\n## 1. Symptoms\nUser in a conference room, meeting starting soon (or in progress), and the AV won't cooperate. Common patterns:\n- TV / projector won't turn on or shows wrong input.\n- Their laptop won't share screen.\n- Mic doesn't work for remote attendees.\n- Camera doesn't show or freezes.\n- Teams Room / Zoom Room console is unresponsive.\n\n## 2. The 60-Second Triage (do FIRST)\n\n1. **TV / Projector power.** Press the remote's power button. Look for power LED on the device.\n2. **Right input?** TV remote → Source / Input → cycle through HDMI 1, HDMI 2, USB-C, etc.\n3. **Cable both ends seated.** Wiggle and re-seat the HDMI / USB-C cable into your laptop and into the wall plate.\n4. **Try a different cable.** Most conference rooms have spares in the credenza / cabinet. Cheap HDMI cables fail constantly.\n\nIf still no joy after 60 seconds, continue.\n\n## 3. Sharing Your Laptop to the Room TV\n\n### Wired path (most reliable, do first)\n\n1. Plug the room's HDMI / USB-C cable into your laptop.\n2. Press **Win + P** (Windows) or **System Settings → Displays** (Mac).\n3. Choose **Duplicate** (mirror) or **Extend**.\n4. Set the room TV to the input matching the wall plate.\n\nIf the TV says \"No signal\" with a working cable:\n- Switch laptop's display mode (Win+P → cycle through PC screen only / Duplicate / Extend / Second screen only).\n- Resolution mismatch: Settings → Display → Resolution → try 1920×1080 explicitly. Some older TVs hate higher rates.\n\n### Wireless paths\n\n**Microsoft Teams Room:**\n- Open Teams on laptop → click your meeting → click **Join** with content sharing → select \"Cast to this room\" if Bluetooth proximity detected.\n- OR get the room's join code (displayed on the room console) → enter from your laptop.\n\n**Zoom Room:**\n- Open Zoom → Share Screen → enter the room's sharing key (visible on the room console).\n\n**AirPlay (Apple TV in room or Mac mini receiver):**\n- Click the AirPlay icon in Mac's menu bar → select the room's name.\n\n**Miracast (Windows-native cast):**\n- Win+K → select the room's display (if room has Miracast receiver).\n\n**Google Chromecast / Meet hardware:**\n- Chrome → 3-dot menu → Cast → select the room.\n\n## 4. Microphone Problems\n\nIn a meeting, mic isn't picking up:\n\n1. **Mute button on table mic / ceiling mic.** Look for a physical button with a red light. Tap it.\n2. **In meeting app:** Teams / Zoom / Meet → check mic input device. Should be \"[Room name] Mic\" or \"Crestron Mic\" or similar — NOT your laptop's built-in.\n3. **Test:** click test mic in Teams → speak normally → should show level bar moving.\n\nIf mic shows in input list but no audio:\n- Sometimes a power-cycle of the AV system reset (if there's an \"End/Restart\" button on the room console) fixes it.\n\n## 5. Camera Problems\n\n- **Lens cover.** Some Poly / Logitech cameras have privacy covers. Push to retract.\n- **Wrong camera selected** in meeting app: Settings → Video → choose the room camera (e.g., \"Poly Studio X70\" not \"Integrated Webcam\").\n- **Camera frozen:** restart the room console — usually a button labeled \"Reboot Console\" on Crestron / Poly / Logitech panels.\n\n## 6. Teams Room / Zoom Room Console Unresponsive\n\n- Press the screen firmly — may have gone to sleep.\n- Wait 30 seconds — sometimes loading.\n- Look for a hidden RESET pinhole on the console (usually back / bottom).\n- If still dead: power-cycle by unplugging the console for 10 seconds and re-plug. Console reboot takes ~3 minutes.\n\n## 7. Last-Resort Workarounds (meeting starting NOW)\n\n- **Use your laptop's screen + speakers** for the meeting (forget the TV). Lean into the laptop's mic. Works in person with smaller groups.\n- **Phone hotspot for connectivity** if room Wi-Fi is also down.\n- **Move meetings to another room** — most offices have multiple.\n- **Send the meeting link to attendees and join from your laptop, not the room system.** Attendees on Zoom / Teams won't care which device you're on.\n\n## 8. When to Call IT (Emergency)\n\n- Meeting starts in < 5 minutes AND nothing in this guide is helping.\n- The whole AV system in the room is unresponsive (no screen, no console, no lights).\n- Sound system feedback / loud noises (turn down volume immediately, call IT).\n- Network connectivity confirmed dead in the room (Wi-Fi + Ethernet both fail in that room).\n\n**Tell IT:**\n- Room name + building.\n- Meeting start time.\n- What's failing.\n- What you already tried.\n\n## 9. Prevention Tips\n- **Arrive 5 minutes early** — gives buffer for \"30-second AV issue\" turning into a real problem.\n- **Familiarize yourself with the room's panel** at low-stakes time, not during a board meeting.\n- **Keep a USB-C → HDMI dongle in your laptop bag.** Solves 30% of AV problems.\n- **Reserve rooms with known-good AV** for important meetings.\n- **Test the room** 24h before customer demos: walk in, run a quick share + mic + camera test.\n\n## 10. User-Friendly Explanation\nMost conference room AV issues are: wrong input on the TV (use the remote's Source button), cable not seated (re-plug), or wrong audio/video device selected in Teams/Zoom (change in app settings). If a meeting is starting in 5 minutes and nothing works, just join from your laptop screen + speakers, or use a different room. Don't lose 20 minutes wrestling with the AV — your meeting matters more.\n\n## 11. Internal Technician Notes\n- Common AV stacks:\n  - **MS Teams Room (MTR) systems:** Logitech Tap + Rally Bar, Poly Studio X70/X50, Crestron Flex, Lenovo ThinkSmart, Yealink MVC.\n  - **Zoom Rooms:** Logitech Rally, Neat Bar, Poly Studio.\n  - **Decoupled:** TV + soundbar + USB camera (e.g., Logitech MeetUp).\n- Console reboot path varies; commonly a hidden button or in admin settings.\n- Network: AV systems often on isolated VLAN. If room network down, console can't connect even if Wi-Fi works for laptops.\n- Daily reboot scheduled at 2 AM is best practice — keep firmware drift low.\n- For demanding meetings, dedicated MTR (always-on, ready-to-join) > BYOD share-from-laptop.\n\n## 12. Related KB Articles\n- `l1-display-001` — External monitor not detected\n- `l1-teams-001` — Teams audio not working\n- `l1-teams-002` — Teams won't load\n\n## 13. Keywords / Search Tags\nconference room, meeting room, av, audio video, projector, tv, teams room, mtr, zoom room, microphone, mic, camera, poly, logitech rally, neat bar, crestron, hdmi, dongle, airplay, miracast, chromecast"
  },
  {
   "slug": "l1-display-001-external-monitor-not-detected",
   "path_rel": "knowledge-base\\top50-gaps\\l1-display-001-external-monitor-not-detected.md",
   "title": "\"External monitor not detected — laptop won't show video on second screen\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-display-001\ntitle: \"External monitor not detected — laptop won't show video on second screen\"\ncategory: hardware\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - external monitor\n  - second monitor\n  - no signal\n  - hdmi not working\n  - displayport not working\n  - usb-c monitor\n  - usb c display\n  - thunderbolt display\n  - monitor blank\n  - extend display\n  - duplicate display\n  - docking station\nrelated_articles:\n  - l1-windows-006-app-wont-open\n  - l1-usb-001-device-not-recognized\n  - l1-windows-be-001-windows-11-25h1-copilot-plus\nescalation_trigger: \"Monitor works on another laptop but not yours, AND laptop's HDMI / USB-C port doesn't work with any monitor → port hardware failure, requires service ticket / replacement.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# External monitor not detected — laptop won't show video on second screen\n\n## 1. Symptoms\n- Connected an HDMI / DisplayPort / USB-C cable from laptop to monitor.\n- Monitor shows \"No Signal\" or stays black.\n- Laptop screen still works but won't extend to second display.\n\n## 2. Step-by-Step Triage\n\n### Step 1 — The dumb stuff (works 40% of the time)\n1. **Monitor power on?** Look at the monitor's own power indicator light.\n2. **Right input selected on monitor?** Press the monitor's **Source** / **Input** button. Cycle through HDMI 1, HDMI 2, DisplayPort, USB-C until you find the active one.\n3. **Cable both ends fully seated.** Unplug, plug back in firmly until click.\n\n### Step 2 — Try a different cable\n- HDMI cables fail more often than people think — especially long ones, or ones that have been bent.\n- Borrow a known-good cable. Replace the monitor cable.\n\n### Step 3 — Try a different port on the laptop\n- Most laptops have multiple HDMI / USB-C / Thunderbolt ports. Try a different one.\n- If ONLY one port is failing → that port is broken. Use a different port permanently and ignore.\n\n### Step 4 — Force display detection\n**Windows 11:**\n1. Right-click on desktop → **Display settings**.\n2. Scroll down → click **Detect** (or **Detect other displays**).\n3. Wait 5 seconds.\n\n**Windows 10:** same path.\n\n**macOS:**\n1. **System Settings** → **Displays**.\n2. Hold **Option** key — a **Detect Displays** button appears at the bottom right.\n3. Click it.\n\n### Step 5 — Project / Duplicate / Extend\nSometimes the laptop detects the monitor but routes nothing to it.\n\n**Win:** Press **Win + P** → choose **Extend** (typical) or **Duplicate** to test.\n\n**Mac:** System Settings → Displays → click the second monitor representation → set \"Use As\" to \"Extended display\" not \"Mirror.\"\n\n### Step 6 — Reboot\nYes. After all the above. Reboot. Then try again. Resolves stuck driver state ~25% of the time.\n\n### Step 7 — USB-C / Thunderbolt specific\nIf using USB-C:\n- Confirm your laptop's USB-C port supports **DisplayPort Alternate Mode (DP Alt Mode)**. Cheaper USB-C laptops (e.g., budget Chromebooks) only support data + power, not display.\n- Check cable rating. Standard USB-C cables that came with phone chargers OFTEN don't carry video. You need a USB-C / Thunderbolt cable rated for video — usually labeled \"DisplayPort Alt Mode supported\" or \"Thunderbolt 3/4.\"\n- Try a USB-C to HDMI / DisplayPort adapter as a test.\n\n### Step 8 — Docking station triage\nIf you're going through a USB-C dock or Thunderbolt dock:\n- Dock power supply plugged in? Many docks won't drive external monitors on bus power alone.\n- Restart the dock (unplug USB-C from laptop, wait 10 seconds, replug).\n- Try the monitor cable plugged DIRECTLY to laptop, bypassing the dock. If direct works → dock is the issue (try firmware update, or warranty replace).\n\n### Step 9 — Driver / firmware\n**Windows:**\n1. Settings → Windows Update → Optional updates → Driver updates → install GPU driver if listed.\n2. OR visit your laptop maker's support page (Dell / HP / Lenovo / ASUS) → download the latest GPU driver (Intel / NVIDIA / AMD) → install → reboot.\n\n**Mac:** macOS Software Update; no separate display driver.\n\n### Step 10 — Monitor firmware\nSome monitors (Dell, LG, Samsung high-end) have firmware. Visit manufacturer support, check for updates. Usually requires USB stick to update.\n\n## 3. Verification Steps\n- Monitor shows the Windows desktop or Mac wallpaper.\n- Display settings shows TWO displays.\n- You can drag a window from laptop screen to monitor.\n\n## 4. When to Call IT\n- Multiple monitors work fine on YOUR laptop but yours specifically — usually display configuration; IT to check.\n- Monitor works on ANOTHER laptop but yours doesn't, AND swap port/cable didn't fix → laptop hardware (replace port or laptop).\n- Office docking station: known docks (Dell WD22, HP USB-C Dock G5, etc.) sometimes need a firmware push from IT.\n\n## 5. Prevention Tips\n- **Buy quality cables.** Cheap HDMI cables from no-name brands fail. Stick to Belkin, Anker, AmazonBasics, StarTech.\n- **Match the standard.** 4K@60Hz needs HDMI 2.0 or higher; 8K needs HDMI 2.1. Buying a Wi-Fi-7 router and pairing with a Wi-Fi-5 laptop wastes the upgrade — same applies to displays.\n- **Label cables** at both ends if you have multiple monitors.\n\n## 6. User-Friendly Explanation\nFirst check the monitor's input button to make sure it's set to the input you plugged into. Then try a different cable and a different port on the laptop. Windows: press Win+P to force display mode. Mac: System Settings → Displays → Detect (hold Option). If none of that works, restart the laptop. Most monitor problems are bad cables or wrong input selected — not the laptop.\n\n## 7. Internal Technician Notes\n- Windows display device pipeline: GPU driver → DXGI → DDI → monitor EDID handshake. Failure often at EDID — try another cable.\n- EDID parsing failure: `Get-PnpDevice -Class Monitor | Select-Object FriendlyName, Status` (PowerShell) — Inactive status often indicates EDID issue.\n- USB-C DP Alt Mode pin layout: 4 SuperSpeed pairs used as 4 DP lanes. Cable must implement it; many phone chargers don't.\n- Thunderbolt 3 / 4 over USB-C: 40 Gbps, full DP 1.4 (4K@120Hz, 8K@60Hz).\n- Common silly causes: monitor in standby (timer set short), HDR mode mismatch (Windows expects HDR, monitor doesn't), refresh rate mismatch.\n- Dell laptop+dock combo: latest dock firmware from Dell Command | Update tool. Often resolves \"missing 2nd monitor\" issues.\n- macOS notebook lid closed → external monitor expected to drive screen. Some macOS versions reject this if no external keyboard/mouse detected — wake by USB device.\n\n## 8. Related KB Articles\n- `l1-windows-006` — App won't open\n- `l1-usb-001` — USB device not recognized\n- `l1-windows-be-001` — Win 11 Copilot+ PC features (some new display tricks)\n\n## 9. Keywords / Search Tags\nexternal monitor, second monitor, no signal, hdmi not working, displayport not working, usb-c monitor, usb c display, thunderbolt display, monitor blank, extend display, duplicate display, docking station, dock, edid, dp alt mode"
  },
  {
   "slug": "l1-display-002-monitor-scaling-resolution",
   "path_rel": "knowledge-base\\top50-gaps\\l1-display-002-monitor-scaling-resolution.md",
   "title": "\"External monitor — wrong resolution, blurry text, things tiny or huge\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-display-002\ntitle: \"External monitor — wrong resolution, blurry text, things tiny or huge\"\ncategory: display\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"External monitor connected and detected\", \"Display cable that supports your target resolution\"]\nkeywords:\n  - monitor blurry\n  - text too small\n  - text too big\n  - wrong resolution\n  - scaling issue\n  - 4k monitor\n  - dpi\n  - everything tiny\n  - apps too small\n  - high dpi blurry\n  - mixed dpi\n  - external display fuzzy\ntags:\n  - display\n  - monitor\n  - scaling\n  - top-50\nrelated: [l1-display-001-external-monitor-not-detected, l1-newdevice-001-new-laptop-first-boot]\n---\n\n# External monitor — fix resolution, scaling, and blurry text\n\n## When this applies\n\nYour external monitor is connected and Windows / macOS sees it, but:\n- Text is blurry or fuzzy\n- Everything is tiny — you can barely read icons\n- Everything is huge — toolbars take half the screen\n- One screen is sharp and the other is blurry\n- Apps look fine on one monitor and pixelated on the other\n- Windows look different sizes when you drag between monitors\n\nThis is a **scaling and resolution** issue, not a hardware issue. Almost always fixable in 2 minutes.\n\n## Step 1 — Set the correct **native resolution**\n\nEvery monitor has one resolution it's designed for (\"native\"). Anything else looks fuzzy.\n\n### Common native resolutions\n- 1080p monitor → **1920 × 1080**\n- 1440p / QHD → **2560 × 1440**\n- 4K UHD → **3840 × 2160**\n- 5K (Studio Display, LG UltraFine) → **5120 × 2880**\n- Ultrawide 1440p → **3440 × 1440**\n- Ultrawide 4K → **3840 × 1600** or **5120 × 2160**\n\nCheck the box, manual, or manufacturer's spec page if unsure.\n\n### Windows\n1. Right-click desktop → **Display settings**.\n2. Click the monitor in the diagram at the top.\n3. Scroll to **Display resolution**.\n4. Pick the one that says **(Recommended)** — that's native.\n5. If \"Recommended\" is wrong, manually pick the native resolution from the dropdown.\n\n### macOS\n1. **System Settings → Displays**.\n2. Click the external monitor in the sidebar.\n3. Pick **Default for display** (this is native — sharpest).\n4. If you want a different \"logical\" size while keeping sharpness, pick from the resolution list. macOS will say \"Looks like X\" for non-native scaled options.\n\n## Step 2 — Fix scaling (DPI)\n\nModern monitors are dense (more pixels per inch). At 100% scaling, text on a 4K 27\" monitor is microscopic. The OS scales the UI larger so it's readable while keeping the resolution sharp.\n\n### Windows recommended scaling\n- **1080p 24\"** → 100%\n- **1440p 27\"** → 100-125%\n- **4K 27\"** → 150%\n- **4K 32\"** → 125-150%\n- **5K 27\"** → 200%\n\nRight-click desktop → Display settings → \"Scale\" dropdown. Pick one of the preset values. Then sign out and back in (Windows scales fully only after a fresh session for some apps).\n\n### macOS recommended\nmacOS handles this automatically. Use \"Default for display.\" If text is too small, pick a higher \"Looks like\" option (e.g., \"Looks like 1920 × 1080\" on a 4K) — slightly less sharp, more readable.\n\n## Step 3 — Per-monitor scaling (when you have two monitors at different DPIs)\n\nThis is the most common cause of blurry-on-one-screen issues.\n\n### Windows 11\nYou can set different scaling per monitor. Display settings → click each monitor → set its own Scale. Windows generally handles this well in modern apps.\n\n**However:** older Windows apps (anything pre-DPI-aware) may scale poorly when dragged between monitors at different DPIs — text gets fuzzy. Fix:\n- Right-click the app's shortcut → Properties → Compatibility → **Change high DPI settings** → check \"Override high DPI scaling behavior\" → choose **System (Enhanced)**.\n- Or close + reopen the app on the monitor you want it sharp on. It'll re-render at that DPI.\n\n### macOS\nApple handles per-display scaling cleanly. If it's still blurry, the app likely isn't Retina-aware. Update the app to its latest version.\n\n## Step 4 — Fix the specific issue\n\n### Text is blurry only on one monitor\n- That monitor isn't at its native resolution. Step 1.\n- OR per-monitor scaling mismatch is breaking older apps. Step 3.\n\n### Text is sharp but apps are tiny\n- Increase Scale (Windows) or pick a larger \"Looks like\" option (macOS).\n\n### Apps are huge / icons take half the screen\n- Decrease Scale.\n\n### Random app suddenly looks pixelated after I dragged it\n- That app isn't fully DPI-aware. Close and reopen on the target monitor.\n- For frequently-used apps: set the compatibility override (Step 3).\n\n### One monitor shows 60Hz, another 144Hz, and the cursor lags\n- Different refresh rates on each monitor can cause cursor stutter when crossing the boundary. Windows 11 handles this better than Win10. Update graphics driver. If the issue persists, set both monitors to the same refresh rate temporarily.\n\n### \"Display port\" 1.4 / 2.0 / HDMI 2.1 issues\n- 4K@120Hz or 4K@144Hz needs DisplayPort 1.4 or HDMI 2.1 + a cable rated for that bandwidth. A cheap HDMI cable will downgrade your monitor to 4K@30Hz or 1080p@60Hz silently.\n- USB-C / Thunderbolt docks: some only output 4K@30Hz. Check the dock's spec.\n\n### Monitor showing 1024x768 or similar low resolution by default\n- Driver issue. Windows may have loaded a generic \"Plug and Play Monitor\" driver. Right-click desktop → Display settings → Advanced display → Display info — does it say a generic name? Update graphics driver from Nvidia / AMD / Intel.\n\n## Step 5 — Cable / connection sanity check\n\nThe cable matters. If you replaced your monitor or laptop:\n- **HDMI 2.1 / DisplayPort 1.4** for 4K@120Hz+\n- **HDMI 2.0** for 4K@60Hz\n- **HDMI 1.4** only does 4K@30Hz (jittery for mouse)\n- **DisplayPort 1.2** does 4K@60Hz on a single stream\n- **USB-C / Thunderbolt** depends on the port spec — check laptop manufacturer\n- **Daisy-chained displays** (DP-MST) cut bandwidth — second monitor may be capped\n\nTry a different cable. Try a different port. Sometimes the cable is the answer.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Monitor only offers low resolutions, never native | L2 — driver or EDID issue |\n| Two-monitor setup randomly drops one display | L2 — possibly bad cable, port, or dock |\n| Color profile wrong (whites look pink) | L2 — color calibration or HDR issue |\n| 4K@120Hz works on Mac but only 60Hz on Windows | L2 — driver / port limitation |\n| Multi-user shared PC where each user wants different scaling | L2 — set per-user scaling |\n\n## Prevention\n\n- Always check the monitor's spec sheet for native resolution before buying.\n- Use cables certified for your target bandwidth — buy from a known brand, not a $2 random.\n- Update graphics drivers monthly (Nvidia / AMD / Intel).\n- After Windows feature updates, double-check display settings — Windows occasionally resets scaling.\n\n## What ARIA can help with\n\nARIA can walk you through display settings live, identify your monitor model from a screenshot of its on-screen info, and tell you the right resolution/scaling for your specific monitor model. ARIA cannot physically swap cables."
  },
  {
   "slug": "l1-email-002-shared-mailbox-cant-send",
   "path_rel": "knowledge-base\\top50-gaps\\l1-email-002-shared-mailbox-cant-send.md",
   "title": "\"Shared mailbox: can read but can't send / 'Send As' denied\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-email-002\ntitle: \"Shared mailbox: can read but can't send / 'Send As' denied\"\ncategory: email\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"Web\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"You're a delegated user on the shared mailbox\", \"Admin granted you Send As or Send on Behalf rights\"]\nkeywords:\n  - shared mailbox cant send\n  - send as denied\n  - this message could not be sent\n  - send on behalf of\n  - your message did not reach some or all\n  - delegate sender\n  - shared mailbox reply bounces\n  - exchange permission error\ntags:\n  - email\n  - shared-mailbox\n  - exchange\n  - top-50\nrelated: [l1-outlook-001-not-receiving-emails, l1-outlook-002-cant-send-emails, l2-exchange-001-mail-flow]\n---\n\n# Shared mailbox can read but can't send — fix Send As permissions\n\n## When this applies\n\nYour team has a shared mailbox like `info@`, `support@`, `sales@`. You can open it, read mail, but when you reply or send new mail from it, you get one of:\n- \"Your message did not reach some or all of the intended recipients\"\n- \"You do not have permission to send on behalf of [shared mailbox]\"\n- Email goes from YOUR address, not the shared address\n- Outlook removes the From field silently and sends from your personal address\n\n99% of the time this is a permissions issue, not a network or app issue.\n\n## Step 1 — Verify you actually have Send As\n\nSend permissions for shared mailboxes come in TWO flavors:\n- **Send As** — recipient sees the email coming from `info@company.com` only (your name hidden)\n- **Send on Behalf** — recipient sees \"Ahmad Wasee on behalf of info@company.com\"\n\nAdmin grants these in Exchange Admin Center. Ask:\n> \"Do I have Send As (or Send on Behalf) on info@company.com?\"\n\nIf admin says no → request it. Done.\n\nIf admin says \"yes, I granted it 5 minutes ago\" → see Step 2 (permissions take time to propagate).\n\n## Step 2 — Wait for propagation, then refresh\n\nExchange Online permissions can take **up to 60 minutes** to propagate from admin grant to your client. Most clear within 5-10 minutes.\n\nAfter waiting:\n1. Close Outlook completely.\n2. Reopen.\n3. Try sending from the shared mailbox.\n\nStill fails? Step 3.\n\n## Step 3 — Force Outlook to recognize the new permission\n\n### Classic Outlook (Windows)\n1. File → Account Settings → Account Settings → Email tab.\n2. Confirm your work account is selected. Click **Change**.\n3. Click **More Settings** → Advanced tab.\n4. Make sure **Open these additional mailboxes** lists the shared mailbox. If not, click Add → enter shared mailbox email.\n5. OK → Next → Finish.\n6. Restart Outlook.\n\n### New Outlook / Web Outlook\n- Shared mailboxes appear automatically once permission propagates. If not, sign out + sign back in.\n\n### macOS Outlook\n- Tools → Accounts → Advanced → Delegates tab.\n- Confirm the shared mailbox is listed under \"People I am a delegate for.\"\n\n## Step 4 — Pick the From address when composing\n\nEven with permission, you have to TELL Outlook to send from the shared address.\n\n### Classic Outlook (Windows)\n1. New email → click the **From** dropdown above the To field.\n2. If From isn't visible: Options tab → click \"From\" to enable.\n3. Click From → Other Email Address → type or pick the shared mailbox.\n4. Send.\n\n### New Outlook + Web Outlook\n1. New message → click the small dropdown next to your name in the From line.\n2. Pick the shared mailbox.\n3. Send.\n\n### macOS Outlook\n- Compose new → From dropdown at top.\n- Pick shared mailbox.\n\n## Step 5 — Clear stale autocomplete cache\n\nIf your previous attempts cached a \"from your address\" version of the message, Outlook may keep using that. Clear:\n\n### Classic Outlook\n- File → Options → Mail → Send Messages → Empty Auto-Complete List.\n\nThen compose fresh.\n\n## Common edge cases\n\n### \"Send works internally but external recipients say it bounced\"\n- DKIM/SPF/DMARC issue. The shared mailbox domain needs proper DNS records to authorize you sending on its behalf. Admin → check DKIM/SPF in Exchange Admin Center.\n- Usually fixed in M365 by default; only an issue if domain was set up old-school.\n\n### \"I can send, but recipient sees MY name not the shared name\"\n- You have Send on Behalf, not Send As. Different permission. Ask admin to upgrade.\n\n### \"Reply removes the shared mailbox from From silently\"\n- Outlook bug — happens when shared mailbox is auto-mapped vs explicitly added.\n- Workaround: remove auto-map (File → Account Settings → Email → Change → More Settings → Advanced → uncheck shared mailbox → re-add manually).\n\n### \"Send works in Outlook but not Outlook Web\"\n- Web client cache. Clear browser cookies for outlook.office.com, re-sign in.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Admin granted permission but it's been 2+ hours, still fails | L2 — Exchange admin checks the grant, may need to re-apply |\n| Send works internally, external bounces with SPF/DKIM error | L2 — DNS / mail-flow rules |\n| \"550 5.7.1\" or similar transport error | L2 — Exchange transport rules |\n| Need Send As for multiple users on same shared mailbox | L2 — admin batch-applies |\n| Compliance / archive requirement | L2 — possibly retention policy interaction |\n\n## Prevention\n\n- New hires: have admin add shared mailbox permissions during onboarding, not after they ask.\n- When granting: prefer \"Send As\" over \"Send on Behalf\" for customer-facing addresses (recipients see the shared address, more professional).\n- Document which mailboxes each team should have access to.\n\n## What ARIA can help with\n\nARIA can walk through the From-dropdown setup, verify whether Send As vs Send on Behalf is in play, draft the IT ticket if admin hasn't granted access yet, and tell you how long propagation typically takes. ARIA cannot grant Send As permissions — that's admin scope."
  },
  {
   "slug": "l1-file-recovery-001-deleted-file-recovery",
   "path_rel": "knowledge-base\\top50-gaps\\l1-file-recovery-001-deleted-file-recovery.md",
   "title": "\"Recover a deleted or lost file — OneDrive, SharePoint, Teams, Recycle Bin\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-file-recovery-001\ntitle: \"Recover a deleted or lost file — OneDrive, SharePoint, Teams, Recycle Bin\"\ncategory: file-management\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - deleted file\n  - file recovery\n  - recycle bin\n  - trash\n  - onedrive restore\n  - sharepoint restore\n  - version history\n  - file history\n  - file versions\n  - recover document\n  - undelete\n  - lost file\n  - find file\nrelated_articles:\n  - l1-onedrive-001-not-syncing\n  - l1-onedrive-002-restore-deleted-file\n  - l1-onedrive-003-version-conflict\nescalation_trigger: \"File deleted > 30 days ago AND not in any restore path → ticket IT for backup tape / Azure Blob soft-delete recovery (may have additional retention).\"\nlast_invoked: 2026-05-12\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Recover a deleted or lost file\n\n## 1. Symptoms\n- Accidentally deleted a file. Need it back.\n- Saved over a file with wrong version. Need previous.\n- Can't find a file you remember creating.\n- Coworker says \"you deleted [thing]\" but you don't remember doing it.\n\n## 2. Decision Tree (where to look first)\n\n### Case A — Deleted from your computer's local disk\n\n**Windows:**\n1. **Recycle Bin** on desktop. Open. Look for file.\n2. Right-click → **Restore** → goes back to original location.\n\n**macOS:**\n1. **Trash** in Dock.\n2. Right-click file → **Put Back** → original location.\n\n### Case B — File was in OneDrive / SharePoint / Teams (Files tab)\n\nThis is where 80% of work files live. Recovery is easy:\n\n**Step 1 — OneDrive web recycle bin.**\n- Open browser → `https://onedrive.live.com` (personal) or `https://[tenant]-my.sharepoint.com` (work).\n- Left sidebar → **Recycle bin**.\n- Find file → click → **Restore**.\n- *(What you should see: File reappears in its original folder within 60 seconds.)*\n\n**Step 2 — Second-stage recycle bin (deleted from recycle bin).**\n- In OneDrive Recycle bin → bottom → \"Second-stage recycle bin\" link.\n- Files live here for **additional 30 days** after being deleted from first recycle bin.\n- 93 days total recovery window.\n\n**Step 3 — SharePoint Online recycle bin.**\n- Open the SharePoint site → bottom-left → **Recycle bin**.\n- Same first-stage + second-stage pattern.\n\n**Step 4 — Teams Files recovery.**\n- A Teams channel's Files tab is actually a SharePoint folder.\n- Click \"Open in SharePoint\" → use SharePoint recycle bin per Step 3.\n\n### Case C — Saved over a file (wrong version saved)\n\n**OneDrive / SharePoint Online (use this — it's gold):**\n1. Open OneDrive web.\n2. Find the file → right-click → **Version history**.\n3. List of versions with timestamps + author.\n4. Click an older version → **Restore** OR **Open** to preview first.\n\n**Office desktop apps (Word/Excel/PowerPoint):**\n1. File menu → **Info** → **Version History**.\n2. Click a version → restore.\n\n**macOS Time Machine:**\n- If you have Time Machine: enter Time Machine → navigate to file's folder → scroll back to earlier date → Restore.\n\n**Windows File History:**\n- Settings → System → Storage → Advanced → File History — only works if you set it up beforehand.\n\n### Case D — Can't find a file you know exists somewhere\n\n1. **Microsoft 365 search** — go to `https://office.com` → top search bar → type any keyword from the file title or content. Searches OneDrive + SharePoint + email attachments + Teams.\n2. **Windows Search** — Start menu type the file name. Shows local + indexed cloud.\n3. **macOS Spotlight** — Cmd+Space type file name.\n4. **OneDrive Files On-Demand:** if file shows ghost icon (cloud only), it's there — click to download.\n\n### Case E — File \"deleted\" by sync conflict\n\nOneDrive sometimes makes a copy named `Filename-MyComputer.docx` when there's a sync conflict. Check the folder for files with `-MyComputer` or `-[YourName]` suffix.\n\n### Case F — File in a Teams chat (not Files tab)\n\nFiles shared in chat:\n- Open the chat → scroll up to find the message with the file.\n- OR: SharePoint root → `OneDrive/Documents/Microsoft Teams Chat Files/` (shared files land in your personal OneDrive).\n\n## 3. Retention Windows (How Long Files Stay Recoverable)\n\n| Location | Retention |\n|---|---|\n| Windows Recycle Bin | Until manually emptied OR disk full |\n| macOS Trash | Until manually emptied |\n| OneDrive personal first-stage recycle bin | 30 days |\n| OneDrive personal second-stage recycle bin | + additional 30 days (60 total) |\n| OneDrive for Business first-stage | 93 days |\n| OneDrive for Business second-stage | After 93 days, Site Collection Admin recovery only |\n| SharePoint Online first-stage | 93 days |\n| SharePoint Online second-stage | + additional retention per tenant policy (often 14-30 more days) |\n| Microsoft 365 Retention Policy (if applied) | Set by your org (could be 7 years, 10 years, etc.) — files preserved even after deletion |\n\n## 4. After 93 days\n\nIf a file is older than the recycle bin window:\n- Ask IT — they may have a backup snapshot (Veeam / Druva / Azure Backup) outside the recycle bin path.\n- Some companies use **immutable backup** for compliance — file may exist even years later, but IT has to do a restore from cold storage.\n\n## 5. Verification Steps\n- File reappears in its expected folder.\n- Open the file — content is the right version.\n- Sync to OneDrive completes (green check mark).\n- For shared files: confirm permissions still correct (sometimes restore strips share links).\n\n## 6. When to Call IT\n- File older than 93 days AND it's important for compliance / legal / business.\n- Multiple files missing simultaneously (potential ransomware, sync corruption).\n- Suspect deletion was malicious (HR / legal involved).\n- Need to restore an entire SharePoint site to a previous state.\n\n## 7. Prevention Tips\n- **Save to OneDrive / SharePoint by default**, not local Documents.\n- **Don't bypass the recycle bin** with Shift+Delete on important files.\n- **Office 365 retention policy** for regulated data: have IT apply a 7-year retention.\n- **Version history is your friend** — overwrite-by-accident is far less scary when versions auto-save.\n- **Don't use third-party file deletion tools** (\"File Shredder\", \"CCleaner\") on synced folders — bypasses recycle bin.\n\n## 8. User-Friendly Explanation\nFor files on OneDrive or SharePoint, go to onedrive.live.com → Recycle bin → restore. That covers most cases. For local files, check Recycle Bin (Windows) or Trash (Mac). For \"I saved over it,\" right-click the file in OneDrive → Version history → restore an older version. Files are recoverable for 93 days on OneDrive for Business — after that, ask IT.\n\n## 9. Internal Technician Notes\n- OneDrive first-stage recycle bin: user-controlled at user's account level.\n- OneDrive second-stage: Site Collection Admin level. Files can be hard-purged here.\n- Versioning default: 500 major versions per file in SharePoint Online (can be tuned per library).\n- Retention policy (Microsoft Purview): can hold deleted items beyond recycle bin retention. Apply at folder, library, or site level.\n- For audit: Unified Audit Log shows file deletion + by whom (90 days default, 1 year with E5).\n- For mass recovery: PowerShell `Restore-PnPRecycleBinItem`.\n- Soft-deleted SharePoint sites: 93-day window then permanent.\n\n## 10. Related KB Articles\n- `l1-onedrive-001` — OneDrive not syncing\n- `l1-onedrive-002` — Restore deleted file\n- `l1-onedrive-003` — Version conflict\n\n## 11. Keywords / Search Tags\ndeleted file, file recovery, recycle bin, trash, onedrive restore, sharepoint restore, version history, file history, file versions, recover document, undelete, lost file, find file, retention, sharepoint recycle bin, microsoft 365 search"
  },
  {
   "slug": "l1-files-001-office-file-wont-open",
   "path_rel": "knowledge-base\\top50-gaps\\l1-files-001-office-file-wont-open.md",
   "title": "\"Excel / Word / PowerPoint won't open — file is corrupt, locked, or in use\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-files-001\ntitle: \"Excel / Word / PowerPoint won't open — file is corrupt, locked, or in use\"\ncategory: files\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"You have the file (locally, OneDrive, SharePoint, or email attachment)\"]\nkeywords:\n  - file is locked for editing\n  - file is in use\n  - excel file wont open\n  - word file corrupt\n  - powerpoint corrupted\n  - cannot open file\n  - protected view\n  - file format not valid\n  - the file is corrupt and cannot be opened\n  - excel found unreadable content\n  - read-only file\n  - .xlsx wont open\n  - .docx wont open\ntags:\n  - files\n  - office\n  - top-50\nrelated: [l1-fileshare-001-cant-open-shared-file, l1-onedrive-003-version-conflict, l1-outlook-001-not-receiving-emails]\n---\n\n# Office file won't open — diagnose the cause and recover\n\n## Symptoms\n\n- \"The file is corrupt and cannot be opened\"\n- \"File is locked for editing by [name]\"\n- \"File is in use\" / \"Document is locked\"\n- Excel: \"We found a problem with some content. Do you want us to try to recover as much as we can?\"\n- Word: opens blank or with garbled text\n- \"Cannot access [filename]\"\n- Protected View bar at top, \"Editing this file is restricted\"\n- Office insists on opening as read-only\n\nThese break down into 5 distinct problems with different fixes.\n\n## Step 1 — Identify which problem you have\n\n| Error / behavior | Most likely cause | Skip to |\n|---|---|---|\n| \"Locked for editing by [person]\" | Real collaboration lock OR stale lock | Step 2 |\n| \"Locked for editing\" but you're alone | Stale lock file from previous crash | Step 3 |\n| \"File is corrupt\" / unreadable | Actual corruption | Step 4 |\n| Protected View / \"from internet\" | Office's security feature | Step 5 |\n| Opens read-only with no error | File permissions or read-only attribute | Step 6 |\n\n## Step 2 — Someone else is editing (real co-author lock)\n\n### If it's a OneDrive / SharePoint / Teams file\n- Modern Office supports real-time co-authoring — multiple people CAN edit at once.\n- If the lock appears, the file isn't co-author-enabled OR they're using an older Office version.\n- **Easiest fix:** message the person, ask them to close the file.\n- **Alternative:** Open via the web (open onedrive.com / sharepoint.com → click the file → Open in browser). Browser version usually allows co-edit.\n\n### If it's a network share file (older corporate setup)\n- Real Windows file lock. Only one editor at a time.\n- Message owner. Or open read-only and save your version with a different name.\n\n## Step 3 — Stale lock file (you're alone but it says locked)\n\nA previous Office crash left an \"owner file\" behind. Office creates a tiny hidden file alongside any open Office doc (e.g., `~$MyReport.docx`) — if Office crashes, this lock file stays and blocks reopening.\n\n### Fix\n1. Close all Office apps.\n2. Open File Explorer to the folder containing the document.\n3. Enable hidden files: View → Show → Hidden items (Windows 11) or View tab → Hidden items (Win 10).\n4. Look for a file starting with `~$` — same name as your document.\n5. Delete that `~$` file.\n6. Reopen the original document.\n\nFor OneDrive / SharePoint:\n- Close all Office apps. Wait 60 seconds.\n- Right-click the OneDrive cloud icon → Pause syncing → Resume syncing.\n- Reopen the file.\n- If still locked, sign out of Office (File → Account → Sign out), reopen Office.\n\n## Step 4 — Actual file corruption\n\n### Symptom\nOffice offers to \"recover\" content. Or the file just won't open at all. Or open and content is garbled.\n\n### Recover within Office\n\n**Excel / Word / PowerPoint:**\n1. **File → Open**.\n2. Browse to the file but **don't open it yet** — single-click to select.\n3. Click the **dropdown arrow** next to the Open button.\n4. Choose **\"Open and Repair\"**.\n5. Pick **Repair** first (recovers most). If that fails, try **Extract Data**.\n\n### Recover from auto-save / version history\n\n**For OneDrive / SharePoint files:**\n1. Right-click the file in OneDrive / SharePoint → **Version history**.\n2. Pick a version from before the corruption.\n3. Click ... → Restore.\n\n**For local files:**\n1. Open the Office app.\n2. **File → Info → Manage Document → Recover Unsaved Documents** (or similar wording).\n3. Pick the auto-saved version.\n\n### If Excel only — try alternate methods\n1. Save the corrupt .xlsx as .xls (older format) — open via File → Open → change file type filter.\n2. Or rename .xlsx → .zip → extract → look inside `xl/worksheets/` for raw XML you can manually fix or import to a new sheet.\n\n### If it's a PDF\n- Different track entirely. Reopen in Adobe Reader. If still corrupt, drag into chrome.com (drop into Chrome address bar) — Chrome's PDF engine is forgiving.\n\n## Step 5 — Protected View / \"from internet\"\n\nOffice sees the file came from a risky source (email attachment, internet download) and opens it read-only by default.\n\n### Enable editing — single file\n1. Click the **yellow banner** at top of the document → \"Enable Editing.\"\n2. Yes, you trust this file.\n3. You can now edit + save.\n\n### Stop the prompt for files in a trusted folder\n1. File → Options → Trust Center → Trust Center Settings.\n2. Trusted Locations → add your work folder.\n3. Office will skip Protected View for files there.\n\n⚠️ **Only do this for folders you control.** Don't disable Protected View globally — it's a real malware defense.\n\n## Step 6 — Read-only / permissions\n\n### Fix file's read-only flag (Windows)\n1. Right-click file → Properties.\n2. Uncheck **Read-only** at bottom.\n3. Apply.\n\n### Fix folder permissions (rare)\n1. Right-click parent folder → Properties → Security.\n2. Click Edit → ensure your user has Modify rights.\n3. Apply.\n\n### macOS\n1. Right-click file → Get Info.\n2. At bottom: Sharing & Permissions → click the lock to authenticate.\n3. Set your user to **Read & Write**.\n\n## Specific scenarios\n\n### \"Excel says 'we removed records: PivotTable from /xl/pivotTables/...'\"\nPartial corruption in pivot tables only. The rest of your data is fine. Repair process strips bad pivots and saves the recovered file.\n\n### \"The file opens but my macros / formulas / charts are gone\"\nPossible recovery dropped them. Check if you have an earlier version (OneDrive Version history) — restore that.\n\n### \"It won't open on my machine but opens on my colleague's\"\n- Office version mismatch. Your install may be missing a patch. Check Office for updates: File → Account → Update Options → Update Now.\n\n### \"Cannot open shared OneDrive file from Outlook attachment\"\n- Save the attachment locally first (Right-click attachment → Save As). Then open from your hard drive.\n- If still fails, ask sender to share the original OneDrive/SharePoint link instead of attaching.\n\n### \"File is too large — Excel hangs\"\n- Office has hard limits (1M rows, but practical limits much lower at ~500K rows + heavy formulas).\n- Open in Power BI or Python (pandas) for big files.\n- For Excel itself: open in Safe Mode (Win+R → `excel /safe`) which skips add-ins that bloat memory.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Open and Repair fails AND no version history | L2 — may need data recovery / professional tool |\n| Multiple files corrupted at once on same drive | L2 — possible disk/sync issue |\n| Files from one user always fail | L2 — that user's Office install may have bugs |\n| Persistent locked-by-self issue | L2 — Office sign-out + cache clean |\n| Macro-enabled files (.xlsm / .docm) blocked by policy | L2 — Group Policy / Mark of the Web issue |\n\n## Prevention\n\n- Save to OneDrive / SharePoint — auto-versioning means you can always rollback.\n- Don't email .docx / .xlsx as attachments between collaborators — share the OneDrive link instead.\n- AutoSave: turn it ON in every Office app (File → toggle at top).\n- Keep Office updated — patches fix the most common file-format bugs.\n- For critical files, manual versioning: save daily backups as filename_2026-05-13.xlsx.\n\n## What ARIA can help with\n\nARIA can identify which of the 5 problem types you're hitting from your error message, walk you through Open and Repair step-by-step, and tell you whether your file is recoverable or you should escalate. ARIA cannot perform manual XML surgery for forensic recovery."
  },
  {
   "slug": "l1-input-001-keyboard-mouse-not-working",
   "path_rel": "knowledge-base\\top50-gaps\\l1-input-001-keyboard-mouse-not-working.md",
   "title": "\"Keyboard or mouse not working — wired, wireless, or specific keys\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-input-001\ntitle: \"Keyboard or mouse not working — wired, wireless, or specific keys\"\ncategory: hardware\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - keyboard not working\n  - mouse not working\n  - bluetooth keyboard\n  - bluetooth mouse\n  - usb keyboard\n  - dongle\n  - logitech unifying\n  - mx keys\n  - mx master\n  - magic keyboard\n  - magic mouse\n  - dead keys\n  - sticky keys\n  - mouse lag\n  - cursor jumping\nrelated_articles:\n  - l1-bluetooth-001-pairing-failed\n  - l1-usb-001-device-not-recognized\nescalation_trigger: \"Multiple keyboards / mice fail on this laptop AND wired+wireless both fail → laptop USB controller or Bluetooth radio dead. Escalate to L2 / hardware service.\"\nlast_invoked: 2026-05-12\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Keyboard or mouse not working\n\n## 1. Symptoms\n- Keyboard stops typing.\n- Mouse cursor frozen / disappeared.\n- Specific keys not working (e.g., spacebar, Enter).\n- Bluetooth keyboard / mouse disconnects randomly.\n- Mouse jumps or lags.\n- Laptop's built-in keyboard stops but external works (or vice versa).\n\n## 2. Step-by-Step Triage\n\n### Step 1 — Power / Battery\n- **Wireless / Bluetooth:** check the device's power switch is ON. Replace batteries (or charge if rechargeable). Most \"dead\" wireless keyboards just have flat batteries.\n- **Wired:** confirm USB cable is fully seated.\n\n### Step 2 — Try a different USB port (wired)\n- Front vs back USB ports, USB-A vs USB-C — try them all.\n- If using a USB hub or dock, try plugging directly into the laptop.\n\n### Step 3 — Reconnect Bluetooth pairing\n**Windows:**\n1. Settings → Bluetooth & devices.\n2. Find your keyboard / mouse → click ⋯ menu → **Remove device**.\n3. Power-cycle the device (off/on).\n4. Click **Add device** → **Bluetooth** → put the device in pairing mode (consult its manual — often hold a button until LED flashes) → select it.\n\n**macOS:** System Settings → Bluetooth → click the X next to the device → re-pair.\n\n### Step 4 — Update or reinstall drivers (Windows)\n1. Press **Win + X** → **Device Manager**.\n2. Expand **Keyboards** OR **Mice and other pointing devices**.\n3. Right-click your device → **Uninstall device**.\n4. Reboot. Windows re-detects + reinstalls fresh driver.\n\n### Step 5 — Battery in wireless devices\n- For Logitech MX Master / MX Keys: plug in via USB-C to charge. They work while charging.\n- For Magic Mouse / Magic Keyboard (Apple): Lightning charge cable. Magic Mouse 1 has annoying bottom-mounted port.\n- Replace AA / AAA batteries in non-rechargeable wireless keyboards.\n\n### Step 6 — Specific key not working (mechanical fix)\n- **Crumbs / dust under key.** Use compressed air. Hold can upright, short blasts.\n- **Sticky from spill?** Power off → flip keyboard upside down → let dry 48 hours → may or may not recover. Spills often kill membranes permanently.\n- **Laptop key popped off?** Look up the model's keycap re-attachment video (different mechanisms — butterfly / scissor / mechanical). Don't force it — easy to break the latch.\n\n### Step 7 — Cursor jumping / mouse lag\n- **Bluetooth interference:** USB 3.0 ports near a Bluetooth receiver interfere with 2.4 GHz. Move the receiver / dongle to a different port.\n- **Surface:** glass tables and very dark surfaces confuse optical sensors. Use a mousepad.\n- **Wireless dongle far from device:** plug the dongle into a USB extension cable closer to the mouse (within 30 cm).\n- **Old driver:** update from manufacturer (Logitech Options+, Razer Synapse, Apple software update).\n\n### Step 8 — All inputs dead simultaneously (laptop)\n- Hard reset: hold power button 10 seconds → power back on → log in.\n- For Mac (Apple Silicon): just shut down and start again. For Intel Mac: SMC reset (Apple Menu → Shut Down → after off, press and hold Shift + Control + Option + Power for 10 seconds → release → power on normally).\n\n### Step 9 — Built-in laptop keyboard dead\n- Check filter keys / sticky keys: Settings → Accessibility → Keyboard → toggle these OFF.\n- BIOS/UEFI test: reboot, press F2 / Del / F10 (depending on maker) before Windows loads → keyboard works in BIOS? If yes, it's a Windows / driver issue. If no, hardware.\n\n## 3. Verification Steps\n- Open Notepad / TextEdit → all keys type correctly.\n- Mouse moves smoothly across both monitors.\n- Bluetooth devices show \"Connected\" status in settings.\n\n## 4. When to Call IT\n- Multiple keyboards/mice fail on the same laptop → USB controller or Bluetooth radio likely failed.\n- BIOS keyboard test fails → motherboard hardware. Service ticket.\n- Laptop keyboard with spilled liquid — replace, don't keep nursing.\n- New laptop, never worked → may need vendor-specific keyboard driver from maker's support page.\n\n## 5. Prevention Tips\n- **Charge wireless devices weekly** instead of waiting for them to die.\n- **Keep a wired USB keyboard / mouse in the desk drawer** as a backup.\n- **Don't eat over the keyboard.** Crumbs kill keys.\n- **Compressed air every 6 months** to blast dust out.\n- **Update mouse / keyboard software quarterly** (Logitech Options+, Razer, Corsair).\n\n## 6. User-Friendly Explanation\nMost input problems are: dead batteries (replace or charge), bad USB connection (try another port), or stuck Bluetooth pairing (remove and re-pair). If a specific key isn't working, compressed air usually fixes it. If your laptop's built-in keyboard suddenly dies and an external one works, restart and check BIOS. If nothing works at all, hold the power button 10 seconds and restart.\n\n## 7. Internal Technician Notes\n- Logitech Unifying Receiver: one dongle pairs up to 6 devices. Use Logitech Connection Utility / Options+ to re-pair.\n- Bolt receiver (newer Logitech): replaces Unifying. Better security (Bluetooth Low Energy Secure Connections).\n- USB 3.0 + 2.4 GHz interference: documented since 2013. Intel whitepaper recommends >10 cm separation between USB 3.0 port and 2.4 GHz receiver.\n- Magic Mouse multi-touch surface: requires macOS Bluetooth daemon healthy. Restart bluetoothd: `sudo killall -9 bluetoothd`.\n- For sticky keys / repeat issue: registry keys at `HKCU\\Control Panel\\Accessibility\\StickyKeys` (Win); Universal Access prefs (Mac).\n- Apple Silicon Mac SMC reset doesn't exist — just shutdown/startup.\n\n## 8. Related KB Articles\n- `l1-bluetooth-001` — Bluetooth pairing failed\n- `l1-usb-001` — USB device not recognized\n\n## 9. Keywords / Search Tags\nkeyboard not working, mouse not working, bluetooth keyboard, bluetooth mouse, usb keyboard, dongle, logitech unifying, mx keys, mx master, magic keyboard, magic mouse, dead keys, sticky keys, mouse lag, cursor jumping, smc reset"
  },
  {
   "slug": "l1-keyboard-002-wrong-characters-language",
   "path_rel": "knowledge-base\\top50-gaps\\l1-keyboard-002-wrong-characters-language.md",
   "title": "\"Keyboard typing wrong characters — language switched accidentally\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-keyboard-002\ntitle: \"Keyboard typing wrong characters — language switched accidentally\"\ncategory: keyboard\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 3\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - keyboard wrong characters\n  - typing wrong letters\n  - keyboard language changed\n  - at sign typing quote\n  - shift 2 wrong character\n  - input language switched\n  - keyboard layout reset\n  - dead keys typing accents\ntags:\n  - keyboard\n  - input\n  - language\n  - top-50\nrelated: [l1-input-001-keyboard-mouse-not-working]\n---\n\n# Keyboard typing wrong characters\n\n### @ types as \" (or other Shift-key swaps) → keyboard set to UK / wrong region\n\nYou hit Win+Space (Windows) or Cmd+Space accidentally and switched layouts. Quick check: Windows — bottom-right taskbar shows a small \"ENG\" or \"FR\" or similar. Click it → switch back to US (or your correct one). Mac: menu bar top-right shows flag/letters. Click → pick correct.\n\n### Cycle through input methods to verify\n\nWindows: Win + Space (hold Win, tap Space repeatedly) cycles through installed languages. Mac: Cmd + Space if shortcut enabled, OR Ctrl + Space. Try pressing once to swap, type a test \"@\" — if right now, that was it.\n\n### Remove unwanted languages so you can't accidentally switch\n\nWindows: Settings → Time & language → Language & region → click each unwanted language → Remove. Keep only the one(s) you actually use. Mac: System Settings → Keyboard → Input Sources → minus button to remove extras.\n\n### Disable the hotkey that switched it\n\nWin+Space and Ctrl+Shift are common accidents. Windows: Settings → Time & language → Typing → Advanced keyboard settings → Input language hot keys → change or disable Win+Space switch. Mac: System Settings → Keyboard → Keyboard Shortcuts → Input Sources → uncheck the switcher hotkeys.\n\n### Number row types as French / Spanish characters\n\nYou're on AZERTY (French) or another layout instead of QWERTY. Visible test: press the key labeled `Q` — if it types `A`, you're on AZERTY. Switch via the language indicator (taskbar/menu bar). Or Windows: Win + Space. Confirm by typing the alphabet — should match the printed keys.\n\n### Caps Lock LED is off but everything types uppercase\n\nSticky Keys or accessibility option active. Windows: Settings → Accessibility → Keyboard → Sticky Keys off. Tap Shift 5 times if that's the accidental trigger. Mac: System Settings → Accessibility → Keyboard → Sticky Keys off.\n\n### Specific keys broken (not whole keyboard)\n\nThat's hardware, not language. See KB l1-input-001 for stuck/dead keys. Or external keyboard: unplug + replug, try a different USB port. Laptop keyboard with a few dead keys → physical cleaning or replacement.\n\n### Mac: dead keys typing accents (option-key behavior)\n\nYou're on US-International layout. Mac System Settings → Keyboard → Input Sources → remove \"U.S. International - PC\" or \"ABC - Extended\" → keep plain \"ABC\" (US). Restart any open apps; dead-key behavior disappears.\n\n### When to escalate to L2\n\nLanguage indicator missing entirely from system tray (Windows display issue). Hardware keyboard pristine but laptop keyboard whole rows dead — physical replacement. After Windows feature update, keyboard layouts reset and won't stick after re-config — L2 checks policy."
  },
  {
   "slug": "l1-m365-003-license-expired-app-greyed",
   "path_rel": "knowledge-base\\top50-gaps\\l1-m365-003-license-expired-app-greyed.md",
   "title": "\"Microsoft 365 app says 'your license isn't valid' or features greyed out\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-m365-003\ntitle: \"Microsoft 365 app says 'your license isn't valid' or features greyed out\"\ncategory: m365\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Active M365 license assigned to your account\"]\nkeywords:\n  - license isnt valid\n  - office activation\n  - word excel greyed out\n  - sign-in loop office\n  - your license isnt valid\n  - office account is greyed out\n  - this product is unlicensed\n  - we couldnt verify your office product\n  - subscription has expired\ntags:\n  - m365\n  - office\n  - license\n  - top-50\nrelated: [l1-m365-001-cant-sign-in, l1-m365-002-license-activation-issues, l1-password-002-locked-after-change]\n---\n\n# Office says \"license isn't valid\" — get unstuck fast\n\n## When this applies\n\nYou open Word, Excel, PowerPoint, or Outlook and see:\n- \"Your license isn't valid\" yellow banner\n- \"Most features are disabled — please activate\"\n- \"Sign in to keep using Office\"\n- Sign-in dialog loops endlessly\n- Toolbar greyed out, can read but not edit\n\nAlmost always one of three things: cached stale credentials, license was unassigned/moved, or new account setup not finished.\n\n## Step 1 — Sign out of Office identity\n\nThis fixes 60% of cases.\n\n### Windows\n1. Open any Office app (Word for example).\n2. File → Account.\n3. Under \"User Information,\" click **Sign out**.\n4. Confirm.\n5. Close all Office apps completely (Task Manager → kill any `winword.exe`, `excel.exe`, `outlook.exe`).\n6. Wait 30 seconds.\n7. Reopen Word → File → Account → Sign in.\n8. Use your work email + password + MFA.\n\n### macOS\n1. Word → top menu → Sign Out.\n2. Word → Quit (Cmd+Q).\n3. Reopen → File → Account → Sign in.\n\n## Step 2 — Clear Windows Credential Manager cache\n\nIf sign-in loops or won't take:\n\n1. Win + R → `control /name Microsoft.CredentialManager` → Enter.\n2. **Windows Credentials** tab.\n3. Look for entries containing:\n   - `MicrosoftOffice16_Data:SSPI`\n   - `MicrosoftOffice16_Data:live.com`\n   - Anything with \"Office\" or your email\n4. Click each → **Remove**.\n5. Restart computer.\n6. Open Office → sign in fresh.\n\n## Step 3 — Reset Office activation (Windows)\n\nIf the above didn't work:\n\n1. Win + R → type `cmd` → Enter.\n2. Type: `cd \"C:\\Program Files\\Microsoft Office\\Office16\"` (or Office15 / OfficePro)\n3. Type: `cscript ospp.vbs /dstatus` → shows current license state.\n4. If state is wrong, type: `cscript ospp.vbs /rearm`\n5. Restart Office.\n\nFor Click-to-Run (most common):\n1. Settings → Apps → Microsoft 365 → Modify → **Online Repair** (takes 5-10 min).\n2. Sign in fresh after repair.\n\n## Step 4 — Verify license is still assigned\n\nIf above didn't help, the license itself may be gone.\n\nAsk IT / Microsoft 365 admin:\n> \"Is M365 E3 (or your license type) still assigned to my account? Last 24 hours?\"\n\nSometimes during license cleanup, an admin accidentally removes the license, or a renewal lapse hits. Verify before more troubleshooting.\n\nIf admin reassigns → sign out + sign back in (Step 1) → Office activates within 5 minutes.\n\n## Step 5 — macOS-specific reset\n\nIf Office on Mac refuses to activate:\n\n1. Quit all Office apps.\n2. Finder → Go → Go to Folder (Cmd+Shift+G).\n3. Paste: `~/Library/Group Containers/UBF8T346G9.Office`\n4. Move the `Licenses` folder to Trash (don't delete other folders — they hold preferences).\n5. Reopen Word → sign in.\n\n## Specific scenarios\n\n### \"I have multiple Office accounts (personal + work) and they're fighting\"\n- Sign out of personal account explicitly. Office tries to use whichever was last signed in.\n- Best practice: separate Windows user profile for personal vs work.\n\n### \"Word/Excel work but Outlook says license invalid\"\n- Outlook uses a separate profile state. File → Account Settings → Account Settings → remove + re-add the account.\n\n### \"Just upgraded from Office 2019 to M365 — old license error\"\n- Old activation is stuck. Uninstall Office 2019 completely (Programs → Uninstall + use Microsoft's Office removal tool if it doesn't fully go), then install M365 fresh.\n\n### \"License greyed out specifically for Visio or Project\"\n- Visio and Project are separate licenses. Even if you have M365 E3, you might not have Visio assigned. Ask admin.\n\n### \"Works at home, not at office (or vice versa)\"\n- Conditional Access policy blocks Office activation from certain networks. L2 — admin checks tenant policy.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| License truly not assigned and admin says \"I can't add it\" | L2 — possibly tenant license shortage, needs procurement |\n| Online Repair didn't fix Windows install | L2 — full uninstall + reinstall |\n| Sign-in completes but app reverts to \"unlicensed\" within minutes | L2 — possibly cached profile vs admin reassignment |\n| Multiple users in the same org hit this simultaneously | L2 — tenant-wide license issue |\n| MFA + license combination failure | L2 — Conditional Access policy |\n\n## Prevention\n\n- Don't fully decommission Office accounts you might need to re-activate later — leave the license assigned until you're sure.\n- Keep Office updated. Latest patches fix many activation edge cases.\n- If your org churns through hires/exits often, audit license assignments quarterly.\n- New hires: pre-assign M365 license BEFORE the user's start date so Office activates cleanly on first sign-in.\n\n## What ARIA can help with\n\nARIA can walk through sign-out → cache clear → reactivate in order, identify whether your specific error message is local-cache vs admin-side, and draft the IT ticket if admin needs to verify license assignment. ARIA cannot assign or revoke M365 licenses — that's admin scope."
  },
  {
   "slug": "l1-mac-002-spotlight-not-finding",
   "path_rel": "knowledge-base\\top50-gaps\\l1-mac-002-spotlight-not-finding.md",
   "title": "\"Mac Spotlight can't find files / apps that obviously exist\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mac-002\ntitle: \"Mac Spotlight can't find files / apps that obviously exist\"\ncategory: macos\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - spotlight not working mac\n  - cant find files spotlight\n  - mac search broken\n  - mdutil reindex\n  - launchpad missing apps\n  - spotlight indexing\n  - search returns no results mac\n  - spotlight excluded folder\ntags:\n  - macos\n  - spotlight\n  - search\n  - top-50\nrelated: [l1-mac-001-kernel-panic-spinning-beach-ball]\n---\n\n# Mac Spotlight broken\n\n### Spotlight returns nothing for files you can see in Finder\n\nThe index is broken or excluded. Reindex your drive: System Settings → Spotlight → Privacy tab → drag your Macintosh HD or home folder into the exclusion list → wait 30 seconds → remove it. macOS rebuilds the index. Takes 15-60 minutes depending on file count. During rebuild, search results are partial.\n\n### Spotlight finds files but won't find apps\n\nApps aren't indexed. Verify Applications folder isn't in the Spotlight Privacy exclude list (System Settings → Spotlight → Privacy). If Applications is listed there, remove it — wait for reindex. Also check: Spotlight Search Results categories — make sure \"Applications\" is checked.\n\n### Force a full reindex from Terminal\n\nWhen the UI method doesn't fix it, drop to command line. Open Terminal. Type: `sudo mdutil -E /` then your password. This erases the volume index. macOS rebuilds automatically over the next 30-60 minutes. Watch progress: `mdutil -s /` shows status.\n\n### Indexing seems stuck — same percentage for hours\n\nActivity Monitor → search \"mds\" — you should see `mds_stores` using CPU and disk. If it's idle, indexing is genuinely paused. Force restart: `sudo killall mds_stores mds` in Terminal. macOS relaunches them. If indexing never resumes, the index database may be corrupt: `sudo mdutil -E /` again.\n\n### Spotlight finds some types but not others (e.g., misses PDFs)\n\nPer-extension indexing failure. Verify the file's content is text-extractable: open a sample PDF — is it scanned-image (image only) or true PDF? Scanned PDFs need OCR before Spotlight indexes them. Adobe Acrobat Pro or PDFpen can OCR. Or use macOS Preview → Tools → Adjust Text Recognition.\n\n### Searching from Finder works, but Spotlight (Cmd+Space) doesn't\n\nTwo different search backends. Finder uses Spotlight but with its own scope. Spotlight (Cmd+Space) is system-wide. If Cmd+Space is dead but Finder works, Spotlight launcher process is hung — System Settings → Spotlight → uncheck a category → recheck (forces reset). Or restart Mac.\n\n### When to escalate to L2\n\nReindex completes but searches still return nothing. mdutil reports errors instead of building. macOS major upgrade broke Spotlight and reindex didn't help — possibly need OS clean install. Spotlight works for system but not for a specific user account — user profile may be corrupt."
  },
  {
   "slug": "l1-mac-003-mail-not-syncing-after-passcode",
   "path_rel": "knowledge-base\\top50-gaps\\l1-mac-003-mail-not-syncing-after-passcode.md",
   "title": "\"Mac Mail stopped syncing after I changed my password\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mac-003\ntitle: \"Mac Mail stopped syncing after I changed my password\"\ncategory: macos\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - mac mail not syncing\n  - mail wont sign in after password change\n  - keychain password mail mac\n  - exchange account stopped working mac\n  - mac mail loop password prompt\n  - mail offline after password reset\ntags:\n  - macos\n  - mail\n  - password\n  - top-50\nrelated: [l1-password-002-locked-after-change, l1-outlook-003-send-receive-errors]\n---\n\n# Mac Mail stopped syncing after password change\n\n### Mail keeps prompting for password — Keychain has the old one\n\nMail.app cached your old password in Keychain. Even when you type the new password in the prompt, it doesn't save unless Keychain accepts it. Fix: Open **Keychain Access** (Spotlight: Keychain Access). Search for your email server (e.g., `outlook.office365.com` or your work domain). Delete any entries with your email. Quit Keychain Access. Restart Mail. It'll prompt fresh — type new password, check \"Remember in Keychain.\" Should save this time.\n\n### Mail account shows \"Offline\" status\n\nSystem Settings → Internet Accounts → click your account → toggle Mail OFF → wait 5 sec → toggle ON. Or quit Mail entirely, reopen. If still offline, sign out of the account fully (Internet Accounts → click account → \"Sign Out\") and re-add it with new password.\n\n### M365 / Exchange account — needs modern auth\n\nOlder Mac Mail uses Basic Authentication which Microsoft killed in 2022-2023. If your work email is M365 and Mail can't sign in, you need modern auth. Settings → Internet Accounts → remove the M365 account → click \"Add Account\" → pick **Microsoft Exchange** → enter email → sign in via the M365 browser popup (this does modern auth + MFA properly). Account re-adds with proper token.\n\n### MFA prompt didn't appear\n\nSome M365 tenants require explicit MFA approval per device. Sign-in flow opens a browser popup briefly — if it didn't appear, your default browser is missing or blocking popups. Set default browser to Safari or Chrome temporarily, retry account add.\n\n### Password change happened on phone too — both prompting now\n\nThe new password isn't propagating to all devices fast enough. Wait 10 minutes after changing on the web portal (office.com). Then enter new password on Mac Mail. If it instantly locks the account → see KB l1-password-002 (the iPhone Mail or another device is still trying old password and locking the account).\n\n### Account works but sent emails don't appear in Sent folder\n\nAfter the re-add, IMAP folder mappings may be off. Mail menu → Mailbox → Use This Mailbox For → \"Sent.\" Repeat for Drafts, Trash, Junk. Picks up correctly on next sync.\n\n### Verify the account is genuinely working\n\nSend a test email to your own personal address. Wait 60 seconds. Refresh inbox. Receive it? Then sync is functional, you're done. If not received, Mail isn't actually authenticated — repeat sign-out / sign-in cycle.\n\n### When to escalate to L2\n\nRe-add account fails with \"cannot verify server identity\" — TLS / cert issue → L2. M365 account works on Outlook iPhone but not Mac Mail — possibly Conditional Access blocking Mac Mail client → L2. Multiple Mac users in same org hit this after a tenant password rotation → admin reviews policy."
  },
  {
   "slug": "l1-mobile-email-001-set-up-work-email-on-phone",
   "path_rel": "knowledge-base\\top50-gaps\\l1-mobile-email-001-set-up-work-email-on-phone.md",
   "title": "\"Set up work email on your phone — iPhone, Android, new device\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-mobile-email-001\ntitle: \"Set up work email on your phone — iPhone, Android, new device\"\ncategory: m365\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: [\"Work email address + password\", \"MFA already set up (or about to set up)\"]\nkeywords:\n  - mobile email\n  - email on phone\n  - outlook mobile\n  - gmail mobile\n  - iphone email setup\n  - android email setup\n  - exchange activesync\n  - microsoft 365 mobile\n  - work email phone\n  - new phone email setup\nrelated_articles:\n  - l1-mfa-001-setup-recovery\n  - l1-outlook-001-not-receiving-emails\n  - l1-security-001-lost-stolen-device\nescalation_trigger: \"MFA succeeds but mobile mail won't sync after 3 attempts AND conditional access policy blocks unknown device → IT to register device or grant exception.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Set up work email on your phone\n\n## 1. Symptoms\n- New phone, need work email on it.\n- Existing email app stopped working after a phone reset.\n- Switching from old phone to new.\n\n## 2. Recommended app — Outlook mobile (best for Microsoft 365)\n\nMicrosoft Outlook mobile is the cleanest path for work email + calendar + contacts on iPhone and Android. Native iPhone Mail and Gmail apps also work but have limitations.\n\n### Step-by-Step — Outlook mobile\n\n#### iPhone / iPad\n\n**Step 1 — Install.**\n- App Store → search **Microsoft Outlook** → tap **GET** → **OPEN**.\n\n**Step 2 — Add account.**\n- First launch: tap **Add Account** → enter your work email address → tap **Add Account**.\n\n**Step 3 — Sign in.**\n- Microsoft sign-in screen appears.\n- Enter your work password.\n- *(What you should see: A Microsoft sign-in dialog, not a generic email form. If you see a generic form, your domain may not be set up for cloud sign-in — see IT.)*\n\n**Step 4 — MFA.**\n- Push notification to your authenticator app (MobilePASS+, Microsoft Authenticator, etc.) → tap **Approve**.\n- OR enter the 6-digit code from your authenticator.\n\n**Step 5 — Allow notifications + add another?**\n- Permission prompt → tap **Yes** to notifications.\n- \"Add another account?\" → **Maybe Later** if just one work account.\n\n**Step 6 — Set up Focused Inbox + signature.**\n- Settings (top-left → gear) → toggle **Focused Inbox** ON (sorts important mail).\n- Settings → Signature → set your signature.\n\n#### Android\n\nIdentical flow. Play Store → \"Microsoft Outlook\" → install → sign in → MFA.\n\n## 3. Alternative — Apple Mail (iPhone) with work account\n\nIf you prefer the built-in Mail app on iPhone:\n\n1. **Settings** → **Mail** → **Accounts** → **Add Account** → **Microsoft Exchange**.\n2. Enter email + description → **Next**.\n3. **Sign In** → Microsoft sign-in page → enter password → MFA.\n4. Choose what to sync: Mail / Contacts / Calendars / Reminders / Notes → **Save**.\n\nApple Mail limitations vs Outlook mobile:\n- No Focused Inbox.\n- Less detail in calendar invites.\n- Slightly slower sync.\n- Better OS integration (Mail widget, Spotlight search).\n\n## 4. Alternative — Gmail app (Android, Microsoft 365 account)\n\nGmail app supports Microsoft work accounts:\n\n1. Gmail app → tap profile (top-right) → **Add another account** → **Exchange and Microsoft 365** (or Outlook / Hotmail / Live).\n2. Enter work email → Next → Microsoft sign-in → MFA.\n\n## 5. After setup — first 10 minutes\n\n- **Confirm last 30 days of email** synced.\n- **Check Sent folder** also synced (some setups only sync Inbox initially).\n- **Open a calendar invite** to confirm it lands on your calendar.\n- **Test reply** to an email — confirm it sends from your work address.\n\n## 6. Common Issues\n\n**\"This account requires Microsoft Authenticator\" but you don't have it:**\n- Tap the link in the prompt → installs Authenticator → activate per company QR/code.\n- Some organizations require Microsoft Authenticator specifically; you can't substitute another app.\n\n**\"Your IT department has restricted email on personal devices\":**\n- Likely conditional access policy. Options:\n  - Enroll in Intune / Microsoft Defender for Endpoint as required (Settings → … → Get the [Company Portal] app).\n  - OR use Outlook on the Web in browser instead of a native app.\n  - OR ask IT to grant exception.\n\n**Sync seems incomplete (only some old emails missing):**\n- Default mobile sync only fetches recent emails. To get older:\n  - Outlook mobile: Settings → tap account → **Sync All Mail** (or scroll mailbox to bottom to trigger more fetch).\n  - Apple Mail: Settings → Mail → Accounts → tap account → Days of mail to sync → set \"No Limit.\"\n\n**Notifications not arriving:**\n- iOS: Settings → Notifications → Outlook → enable Alerts, Sounds, Badges.\n- Android: Settings → Apps → Outlook → Notifications → allow.\n- In-app: Outlook → Settings → Notifications → toggle on.\n- Don't Disturb / Focus modes can suppress — check.\n\n## 7. Verification\n- Send test email from work computer → arrives on phone within 30 seconds.\n- Reply from phone → arrives at recipient + appears in your Sent on the computer.\n- Calendar invite shows on phone's calendar app.\n\n## 8. When to Call IT\n- Conditional access policy that says \"device must be enrolled\" — needs IT to walk you through Intune enrollment, or get an exception.\n- MFA prompt repeats indefinitely — token clock skew, needs IT.\n- Brand new device that's never been registered — IT may need to add it to the company directory.\n\n## 9. Prevention Tips\n- **Use Outlook mobile for work; keep personal email separate.** Easier security boundary.\n- **Backup your MFA tokens BEFORE switching phones.** MobilePASS+ tokens are bound to the device — moving to a new phone usually requires IT re-enrollment.\n- **Don't use the same password as personal email** on work account.\n\n## 10. User-Friendly Explanation\nDownload Microsoft Outlook from the app store, sign in with your work email and password, approve the MFA prompt on your authenticator. Within 60 seconds you'll have email, calendar, and contacts. If the company requires extra setup like Intune enrollment, follow the prompts — that's normal for work email on a personal phone.\n\n## 11. Internal Technician Notes\n- Outlook mobile uses Microsoft Graph + REST APIs, NOT classic ActiveSync. More efficient, better feature support.\n- Apple Mail with Exchange uses Exchange ActiveSync (EAS) — fewer features, but native OS integration.\n- Conditional access: typical policies require compliant device (Intune-enrolled) OR managed app (Outlook mobile with app protection policy).\n- Outlook mobile supports app-level encryption + remote wipe without device-level MDM (good BYOD pattern).\n- \"Hybrid modern auth\" needed for on-prem Exchange + cloud SSO mix.\n- Disable IMAP / POP at Exchange level if all users on Outlook mobile / native — reduces attack surface.\n\n## 12. Related KB Articles\n- `l1-mfa-001` — MFA setup and recovery\n- `l1-outlook-001` — Outlook not receiving emails\n- `l1-security-001` — Lost / stolen device\n\n## 13. Keywords / Search Tags\nmobile email, email on phone, outlook mobile, gmail mobile, iphone email setup, android email setup, exchange activesync, microsoft 365 mobile, work email phone, new phone email setup, intune enrollment, conditional access"
  },
  {
   "slug": "l1-network-002-unidentified-network-ethernet",
   "path_rel": "knowledge-base\\top50-gaps\\l1-network-002-unidentified-network-ethernet.md",
   "title": "\"Ethernet says 'Unidentified network' — fix wired connection\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-network-002\ntitle: \"Ethernet says 'Unidentified network' — fix wired connection\"\ncategory: networking\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - unidentified network\n  - ethernet no internet\n  - public network ethernet\n  - no network access\n  - apipa 169.254\n  - ethernet cable plugged in no internet\n  - ethernet limited\n  - network discovery off\ntags:\n  - networking\n  - ethernet\n  - dhcp\n  - top-50\nrelated: [l1-wifi-002-connected-no-internet, l1-internet-001-no-internet-at-all]\n---\n\n# Ethernet \"Unidentified network\"\n\n### IP address starts with 169.254 — DHCP isn't responding\n\nYour machine couldn't get an IP from the network. Either the cable isn't truly connected to a live port OR the DHCP server is down. Check: Windows admin cmd → `ipconfig /all` → look at \"Autoconfiguration IPv4 Address.\" If it shows 169.254.x.x, that's APIPA = no DHCP. Try a different port / different cable / restart the switch you're plugged into.\n\n### Renew IP — sometimes just needs a kick\n\nWindows: admin cmd → `ipconfig /release` → `ipconfig /renew`. Mac: System Settings → Network → Ethernet → Details → TCP/IP → \"Renew DHCP Lease.\" iPhone tethering: airplane on/off. Wait 30 seconds. Re-check IP.\n\n### Cable is fine, port is fine, but still no internet\n\nDriver mismatch. Device Manager → Network adapters → right-click your Ethernet adapter → \"Uninstall device\" (check \"Delete the driver software\"). Reboot. Windows reinstalls the default driver. If still broken, download latest from your laptop manufacturer's site (HP, Dell, Lenovo, etc.). Don't trust \"Update driver\" in Device Manager — Microsoft's catalog is often stale.\n\n### \"Public network\" instead of \"Private\" — limited features\n\nWindows treats unidentified networks as Public by default, blocking file sharing and discovery. To switch: Settings → Network & Internet → Ethernet → click the network → change profile to **Private** (only if you trust this network — your home or office). For Public networks, leave as Public.\n\n### Cable is loose / port LED off\n\nVisual check at both ends. Activity LED (usually amber/orange) on the Ethernet port indicates physical link. No LED = no link = cable bad or port dead. Try a known-good cable. Try a different port on the switch/router. If laptop has a USB-C dock providing Ethernet, the dock may be the issue — bypass and plug straight in.\n\n### USB-C dock Ethernet inconsistent\n\nUSB-C docks (Dell WD19, HP USB-C Universal Dock, CalDigit TS3+, etc.) often drop Ethernet after sleep. Symptom: works after fresh boot, breaks after first laptop sleep. Fix: unplug dock from laptop, replug. Or: Settings → Power Options → uncheck \"Allow the computer to turn off this device to save power\" on the dock and Ethernet adapter.\n\n### Cisco SecureClient / corporate NAC blocking\n\nCorporate networks may require posture check (antivirus running, OS patches up to date) before granting full access. You're on Ethernet but stuck on a guest VLAN. Visible signs: only some internal sites work, can't reach file shares. Run Cisco SecureClient / Forescout / Aruba ClearPass posture check if installed. Or wait for it to auto-trigger after sign-in.\n\n### Restart the network adapter\n\nWindows: Win + X → Network Connections → right-click Ethernet → Disable → wait 10 sec → Enable. Mac: System Settings → Network → Ethernet → Make Inactive → wait → Make Active. Often clears stuck driver state.\n\n### When to escalate to L2\n\nCable + port + driver all replaced/refreshed, still no internet on wired but Wi-Fi works fine. Multiple users on the same switch report same issue → switch port/VLAN config or PoE limit. Working in office but not in conference room — possibly different VLAN that needs whitelisting your MAC. Cisco posture check fails repeatedly → endpoint security review."
  },
  {
   "slug": "l1-newdevice-001-new-laptop-first-boot",
   "path_rel": "knowledge-base\\top50-gaps\\l1-newdevice-001-new-laptop-first-boot.md",
   "title": "\"New work laptop — first-boot setup checklist\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-newdevice-001\ntitle: \"New work laptop — first-boot setup checklist\"\ncategory: onboarding\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 60\naudience: end-user\nos_scope: [\"Windows 11\", \"macOS 15+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: [\"Laptop unboxed, plugged in, network available\", \"Sign-in credentials from IT\", \"MFA already set up on phone\"]\nkeywords:\n  - new laptop\n  - new computer\n  - first boot\n  - oobe\n  - out of box experience\n  - windows 11 setup\n  - macos setup\n  - autopilot\n  - intune enrollment\n  - jamf enrollment\n  - device onboarding\n  - migration\n  - new user setup\nrelated_articles:\n  - l1-mfa-001-setup-recovery\n  - l2-onboarding-001-new-user\n  - l1-mobile-email-001-set-up-work-email-on-phone\nescalation_trigger: \"Autopilot / Jamf enrollment fails to apply policies after 2 attempts → IT to manually re-enroll device.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# New work laptop — first-boot setup checklist\n\n## 1. Symptoms\nUser received a new work laptop. Needs to set it up so it's ready for daily work, with all company apps and policies applied.\n\n## 2. The Smooth Path (Autopilot / DEP — most common)\n\nIf IT pre-staged the device (Windows Autopilot or Apple Automated Device Enrollment), unboxing + signing in does most of the work:\n\n### Windows 11 — Autopilot\n\n**Step 1 — Power on.**\n- Press power button. Windows starts the Out-of-Box Experience (OOBE).\n\n**Step 2 — Country + keyboard.**\n- Select your country (Canada / United States / etc.).\n- Keyboard layout: English (US) or English (Canada) typically.\n- Skip second keyboard layout.\n\n**Step 3 — Network.**\n- Connect to Wi-Fi. Use a network that's NOT the corporate 802.1X network — that requires policies that aren't applied yet. Personal hotspot or office guest Wi-Fi works.\n- *(What you should see: After connecting, Windows downloads updates briefly.)*\n\n**Step 4 — License agreement → Accept.**\n\n**Step 5 — Sign in with WORK email.**\n- \"Enter your email\" → enter your work address (e.g., `jane.smith@yourcompany.com`).\n- Microsoft sign-in flow → enter your work password → MFA prompt.\n- *(What you should see: A \"Setting up your device\" loading screen for 5-15 minutes. Autopilot is applying policies, installing required apps, configuring Defender, BitLocker, etc.)*\n\n**Step 6 — Initial Windows desktop appears.**\n- BitLocker may finish encrypting in the background (don't power off for 1-2 hours).\n- Required apps installed automatically: Outlook, Teams, OneDrive, Microsoft 365 apps, antivirus.\n- Optional apps available via **Company Portal** → install on demand.\n\n**Step 7 — Open Outlook.**\n- First launch may take 5 minutes to sync — let it.\n- Outlook → File → Office Account → confirm Activated (no nag).\n\n**Step 8 — Sign in OneDrive.**\n- Start menu → OneDrive → sign in with work email.\n- Choose folders to sync: Documents + Desktop + Pictures recommended.\n- Files migrate over 10-60 minutes depending on volume.\n\n**Step 9 — Set up Teams.**\n- Open Teams → sign in (auto-detects work email).\n- Test camera + mic in Settings.\n\n### macOS — Apple Automated Device Enrollment (DEP)\n\n**Step 1 — Power on.**\n- Pick language + region.\n\n**Step 2 — Wi-Fi.**\n\n**Step 3 — Apple ID** — leave blank initially, OR sign in with a PERSONAL Apple ID. Don't use a work Apple ID unless your company specifically provides one (rare).\n\n**Step 4 — Activation Lock check** — should bypass automatically (DEP).\n\n**Step 5 — Remote Management** — screen appears asking to enroll. Click **Enroll**.\n\n**Step 6 — Sign in.**\n- \"Enter your work email\" → your work address.\n- MFA → approve.\n- Jamf / Kandji / Intune for macOS pushes policies + apps. Takes 5-15 minutes.\n\n**Step 7 — Set up Touch ID / Face ID + password.**\n\n**Step 8 — FileVault encryption.**\n- Will be enabled automatically by policy. Save your recovery key to iCloud if prompted.\n\n**Step 9 — Open Self Service** — install your specific apps.\n\n**Step 10 — Open Outlook / Teams / OneDrive** — same as Windows.\n\n## 3. The Manual Path (no pre-staging)\n\nIf IT didn't pre-stage:\n\n1. Set up Windows / macOS with a LOCAL account first.\n2. Add your work account: Settings → Accounts → Access work or school → Connect.\n3. Microsoft sign-in + MFA.\n4. IT-pushed policies apply within 30 minutes.\n5. Install apps manually via Company Portal / Self Service.\n\n## 4. Essential Day-1 Configuration (do these even if Autopilot worked)\n\n### Windows 11\n- **BitLocker:** Settings → Privacy & security → Device encryption → ON (should already be).\n- **Hello (face/fingerprint):** Settings → Accounts → Sign-in options → Set up Windows Hello.\n- **Screen lock timeout:** Settings → Accounts → Sign-in options → \"When PC has been inactive\" → 5 minutes.\n- **OneDrive backup:** OneDrive icon → Settings → Backup → Manage backup → enable Documents + Desktop + Pictures.\n- **Sleep / power:** Settings → System → Power → Sleep at 30 min when plugged in.\n- **Updates:** Settings → Windows Update → Check now.\n- **Antivirus:** Defender / CrowdStrike / SentinelOne / etc. should be running (icon in tray).\n\n### macOS\n- **FileVault:** System Settings → Privacy & Security → FileVault → confirm ON.\n- **Touch ID:** Settings → Touch ID & Password → Add a fingerprint.\n- **Screen lock timeout:** Settings → Lock Screen → 5 minutes idle.\n- **iCloud Drive:** sign in with personal Apple ID OK; do NOT sync work folders to personal iCloud.\n- **Software Update:** System Settings → General → Software Update → check.\n- **Privacy → Full Disk Access:** confirm IT's MDM agent + endpoint security have it.\n\n## 5. Migrate from Old Laptop\n\nIf migrating, copy these BEFORE the old laptop is wiped:\n\n- Bookmarks: export from browser → import on new.\n- Files outside OneDrive / cloud sync.\n- Email PST archives (if old setup used local PST).\n- Saved Wi-Fi passwords (export from old: `netsh wlan export profile` Windows; Keychain Access macOS).\n- App preferences (most apps re-prompt; some have export/import).\n- License keys for non-M365 apps (BUY only if you can't find the key).\n\n## 6. The 24-Hour Checklist\n\nBy end of Day 1:\n- ✅ Outlook receives + sends mail.\n- ✅ Teams + OneDrive working.\n- ✅ Can access intranet via VPN (if required).\n- ✅ Printer driver installed (test print).\n- ✅ Browser extensions: 1Password / Bitwarden, ad blocker if policy allows.\n- ✅ MFA token bound to this device (sign in to a M365 app fresh → confirm MFA on phone).\n- ✅ Calendar populated from server.\n- ✅ Slack / Discord / industry-specific tools installed.\n- ✅ Backup verification: edit a file in OneDrive Documents → wait 60s → confirm green check (synced).\n\n## 7. When to Call IT\n- Autopilot/DEP fails to apply policies (Settings shows you as \"personal device\" not \"work\").\n- Required corporate app missing from Company Portal / Self Service.\n- BitLocker / FileVault recovery key prompts unexpectedly (something went sideways during setup).\n- Can't sign into specific corporate app (might need pre-registration on that app's back-end).\n- Older laptop replacement: data migration help.\n\n## 8. Prevention Tips\n- **Don't sign in with your personal Apple ID** as the primary on a work Mac.\n- **Keep OneDrive sync clean** — don't pile up 100 GB of personal photos.\n- **Set up your password manager browser extension Day 1** — saves headaches later.\n\n## 9. User-Friendly Explanation\nPlug in, power on, connect to Wi-Fi, sign in with your work email — Windows/macOS does the rest automatically if IT pre-staged the device. Within 30 minutes you'll have Outlook, Teams, and OneDrive ready. Take a quick walk through Settings to confirm BitLocker/FileVault is on, screen lock at 5 minutes, and Hello/Touch ID set up. If anything doesn't work after an hour, ping IT.\n\n## 10. Internal Technician Notes\n- Autopilot profile assignment via Entra ID Group → Intune Autopilot deployment profile → mapped on device serial number import.\n- ESP (Enrollment Status Page) controls user experience during apply. Configure: track app install progress, block until critical apps deploy.\n- For Macs: DEP enrolled via Apple Business Manager → MDM server URL → Jamf Pro / Kandji / Intune.\n- LAPS (Local Administrator Password Solution) for Win — randomized local admin per device, rotated on use.\n- For migration: User State Migration Tool (USMT) for Win OOBE-to-OOBE; Migration Assistant for Mac (slow, often skipped — files via OneDrive instead).\n- Required apps to push via Intune: Microsoft 365, Outlook, Teams, OneDrive, Edge Stable, Defender, Company Portal, Authenticator, BitLocker policy, antivirus.\n- Optional apps: VS Code, Slack, Zoom, 1Password, Adobe Reader, AnyDesk — Self Service catalog.\n\n## 11. Related KB Articles\n- `l1-mfa-001` — MFA setup\n- `l2-onboarding-001` — New user (full onboarding from IT side)\n- `l1-mobile-email-001` — Email on phone\n\n## 12. Keywords / Search Tags\nnew laptop, new computer, first boot, oobe, out of box experience, windows 11 setup, macos setup, autopilot, intune enrollment, jamf enrollment, dep, apple business manager, device onboarding, migration, new user setup, day one"
  },
  {
   "slug": "l1-onedrive-004-sync-paused-stuck",
   "path_rel": "knowledge-base\\top50-gaps\\l1-onedrive-004-sync-paused-stuck.md",
   "title": "\"OneDrive sync paused, red X, or 'processing changes' forever\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-004\ntitle: \"OneDrive sync paused, red X, or 'processing changes' forever\"\ncategory: onedrive\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - onedrive sync stuck\n  - onedrive red x\n  - processing changes\n  - onedrive paused metered\n  - onedrive reset\n  - file in use cant sync\n  - sync icon spinning forever\n  - onedrive battery saver\ntags:\n  - onedrive\n  - sync\n  - top-50\nrelated: [l1-onedrive-001-not-syncing, l1-onedrive-002-restore-deleted-file, l1-onedrive-003-version-conflict]\n---\n\n# OneDrive sync stuck\n\n### Red X on OneDrive icon — sync paused because of metered network\n\nOneDrive auto-pauses on metered or low-battery connections to save data/power. Right-click OneDrive cloud icon in system tray → Settings → Sync and backup → uncheck \"Pause syncing when this device is on a metered network\" and \"Pause syncing when this device is in battery saver mode.\" Click Resume. Sync resumes within 30 seconds.\n\n### \"Processing changes\" spins forever on one file\n\nThat single file is the blocker. Hover the OneDrive icon — it usually shows which file is stuck. Common causes: filename has illegal characters (`<`, `>`, `:`, `\"`, `|`, `?`, `*`), path too long (over 400 chars total), or file is open in another app holding a lock. Fix: rename the file removing illegal chars, shorten the folder path, or close the app that has it open. Sync clears within 60 seconds.\n\n### Reset OneDrive completely\n\nLast-resort fix when nothing else works. Quit OneDrive (right-click icon → Quit OneDrive). Open Run dialog (Win+R), paste: `%localappdata%\\Microsoft\\OneDrive\\onedrive.exe /reset` — Enter. Wait 60 seconds. OneDrive auto-restarts. If it doesn't, manually launch from Start. Your files are safe — reset only clears the sync state.\n\n### \"Some files are locked and won't sync\"\n\nOffice files held open by Word/Excel/PowerPoint block sync. Close every Office app completely (Task Manager → end winword.exe, excel.exe, powerpnt.exe). Wait 30 seconds. OneDrive re-attempts. Also check: anti-virus / backup software (Carbonite, CrashPlan) sometimes locks files during scan. Pause AV temporarily to confirm.\n\n### OneDrive shows \"Up to date\" but my colleague says they don't see my file\n\nClick File Explorer → navigate to OneDrive folder → the file should have a green check mark (synced). If it shows a cloud icon, it's not actually uploaded yet — open it once to trigger upload. If it shows red X, sync failed for that file specifically. If green check but colleague still can't see, they may be looking at the wrong folder OR their sync is paused.\n\n### Unlink and relink account\n\nWhen the OneDrive client itself is misbehaving despite reset. Right-click OneDrive icon → Settings → Account → \"Unlink this PC.\" Files stay on disk; sync stops. Sign in again with your work account. Choose your existing OneDrive folder when prompted (don't pick a new location). Sync rebuilds within 5-30 minutes depending on folder size.\n\n### When to escalate to L2\n\nYou've reset OneDrive, unlinked + relinked, and sync is still broken after 30 minutes → L2. Also: errors mentioning \"credential failure\" repeatedly, sync queue stuck at the same number forever, or admin-controlled Known Folder Move (Desktop/Documents/Pictures redirection) failing on first setup."
  },
  {
   "slug": "l1-onedrive-005-known-folder-move-broken",
   "path_rel": "knowledge-base\\top50-gaps\\l1-onedrive-005-known-folder-move-broken.md",
   "title": "\"OneDrive Known Folder Move — Desktop / Documents / Pictures not syncing\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-005\ntitle: \"OneDrive Known Folder Move — Desktop / Documents / Pictures not syncing\"\ncategory: onedrive\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - known folder move\n  - kfm\n  - desktop not syncing\n  - documents not in onedrive\n  - kfm setup failed\n  - protect your folders\n  - onedrive folder redirection\n  - kfm policy\ntags:\n  - onedrive\n  - kfm\n  - top-50\nrelated: [l1-onedrive-001-not-syncing, l1-onedrive-004-sync-paused-stuck]\n---\n\n# OneDrive Known Folder Move (Desktop / Documents / Pictures)\n\n### What is KFM and why your Desktop is suddenly in OneDrive\n\nKnown Folder Move (KFM) redirects your Windows Desktop, Documents, and Pictures folders to live inside OneDrive instead of locally on C:\\Users\\You. Your IT may have enabled this via Intune policy so your files survive a laptop swap. Visible signs: Desktop folder path now reads C:\\Users\\You\\OneDrive\\Desktop. Files moved automatically. Nothing was deleted.\n\n### Files I had on Desktop are missing after KFM activation\n\nThey moved to OneDrive\\Desktop, didn't delete. Open File Explorer → OneDrive → Desktop. If files aren't there either, they're still syncing — wait 10-30 minutes for the initial upload. Status visible: right-click OneDrive icon → see queue. If files truly missing after sync completes, check OneDrive Recycle Bin (onedrive.live.com → Recycle bin).\n\n### \"Protect your folders\" prompt keeps appearing\n\nWindows wants you to opt in to KFM. If your IT hasn't enforced it via policy, you can dismiss and ignore. If you DO want to enable: right-click OneDrive icon → Settings → Sync and backup → Manage backup → check Desktop / Documents / Pictures → Start backup. Migration takes 5-60 minutes depending on folder size.\n\n### Saved files to Desktop, they're not appearing on my other PC\n\nKFM only syncs to OneDrive after files are saved and detected. Check status: hover OneDrive icon → see if sync is paused/active. If active, file should appear on other PC within 30 seconds for small files, longer for large. If 5+ minutes pass: see KB l1-onedrive-004 for stuck-sync diagnosis.\n\n### KFM setup failed with error 0x80070005 or similar\n\nMost common cause: Desktop path is currently used by a third-party tool (cloud backup software, Dropbox redirecting it, custom shell extension). KFM can't overlay another redirect. Disable other cloud sync tools, retry KFM. Or: existing Desktop folder has a file with illegal characters / over-long path. KFM lists the blocker — fix that one file/folder, retry.\n\n### Disable KFM (revert to local folders)\n\nRight-click OneDrive icon → Settings → Sync and backup → Manage backup → click \"Stop backup\" next to Desktop / Documents / Pictures. Files stay in OneDrive but new files go to local C:\\Users\\You\\Desktop. Old files won't auto-move back; you do that manually or leave them in OneDrive.\n\n### Pictures folder showing 200,000 files I don't recognize\n\nYour iPhone or iPad is also syncing photos to OneDrive Pictures (Camera Roll). Settings → Notifications & actions → check OneDrive mobile is uploading. To stop: OneDrive mobile app → Settings → Camera upload → off. Local Pictures folder isn't affected once that's off.\n\n### When to escalate to L2\n\nKFM is admin-enforced and failing silently. Migration appears stuck for hours. Other Cloud-Sync tools (Box, Dropbox Business, Google Drive for desktop) conflict with KFM. Files truly lost after KFM activation (rare, but possible with corrupt sync state) — L2 + Microsoft support for OneDrive recovery."
  },
  {
   "slug": "l1-onedrive-006-file-path-too-long",
   "path_rel": "knowledge-base\\top50-gaps\\l1-onedrive-006-file-path-too-long.md",
   "title": "\"OneDrive won't sync — file path too long or illegal characters\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-onedrive-006\ntitle: \"OneDrive won't sync — file path too long or illegal characters\"\ncategory: onedrive\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - path too long onedrive\n  - cannot sync file\n  - file name contains invalid character\n  - 400 character limit\n  - this file path is too long\n  - long file name\n  - illegal characters file\n  - rename to sync\ntags:\n  - onedrive\n  - sync\n  - file-path\n  - top-50\nrelated: [l1-onedrive-001-not-syncing, l1-onedrive-004-sync-paused-stuck]\n---\n\n# OneDrive can't sync — path or filename issue\n\n### \"This file path is too long\" — over 400 chars total\n\nOneDrive's hard limit is 400 chars for the full path (drive + folders + filename + extension). Identify the offender: right-click OneDrive icon → View Sync Problems → see the specific file flagged. Fix: rename a parent folder shorter, OR move the file to a higher-level folder, OR rename the file itself. Sync resumes within 60 seconds after the path is under 400.\n\n### Illegal character in filename — `<` `>` `:` `\"` `|` `?` `*` `\\` `/`\n\nFiles copied from Mac, Linux, or another system may have characters Windows OneDrive rejects. View Sync Problems shows which file. Right-click in File Explorer → Rename → remove the bad character. Common offenders: colons in dates (`Meeting 9:00.docx` → `Meeting 9-00.docx`), question marks (`Is this final?.pdf` → `Is this final.pdf`).\n\n### Trailing space or period at end of filename\n\nOneDrive rejects filenames ending with space or period (Windows quirk). Visible test: rename file, hit End key, look for invisible space. Remove. Save. Sync proceeds.\n\n### Reserved Windows names\n\n`CON`, `PRN`, `AUX`, `NUL`, `COM1-9`, `LPT1-9` (case-insensitive, with any extension). Files literally named these won't sync. Rename to anything else.\n\n### Folder has 50+ characters AND nested 8+ levels deep\n\nNot a single problem but combined. Open the deeply-nested folder. Move it up to OneDrive root or shorten parent folder names. Pattern: a typical bad case is `OneDrive\\Documents\\Projects\\2026\\Q2\\Client Name Inc\\Project Folder\\Subproject Phase 3\\Working Drafts\\filename.docx` — flatten this hierarchy.\n\n### Two files differ only by case (Mac-source)\n\nOn Mac, `Report.docx` and `report.docx` are different files. On Windows, they're the same. OneDrive can't sync both. Rename one to `Report-v2.docx` or similar.\n\n### File is 250 GB and stuck\n\nOneDrive single-file limit is 250 GB. Files over this need to be split or stored in SharePoint document library which has higher limits. If you're hitting this with backups: move to a dedicated backup tool, not OneDrive.\n\n### View what's actually failing — the Sync Problems list\n\nRight-click OneDrive cloud icon → \"View sync problems.\" Shows every file that failed and why. Most useful diagnostic in OneDrive. Tackle one row at a time — fix file, refresh list, watch entries disappear. If 100+ files all share the same parent folder, that folder is the problem (path length, permissions, or shared-with weirdness).\n\n### When to escalate to L2\n\nSync problems list shows files but renaming doesn't help. Files truly cannot be renamed (in use by an app that won't close). Sync problem persists after restart + reset + rename — possible OneDrive client corruption. SharePoint document library version of OneDrive returning permission errors → admin checks library config."
  },
  {
   "slug": "l1-outlook-003-send-receive-errors",
   "path_rel": "knowledge-base\\top50-gaps\\l1-outlook-003-send-receive-errors.md",
   "title": "\"Outlook send/receive errors — stuck Outbox, can't connect, sync paused\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-outlook-003\ntitle: \"Outlook send/receive errors — stuck Outbox, can't connect, sync paused\"\ncategory: outlook\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Outlook installed and signed in\"]\nkeywords:\n  - outlook stuck outbox\n  - outlook cant connect\n  - outlook offline\n  - email wont send\n  - 0x8004210b\n  - 0x800ccc0e\n  - cannot connect to server\n  - send receive error\n  - outlook disconnected\n  - new outlook sync paused\ntags:\n  - outlook\n  - email\n  - sync\n  - top-50\nrelated: [l1-outlook-001-not-receiving-emails, l1-outlook-002-cant-send-emails, l1-m365-001-cant-sign-in, l1-password-002-locked-after-change]\n---\n\n# Outlook send/receive errors — get email flowing again\n\n## Symptoms\n\n- Email sitting in Outbox, never sends\n- \"Outlook is disconnected\" at bottom-right of window\n- \"Cannot connect to server\" error\n- Send/Receive Status bar shows red X or \"Failed\"\n- New Outlook shows \"Sync paused\" or never updates\n- Specific error codes: 0x8004210b, 0x800ccc0e, 0x80040115, \"needs password\"\n\n## Step 1 — Check the obvious\n\n1. **Are you actually online?** Open a browser. Load any website. If browser also fails → Wi-Fi / Ethernet issue, fix that first.\n2. **Is Outlook offline mode on accidentally?** Send/Receive tab → check **Work Offline** button. If highlighted, click to turn off.\n3. **Restart Outlook.** Yes really. Resolves 30% of these.\n\n## Step 2 — Check Microsoft 365 service health\n\nIf everything looks fine on your end, M365 might be having an outage.\n\n- Visit https://portal.office.com/servicestatus (sign-in required) or https://status.office.com.\n- Look for Exchange Online incidents.\n- If there's a current incident: wait. Don't troubleshoot further. Microsoft fixes within hours typically.\n\n## Step 3 — Stuck Outbox (most common)\n\nThe email is in your Outbox and won't go out.\n\n### Why it gets stuck\n- Attachment too large (most M365 tenants cap at 25 MB).\n- Recipient address invalid.\n- Outlook profile auth expired (silent — no obvious password prompt).\n\n### Fix\n1. Click the **Outbox** folder in Outlook's folder pane.\n2. Open the stuck email.\n3. Check:\n   - Recipient address (typo? Spaces?)\n   - Attachment size (right-click attachment → see size). If > 25 MB → use OneDrive link instead: drag the file to OneDrive, share, paste link.\n4. Hit **Send** again.\n5. Watch the Outbox — does the email show as italic-pending? If so, click **Send/Receive All Folders** to push.\n6. If it stays stuck: delete (or save as draft), restart Outlook, retry.\n\n### \"It's stuck and won't even delete from Outbox\"\n- File → Work Offline → toggle offline mode.\n- Now Outbox is editable. Right-click stuck email → Delete (or move to Drafts).\n- Toggle Work Offline back off.\n- Send/Receive.\n\n## Step 4 — \"Cannot connect to server\" / disconnected\n\n### Classic Outlook (Windows)\n1. File → Account Settings → Account Settings.\n2. Pick your account → **Repair**.\n3. Follow prompts. Usually fixes 70% of connection issues.\n\n### If repair fails\n1. Same Account Settings → Pick account → **Change** → **More Settings**.\n2. Advanced tab → confirm you're using Exchange (not POP/IMAP) for M365.\n3. Security tab → \"Logon network security\" → **Anonymous Authentication** (for modern Exchange Online).\n4. OK → Test Account Settings.\n\n### New Outlook (Windows)\n1. Settings (gear) → Accounts → click your account → Remove.\n2. Add it back fresh.\n3. Sign in with your work email.\n4. Wait for initial sync (5-10 min for big mailboxes).\n\n### macOS Outlook\n- Outlook (top menu) → Preferences → Accounts → click account → **Advanced** → Server tab.\n- Verify outlook.office365.com is the server (for M365 accounts).\n- Save → restart Outlook.\n\n## Step 5 — \"Outlook needs your password\" repeatedly\n\nIf Outlook keeps asking for password every few minutes:\n\n### Most likely — you changed your password\nSee `l1-password-002-locked-after-change`. Outlook is using the old password. Sign out + sign back in via Account Settings.\n\n### Or — MFA token expired\n1. Open a browser → go to office.com → sign in fresh.\n2. Complete MFA.\n3. Return to Outlook → it should reconnect using the refreshed token.\n\n### Or — corrupted Windows credential cache\n1. Close Outlook.\n2. Win+R → `control /name Microsoft.CredentialManager` → Enter.\n3. Look for entries containing \"MicrosoftOffice\", \"Outlook\", or your email.\n4. Delete each one.\n5. Reopen Outlook. It'll prompt for fresh sign-in.\n\n## Step 6 — Specific error codes\n\n### 0x8004210b — Operation timed out\n- Slow internet, server unreachable, or antivirus blocking.\n- Temporarily disable antivirus → test send.\n- Or restart router.\n\n### 0x800ccc0e — Cannot connect to server (POP/IMAP)\n- Server settings wrong. Check vendor's recommended settings.\n- For M365 users: you should be on Exchange, not POP/IMAP. Migrate the account profile.\n\n### 0x80040115 — Logon failure / mailbox unavailable\n- Account is being moved on Exchange Online side.\n- Wait 15-30 minutes, try again. Usually self-resolves.\n\n### \"We're not able to schedule the meeting\" (calendar-specific)\n- Calendar Connector issue with Teams. Restart Teams + Outlook.\n\n## Step 7 — Profile rebuild (last resort)\n\nIf nothing above works, the Outlook profile may be corrupt.\n\n### Classic Outlook (Windows)\n1. Close Outlook.\n2. Control Panel → Mail (32-bit) → Show Profiles.\n3. Add → name it \"New Profile\" → set up your account.\n4. Set \"When starting Microsoft Outlook, use this profile\" → \"Prompt for a profile to be used.\"\n5. Open Outlook → pick New Profile.\n6. If it works smoothly, you can delete the old profile.\n\n### macOS\n- /Applications/Outlook → Right-click → Show Package Contents → not the answer here.\n- Simpler: Library → Group Containers → UBF8T346G9.Office → Outlook → delete the profile data folder.\n- Reopen Outlook → set up from scratch.\n\n⚠️ Local-only data (drafts, custom views, signatures) is lost on profile rebuild. Server data is fine.\n\n## Specific scenarios\n\n### \"Outlook stuck on splash screen, never opens\"\nSee `l1-teams-002-wont-load-stuck-splash` for similar diagnostics. Try `outlook.exe /safe` to skip add-ins.\n\n### \"Big mailbox — never finishes initial sync\"\n- Settings → Account Settings → Email → click account → Change → use the slider to set \"Mail to keep offline\" to a shorter range (e.g., 3 months instead of 1 year).\n- Online-only mode (Outlook = thin client) loads faster on big mailboxes.\n\n### \"Email sent but recipient says they never got it\"\n- Check Outlook → Sent Items. Is it actually there?\n- If yes — possibly stuck in their spam / quarantine.\n- If no — your send didn't complete; investigate Outbox.\n\n### \"Teams meeting invite from Outlook doesn't show as Teams meeting\"\n- Teams add-in for Outlook may be disabled. File → Options → Add-ins → COM Add-ins → enable Microsoft Teams Meeting Add-in.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Account-level issue (mailbox unavailable, exchange error) | L2 — Exchange admin |\n| Profile rebuild didn't help | L2 — possibly OST file corruption, may need full reset |\n| Multiple users in your org report same issue today | L2 — service health, mail flow rules |\n| Send works internally but external emails bounce | L2 — DKIM / SPF / DMARC configuration |\n| Encrypted email won't decrypt | L2 — certificates / Outlook S/MIME |\n\n## Prevention\n\n- Use OneDrive links for attachments > 10 MB.\n- Keep Outlook updated. Most send/receive bugs are fixed in next patch.\n- Don't switch between online and cached mode often — pick one.\n- After password changes, immediately repair the Outlook account profile.\n\n## What ARIA can help with\n\nARIA can identify the specific error code from your screenshot, walk you through repair → reset → rebuild in order, and tell you when to give up and call IT vs keep trying. ARIA cannot rebuild your Outlook profile remotely."
  },
  {
   "slug": "l1-outlook-004-stuck-outbox",
   "path_rel": "knowledge-base\\top50-gaps\\l1-outlook-004-stuck-outbox.md",
   "title": "\"Outlook stuck in Outbox — email won't send\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-outlook-004\ntitle: \"Outlook stuck in Outbox — email won't send\"\ncategory: outlook\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - outlook stuck outbox\n  - email wont send\n  - send and receive failed\n  - attachment too large\n  - outlook offline mode\n  - 0x8004210b\n  - cant send mail\n  - outbox not clearing\n  - retry send\ntags:\n  - outlook\n  - email\n  - top-50\nrelated: [l1-outlook-001-not-receiving-emails, l1-outlook-002-cant-send-emails, l1-outlook-003-send-receive-errors]\n---\n\n# Outlook stuck in Outbox\n\n### Email stuck because attachment is over 25 MB\n\nM365 caps attachments at 25 MB. Open the email in the Outbox folder. Right-click attachment → see size. If over 25 MB, save the file to OneDrive, get the share link, replace the attachment with the link, hit Send. If you can't tell the size, that's still the most likely cause — try removing the attachment and retest. If under 25 MB but still stuck, that's the next bit.\n\n### Send/Receive button does nothing, Outbox just sits there\n\nOutlook is in offline mode silently. Send/Receive tab → Work Offline button → toggle on then off. This forces a reconnect. Watch the bottom-right status bar — should go from \"Disconnected\" to \"Connected.\" Outbox flushes within 30 seconds if connection is healthy. If button stays grey or status stays disconnected, your account profile needs repair — File → Account Settings → Email → click your account → Repair.\n\n### Outlook keeps prompting for password\n\nYou changed your password recently and Outlook still has the old cached one. File → Office Account → Sign out completely. Quit Outlook. Reopen → sign in with new password. If it prompts immediately again, the Windows credential cache is bad — Control Panel → Credential Manager → Windows Credentials → delete every entry starting with \"Outlook\" or \"MicrosoftOffice\" → restart Outlook fresh. If still prompting after that, your account is locked (5+ failed attempts) — wait 15 minutes or call IT.\n\n### Stuck email won't even delete from Outbox\n\nOutlook is mid-send-attempt and has the email locked. Force the lock release: File → Work Offline → ON. Now Outbox is editable. Right-click stuck email → move to Drafts OR delete. Toggle Work Offline OFF. Send the fixed version from Drafts.\n\n### Error 0x8004210b — operation timed out\n\nNetwork is slow or antivirus is scanning outbound mail. Test: open a browser, load any heavy site (youtube.com). Does it load fast? If no, fix your internet. If yes, temporarily disable antivirus and try send — if it works, antivirus's email scanner is the problem. Re-enable AV, add Outlook to exclusions in the AV settings.\n\n### Whole team can't send today\n\nNot a you-problem. Check status.office.com for an Exchange Online incident. If service health shows orange/red, wait. If service health is green and only you/your team is affected, that's L2 — your tenant's mail flow rule or recent migration is the cause.\n\n### When to escalate to L2\n\nYou've tried Work Offline toggle, restart, password re-sign-in, and the email is under 25 MB → L2 takes it. Also: any error code starting with \"550 5.7\" (transport authorization failed), profile rebuild not solving it, or send works internally but external bounces with SPF/DKIM error."
  },
  {
   "slug": "l1-password-002-locked-after-change",
   "path_rel": "knowledge-base\\top50-gaps\\l1-password-002-locked-after-change.md",
   "title": "\"Account locked after password change — sync your new password to every device and app\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-password-002\ntitle: \"Account locked after password change — sync your new password to every device and app\"\ncategory: authentication\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"You know your new password\"]\nkeywords:\n  - locked out after password change\n  - just changed my password\n  - keep getting locked out\n  - account keeps locking\n  - phone keeps asking for old password\n  - outlook locked after password change\n  - sync new password\n  - password not accepted\n  - aad_smartcard_credential_provider\ntags:\n  - authentication\n  - password\n  - lockout\n  - top-50\nrelated: [l1-password-001-reset-and-sspr, l1-mfa-002-lost-authenticator-phone, l2-active-directory-001-account-lockout]\n---\n\n# Locked out after password change — find the device that's still trying the old password\n\n## When this applies\n\nYou changed your work password (forced rotation, you forgot the old one, IT reset it) and now:\n- You get locked out every few minutes\n- Outlook keeps asking for the password\n- Your phone keeps showing \"wrong password\" for work email\n- Teams or VPN keeps disconnecting\n\n99% of the time, this is one device or app still trying your **old** password in the background. Each failed attempt counts against you. After 5-10 failures, AD/Entra locks the account.\n\n## Step 1 — Identify which device is the culprit\n\nCommon offenders (in order of frequency):\n1. **Phone — work email account.** Outlook mobile, Apple Mail, Gmail/Outlook on Android.\n2. **Phone — Wi-Fi password** (if your corporate Wi-Fi uses your account creds).\n3. **Other laptop / second device** you forgot you signed into.\n4. **Saved password in browser** for SharePoint / Teams / your time-tracking app.\n5. **Old VPN client** still running with cached creds.\n6. **Outlook desktop on Windows** with cached Exchange profile.\n7. **OneDrive / Google Drive sync client** on any device.\n8. **Smartphone Authenticator app** isn't the issue (it doesn't use your password).\n\n### Ask IT to send you a lockout source report\nActive Directory and Entra ID can show **which device IP** generated the failed sign-in. Open a ticket: \"I'm locked out repeatedly after password change. Please pull the lockout source for [your username] in the last 24 hours.\"\n\nThis narrows it to one device fast.\n\n## Step 2 — Update password everywhere — checklist\n\nWork through this list. Skip what doesn't apply.\n\n### On your phone\n- [ ] **Outlook mobile:** open Outlook → tap account icon → Settings → tap your account → **Reset Account** OR sign out and sign back in with new password.\n- [ ] **Apple Mail (iOS):** Settings → Mail → Accounts → tap work account → Account → re-enter password.\n- [ ] **Gmail app (Android, with Exchange account):** Settings → tap account → Account → re-enter password.\n- [ ] **Corporate Wi-Fi:** Forget the Wi-Fi network → rejoin → enter new password.\n- [ ] **VPN apps:** open Ivanti / GlobalProtect / Cisco AnyConnect / Pulse / SonicWall → disconnect → reconnect → enter new password.\n- [ ] **Microsoft Authenticator:** doesn't store passwords directly, but if it shows a stale \"approve sign-in\" prompt for an old session, deny and re-enroll if needed.\n- [ ] **MDM-enrolled phone:** Settings → may have a \"Company portal\" or \"Intune\" app that needs you to re-enter creds.\n\n### On your laptop\n- [ ] **Lock and unlock Windows** with new password (if you changed it on the web/portal but haven't typed it on the laptop yet). On AD-joined: Ctrl-Alt-Del → Change Password (if available) OR lock + unlock to refresh.\n- [ ] **Outlook desktop:** restart Outlook. It'll prompt for new password. If it doesn't and keeps failing → File → Account Settings → repair.\n- [ ] **OneDrive sync client:** right-click cloud icon → Settings → Account → \"Unlink this PC\" → set up again with new password (you won't lose files — they're still in the cloud).\n- [ ] **Teams desktop:** sign out, sign back in.\n- [ ] **Browsers:** Chrome / Edge / Safari — clear saved credentials for your work domains. Settings → Passwords → search for company email → delete entry → next time you log in, save the new one.\n- [ ] **Credential Manager (Windows):** Control Panel → User Accounts → Credential Manager → Windows Credentials. Look for entries pointing to your work tenant. Remove any stale entries.\n\n### On other devices\n- [ ] **Old laptop, tablet, second computer** you forgot about\n- [ ] **Home computer** with a saved work email account\n- [ ] **Smart watch** linked to your phone (it inherits the phone's accounts)\n- [ ] **Conference room PCs / shared workstations** where you signed in\n\n## Step 3 — Unlock your account\n\nIf you're currently locked out:\n- **Entra ID / Office 365:** wait 5-30 minutes (auto-unlock) OR go to `aka.ms/sspr` if SSPR is enabled.\n- **AD on-prem:** call IT to unlock. Don't keep trying the new password — that resets the lockout timer.\n\nWhile the unlock is in flight, **kill the device that was failing**. Otherwise it'll lock you out again within minutes.\n\n## Step 4 — Verify by waiting\n\nAfter updating everywhere:\n1. Sign in normally on your laptop.\n2. **Wait 15 minutes** without doing anything special.\n3. Try to sign in again. Still works? Good — you found and fixed the source.\n4. If you get locked out again → there's still a device using old creds. Get the lockout-source report from IT.\n\n## Common edge cases\n\n### \"I keep getting locked out at 3 AM\"\nLikely a server, scheduled task, or service account using your creds. Common cause: a script you set up months ago, a printer scan-to-email, or a phone email check on auto-fetch overnight. Run through the checklist above; check any \"scheduled task\" or \"service\" that might use your account.\n\n### \"My phone wants my password but I just typed it\"\nSometimes the OS keychain on iOS/Android keeps re-trying with a cached version even after you re-enter. Restart the phone. Then re-enter. If it still keeps prompting, delete the email account entirely and re-add it.\n\n### \"VPN works for 30 seconds then disconnects\"\nYour VPN client may have two saved credential sets. Settings → Saved connections → delete all, recreate with new password.\n\n### \"Outlook desktop won't accept the new password\"\nSign out of Windows entirely (not just lock — full sign-out), sign back in. This refreshes the kerberos ticket / Entra token Outlook is using.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| You've updated everything, still locked every few minutes | L1 — needs lockout source report from AD/Entra |\n| Phone won't sign in with new password no matter what | L2 — possible Intune compliance or conditional access block |\n| Multiple team members locked after a tenant-wide rotation | L2 — likely a service account or policy script that needs updating |\n| Account locked AND MFA is also failing | L1 + see l1-mfa-002 (recovery) |\n\n## Prevention\n\n- When you change your password, **immediately** sign out and back into Outlook + your phone email + Teams + any VPN.\n- Use a password manager (1Password / Bitwarden / Dashlane). Update one entry, and your devices that use the manager pick up the new password.\n- Don't share your password to \"make IT easier.\" If a teammate or service needs access, IT can use delegated permissions or a service account.\n- For PCs left on overnight: don't enable \"save password\" on third-party apps unless you know they'll handle rotation gracefully.\n\n## What ARIA can help with\n\nARIA can walk you through the checklist live for your specific device mix, generate the lockout-source ticket text for IT, and identify which device class is most likely the offender based on your description. ARIA cannot reset the password itself — that's you or your admin."
  },
  {
   "slug": "l1-printer-004-cant-find-printer",
   "path_rel": "knowledge-base\\top50-gaps\\l1-printer-004-cant-find-printer.md",
   "title": "\"Can't find printer — network printer not showing in Add Printer list\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-printer-004\ntitle: \"Can't find printer — network printer not showing in Add Printer list\"\ncategory: printing\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Printer is powered on\", \"You're on the same network OR have driver\"]\nkeywords:\n  - printer not found\n  - cant find printer\n  - network printer missing\n  - add printer empty list\n  - printer disappeared\n  - office printer gone\n  - printer offline\n  - cant add printer windows\n  - printer not in airprint list\n  - printer not showing in mac\ntags:\n  - printer\n  - network\n  - top-50\nrelated: [l1-printer-001-not-printing, l1-printer-002-prints-garbage, l1-printer-003-print-queue-stuck]\n---\n\n# Network printer not in your list — find and add it\n\n## Symptoms\n\n- \"Add Printer\" dialog shows empty list\n- Printer worked yesterday, today it's gone\n- AirPrint doesn't see the office printer from your iPhone\n- macOS \"Add Printer\" can't find network printer\n- New laptop never picked up the office printer\n- Printer name shows but won't add (\"driver unavailable\" or similar)\n\n## Step 1 — Verify the basics\n\nBefore chasing software:\n1. **Printer powered on?** Walk over and check.\n2. **No paper jam / error code on the printer's display?**\n3. **Network cable plugged in** (if wired) or **Wi-Fi indicator lit** (if wireless)?\n4. **You on the office Wi-Fi**, not guest Wi-Fi or VPN? Many office networks segregate VLANs so guest Wi-Fi can't see printers.\n\nIf any of those is wrong, fix it first.\n\n## Step 2 — Verify printer's network state\n\nMost office printers have a panel that can print a network configuration page:\n- HP: Settings → Reports → Network Configuration.\n- Brother: Network Information → Configuration.\n- Canon: Setup → Device Settings → Network Settings → Print Network Status.\n\nPrint it. Look for an **IP address**. Note it.\n\nIf no IP, the printer isn't on the network at all. Power-cycle the printer (off 30 sec, on). Walk away for 2 minutes. Reprint config.\n\n## Step 3 — Add printer by IP (most reliable)\n\nIf Windows / macOS \"auto-discover\" failed, manually add by IP.\n\n### Windows 11\n1. Settings → Bluetooth & devices → Printers & scanners → Add device.\n2. Wait for discovery. If yours shows, click → install. Done.\n3. If not: scroll → \"The printer that I want isn't listed.\"\n4. Pick **\"Add a printer using an IP address or hostname.\"**\n5. Enter IP from Step 2.\n6. Pick the manufacturer + model from the driver list, or \"Have Disk\" if you downloaded a driver.\n7. Done.\n\n### Windows 10\n- Settings → Devices → Printers & scanners → Add a printer.\n- Same path otherwise.\n\n### macOS\n1. System Settings → Printers & Scanners → +.\n2. Top of the dialog: tabs (Default / IP / Windows / Advanced).\n3. Click **IP**.\n4. Enter IP. Protocol: usually IPP or LPD. Queue: usually empty or \"auto.\"\n5. Use: pick driver or \"Generic PostScript.\"\n6. Add.\n\n## Step 4 — Driver issues\n\n### \"Driver unavailable\" or doesn't show in list\n- Download driver from manufacturer's site BEFORE adding.\n  - HP: hp.com/support → enter your model.\n  - Brother: brother.ca/support.\n  - Canon: canon.ca → support → drivers.\n  - Lexmark: lexmark.com → support → drivers.\n- Install driver first, then add printer.\n- Use Universal Print Driver (UPD) if your IT shop uses it — works for most enterprise fleets.\n\n### \"Windows can't connect to this printer\" (error 0x000003e3 or similar)\n- Restart the **Print Spooler** service (services.msc → Print Spooler → Restart).\n- See `l1-printer-003-print-queue-stuck` for full spooler reset.\n\n## Step 5 — Specific environment fixes\n\n### Corporate AD/Azure-joined PC\n- Type `\\\\printserver` in File Explorer (replace with your actual print server name — ask IT).\n- See list of shared printers.\n- Right-click yours → Connect → install.\n\nIf you don't know the print server name, IT will know it. Common naming: `print01`, `printsrv`, `\\\\corp-prints`.\n\n### \"Printer worked yesterday, gone today\"\n- Check if you're on a different Wi-Fi / VPN than yesterday.\n- Check if printer IP changed (DHCP may have re-assigned it). The IT team can assign a static IP to prevent this.\n- Power-cycle your laptop + the printer.\n\n### \"iPhone / iPad doesn't see office printer\"\n- iOS uses AirPrint. The printer needs AirPrint-compatible firmware (most enterprise printers do; some don't).\n- Phone needs to be on the SAME subnet as the printer (often blocked between guest Wi-Fi and office Wi-Fi).\n- If printer doesn't support AirPrint, install vendor's app (HP Smart, Canon PRINT, Brother iPrint&Scan).\n\n### Mac on a Windows print server\n- System Settings → Printers & Scanners → + → click \"Windows\" tab.\n- Workgroup → click yours → server → printer.\n- Pick driver. Add.\n\n### \"Multiple printers, only some show\"\n- Some printers are restricted (e.g., color printer requires permission). Ask IT for access.\n- Or your driver is missing for a subset of printer models. Install the universal driver.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Printer has no IP after power-cycle | L2 — network issue, possibly hardware fault |\n| You can ping the IP but Windows still can't add | L2 — driver or firewall issue |\n| All printers gone from your laptop after Windows update | L2 — possible spooler corruption |\n| Need access to restricted printer (color, finance, etc.) | L1 — IT grants permission |\n| Whole office can't see any printers | L2 — print server or network outage |\n\n## Prevention\n\n- After a major Windows feature update, take 60 sec to verify printers still work.\n- Don't unplug office printer's Ethernet cable casually — it may take 5 minutes to fully re-register.\n- For static-IP'd office printers, get the IP from IT and save it. If discovery breaks, you can always add by IP.\n- Mac: if you swap networks (home / office / coffee shop) and one of those has the same SSID name with different setup, printers will get re-detected each time. Annoying but normal.\n\n## What ARIA can help with\n\nARIA can walk you through Add-by-IP, identify whether your issue is network-layer / driver / permission, and find the right driver download link for your specific printer model. ARIA cannot physically check if the printer's power cable is plugged in."
  },
  {
   "slug": "l1-printer-005-offline-after-sleep",
   "path_rel": "knowledge-base\\top50-gaps\\l1-printer-005-offline-after-sleep.md",
   "title": "\"Network printer shows 'offline' after PC wake or reboot\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-printer-005\ntitle: \"Network printer shows 'offline' after PC wake or reboot\"\ncategory: printing\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 6\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - printer offline\n  - printer disconnected after wake\n  - printer status offline\n  - cant communicate with printer\n  - printer ip changed\n  - dhcp printer disappeared\n  - use printer offline\n  - reactivate network printer\ntags:\n  - printer\n  - network\n  - top-50\nrelated: [l1-printer-001-not-printing, l1-printer-003-print-queue-stuck, l1-printer-004-cant-find-printer]\n---\n\n# Printer offline after sleep / wake\n\n### Printer shows \"Offline\" — check Use Printer Offline isn't toggled\n\nCommon gotcha. Settings → Bluetooth & devices → Printers & scanners → click your printer → Open print queue → Printer menu (top-left) → uncheck \"Use Printer Offline.\" Some Windows builds set this automatically when the printer becomes unreachable, then leave it stuck even after the printer is back. Toggle it off and try printing.\n\n### Printer was on DHCP, IP changed after weekend reboot\n\nOffice printers should have static IPs. If yours got a new IP from DHCP overnight, your saved printer config points to the old IP. Walk to the printer, print the network configuration page (HP: Settings → Reports → Network Configuration; Brother: Network → Print Configuration). Note the new IP. On your PC: Settings → Printers & scanners → remove old printer → add by IP using the new address. Long-term fix: ask IT to reserve a static IP for office printers in DHCP.\n\n### Restart Print Spooler — fixes 50% of \"offline\" states\n\nSpooler service crashed during sleep. Press Win+R → `services.msc` → Enter. Scroll to **Print Spooler**. Right-click → Restart. Wait 10 seconds. Send a test print. If it works, the spooler was the issue — happens after Windows updates or driver glitches. If still offline, the printer or network is the problem.\n\n### Printer's panel shows \"Sleep\" — wake it up\n\nSome printers (especially HP, Brother) hibernate after 30-60 min of idle. They look \"offline\" to clients during deep sleep. Walk to the printer, press any panel button to wake. Try printing within 30 seconds. If this happens daily, increase the sleep timer on the printer's web admin page (browse to its IP) — default is often 15 min; bump to 60 min.\n\n### Multiple PCs can't see the printer — it's the network\n\nIf only your PC reports offline, it's local. If everyone reports offline, the printer dropped off the network. Walk to the printer: is the network cable plugged in? Wi-Fi LED lit? Any error code on the panel? Power-cycle (off 30 sec, on). After it boots, wait 2 min for full network re-registration. If still offline org-wide, ask IT to check the print server / VLAN.\n\n### Mac shows \"Paused\" or \"Idle\" but won't print\n\nSystem Settings → Printers & Scanners → click printer → Open Print Queue → click \"Resume Printer\" if it shows that button. Sometimes paused on a previous error. If queue is empty and printer shows ready but jobs vanish: Reset printing system (System Settings → Printers & Scanners → right-click empty area → Reset printing system) → re-add printer.\n\n### When to escalate to L2\n\nSpooler won't start at all (service crashes immediately). Multiple users on same network printer all show offline despite power-cycle. Print server isn't reachable from any PC. Static-IP'd printer disappears after a Windows feature update (driver issue). Garbage prints after the offline clear — see KB l1-printer-002."
  },
  {
   "slug": "l1-security-001-lost-stolen-device",
   "path_rel": "knowledge-base\\top50-gaps\\l1-security-001-lost-stolen-device.md",
   "title": "\"Lost or stolen company device — immediate response protocol\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-security-001\ntitle: \"Lost or stolen company device — immediate response protocol\"\ncategory: security\nsupport_level: L1\nseverity: critical\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - lost laptop\n  - stolen laptop\n  - lost phone\n  - stolen phone\n  - find my device\n  - remote wipe\n  - kill switch\n  - mobile device management\n  - mdm\n  - intune wipe\n  - jamf wipe\n  - report theft\n  - police report\nrelated_articles:\n  - l1-email-001-suspicious-phishing\n  - l1-password-001-reset-and-sspr\n  - l3-security-001\nescalation_trigger: \"ANY lost or stolen device handling work data is automatically a security incident. Notify IT/Security IMMEDIATELY. Do not wait.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Lost or stolen company device — immediate response protocol\n\n## 1. This is an emergency\nTreat every lost/stolen device as potentially compromised data. Speed matters. Hours, not days. **Call IT immediately at (647) 581-3182 — do not wait until tomorrow.**\n\n## 2. The 10-Minute Protocol (Do These Right Now)\n\n### Step 1 — Report it to IT (FIRST — even before retracing your steps)\n- Call IT: **(647) 581-3182**.\n- If after hours: text the after-hours emergency line OR email `security@iisupp.net` with subject **URGENT LOST DEVICE**.\n- Tell them:\n  - Your full name + email.\n  - What device (laptop model / phone model).\n  - When and where last seen.\n  - Was it powered ON when lost? (Matters for encryption status.)\n  - Was it locked when lost?\n  - Do you remember if you were signed into email / Slack / Teams / VPN at the time?\n\n### Step 2 — Remote lock / wipe (IT does this — but you can start)\n\n**For your phone (you can self-trigger):**\n\n**iPhone / iPad:**\n1. From any device → `https://icloud.com/find` → sign in with your Apple ID.\n2. Click your phone → click **Mark As Lost**.\n3. Set a passcode + custom message (\"Reward if returned, call XYZ\").\n4. If recovery seems unlikely: click **Erase iPhone**.\n\n**Android (Google account):**\n1. From any device → `https://android.com/find` → sign in.\n2. Click your phone → **Secure device** (locks remotely) OR **Erase device**.\n\n**Samsung Find My Mobile** (extra option if you have a Samsung):\n- `https://findmymobile.samsung.com` → sign in → similar options.\n\n**For your laptop (IT does this):**\n- IT will trigger an Intune / Jamf / MDM wipe.\n- Disable account: IT disables your account in Entra ID / Active Directory — instantly blocks email / VPN / Microsoft 365 access regardless of laptop state.\n- Revoke active sessions: IT runs a \"Revoke all sessions\" command — kills any open Outlook / Teams / Slack on the lost device.\n\n### Step 3 — Change critical passwords from a DIFFERENT trusted device\n\nFrom a friend's phone, a coworker's computer, your home computer — NOT the lost device — change:\n1. **Your primary work email password** (Microsoft 365 / Google Workspace).\n2. **Your password manager master password** (1Password / Bitwarden / LastPass).\n3. **VPN credentials** if separate.\n4. **Any banking / payment passwords** if you signed in on the lost device.\n5. **Personal email** (often a recovery path to corporate).\n\n### Step 4 — Revoke MFA tokens / device trust\n1. Go to your account portal (Microsoft: `https://aka.ms/mysecurityinfo` / Google: `https://myaccount.google.com/security`).\n2. Look for **Devices** or **Where you're signed in**.\n3. Sign out / revoke trust for the missing device.\n4. Remove MFA methods that were on the missing device (set up new ones first).\n\n### Step 5 — File the appropriate report\n- **Stolen:** police report. Get a case / report number. Insurance + corporate require it.\n- **Lost in transit:** file with the venue (hotel, airline, ride-share, restaurant).\n- **Document the loss** internally: write a short timeline (when, where, who you told).\n\n## 3. What IT will do on their end (you don't have to do this)\n- Disable your Entra ID / AD account → blocks all logins.\n- Initiate Intune / Jamf wipe on the device.\n- Revoke OAuth tokens (Microsoft, Google, Slack, Teams).\n- Check audit logs for any post-loss activity from the device or your account.\n- Decide whether incident escalates to Security team + management.\n- File insurance / asset-loss paperwork.\n\n## 4. While waiting for IT to finish\n- Don't keep trying to find the device by signing into apps to look at its location — that creates more audit entries.\n- Don't post about it on social media (signals to thieves to wipe / extract faster).\n- Don't tell vendors / customers the device is lost via the lost device's email — use another channel.\n- Note any suspicious activity in your accounts (login alerts, password reset emails, MFA prompts you didn't initiate) — share with IT.\n\n## 5. If you find the device later\n- DO NOT plug it into your work network until IT inspects it.\n- DO NOT log in to anything from it.\n- Bring it to IT. They will:\n  - Check for tampering signs.\n  - Confirm wipe state.\n  - Re-image and re-enroll OR retire the device.\n\n## 6. Verification (after IT response)\n- Try to sign into your work account from the missing device's expected sign-in URL (using a different device) → you get prompted for full re-authentication (account disable then re-enable confirms IT's action).\n- All previously-signed-in sessions are gone.\n- Lost device shows as \"Wiped\" or \"Compromised\" in IT's MDM console (IT confirms).\n\n## 7. Prevention (so this hurts less next time)\n- **Disk encryption (BitLocker / FileVault)** enabled on every device. Without encryption, a thief can pull the drive and read everything regardless of password.\n- **Auto-lock screen** at 5-10 minutes idle.\n- **Strong device PIN/password.** Not 1234. Not the year. Six characters minimum, longer for laptops.\n- **Find My iPhone / Find My Android** always on. Don't disable for \"battery savings.\"\n- **Don't store payment cards in browser** on portable devices unless absolutely needed.\n- **Password manager with MFA** so no plaintext passwords live on any device.\n- **Insurance:** corporate cyber insurance + asset insurance. Personal AppleCare+ / Samsung Care+ for phones.\n\n## 8. User-Friendly Explanation\nCall IT immediately, even if it's after hours — they need to disable your account and wipe the device before someone else can use it. While you wait, go to icloud.com/find (iPhone) or android.com/find (Android) and mark the device as lost or erase it. Then from a different computer or phone, change your work email password, your password manager password, and any banking passwords you used on the lost device. File a police report if stolen. Don't try to find the device yourself by logging in — let IT handle the audit log review.\n\n## 9. Internal Technician Notes\n- Intune wipe command: `Invoke-MgGraphRequest -Method POST -Uri \"/v1.0/deviceManagement/managedDevices/{id}/wipe\"` OR Intune portal → Devices → Wipe.\n- Jamf wipe: Jamf Pro console → Computers → action → Erase.\n- Entra ID account disable: `Update-MgUser -UserId user@company.com -AccountEnabled:$false`. (Note: this kills email immediately. Confirm before pulling trigger if disputes possible.)\n- Revoke sessions: Microsoft Graph `revokeSignInSessions` on user object → kills all tokens.\n- Conditional access risk score: Entra ID will mark the user as \"Risk: high\" automatically after sign-in from unfamiliar device — confirms our suspicion.\n- Logs to check: Entra ID Sign-in logs (last 30 days), Intune device check-in time, Microsoft Defender for Cloud Apps alerts, Exchange Online unified audit log.\n- If device may be at risk of exfiltration: Entra ID → Conditional access → block sign-in from outside specific IPs immediately while investigation runs.\n- Consider: was disk encrypted? BitLocker recovery key in tenant? FileVault recovery key escrowed?\n- If suspected nation-state / targeted theft: escalate to Anthropic / CISA / law enforcement per playbook.\n\n## 10. Related KB Articles\n- `l1-email-001` — Suspicious / phishing email\n- `l1-password-001` — Password reset\n- `l3-security-001` — Security incident response\n\n## 11. Keywords / Search Tags\nlost laptop, stolen laptop, lost phone, stolen phone, find my device, remote wipe, kill switch, mobile device management, mdm, intune wipe, jamf wipe, report theft, police report, icloud find, find my iphone, find my android, samsung find my mobile, security incident"
  },
  {
   "slug": "l1-slack-001-cant-join-voice-huddle",
   "path_rel": "knowledge-base\\top50-gaps\\l1-slack-001-cant-join-voice-huddle.md",
   "title": "\"Slack / Discord huddle or call won't connect — audio, mic, or join error\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-slack-001\ntitle: \"Slack / Discord huddle or call won't connect — audio, mic, or join error\"\ncategory: collaboration\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"App installed and signed in\"]\nkeywords:\n  - slack huddle wont start\n  - cant join slack call\n  - discord voice not working\n  - slack audio missing\n  - huddle no sound\n  - slack mic not working\n  - discord cant connect to voice\n  - mic muted in slack\n  - slack screen share black\n  - no input audio device\ntags:\n  - slack\n  - discord\n  - voice\n  - top-50\nrelated: [l1-meeting-audio-001-wrong-device, l1-bluetooth-002-airpods-headset-wont-reconnect, l1-teams-001-audio-not-working]\n---\n\n# Slack / Discord call won't connect — diagnose and fix\n\n## Symptoms\n\n- Click \"Start huddle\" in Slack → nothing happens\n- Discord shows \"Connecting...\" indefinitely\n- Joined the call but no audio either direction\n- Your mic shows muted even when you click unmute\n- Screen share is a black rectangle\n- \"Couldn't access microphone/camera\" error\n- Audio works for music but Slack/Discord can't hear you\n\n## Step 1 — Permissions (most common cause)\n\n### macOS\n1. **System Settings → Privacy & Security → Microphone**.\n2. Make sure **Slack** (and **Discord**) are toggled ON.\n3. **Camera** — same check.\n4. **Screen & System Audio Recording** — required for screen share + sometimes for huddle audio sharing.\n5. **Quit and reopen the app** after any change.\n\n### Windows\n1. Settings → Privacy & security → Microphone → \"Let apps access your microphone\" → On.\n2. Scroll down to Slack / Discord → On.\n3. Same for Camera.\n\n### iOS / Android\n1. Phone Settings → Apps → Slack (or Discord) → Permissions.\n2. Microphone + Camera + (optionally) Notifications → Allow.\n\n## Step 2 — Right input/output device\n\nInside the app:\n\n### Slack desktop\n1. Click your profile → Preferences → Audio & video.\n2. **Microphone** dropdown — pick your actual mic (not \"Default\" which Slack may have wrong).\n3. **Speaker** dropdown — pick where you want to hear.\n4. **Camera** dropdown — pick your real camera.\n5. Click \"Test\" — does the mic level meter respond when you talk?\n\n### Discord\n1. Discord Settings (gear) → Voice & Video.\n2. INPUT DEVICE → pick your mic.\n3. OUTPUT DEVICE → pick your speakers/headset.\n4. Scroll to \"Voice Settings\" → set Input Mode to \"Voice Activity\" (auto detect) or \"Push to Talk.\"\n5. **Reset Voice Settings** button at the bottom — nukes stuck state.\n\n## Step 3 — Slack-specific huddle issues\n\n### \"Huddle won't start\" — Slack hangs\n- Update Slack to latest version (Help → Check for Updates).\n- Restart Slack.\n- If it persists: signOut/signIn (Slack → workspace name → Sign out → sign back in).\n\n### \"Huddle audio is robotic / laggy\"\n- Slack Huddles use WebRTC. Quality drops on weak Wi-Fi.\n- Move closer to router OR switch to wired Ethernet.\n- Disable any VPN — it adds latency.\n\n### Screen share black in huddle\n- macOS: System Settings → Privacy & Security → Screen Recording → enable Slack. Then quit + reopen Slack.\n- Windows: usually a GPU acceleration issue. Slack → Preferences → Advanced → uncheck \"Hardware acceleration\" → restart.\n\n## Step 4 — Discord-specific issues\n\n### \"Stuck on RTC Connecting\"\n- Discord can't reach its voice servers. Try:\n  1. Different network (mobile hotspot test).\n  2. Disable VPN.\n  3. Discord Settings → Voice & Video → Voice Region → change to a closer one or \"Automatic.\"\n  4. Restart Discord.\n\n### \"No Route\" error\n- Firewall blocking Discord. Either disable host firewall temporarily OR allow Discord in Windows Defender Firewall.\n\n### \"Mic always shows muted\"\n- Hold the slash key (/) — Discord push-to-talk override default.\n- Or your hardware mute button on headset is engaged. Check headset.\n- Or input device is wrong (Step 2).\n\n### \"Other people sound robotic, I sound fine\"\n- Receive-side codec issue. Have THEM update Discord, restart, OR change voice region.\n\n## Step 5 — Other apps stealing mic/camera\n\nIf Slack / Discord can't access the mic but Voice Recorder can, another app has it locked.\n\n### Common culprits\n- Microsoft Teams (background process even when window closed)\n- Zoom (running in tray)\n- OBS / Streamlabs\n- Snap Camera (notorious — uninstall if not actively used)\n- Web tabs with camera permission still open in another browser window\n\n### Fix\n- Quit all of the above completely (Task Manager / Force Quit).\n- Reopen Slack / Discord — mic should work now.\n\n## Step 6 — Headphones / Bluetooth specifics\n\nIf using AirPods or other Bluetooth headset, see `l1-bluetooth-002-airpods-headset-wont-reconnect` first.\n\nQuick:\n- Switch Bluetooth profile to **Hands-Free** mode for calls (better mic, lower stereo quality).\n- For consistent quality on Windows, use wired or a dedicated USB headset dongle.\n\n## Step 7 — Slack mobile huddle issues\n\n### \"Huddle invite came but I can't join\"\n- Update Slack mobile to latest version.\n- Phone Permissions → mic + camera allowed for Slack.\n- Phone Settings → Focus / Do Not Disturb → off (might be silencing the join).\n- Force-quit + reopen Slack.\n\n### \"Can hear them, they can't hear me\"\n- Hardware: another app is using the mic. Phone Settings → see what's recently used mic.\n- Reboot phone — clears mic claim.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Permissions reset every reboot | L2 — possibly MDM / Intune policy |\n| Slack / Discord crashes on every call | L2 — reinstall + check OS compatibility |\n| All voice/video apps have issues | L2 — driver / audio subsystem |\n| Workplace mass issue | L2 — Slack / Discord status page, possibly outage |\n| Corporate firewall blocks Slack voice | L2 — IT whitelists Slack IP ranges |\n\n## Prevention\n\n- After OS major upgrade: spend 60 sec verifying mic + camera permissions for collaboration apps.\n- Keep Slack, Discord, Teams, Zoom updated. They all auto-update by default — leave it on.\n- Pick **one** primary mic/headset and stick with it.\n- For Discord: enable Krisp / built-in noise suppression for cleaner calls.\n- For Slack: huddles work best on stable Wi-Fi or wired. Avoid coffee shop Wi-Fi for critical huddles.\n\n## What ARIA can help with\n\nARIA can walk through the permission stack live for your specific OS, identify which app stole the mic from your description, and reset Slack/Discord audio settings step-by-step. ARIA cannot click the OS permission dialog for you."
  },
  {
   "slug": "l1-software-install-001-software-install-request",
   "path_rel": "knowledge-base\\top50-gaps\\l1-software-install-001-software-install-request.md",
   "title": "\"Requesting software install on work computer — process and self-serve options\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-software-install-001\ntitle: \"Requesting software install on work computer — process and self-serve options\"\ncategory: software\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current\"\nprerequisites: []\nkeywords:\n  - software install\n  - install request\n  - app store\n  - company portal\n  - winget\n  - chocolatey\n  - homebrew\n  - software center\n  - intune company portal\n  - jamf self service\n  - admin rights\n  - request software\n  - allowed software\n  - approved software\nrelated_articles:\n  - l1-windows-006-app-wont-open\n  - l1-m365-002-license-activation-issues\nescalation_trigger: \"Software not in self-serve catalog AND business case is clear (regulated industry tool, compliance need, customer-required) → IT submits formal request through procurement; user notified within 2 business days.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Requesting software install on work computer\n\n## 1. Symptoms\n- User needs an app installed on their work computer.\n- They don't have admin rights (typical).\n- Don't know how to request it formally.\n\n## 2. Step-by-Step\n\n### Step 1 — Check self-serve catalog FIRST\n\nMost companies pre-approve common software. Try the self-serve portal:\n\n**Windows (Microsoft Intune):**\n1. Start menu → search **Company Portal** → open.\n2. Browse or search for the app.\n3. Click **Install**.\n4. Wait — typically 2-10 minutes.\n\n**Windows (Microsoft Endpoint Configuration Manager / SCCM):**\n1. Start menu → **Software Center**.\n2. Browse → click → Install.\n\n**Mac (Jamf):**\n1. Apps → **Self Service.app**.\n2. Browse or search.\n3. Click **Install**.\n\n**Mac (Kandji):**\n1. Apps → **Kandji Self Service**.\n2. Same pattern.\n\n### Step 2 — Common pre-approved software (probably available)\n\nTypically pre-approved in self-serve catalogs:\n- Slack, Zoom, Teams, Discord\n- Chrome, Firefox, Edge\n- VS Code, IntelliJ Idea Community, Visual Studio Community\n- 1Password, Bitwarden\n- Notion, Obsidian, Logseq\n- Adobe Acrobat Reader\n- 7-Zip, Keka\n- ImgBurn / Rufus\n- Postman, Insomnia\n- DBeaver, Sequel Pro\n- Cisco AnyConnect, GlobalProtect (VPNs)\n- Microsoft Authenticator, Duo Mobile\n- Outlook, OneDrive, OneNote (usually part of Office install)\n\n### Step 3 — If NOT in self-serve\n\nSubmit a request:\n1. Email IT: `it@<company>.com` OR formal ticketing system if your company uses one.\n2. Include in the email:\n   - Software name + version + vendor website.\n   - Business reason (which job task needs it).\n   - Manager approval (CC manager or include in the message).\n   - Whether you've paid for a license already or need IT to procure.\n\n### Step 4 — While waiting\n\n**For one-off tasks, web alternatives often suffice:**\n- Need a quick PDF edit? smallpdf.com, ilovepdf.com.\n- Need a quick file format conversion? cloudconvert.com.\n- Need a quick image edit? photopea.com (free Photoshop clone in browser).\n\n**Some apps run portable without install:**\n- WinSCP, PuTTY portable, VLC portable — but check with IT first; some companies block portable .exe execution.\n\n### Step 5 — Self-install options (Windows users with command line)\n\n**winget** (built into Windows 11):\n```\nwinget search <app>\nwinget install <appid>\n```\n*(If you don't have admin rights, winget will fail — that's expected. Use Company Portal.)*\n\n**Chocolatey** (only if pre-installed by IT):\n```\nchoco install <pkg>\n```\n\n### Step 6 — Self-install options (Mac users with command line)\n\n**Homebrew** (only if your company allows it — check first):\n```\nbrew install <pkg>\nbrew install --cask <gui-app>\n```\n\n## 3. Why some software gets denied\n\nSoftware requests are evaluated against:\n- **Security:** does it have known vulnerabilities? Open-source vs commercial vendor reputation?\n- **Cost:** seat license per user × team size.\n- **Compliance:** does it handle regulated data? PCI / HIPAA / GDPR audit footprint?\n- **Maintenance:** can IT keep it patched / supported?\n- **Duplication:** does an already-approved tool do the same job?\n\nIf denied, ask:\n- What's the security concern?\n- Is there an approved alternative?\n- Can you submit a security review + revisit?\n\n## 4. Verification Steps\n- App appears in Start menu (Win) or Applications folder (Mac).\n- Launches without error.\n- License (if any) activates successfully.\n\n## 5. When to Call IT\n- Self-serve portal isn't installed on your computer — IT to deploy it (usually 1-day SLA).\n- \"This installation is blocked by your administrator\" error — software not in approved list.\n- Critical business need with a deadline — emphasize urgency in the request + CC your manager.\n\n## 6. Prevention Tips\n- **Bookmark your company's Self Service portal** — saves 5 minutes vs digging through menus every time.\n- **Keep a list of your essential apps** for migration to new computers.\n- **Don't install pirated / cracked software.** Even on a personal device used for work — security risk, IP risk, audit risk. Use trial → buy if needed.\n\n## 7. User-Friendly Explanation\nFirst check the Company Portal (Windows) or Self Service (Mac) on your computer — most common apps are there and self-install with one click. If your app isn't listed, email IT with the name of the software, why you need it, and your manager's approval. While waiting, check if there's a web version. Most companies turn requests around in 1-3 business days.\n\n## 8. Internal Technician Notes\n- Intune Company Portal apps are deployed as Win32 LOB apps, .intunewin format, or via Microsoft Store for Business / new Windows Package Manager (winget).\n- Jamf Self Service shows policies + packages user-scoped. Restrict by user group / smart group.\n- Application reputation services (Microsoft Defender SmartScreen, Apple Gatekeeper) block unsigned binaries by default — sometimes blocks legitimate freeware.\n- Application Control / WDAC on Windows 11 Enterprise blocks unsigned binaries entirely.\n- macOS Gatekeeper: System Settings → Privacy & Security → \"Allow apps from\" → \"App Store & Identified Developers\" is standard.\n- For self-installable but rare apps: keep a curated \"advanced\" tier in Self Service for engineering staff vs locked-down for general staff.\n- SCCM (now MECM / Configuration Manager) is the legacy on-prem deployment tool, Intune is cloud successor.\n\n## 9. Related KB Articles\n- `l1-windows-006` — App won't open\n- `l1-m365-002` — License activation\n\n## 10. Keywords / Search Tags\nsoftware install, install request, app store, company portal, winget, chocolatey, homebrew, software center, intune company portal, jamf self service, admin rights, request software, approved software, mecm, sccm"
  },
  {
   "slug": "l1-software-install-002-wont-install",
   "path_rel": "knowledge-base\\top50-gaps\\l1-software-install-002-wont-install.md",
   "title": "\"Software won't install — admin rights, blocked installer, or app store error\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-software-install-002\ntitle: \"Software won't install — admin rights, blocked installer, or app store error\"\ncategory: software\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"You have the installer or app store access\", \"Admin rights or ability to request them\"]\nkeywords:\n  - cant install software\n  - admin rights needed\n  - this app cant run on your pc\n  - smartscreen blocked\n  - unidentified developer mac\n  - app store error\n  - winget install failed\n  - cant install msi\n  - this installation package cannot be opened\n  - administrator privileges required\ntags:\n  - software\n  - install\n  - admin-rights\n  - top-50\nrelated: [l1-software-install-001-software-install-request, l1-windows-006-app-wont-open]\n---\n\n# Software won't install — diagnose and unblock\n\n## Symptoms\n\n- \"This app can't run on your PC\"\n- \"Windows protected your PC\" (SmartScreen)\n- \"Administrator privileges required\"\n- macOS: \"[App] can't be opened because Apple cannot check it for malicious software\"\n- \"App can't be opened because the developer cannot be verified\"\n- App store error / never finishes downloading\n- Installer launches then closes immediately\n- \"The installation package cannot be opened\"\n\n## Step 1 — Identify the block type\n\n| Error | Type |\n|---|---|\n| \"Administrator privileges required\" | UAC / Admin rights |\n| \"Windows protected your PC\" (blue banner) | SmartScreen / unsigned installer |\n| \"This app can't run on your PC\" | Architecture mismatch (x86/x64/ARM) or compatibility |\n| \"Apple cannot check it\" / \"developer cannot be verified\" | macOS Gatekeeper |\n| App store shows install spinning forever | Account / connection / storage |\n| Installer opens then closes | Corrupt download or missing prerequisite |\n\n## Step 2 — Admin rights (most common)\n\n### Windows\n1. Right-click installer → **Run as administrator**.\n2. UAC prompt → Yes.\n3. If you don't have admin: the box was set up by IT and end users are blocked from installing. **Request from IT** via your standard process.\n\n### macOS\n1. Apps that need admin: enter your password when prompted.\n2. If you're not an admin user on the Mac: ask your admin user to install, or get elevated.\n\n### Corporate-managed devices\n- Most managed PCs use Software Center, Company Portal, or Self Service.\n- Don't try to install with regular installers — go through the IT-approved store.\n- If the app you need isn't in the store: open a ticket asking for it to be added or for a one-time admin elevation.\n\n## Step 3 — Windows SmartScreen (unsigned installer)\n\nFor legitimate apps that aren't signed (rare, but happens with smaller indie tools):\n\n1. SmartScreen blue banner: \"Windows protected your PC.\"\n2. Click **More info**.\n3. Click **Run anyway**.\n4. Confirm UAC.\n5. Done.\n\n⚠️ **Only do this for apps you trust**. If you downloaded from a random link, don't.\n\n### Persistent SmartScreen on every install\nSettings → Privacy & security → Windows Security → App & browser control → Reputation-based protection settings → adjust \"Check apps and files\" to **Warn** instead of **Block**. (Don't disable entirely.)\n\n## Step 4 — macOS Gatekeeper\n\nFor apps not signed with a recognized Apple Developer ID:\n\n1. Try to open the app — you get the \"cannot be verified\" error.\n2. Click **Cancel**.\n3. **System Settings → Privacy & Security**.\n4. Scroll down to the message at the bottom: \"[App] was blocked...\"\n5. Click **Open Anyway**.\n6. Re-launch the app → confirm.\n\n⚠️ Same caution — only for apps you trust.\n\n### Persistent issue\n- If you frequently install from non-App-Store sources, the Gatekeeper setting can be relaxed. But Apple in recent macOS versions removed the \"Anywhere\" option for security.\n\n## Step 5 — Architecture / compatibility\n\n### \"This app can't run on your PC\"\n- Likely 32-bit installer on 64-bit Windows (or vice versa), or x86 installer on ARM Windows.\n- Check the app's download page — pick the version matching your PC architecture.\n- See your system: Settings → System → About → \"System type\" (e.g., \"64-bit operating system, x64-based processor\").\n\n### macOS Intel vs Apple Silicon\n- Most apps work on both (Universal binary).\n- Some older apps: Intel-only — they run via Rosetta. Mac will auto-install Rosetta on first request. If it doesn't:\n  - Right-click app → Get Info → check \"Open using Rosetta.\"\n\n## Step 6 — App store install errors\n\n### Microsoft Store stuck\n- Settings → Apps → Apps & features → search Microsoft Store → Advanced options → **Reset** (or Repair first).\n- Restart.\n- Try install again.\n\n### Mac App Store stuck\n- Sign out of Apple ID in App Store → sign back in.\n- Or restart the Mac.\n\n### iOS / Android\n- Cellular data limit blocks large apps. Try Wi-Fi.\n- Storage full — see `l1-storage-001-disk-full`.\n- App store account region mismatch — sign out, sign in correctly.\n\n## Step 7 — Installer opens then closes / Corrupt download\n\n1. Re-download from the original source (don't trust cached download).\n2. Disable antivirus temporarily during install (re-enable after).\n3. Check installer size — should match what the website lists.\n4. Try a different download mirror if available.\n\n## Step 8 — Missing prerequisite\n\nMany apps need a runtime: .NET Framework, .NET Runtime, Visual C++ Redistributable, Java.\n\nIf installer fails with \"missing X\" error:\n- Windows: install Visual C++ Redistributables (all versions, free from Microsoft).\n- .NET: Windows Update usually installs the right version; or download from microsoft.com.\n- Java: only install if explicitly required — many apps don't need it anymore.\n\n## Step 9 — `winget` / `choco` / `brew` (CLI installers)\n\nIf you're a power user and Microsoft Store install fails:\n\n**Windows:**\n```\nwinget install <app-name>\n```\nor with Chocolatey: `choco install <app-name>`\n\n**Mac:**\n```\nbrew install <app-name>\n```\n\nThese avoid Store and Gatekeeper friction entirely.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Admin rights blocked, app is business-critical | L1 — IT grants elevation or pre-approves the app |\n| Same app fails to install on multiple PCs | L2 — possibly conflict with endpoint security or AppLocker |\n| Need software not in IT's approved list | L1 → procurement |\n| Installer modifies system files and fails halfway | L2 — system file repair may be needed |\n| Persistent SmartScreen block on legitimate vendor app | L2 — IT can whitelist the publisher |\n\n## Prevention\n\n- Keep a list of apps you legitimately need. Submit them once to IT in a batch.\n- Always download installers from the official vendor site, not mirror/forum links.\n- For ongoing software needs: ask IT to add to Software Center / Company Portal.\n- Don't install from email attachments — even if from a coworker.\n\n## What ARIA can help with\n\nARIA can identify which block type you're hitting from the error text, walk you through the bypass (when safe), and draft the IT ticket if the app needs admin approval. ARIA cannot grant admin rights or override SmartScreen / Gatekeeper."
  },
  {
   "slug": "l1-sync-001-cloud-sync-stuck-phone",
   "path_rel": "knowledge-base\\top50-gaps\\l1-sync-001-cloud-sync-stuck-phone.md",
   "title": "\"iCloud / Google / OneDrive sync stuck on your phone — clear the queue and resume\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-sync-001\ntitle: \"iCloud / Google / OneDrive sync stuck on your phone — clear the queue and resume\"\ncategory: sync\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"iOS\", \"Android\", \"Windows\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Working internet on the phone\", \"Active iCloud / Google / OneDrive account\"]\nkeywords:\n  - icloud sync stuck\n  - google drive not syncing\n  - onedrive stuck syncing\n  - photos not uploading\n  - cloud sync error\n  - storage full warning\n  - sync paused\n  - sync over wifi only\n  - low power mode sync\n  - icloud photos pending\ntags:\n  - sync\n  - icloud\n  - google drive\n  - onedrive\n  - photos\n  - top-50\nrelated: [l1-onedrive-001-not-syncing, l1-storage-001-disk-full]\n---\n\n# Cloud sync stuck on your phone — diagnose and resume\n\n## Symptoms\n\n- iCloud Photos shows \"Updating\" or \"X photos remaining\" for days\n- Google Drive / Photos says \"Backup waiting for Wi-Fi\" forever\n- OneDrive mobile app shows \"Sync paused\"\n- Your laptop has photos your phone hasn't uploaded yet (or vice versa)\n- \"Not enough iCloud storage\" warning popping up\n\n99% of stuck-sync issues fall into 6 buckets. Work through in order.\n\n## Bucket 1 — Wi-Fi / cellular setting\n\nMost cloud apps default to \"Sync over Wi-Fi only\" to save your cellular data. If you're never on Wi-Fi long enough, sync stalls.\n\n### iCloud Photos (iOS)\n- Settings → Apple Account (top) → iCloud → Photos.\n- **Off → Enable cellular data** if you want it to sync without Wi-Fi (warning: can burn your cellular allowance fast).\n- Or get on Wi-Fi for 30+ minutes uninterrupted.\n\n### Google Photos (Android / iOS)\n- Open Google Photos → profile icon → Backup → \"Use cellular data\" → toggle on if you accept the data cost.\n- Default is Wi-Fi only.\n\n### OneDrive (mobile)\n- OneDrive app → Me icon → Settings → Camera Upload → \"Use cellular network.\"\n- Default off.\n\n## Bucket 2 — Storage full (your cloud account)\n\nIf iCloud / Google / OneDrive shows \"Not enough storage,\" sync pauses entirely.\n\n### iCloud\n- Settings → Apple Account → iCloud.\n- See your usage bar.\n- Tap **Manage Account Storage** to find what's eating space.\n- Options: delete old iCloud backups of devices you no longer use, clear iMessage attachments, upgrade plan ($0.99/mo gets 50 GB).\n\n### Google\n- drive.google.com → bottom-left storage bar OR one.google.com.\n- Tap **Storage details** → see Gmail / Drive / Photos breakdown.\n- Photos are usually the killer. Delete giant videos. Or clean Gmail attachments via the search `has:attachment larger:25M`.\n\n### OneDrive\n- onedrive.live.com → bottom-left storage indicator.\n- Personal plan: clear OneDrive Recycle Bin (often takes 10+ GB).\n- Work account: ask IT — you may have an exchange-quota or SharePoint limit hit.\n\n## Bucket 3 — Background app permissions\n\nThe OS may be killing the sync app in the background to save battery.\n\n### iOS\n- Settings → General → Background App Refresh → ensure the cloud app is enabled.\n- Settings → Battery → Battery Health & Charging → check Low Power Mode — turning it on stops most background sync.\n\n### Android (battery aggressiveness — Samsung, Xiaomi, OnePlus, etc.)\n- Settings → Apps → [Cloud app] → Battery → set to \"Unrestricted\" / \"Don't optimize.\"\n- Some OEMs hide this under \"App standby\" or \"Auto-start.\" Search settings for \"battery optimization.\"\n- Samsung especially aggressive — go through \"Sleeping apps\" and \"Deep sleeping apps\" lists and remove the cloud app.\n\n## Bucket 4 — App-side bug / stuck queue\n\nSometimes the sync queue itself gets corrupted. The fix is a forced restart.\n\n### Universal fix\n1. Force-quit the app:\n   - iOS: swipe up from bottom → flick the app card up.\n   - Android: recent apps → close.\n2. Wait 30 seconds.\n3. Reopen.\n4. Watch — does it resume? Usually yes.\n\n### Stronger reset (iCloud Photos stuck on a specific photo)\n- Often a corrupt heic file in Camera Roll. Look for the photo iCloud says is \"next to upload.\"\n- Try opening it in Photos. Does it open? If no, it's corrupt — delete it (sync resumes).\n- Yes? It's something else — see Bucket 6.\n\n### Stronger reset (Google Photos / OneDrive — clear cache)\n- iOS: usually just reinstall.\n- Android: Settings → Apps → [Cloud app] → Storage & cache → **Clear cache** (not Clear data — that signs you out).\n\n## Bucket 5 — Date / time wrong on phone\n\nWrong system clock breaks SSL/TLS handshakes silently. Sync fails with no clear error.\n\n- Settings → General/System → Date & time → enable **Set automatically**.\n- Restart phone.\n\n## Bucket 6 — Account state issue\n\nIf above hasn't worked, the account itself may be stuck.\n\n### iCloud\n- Settings → Apple Account → tap your name → **Sign out** → restart → sign back in.\n- Backup important data first if you haven't recently — signing out can pause downloads briefly.\n\n### Google\n- Settings → Passwords & accounts → Google account → Remove account → Re-add (or just Settings → Apps → Drive/Photos → sign out and back in within the app).\n\n### OneDrive\n- App → Me → Sign out → sign back in.\n- Work account: if it still won't sync, IT can check your account state for any compliance / conditional-access block.\n\n## Specific scenarios\n\n### \"I have iPhone + iPad + Mac. Photos on phone aren't on Mac yet.\"\n- Make sure iCloud Photos is on for all 3 devices (Settings → iCloud → Photos).\n- Plug iPhone in, leave on Wi-Fi overnight. iCloud needs power + Wi-Fi to upload bulk.\n- \"Optimize iPhone Storage\" mode means full-res lives in cloud only. Original is on Mac after it syncs.\n\n### \"Google Photos says 'backup waiting for Wi-Fi' but I'm on Wi-Fi\"\n- Toggle Wi-Fi off → on.\n- Reboot the phone.\n- Verify in Photos → Backup that it now shows \"Up to date\" or \"Backing up...\"\n- If still stuck, sign out and back in.\n\n### \"OneDrive shows 'You're running out of space' but I have plenty\"\n- This refers to your phone's local storage, not OneDrive. Free up local storage first.\n\n### \"My work email won't sync since I changed my password\"\n- See l1-password-002-locked-after-change. The phone is using the old password and locking your account.\n\n### \"Sync looks fine on phone but laptop doesn't have today's photos\"\n- Open Photos app on Mac / OneDrive on Windows.\n- Force a manual refresh: scroll to top of library, pull down (iCloud); click sync icon (OneDrive).\n- Photos can take 15-60 minutes to propagate.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Photos uploading but never appearing on Mac/PC | L2 — possibly account-state inconsistency |\n| iCloud Backup repeatedly fails | L2 — Apple Support if persists; usually corrupt local backup |\n| Work OneDrive sync blocked by Conditional Access | L2 — admin checks policy |\n| \"Cannot connect to iCloud\" persists for >24 hours | L2 — may need Apple ID password reset |\n| Photos / Drive thinks files are duplicated and re-uploads constantly | L2 — file metadata corruption, needs library repair |\n\n## Prevention\n\n- Plug phone in nightly + leave on Wi-Fi = sync stays current.\n- Don't run cloud accounts at 99% storage. Stay below 90%.\n- Keep cloud apps updated (auto-update on by default).\n- For business OneDrive: don't store giant video files in synced folders — use streaming-only mode.\n- Battery optimization for cloud apps should be **off**.\n\n## What ARIA can help with\n\nARIA can identify which bucket your stuck sync falls into from your specific symptom, walk through each fix step-by-step, and tell you when it's time to escalate vs keep trying. ARIA cannot upload your photos for you."
  },
  {
   "slug": "l1-teams-003-cant-hear-meeting",
   "path_rel": "knowledge-base\\top50-gaps\\l1-teams-003-cant-hear-meeting.md",
   "title": "\"Teams meeting — can't hear or be heard\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-teams-003\ntitle: \"Teams meeting — can't hear or be heard\"\ncategory: teams\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 6\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - teams cant hear\n  - teams no audio\n  - mic not working teams\n  - microphone disabled teams\n  - teams cant be heard\n  - teams device settings\n  - teams audio cache\n  - default device wrong\ntags:\n  - teams\n  - meetings\n  - audio\n  - top-50\nrelated: [l1-meeting-audio-001-wrong-device, l1-teams-001-audio-not-working, l1-bluetooth-002-airpods-headset-wont-reconnect]\n---\n\n# Teams meeting audio\n\n### Mic in Teams is set to the wrong device\n\nMost common cause. In the meeting: click More (...) → Device settings. Microphone dropdown should show your actual mic (headset, AirPods, USB mic). If it says \"Default Communications Device,\" that's a wild card — pick the explicit name instead. Same for Speaker. Test by talking — the level meter should jump green. If meter is flat, you're still picking a dead device.\n\n### Mic works in Windows but not in Teams\n\nTeams doesn't have microphone permission. macOS: System Settings → Privacy & Security → Microphone → toggle Teams ON → quit and reopen Teams (mac doesn't apply mid-session). Windows: Settings → Privacy & security → Microphone → \"Let apps access your microphone\" ON → scroll to Teams → ON. Restart Teams.\n\n### Joined meeting but no one can hear you — mic looks unmuted\n\nHardware mute is engaged. Headsets often have a physical mic-mute button on the cable or earcup. Press it — most have a small LED that indicates muted (red) or live (green/off). If no physical button, swap to a different mic via Device settings to confirm hardware vs Teams.\n\n### Audio works during meeting then suddenly drops\n\nBluetooth profile flipped from Hands-Free to Stereo (or vice versa). Common with AirPods + corporate Teams. Quick fix: in Device settings, switch to the wired/built-in mic for the rest of the meeting. Permanent fix: see KB l1-bluetooth-002 — pin Hands-Free profile in Windows sound settings.\n\n### Echo — others hear themselves\n\nYou don't have headphones on. Teams audio coming out of your laptop speakers is being picked up by your mic and re-broadcast. Plug in headphones. Or move away from the laptop mic. Software echo cancel only works so well; physical separation always wins.\n\n### Teams crashes audio after USB headset hot-swap\n\nTeams loses track of devices on mid-meeting USB swap. Don't swap mid-meeting if you can help it. If you did: leave the meeting and rejoin — Teams re-enumerates devices on fresh join.\n\n### Clear Teams audio cache (last resort)\n\nQuit Teams completely (Task Manager → End all ms-teams.exe / Teams.exe). Windows: delete contents of `%appdata%\\Microsoft\\Teams\\Cache` and `%appdata%\\Microsoft\\Teams\\blob_storage`. New Teams: `%localappdata%\\Packages\\MSTeams_8wekyb3d8bbwe\\LocalCache`. Mac: `~/Library/Application Support/Microsoft/Teams/`. Reopen Teams → fresh device enumeration.\n\n### When to escalate to L2\n\nMic works in Voice Recorder / Sound test but never in Teams after permissions + cache reset → L2 reinstalls Teams. Headset works on a different PC but not yours → L2 reinstalls audio driver. Multiple users in same office report mic dead today → L2 checks tenant + Teams service health."
  },
  {
   "slug": "l1-vpn-007-connected-no-resources",
   "path_rel": "knowledge-base\\top50-gaps\\l1-vpn-007-connected-no-resources.md",
   "title": "\"VPN says connected but can't reach file shares or intranet\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-007\ntitle: \"VPN says connected but can't reach file shares or intranet\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 8\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - vpn connected no access\n  - cant reach intranet\n  - file share not accessible vpn\n  - dns resolution vpn\n  - split tunnel issue\n  - vpn doesnt route internal\n  - flush dns vpn\n  - ipconfig all vpn\n  - internal site times out\ntags:\n  - vpn\n  - networking\n  - top-50\nrelated: [l1-vpn-001-cant-connect, l1-vpn-ivanti-001-ivanti-secure-access-connect, l2-vpn-001-gateway-and-certs]\n---\n\n# VPN connected, internal resources unreachable\n\n### Test 1 — Can you ping an internal IP?\n\nOpen Command Prompt (Win+R → cmd) or Terminal (Mac). Type: `ping 10.0.0.1` (replace with an actual internal server IP if you know one, or your gateway). If ping replies → VPN is routing correctly, the issue is DNS or permissions. If ping times out → VPN tunnel isn't actually carrying traffic; the connection looks up but isn't routing. Reconnect VPN, escalate if it persists.\n\n### DNS isn't resolving internal hostnames\n\nMost common after split-tunnel VPNs reconnect. Try: `nslookup internalserver.company.local`. If it fails or returns external IPs, your DNS is pointing at the wrong server. Flush DNS: Windows `ipconfig /flushdns` (admin cmd). Mac `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder`. Reconnect VPN. If still failing, your VPN's DNS suffix list is missing — that's L2.\n\n### Internal site loads slowly or partial — split-tunnel routing some traffic outside\n\nSplit-tunnel VPN routes only specific subnets through the tunnel; everything else (including some intranet servers if misconfigured) goes via your home internet. Symptom: some internal sites work, others don't. Check VPN client status: does it show \"Full tunnel\" or \"Split tunnel\"? If split, ask IT which subnets are tunneled and whether the missing resource should be added. L2 task.\n\n### Mapped network drives show red X after VPN connect\n\nWindows mapped drives are sticky to the network state at boot. Reconnect drives manually: Win+R → `\\\\fileserver\\share` → Enter. If it opens, drive credentials propagated; remap with persistent option. If it times out, the file server's IP changed or it's on a subnet not routed by your VPN — L2.\n\n### Browser intranet works, ping doesn't\n\nBrowser uses your VPN's proxy; ping uses raw ICMP which may be blocked at the firewall on purpose. Don't trust ping as the only diagnostic. Try opening the intranet URL directly in a browser. If browser works → VPN is fine for HTTP, ICMP is blocked (normal corporate policy). If browser fails → real connectivity problem.\n\n### VPN dropped silently — status says connected but isn't\n\nCommon with Ivanti and Cisco AnyConnect after long idle. Tunnel status shows green but traffic isn't moving. Force-disconnect: VPN client → Disconnect button. Wait 5 seconds. Reconnect. Test ping to internal IP again. If happens repeatedly, your idle-timeout setting needs adjustment — L2 reviews client config.\n\n### Routes are wrong — VPN didn't push the right routes\n\nCommand line check: Windows `route print` → look for entries for your company's internal subnets. Mac `netstat -nr | grep \"10\\.\\|192\\.168\\.\"`. If your VPN should route 10.x.x.x but no route exists for it, the VPN policy didn't push it. Disconnect + reconnect. Still missing → L2 fixes the VPN profile.\n\n### When to escalate to L2\n\nPing fails to internal IPs after VPN reconnect → tunnel routing issue. DNS suffix list missing or wrong → VPN profile config. Split-tunnel needs a new subnet added → policy change. Mapped drives need updated server IPs → file server team. Cert errors on connect → certificate renewal needed."
  },
  {
   "slug": "l1-vpn-008-slow-throttled",
   "path_rel": "knowledge-base\\top50-gaps\\l1-vpn-008-slow-throttled.md",
   "title": "\"VPN is connected but everything is slow — diagnose the throttle\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-008\ntitle: \"VPN is connected but everything is slow — diagnose the throttle\"\ncategory: vpn\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - vpn slow\n  - vpn throttle\n  - slow when connected to vpn\n  - everything slow on vpn\n  - intranet sluggish\n  - vpn bandwidth\n  - speedtest while on vpn\n  - vpn protocol switch\n  - tcp udp vpn\ntags:\n  - vpn\n  - performance\n  - top-50\nrelated: [l1-vpn-007-connected-no-resources, l1-internet-002-slow-but-connected]\n---\n\n# VPN is slow\n\n### Test 1 — Speed without vs with VPN\n\nDisconnect VPN. Go to fast.com or speedtest.net. Note download speed. Reconnect VPN. Test again. Drop more than 50%? That's VPN-side throttling. Drop less than 20%? Normal overhead, the real issue is upstream internet (see KB l1-internet-002). Equal? Something else (DNS, route).\n\n### Switch VPN protocol — TCP → UDP usually 2x faster\n\nMost enterprise VPN clients (Ivanti, Cisco AnyConnect, GlobalProtect) default to TCP for compatibility but support UDP for speed. TCP-over-TCP is slow (\"TCP meltdown\" on bad networks). In the VPN client settings, switch to UDP if available. Reconnect, retest speed.\n\n### Server choice — pick the closest gateway\n\nIf your VPN client lets you choose a gateway, pick the geographically closest one. Toronto user connecting to a Frankfurt gateway = 100ms+ added latency, half the speed. Some clients auto-pick — verify in client settings or status panel.\n\n### Split-tunnel — exclude high-bandwidth apps\n\nIf your VPN routes ALL traffic through corporate, YouTube and Zoom calls eat your tunnel bandwidth. Ask IT to enable split-tunnel for trusted SaaS apps (Teams, Zoom, OneDrive, YouTube) so they bypass the VPN. Saves 60-90% of bandwidth for actual corporate traffic.\n\n### Wi-Fi is the bottleneck, not VPN\n\nRun speedtest first on Wi-Fi WITHOUT VPN. If you're getting 30 Mbps over Wi-Fi but you pay for 500 Mbps, your Wi-Fi is the issue. Move closer to router, switch to 5 GHz band, or use Ethernet. VPN can't be faster than your underlying link.\n\n### Antivirus is scanning every VPN packet\n\nEnterprise antivirus deep-packet-inspects VPN traffic. Symptoms: CPU pegged when VPN active, network slow. Temporarily disable AV → retest speed. If huge difference, work with IT to add VPN client to AV exclusions.\n\n### MTU mismatch — packets getting fragmented\n\nRare but possible. Symptoms: web pages load partial or images broken on VPN only. Windows admin cmd: `ping -f -l 1472 8.8.8.8` — if it says \"Packet needs to be fragmented but DF set,\" your MTU is too high. Set VPN client MTU to 1400 (most clients have this in advanced settings). Restart VPN.\n\n### Two VPN clients installed at once — fighting\n\nIf you have both Cisco AnyConnect AND Ivanti AND GlobalProtect installed (e.g., from old jobs), they can fight over network adapters even when only one is \"connected.\" Uninstall the ones you don't actively use. Restart.\n\n### Speed test on VPN gateway directly\n\nIf your IT exposes an internal speedtest server, use it. Tells you the speed inside the tunnel without external internet interference. If internal is fast but external is slow, the corporate egress proxy/firewall is the bottleneck — L2 problem.\n\n### When to escalate to L2\n\nSpeed cut >70% on VPN even after protocol switch + closest gateway. AV exclusion didn't help. Whole team complains the VPN is slow today → gateway concentrator is overloaded, L2 scales it. Specific apps slow but internet OK → DPI / proxy filtering specific traffic → L2 reviews policy."
  },
  {
   "slug": "l1-webcam-002-virtual-background-filter",
   "path_rel": "knowledge-base\\top50-gaps\\l1-webcam-002-virtual-background-filter.md",
   "title": "\"Virtual background, blur, and filters not working in Teams / Zoom / Meet\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-webcam-002\ntitle: \"Virtual background, blur, and filters not working in Teams / Zoom / Meet\"\ncategory: webcam\nsupport_level: L1\nseverity: low\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Webcam working and selected in the meeting app\"]\nkeywords:\n  - virtual background not working\n  - blur background failed\n  - teams background option missing\n  - zoom virtual background not available\n  - cant see background options\n  - background flickering\n  - greenscreen edges\n  - cpu maxed during call\n  - your computer doesnt support virtual background\n  - apply background filter\ntags:\n  - webcam\n  - meetings\n  - virtual-background\n  - top-50\nrelated: [l1-meeting-audio-001-wrong-device, l1-webcam-001-camera-not-working]\n---\n\n# Virtual background not working — diagnose and fix\n\n## Symptoms\n\n- \"Your computer doesn't support virtual background\" error in Zoom\n- Teams shows no background options at all\n- Background works but flickers / edges are weird\n- Background takes 30 seconds to apply or never applies\n- CPU pinned at 100% when background is on\n- Background works for you but others see you without it\n- Filter / beauty effects missing from your version\n\n## Step 1 — Check hardware requirements\n\nVirtual backgrounds need GPU and CPU horsepower. Some old laptops don't qualify.\n\n### Zoom minimum (current)\n- Intel i5 / i7 4th gen or newer\n- 4 GB RAM minimum, 8 GB recommended\n- 64-bit OS\n- Webcam: pretty much any\n\n### Teams minimum\n- Intel i3 / i5 6th gen or newer\n- Background blur is more forgiving than full virtual background\n\n### Mac\n- Most M1 / M2 / M3 / M4 Macs handle this trivially\n- Intel Macs from 2018+ usually fine\n- Older Intel Macs (2015 / 2016) may struggle\n\n### Check your spec\n- Windows: Settings → System → About → Processor + RAM.\n- macOS: Apple menu → About This Mac.\n\nIf you're below spec: virtual background just won't work. Use **green screen** mode if available (Zoom's old method using a real physical green sheet behind you).\n\n## Step 2 — Update the meeting app\n\nOlder versions are missing background features.\n\n### Zoom\n- Zoom → check for updates (top menu).\n- Sign out → sign back in (sometimes feature flags are account-tied).\n\n### Teams\n- New Teams: Settings → About → Check for updates.\n- Classic Teams: it auto-updates, but verify version is recent.\n- Free Teams (consumer): some features only available in paid.\n\n### Google Meet\n- Browser-based. Refresh the page.\n\n## Step 3 — Enable GPU acceleration\n\nIronically, **turning hardware acceleration OFF** (Zoom black-screen fix) breaks virtual backgrounds. Re-enable.\n\n### Zoom\n- Settings → Video → Advanced.\n- Check \"Enable hardware acceleration for video processing\" → ON.\n- Restart Zoom.\n\n### Teams\n- Update graphics driver.\n- Teams uses your default GPU; if you have integrated + discrete, make sure Teams uses discrete:\n  - Windows Settings → System → Display → Graphics → Browse → add Teams.exe → set to \"High performance.\"\n\n## Step 4 — App-specific path\n\n### Zoom\n- Settings → Background & Effects.\n- If you see the dropdown, pick a background or \"Blur.\"\n- \"Your computer doesn't support virtual background\" → driver / GPU issue (Steps 1 + 3).\n\n### Teams\n- In a call → \"...\" → Apply background effects.\n- Select blur or pick from gallery.\n- Upload your own with \"Add new.\"\n\n### Google Meet\n- Three dots → \"Apply visual effects.\"\n- Pick filter or background.\n\n## Step 5 — Background flickering / weird edges\n\n- **Bad lighting.** Background segmentation works on luminance. Get a uniform light source in front of you. Avoid backlighting from windows.\n- **Cluttered background.** Plain wall = better.\n- **CPU bottleneck.** Close other apps. Background apps eating CPU make segmentation choppy.\n- **Cheap webcam.** 720p built-in laptop webcam = poor segmentation. 1080p USB webcam = significant improvement.\n\n## Step 6 — Filters / beauty effects missing\n\n### Zoom\n- \"Touch up my appearance\" → Settings → Video → Touch up my appearance → toggle ON.\n- More filters: Settings → Background & Effects → tabs at top (Backgrounds, Filters, Avatars).\n\n### Teams\n- Some beauty effects only in Teams desktop, not web.\n- New Teams has fewer effects than classic in 2025-2026. Microsoft is phasing classic. If you must have features, classic Teams is still available on most managed environments.\n\n## Step 7 — Others see you without background\n\nThe background renders on YOUR machine and is sent as part of the video stream. If others see plain you:\n\n- **You forgot to enable it for this call.** Re-toggle in the meeting controls.\n- **Different camera mid-call.** Sometimes apps reset effects when you change camera.\n- **Bandwidth fallback.** If your network is poor, Zoom/Teams may strip effects to preserve a usable stream. You'll see your background; the network strips it before sending.\n\n## Step 8 — Mac-specific edge cases\n\n### \"Background goes away every time I update macOS\"\n- macOS major upgrades sometimes reset Privacy permissions. Re-grant Camera + Screen Recording for the meeting app.\n\n### \"Continuity Camera (using iPhone as webcam) — backgrounds don't apply\"\n- Background processing happens on the iPhone side via Center Stage. Apps can't override that.\n- Use Mac's built-in camera if you want app-side virtual background instead.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Hardware doesn't meet spec | Hardware upgrade — IT decision |\n| Driver fully updated, still broken | L2 — possibly GPU driver / BIOS issue |\n| Works on personal device, not work | L2 — possibly Intune / MDM policy disables it |\n| Background works but CPU pegged | L1 — close other apps, or accept tradeoff |\n| Need custom branded background | L1 — IT provides company-approved images |\n\n## Prevention\n\n- Keep meeting apps updated.\n- Keep graphics driver updated (especially Nvidia / AMD discrete cards).\n- Have decent lighting in your work-from-home spot — saves CPU on heavy segmentation.\n- For executives / customer-facing calls: use a real physical setup (decent webcam + uncluttered background) — relying on virtual background is fragile.\n\n## What ARIA can help with\n\nARIA can verify your hardware meets requirements, walk you through the app-specific setting paths, and diagnose flickering from your description (lighting vs CPU vs bandwidth). ARIA cannot replace your webcam hardware if you're below spec."
  },
  {
   "slug": "l1-wifi-002-connected-no-internet",
   "path_rel": "knowledge-base\\top50-gaps\\l1-wifi-002-connected-no-internet.md",
   "title": "\"Wi-Fi says connected but no internet — fix in 3 minutes\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-wifi-002\ntitle: \"Wi-Fi says connected but no internet — fix in 3 minutes\"\ncategory: networking\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 5\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\", \"iOS\", \"Android\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - wifi connected no internet\n  - no internet secured\n  - limited connectivity\n  - browser cant reach site\n  - dns probe failed\n  - wifi works but websites dont\n  - captive portal\n  - guest wifi sign in\ntags:\n  - wifi\n  - networking\n  - top-50\nrelated: [l1-wifi-001-cant-connect, l1-internet-001-no-internet-at-all, l1-internet-003-intermittent-drops]\n---\n\n# Wi-Fi connected, no internet\n\n### Captive portal didn't show — open browser to any HTTP site\n\nMost \"connected but no internet\" on coffee shop / hotel / airport Wi-Fi is captive portal. Open a browser → type `http://neverssl.com` (use HTTP not HTTPS — captive portal needs to intercept). Login page appears, accept terms, you're online. iPhone usually auto-detects but sometimes doesn't.\n\n### Forget Wi-Fi and reconnect\n\nWindows: Settings → Network & Internet → Wi-Fi → Manage known networks → click your network → Forget. Then reconnect, re-enter password. Mac: System Settings → Wi-Fi → Details next to network → Forget This Network. Reconnect. Fixes corrupted Wi-Fi profiles 50% of the time.\n\n### Renew your IP address\n\nWindows admin cmd: `ipconfig /release` then `ipconfig /renew`. Mac: System Settings → Network → Wi-Fi → Details → TCP/IP tab → \"Renew DHCP Lease.\" iOS/Android: airplane mode on for 5 sec then off. If your machine has a 169.254.x.x address (\"APIPA\"), DHCP isn't giving you a real IP — restart your router or contact the network owner.\n\n### Flush DNS — fixes \"your DNS server might be unavailable\"\n\nBrowser shows DNS_PROBE_FINISHED_NXDOMAIN or \"cannot find server.\" Windows admin cmd: `ipconfig /flushdns`. Mac: `sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder` in Terminal. Restart browser, retry. If still broken, try a public DNS — Settings → set DNS to 1.1.1.1 (Cloudflare) or 8.8.8.8 (Google).\n\n### Restart the router (for home Wi-Fi)\n\nIf you control the router: unplug power, wait 60 seconds, plug back. Full reboot takes 2-3 minutes (DSL/cable modems even longer). Reconnect after lights go green. Most \"intermittent no-internet\" is router-side after days of uptime. Schedule monthly reboot if it's chronic.\n\n### VPN connected but internet dead\n\nVPN is routing everything through a broken tunnel. Disconnect VPN, test internet without it. If works, the VPN profile or gateway is the issue — see KB l1-vpn-007 for VPN-connected-no-resources or L2 for VPN routing fix.\n\n### Date/time wrong → HTTPS sites fail\n\nIf your clock is way off, every HTTPS site refuses to load with cert errors. Windows Settings → Time & language → Date & time → \"Set automatically\" ON. Mac System Settings → General → Date & Time → \"Set automatically\" ON. Restart browser after fix.\n\n### Test if it's a website-specific issue\n\nIf only one site is unreachable, others fine — that site is down (not you). Try downforeveryoneorjustme.com to check. If multiple major sites down but Wi-Fi shows connected, your DNS or VPN is the issue (Steps above).\n\n### When to escalate to L2\n\nAll steps tried, no internet on this network specifically but mobile hotspot works → corporate Wi-Fi / NAC blocking your device → L2. Same network works on phone but not laptop → laptop driver or profile → L2. Whole office can't reach internet → ISP outage or perimeter firewall, IT escalates upstream."
  },
  {
   "slug": "l1-windows-007-update-stuck-reboot-loop",
   "path_rel": "knowledge-base\\top50-gaps\\l1-windows-007-update-stuck-reboot-loop.md",
   "title": "\"Windows Update stuck, pending reboot loop, or '0% installing' forever\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-007\ntitle: \"Windows Update stuck, pending reboot loop, or '0% installing' forever\"\ncategory: windows\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 20\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Admin rights helpful\", \"Backup important work before troubleshooting\"]\nkeywords:\n  - windows update stuck\n  - 0% installing forever\n  - cant install updates\n  - update error\n  - pending restart wont apply\n  - update keeps failing\n  - 0x80070002\n  - 0x800f081f\n  - feature update stuck\n  - update keeps rolling back\n  - we couldnt complete the updates\ntags:\n  - windows\n  - update\n  - top-50\nrelated: [l1-windows-001-blue-screen-stop-error, l1-windows-003-slow-pc-performance, l1-storage-001-disk-full]\n---\n\n# Windows Update stuck or rebooting in a loop — get it unstuck\n\n## Symptoms\n\n- \"Downloading 0%\" forever\n- \"Installing 0%\" forever\n- Stuck on \"Working on updates 30%\" after reboot\n- \"We couldn't complete the updates. Undoing changes.\"\n- Pending restart never applies\n- Specific error codes: 0x80070002, 0x800f081f, 0x8007000d, 0x80073712\n\n## Step 1 — How long has it really been stuck?\n\nA few major Windows updates legitimately take **45-90 minutes** even on fast SSDs. Don't pull the plug before that.\n\n**Wait at least 90 minutes** before declaring it stuck if you see:\n- Spinning circle with no error\n- Percentage that hasn't changed (it may be working on something else)\n- \"Working on updates\" with hard drive activity light blinking\n\n**Pull plug only if:**\n- 2+ hours with zero progress AND no disk activity\n- Or a clear error message has appeared\n- Or the screen is black with no cursor for 30+ min\n\n## Step 2 — Check free disk space\n\nWindows updates need 15-30+ GB free.\n\n1. Settings → System → Storage.\n2. If C: drive is below 20 GB free → see `l1-storage-001-disk-full` first.\n3. After freeing space, restart and retry update.\n\n## Step 3 — Run Windows Update Troubleshooter\n\nMicrosoft's first-line tool actually works for many common stuck states.\n\n1. Settings → System → Troubleshoot → Other troubleshooters.\n2. Find **Windows Update** → Run.\n3. Follow prompts.\n4. Restart → try update again.\n\n## Step 4 — Reset the Windows Update components manually (advanced)\n\nIf troubleshooter didn't fix it, the Update cache may be corrupt.\n\n### Run in Administrator Command Prompt\n1. Right-click Start → Terminal (Admin) or \"Command Prompt (Admin)\".\n2. Paste these one at a time:\n\n```\nnet stop wuauserv\nnet stop cryptSvc\nnet stop bits\nnet stop msiserver\nren C:\\Windows\\SoftwareDistribution SoftwareDistribution.old\nren C:\\Windows\\System32\\catroot2 catroot2.old\nnet start wuauserv\nnet start cryptSvc\nnet start bits\nnet start msiserver\n```\n\n3. Restart.\n4. Settings → Windows Update → Check for updates. It'll rebuild the cache fresh and start downloading.\n\nThis usually fixes 80% of stuck-update problems.\n\n## Step 5 — Specific error code fixes\n\n### 0x80070002 — file missing in cache\n- Step 4 (manual reset) fixes this.\n\n### 0x800f081f — feature install fails (.NET / Windows Features)\n- Open Control Panel → Programs → Turn Windows Features On or Off → check what was attempted → toggle.\n\n### 0x8007000d — bad data in cache\n- Step 4.\n\n### 0x80073712 — system files corrupt\n1. Admin Command Prompt:\n   ```\n   sfc /scannow\n   ```\n2. Wait for it to complete (10-15 min).\n3. Then:\n   ```\n   DISM /Online /Cleanup-Image /RestoreHealth\n   ```\n4. Wait again (15-30 min).\n5. Restart. Retry update.\n\n### \"Update keeps rolling back to previous version\"\n1. Storage might be marginal — free more space.\n2. Or specific driver is incompatible — Settings → Windows Update → Update history → see what failed.\n3. Use **Show or hide updates** tool (Microsoft's) to skip the failing one temporarily until they patch it.\n\n## Step 6 — Manual install from Microsoft Update Catalog\n\nWhen Windows Update itself is broken, you can download specific updates and install directly.\n\n1. Go to https://www.catalog.update.microsoft.com.\n2. Search for the KB number (e.g., \"KB5045500\") shown in your failing update.\n3. Download the `.msu` file for your Windows version (x64 vs ARM64).\n4. Double-click to install.\n\n## Step 7 — Pending reboot won't apply\n\n### Symptom\nSettings shows \"Restart required to finish installing updates\" but every restart loops back to the prompt.\n\n### Fix\n1. Shut down (not restart) — File → Shut down → wait 30 sec.\n2. Hold Shift while clicking Restart → opens Advanced Startup.\n3. Troubleshoot → Advanced options → Startup Settings → Restart → boot to Safe Mode.\n4. In Safe Mode: Admin Command Prompt → `sfc /scannow`.\n5. Restart normally.\n\n## Step 8 — Last resort: in-place upgrade repair\n\nIf updates have been broken for weeks:\n\n1. Download the **Windows 11 Installation Assistant** (or Win 10) from microsoft.com.\n2. Run it.\n3. Choose \"Upgrade this PC now\" / \"Keep my files and apps.\"\n4. Takes 1-2 hours but repairs the install in place. Apps, files, settings stay.\n\nThis is the nuclear-but-non-destructive option.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Multiple users in the office all stuck on the same update | L2 — possibly a patch issue Microsoft will fix in 1-7 days |\n| Update fails AND PC reboots randomly | L2 — possibly hardware (failing SSD, RAM) |\n| sfc /scannow reports unfixable corruption | L2 — DISM + Windows install repair |\n| Critical security update fails repeatedly | L2 — manual install or in-place upgrade |\n| PC won't boot at all after update | L2 — System Restore / boot media |\n\n## Prevention\n\n- Don't power off mid-update. Let it finish, even if it's been 90 min.\n- Keep 25%+ free space on C: drive.\n- Pause updates if you have a critical demo / meeting in the next 24 hours (Settings → Windows Update → Pause).\n- Install updates on a Friday afternoon — Monday morning fixes are easier with the weekend buffer.\n- For corporate PCs: tell IT if you keep hitting the same failing update — they may have a managed fix.\n\n## What ARIA can help with\n\nARIA can identify specific error codes, walk you through the manual reset commands step-by-step, and tell you whether your symptom is \"wait longer\" vs \"needs intervention.\" ARIA cannot execute admin command prompt commands on your behalf — you need to run them with your admin rights."
  },
  {
   "slug": "l1-windows-008-update-keeps-reverting",
   "path_rel": "knowledge-base\\top50-gaps\\l1-windows-008-update-keeps-reverting.md",
   "title": "\"Windows Update keeps rolling back / 'undoing changes'\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-windows-008\ntitle: \"Windows Update keeps rolling back / 'undoing changes'\"\ncategory: windows\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nkeywords:\n  - we couldnt complete the updates\n  - undoing changes\n  - update keeps rolling back\n  - feature update fails repeatedly\n  - 0x80070643\n  - 0xc1900101\n  - kb installation failed\n  - update reverts on reboot\ntags:\n  - windows\n  - update\n  - top-50\nrelated: [l1-windows-007-update-stuck-reboot-loop, l1-storage-001-disk-full]\n---\n\n# Windows Update keeps reverting\n\n### \"We couldn't complete the updates. Undoing changes.\"\n\nA specific patch failed mid-install. Settings → Windows Update → Update history → find the failing KB number → note the error code (in red, like `0xc1900101`). Then: pause updates for 7 days (Settings → Windows Update → Pause), let Microsoft fix the patch upstream. Most \"undoing changes\" loops resolve in a week without your intervention.\n\n### Free up disk space first — most reverts are storage failures\n\nUpdates need 15-30 GB free during install. If C: is below that, the install commits then can't finalize → rollback. Check: Settings → System → Storage. If under 25 GB free, see KB l1-storage-001. Free space, then retry update.\n\n### Specific error: 0xc1900101 — driver incompatible\n\nA device driver isn't compatible with the new build. Settings → Update history → click the failing update → \"Get help\" link sometimes identifies the driver. Or run Device Manager → check for any yellow exclamation marks — those drivers are suspects. Update or remove the conflicting driver, retry Windows Update.\n\n### Specific error: 0x80070643 — .NET or installer error\n\nOften .NET Framework patch in a loop. Open Settings → Apps → Optional features → search \".NET\" — if any version shows \"needs update,\" click → uninstall → reinstall via Windows Update. Or use the Microsoft .NET repair tool from microsoft.com.\n\n### Update installs then reverts on next reboot\n\nCritical service mid-install crashed. Boot to Safe Mode (Shift + Restart → Troubleshoot → Advanced → Startup Settings → Safe Mode). In Safe Mode, run System File Checker: Admin Command Prompt → `sfc /scannow`. Then `DISM /Online /Cleanup-Image /RestoreHealth`. Both take 15-30 min. Reboot normally, retry update.\n\n### \"Working on updates X%\" goes backwards\n\nPhase 2/3 of install hit a hardware issue. Don't interrupt — let it finish even if it goes from 80% → 30%. After full rollback, try again. If it loops backward more than twice, the OS install image is corrupt. Run in-place upgrade via Windows 11 Installation Assistant (microsoft.com) — preserves apps + files, repairs the OS in place.\n\n### One specific update keeps failing every month\n\nHide that update temporarily until Microsoft fixes it. Use Microsoft's \"Show or hide updates\" tool from microsoft.com. Pick the failing KB → hide. It stops getting offered. Re-check monthly via the same tool whether to unhide.\n\n### When to escalate to L2\n\nIn-place upgrade (Windows Installation Assistant) didn't fix it. Update fails AND PC reboots randomly (hardware suspect — failing SSD or RAM). Multiple users in office hit same failing update (likely Microsoft-side issue, wait for fix). Critical security update failing and you need compliance — L2 manually installs via offline package."
  },
  {
   "slug": "l1-zoom-002-wont-start-black-screen",
   "path_rel": "knowledge-base\\top50-gaps\\l1-zoom-002-wont-start-black-screen.md",
   "title": "\"Zoom won't start, black screen, or stuck loading — fix and join the meeting\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-zoom-002\ntitle: \"Zoom won't start, black screen, or stuck loading — fix and join the meeting\"\ncategory: meetings\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS\"]\ntech_generation: modern\nyear_range: \"2022-2026\"\neol_status: \"Current.\"\nprerequisites: [\"Zoom app installed and signed in (or web join available)\"]\nkeywords:\n  - zoom black screen\n  - zoom wont start\n  - zoom stuck loading\n  - zoom crashes\n  - zoom freezes\n  - cant share screen zoom\n  - zoom cant see other participants\n  - zoom no video\n  - zoom unable to launch\ntags:\n  - zoom\n  - meetings\n  - top-50\nrelated: [l1-meeting-audio-001-wrong-device, l1-teams-002-wont-load-stuck-splash, l1-windows-006-app-wont-open]\n---\n\n# Zoom won't start or shows a black screen — fix and join\n\n## Symptoms\n\n- Click Zoom icon → nothing happens, or icon bounces then disappears\n- Zoom opens but screen is fully black\n- Zoom stuck on \"Loading...\" or \"Connecting...\" for 30+ seconds\n- Joined the meeting but you see participants as black tiles (or you appear black to others)\n- Screen share is just a black rectangle\n- Zoom crashes immediately on join\n\nMost of these fall into 4 buckets: GPU acceleration, permissions, network, or a stale install.\n\n## Step 1 — Fast path (often fixes it)\n\n### Force-quit and restart Zoom\n\n**Windows:**\n1. Ctrl + Shift + Esc → Task Manager.\n2. Find every process named \"Zoom\" or \"Zoom Meetings.\"\n3. Right-click each → End task.\n4. Wait 15 seconds.\n5. Reopen Zoom.\n\n**macOS:**\n1. ⌘ + Option + Esc → Force Quit Applications.\n2. Select Zoom → Force Quit.\n3. Wait 15 seconds.\n4. Reopen.\n\n### Try joining via browser\nWhile Zoom desktop is broken, you can still attend:\n1. Click the meeting link → \"Join from your browser\" option appears at the bottom of the page (sometimes hidden).\n2. Or paste the meeting URL into Chrome directly.\n\nBrowser join has limited features (no breakout rooms, no virtual backgrounds, weaker audio mixing) but **you'll make the meeting**. Fix the app afterward.\n\n## Step 2 — Disable GPU acceleration (fixes most \"black screen\" issues)\n\n90% of Zoom black-screen issues are GPU acceleration conflicts. Disable it.\n\n### Inside Zoom (if you can get into Settings)\n1. Zoom app → Settings (gear) → Video → **Advanced**.\n2. Uncheck **\"Enable hardware acceleration for video processing\"**.\n3. Same panel: uncheck **\"Enable hardware acceleration for sending video\"** and **\"...receiving video\"**.\n4. Sign out of Zoom → sign back in.\n\n### If Zoom won't open at all (edit the config file)\n**Windows:**\n1. Close Zoom completely (Task Manager → End all Zoom processes).\n2. Open File Explorer → paste in address bar: `%APPDATA%\\Zoom\\data`\n3. Find `Zoom.cfg` or `zoomus.conf` file.\n4. Open in Notepad.\n5. Add (or edit) the line: `enableHardwareAccel=false`\n6. Save. Reopen Zoom.\n\n**macOS:**\n1. Force-quit Zoom.\n2. Finder → ⌘ + Shift + G → paste `~/Library/Application Support/zoom.us/`\n3. Edit the config files similarly.\n\n## Step 3 — Permissions (Camera / Microphone / Screen Recording)\n\n### macOS — most common cause of \"you appear as black tile\"\n1. **System Settings → Privacy & Security**.\n2. Click **Camera** → ensure Zoom is enabled.\n3. Click **Microphone** → ensure Zoom is enabled.\n4. Click **Screen & System Audio Recording** → ensure Zoom is enabled (required for screen sharing).\n5. **Quit and reopen Zoom** after any change — macOS doesn't apply mid-session.\n\n### Windows\n1. Settings → Privacy & security → Camera → \"Let apps access your camera\" → On → Zoom → On.\n2. Same for Microphone.\n\n## Step 4 — Conflicting apps\n\n### Windows\n- Other video apps holding the camera lock will black-screen Zoom. Close:\n  - Microsoft Teams\n  - Skype\n  - Web browsers using camera (check tabs)\n  - OBS, Streamlabs, screen recorders\n  - Snap Camera (notorious for black screens — uninstall if not actively using)\n\n### macOS\n- Same — close all other camera-using apps.\n- If you use a virtual camera (OBS, mmhmm, Snap), restart it after killing Zoom.\n\n## Step 5 — Network / corporate firewall\n\nZoom needs these ports/protocols:\n- TCP 443, 80\n- UDP 8801-8810 (audio/video)\n- Various Zoom CDN IPs\n\n### Symptoms of network block\n- Stuck on \"Connecting...\"\n- Audio works but video doesn't\n- Screen share fails with \"unable to connect\"\n\n### Fixes\n- Try a different network (mobile hotspot test — does Zoom work? Then your office network is the issue).\n- VPN: disconnect VPN and try.\n- Corporate proxy: ask IT — they may need to whitelist Zoom IPs.\n\n## Step 6 — Stale install / corrupted update\n\nIf Zoom auto-updated and now misbehaves:\n1. **Windows:** Settings → Apps → Installed apps → Zoom → Uninstall → reinstall fresh from zoom.us/download.\n2. **macOS:** drag /Applications/zoom.us.app to Trash → reinstall from zoom.us/download. Or use Zoom's official uninstaller tool.\n3. After reinstall, sign in fresh.\n\n## Step 7 — Display / monitor issues\n\n### \"Zoom only black on my external monitor\"\n- Graphics driver / scaling issue.\n- Right-click desktop → Display settings → ensure your scaling matches across monitors.\n- Update Nvidia / AMD / Intel graphics driver from manufacturer site.\n\n### \"Zoom window opens off-screen\"\n- Right-click Zoom in taskbar → Maximize. Or Win+Arrow keys to snap back.\n\n## When to escalate\n\n| Situation | Path |\n|---|---|\n| Black screen persists after disabling GPU accel + reinstall | L2 — possibly graphics driver or codec issue |\n| Connecting... times out on every network | L2 — possible account / SSO issue |\n| Crashes on every meeting join, all networks | L2 — clean reinstall + Zoom Support diagnostic logs |\n| Works on personal account, fails on work SSO | L2 — identity provider config issue |\n| Screen share fails specifically (rest works) | L2 — screen recording permission or driver |\n\n## Browser join — always-available fallback\n\nWhen desktop is broken and you NEED to make the meeting:\n1. Click the meeting link.\n2. Bottom of the page: **\"Join from your browser\"** (sometimes you have to click \"Launch Meeting\" first; the browser option appears after).\n3. Works in Chrome, Edge, Firefox, Safari.\n4. Use the dial-in number from the invite as backup-backup.\n\n## Prevention\n\n- Keep Zoom updated. Stable channel auto-updates by default — leave it on.\n- Restart your computer once a week — Zoom driver state accumulates.\n- If you switch headsets / cameras often, do a 60-second test meeting before any important call.\n- For Macs: macOS major version updates often break permissions — recheck after each upgrade.\n\n## What ARIA can help with\n\nARIA can walk you through GPU acceleration disable, the permission resets, force-quit steps, and the browser-join fallback — live, while you're trying to make a meeting. ARIA cannot reinstall Zoom for you (admin action)."
  },
  {
   "slug": "l1-edu-001",
   "path_rel": "knowledge-base\\vertical-education\\l1-edu-001.md",
   "title": "Student cannot access Google Classroom",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "google classroom",
    "student",
    "login",
    "ferpa"
   ],
   "compliance": [],
   "content": "---\ntitle: Student cannot access Google Classroom\ncategory: education\nsupport_level: L1\nseverity: medium\naudience: education-it\nkeywords: [google classroom, student, login, ferpa]\ncreated: 2026-06-18\nescalation_trigger: Teacher confirms student enrollment but login or class visibility fails.\n---\n# Student cannot access Google Classroom\n\n## Symptom\n\nThe requester reports a education support issue that matches: google classroom, student, login, ferpa.\n\n## What ARIA should do first\n\nVerify student identity, check account status, confirm class roster sync, avoid exposing student records in screenshots.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Teacher confirms student enrollment but login or class visibility fails.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-edu-001."
  },
  {
   "slug": "l1-edu-002",
   "path_rel": "knowledge-base\\vertical-education\\l1-edu-002.md",
   "title": "Chromebook cannot enroll after powerwash",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "chromebook",
    "enrollment",
    "google admin"
   ],
   "compliance": [],
   "content": "---\ntitle: Chromebook cannot enroll after powerwash\ncategory: education\nsupport_level: L1\nseverity: medium\naudience: education-it\nkeywords: [chromebook, enrollment, google admin]\ncreated: 2026-06-18\nescalation_trigger: Device serial does not appear in the expected organizational unit.\n---\n# Chromebook cannot enroll after powerwash\n\n## Symptom\n\nThe requester reports a education support issue that matches: chromebook, enrollment, google admin.\n\n## What ARIA should do first\n\nConfirm Wi-Fi, device serial, enrollment permissions, and OU assignment before escalating to Google Admin.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Device serial does not appear in the expected organizational unit.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-edu-002."
  },
  {
   "slug": "l1-edu-003",
   "path_rel": "knowledge-base\\vertical-education\\l1-edu-003.md",
   "title": "Student password reset with guardian present",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "student",
    "password reset",
    "guardian",
    "ferpa"
   ],
   "compliance": [],
   "content": "---\ntitle: Student password reset with guardian present\ncategory: education\nsupport_level: L1\nseverity: high\naudience: education-it\nkeywords: [student, password reset, guardian, ferpa]\ncreated: 2026-06-18\nescalation_trigger: Identity proof is incomplete or requester is not authorized.\n---\n# Student password reset with guardian present\n\n## Symptom\n\nThe requester reports a education support issue that matches: student, password reset, guardian, ferpa.\n\n## What ARIA should do first\n\nValidate school policy, confirm requester authority, reset through approved IdP, and log the ticket without sensitive notes.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Identity proof is incomplete or requester is not authorized.\n\n## Support tier\n\nDefault tier: L1. Default severity: high. Article ID: l1-edu-003."
  },
  {
   "slug": "l1-edu-004",
   "path_rel": "knowledge-base\\vertical-education\\l1-edu-004.md",
   "title": "Shared classroom projector audio missing",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "projector",
    "audio",
    "classroom"
   ],
   "compliance": [],
   "content": "---\ntitle: Shared classroom projector audio missing\ncategory: education\nsupport_level: L1\nseverity: low\naudience: education-it\nkeywords: [projector, audio, classroom]\ncreated: 2026-06-18\nescalation_trigger: Issue persists across devices and cables.\n---\n# Shared classroom projector audio missing\n\n## Symptom\n\nThe requester reports a education support issue that matches: projector, audio, classroom.\n\n## What ARIA should do first\n\nCheck input source, HDMI audio device, projector volume, adapter, and classroom control panel.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Issue persists across devices and cables.\n\n## Support tier\n\nDefault tier: L1. Default severity: low. Article ID: l1-edu-004."
  },
  {
   "slug": "l1-edu-005",
   "path_rel": "knowledge-base\\vertical-education\\l1-edu-005.md",
   "title": "Teacher cannot launch video meeting",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "meet",
    "teams",
    "teacher",
    "policy"
   ],
   "compliance": [],
   "content": "---\ntitle: Teacher cannot launch video meeting\ncategory: education\nsupport_level: L1\nseverity: medium\naudience: education-it\nkeywords: [meet, teams, teacher, policy]\ncreated: 2026-06-18\nescalation_trigger: Meeting policy blocks host creation or external guests.\n---\n# Teacher cannot launch video meeting\n\n## Symptom\n\nThe requester reports a education support issue that matches: meet, teams, teacher, policy.\n\n## What ARIA should do first\n\nConfirm teacher role, calendar policy, meeting license, browser permission, and student join restrictions.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Meeting policy blocks host creation or external guests.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-edu-005."
  },
  {
   "slug": "l2-ferpa-001",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-001.md",
   "title": "FERPA-safe student data export request",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ferpa",
    "student record",
    "export"
   ],
   "compliance": [],
   "content": "---\ntitle: FERPA-safe student data export request\ncategory: education\nsupport_level: L2\nseverity: high\naudience: education-it\nkeywords: [ferpa, student record, export]\ncreated: 2026-06-18\nescalation_trigger: Requester authority or scope is unclear.\n---\n# FERPA-safe student data export request\n\n## Symptom\n\nThe requester reports a education support issue that matches: ferpa, student record, export.\n\n## What ARIA should do first\n\nConfirm authorized requester, define exact data scope, use approved export path, and keep an audit note.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Requester authority or scope is unclear.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ferpa-001."
  },
  {
   "slug": "l2-ferpa-002",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-002.md",
   "title": "Accidental gradebook share",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ferpa",
    "gradebook",
    "share",
    "privacy"
   ],
   "compliance": [],
   "content": "---\ntitle: Accidental gradebook share\ncategory: education\nsupport_level: L2\nseverity: critical\naudience: education-it\nkeywords: [ferpa, gradebook, share, privacy]\ncreated: 2026-06-18\nescalation_trigger: External recipient or broad student access occurred.\n---\n# Accidental gradebook share\n\n## Symptom\n\nThe requester reports a education support issue that matches: ferpa, gradebook, share, privacy.\n\n## What ARIA should do first\n\nRemove sharing, preserve evidence, notify school privacy owner, identify affected records, and follow district notification policy.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: External recipient or broad student access occurred.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ferpa-002."
  },
  {
   "slug": "l2-ferpa-003",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-003.md",
   "title": "Student account still active after withdrawal",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ferpa",
    "withdrawn student",
    "deprovision"
   ],
   "compliance": [],
   "content": "---\ntitle: Student account still active after withdrawal\ncategory: education\nsupport_level: L2\nseverity: high\naudience: education-it\nkeywords: [ferpa, withdrawn student, deprovision]\ncreated: 2026-06-18\nescalation_trigger: Account retains mailbox, drive, LMS, or SIS access.\n---\n# Student account still active after withdrawal\n\n## Symptom\n\nThe requester reports a education support issue that matches: ferpa, withdrawn student, deprovision.\n\n## What ARIA should do first\n\nDisable access, preserve required records, remove active sessions, and confirm SIS-to-IdP lifecycle mapping.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Account retains mailbox, drive, LMS, or SIS access.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ferpa-003."
  },
  {
   "slug": "l2-ferpa-004",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-004.md",
   "title": "LMS roster sync mismatch",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "lms",
    "sis",
    "roster",
    "sync"
   ],
   "compliance": [],
   "content": "---\ntitle: LMS roster sync mismatch\ncategory: education\nsupport_level: L2\nseverity: medium\naudience: education-it\nkeywords: [lms, sis, roster, sync]\ncreated: 2026-06-18\nescalation_trigger: Multiple students or classes have incorrect enrollment.\n---\n# LMS roster sync mismatch\n\n## Symptom\n\nThe requester reports a education support issue that matches: lms, sis, roster, sync.\n\n## What ARIA should do first\n\nCompare SIS source, sync timestamp, scoped OU, and LMS connector logs before manual overrides.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Multiple students or classes have incorrect enrollment.\n\n## Support tier\n\nDefault tier: L2. Default severity: medium. Article ID: l2-ferpa-004."
  },
  {
   "slug": "l2-ferpa-005",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-005.md",
   "title": "Guardian portal identity dispute",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "guardian portal",
    "identity",
    "ferpa"
   ],
   "compliance": [],
   "content": "---\ntitle: Guardian portal identity dispute\ncategory: education\nsupport_level: L2\nseverity: high\naudience: education-it\nkeywords: [guardian portal, identity, ferpa]\ncreated: 2026-06-18\nescalation_trigger: Guardian relationship or custody restriction is disputed.\n---\n# Guardian portal identity dispute\n\n## Symptom\n\nThe requester reports a education support issue that matches: guardian portal, identity, ferpa.\n\n## What ARIA should do first\n\nDo not disclose records. Route to school admin, verify SIS relationship flags, and document only minimal facts.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Guardian relationship or custody restriction is disputed.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ferpa-005."
  },
  {
   "slug": "l2-ferpa-006",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-006.md",
   "title": "OneDrive or Drive folder exposes student records",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ferpa",
    "onedrive",
    "google drive",
    "share"
   ],
   "compliance": [],
   "content": "---\ntitle: OneDrive or Drive folder exposes student records\ncategory: education\nsupport_level: L2\nseverity: critical\naudience: education-it\nkeywords: [ferpa, onedrive, google drive, share]\ncreated: 2026-06-18\nescalation_trigger: Student records were shared outside the authorized group.\n---\n# OneDrive or Drive folder exposes student records\n\n## Symptom\n\nThe requester reports a education support issue that matches: ferpa, onedrive, google drive, share.\n\n## What ARIA should do first\n\nRevoke sharing, export access list, preserve audit logs, notify privacy owner, and reset folder permissions.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Student records were shared outside the authorized group.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ferpa-006."
  },
  {
   "slug": "l2-ferpa-007",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-007.md",
   "title": "Student device lost with local files",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "lost device",
    "student data",
    "ferpa"
   ],
   "compliance": [],
   "content": "---\ntitle: Student device lost with local files\ncategory: education\nsupport_level: L2\nseverity: high\naudience: education-it\nkeywords: [lost device, student data, ferpa]\ncreated: 2026-06-18\nescalation_trigger: Encryption or remote wipe status cannot be proven.\n---\n# Student device lost with local files\n\n## Symptom\n\nThe requester reports a education support issue that matches: lost device, student data, ferpa.\n\n## What ARIA should do first\n\nConfirm device management state, remote lock or wipe, collect last sync details, and escalate to privacy lead if records may be exposed.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Encryption or remote wipe status cannot be proven.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ferpa-007."
  },
  {
   "slug": "l2-ferpa-008",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-008.md",
   "title": "Assessment platform outage during exam",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "assessment",
    "exam",
    "outage"
   ],
   "compliance": [],
   "content": "---\ntitle: Assessment platform outage during exam\ncategory: education\nsupport_level: L2\nseverity: critical\naudience: education-it\nkeywords: [assessment, exam, outage]\ncreated: 2026-06-18\nescalation_trigger: Many students cannot complete timed assessment.\n---\n# Assessment platform outage during exam\n\n## Symptom\n\nThe requester reports a education support issue that matches: assessment, exam, outage.\n\n## What ARIA should do first\n\nVerify vendor status, preserve impacted student list, communicate approved workaround, and avoid modifying exam results without school approval.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Many students cannot complete timed assessment.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ferpa-008."
  },
  {
   "slug": "l2-ferpa-009",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-009.md",
   "title": "Teacher mailbox compromised",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "teacher",
    "mailbox",
    "compromise",
    "ferpa"
   ],
   "compliance": [],
   "content": "---\ntitle: Teacher mailbox compromised\ncategory: education\nsupport_level: L2\nseverity: critical\naudience: education-it\nkeywords: [teacher, mailbox, compromise, ferpa]\ncreated: 2026-06-18\nescalation_trigger: Mailbox contains student records or external forwarding rule.\n---\n# Teacher mailbox compromised\n\n## Symptom\n\nThe requester reports a education support issue that matches: teacher, mailbox, compromise, ferpa.\n\n## What ARIA should do first\n\nDisable sessions, reset MFA, remove rules, search audit logs, and notify privacy/security owner.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Mailbox contains student records or external forwarding rule.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ferpa-009."
  },
  {
   "slug": "l2-ferpa-010",
   "path_rel": "knowledge-base\\vertical-education\\l2-ferpa-010.md",
   "title": "EdTech vendor access review",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "edtech",
    "vendor",
    "access review"
   ],
   "compliance": [],
   "content": "---\ntitle: EdTech vendor access review\ncategory: education\nsupport_level: L2\nseverity: high\naudience: education-it\nkeywords: [edtech, vendor, access review]\ncreated: 2026-06-18\nescalation_trigger: Vendor can access student PII without current approval.\n---\n# EdTech vendor access review\n\n## Symptom\n\nThe requester reports a education support issue that matches: edtech, vendor, access review.\n\n## What ARIA should do first\n\nCollect DPA status, app scopes, active users, data retention terms, and route decision to school authority.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Vendor can access student PII without current approval.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ferpa-010."
  },
  {
   "slug": "l1-adp-001-adp-workforcenow-sso-broken",
   "path_rel": "knowledge-base\\vertical-finance\\l1-adp-001-adp-workforcenow-sso-broken.md",
   "title": "ADP WorkforceNow SSO broken after AAD password change",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "ADP",
    "SSO"
   ],
   "keywords": [
    "finance",
    "accounting",
    "adp"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: ADP WorkforceNow SSO broken after AAD password change\nvertical: finance\ntier: l1\nintent_codes: [ADP,SSO]\nkeywords: [finance, accounting, adp]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nADP WorkforceNow SSO broken after AAD password change — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most adp issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor ADP WorkforceNow SSO broken after AAD password change: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-expense-001-expensify-receipt-not-syncing-from-mobile",
   "path_rel": "knowledge-base\\vertical-finance\\l1-expense-001-expensify-receipt-not-syncing-from-mobile.md",
   "title": "Expensify receipt not syncing from mobile",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "EXPENSIFY",
    "SYNC"
   ],
   "keywords": [
    "finance",
    "accounting",
    "expense"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: Expensify receipt not syncing from mobile\nvertical: finance\ntier: l1\nintent_codes: [EXPENSIFY,SYNC]\nkeywords: [finance, accounting, expense]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nExpensify receipt not syncing from mobile — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most expense issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Expensify receipt not syncing from mobile: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-payroll-001-direct-deposit-rejected-by-bank",
   "path_rel": "knowledge-base\\vertical-finance\\l1-payroll-001-direct-deposit-rejected-by-bank.md",
   "title": "Direct deposit batch rejected by bank",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "DD",
    "REJECT"
   ],
   "keywords": [
    "finance",
    "accounting",
    "payroll"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: Direct deposit batch rejected by bank\nvertical: finance\ntier: l1\nintent_codes: [DD,REJECT]\nkeywords: [finance, accounting, payroll]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nDirect deposit batch rejected by bank — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most payroll issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Direct deposit batch rejected by bank: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-qb-001-quickbooks-online-login-loop",
   "path_rel": "knowledge-base\\vertical-finance\\l1-qb-001-quickbooks-online-login-loop.md",
   "title": "QuickBooks Online login loop / 2FA error",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "QBO",
    "LOGIN"
   ],
   "keywords": [
    "finance",
    "accounting",
    "qb"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: QuickBooks Online login loop / 2FA error\nvertical: finance\ntier: l1\nintent_codes: [QBO,LOGIN]\nkeywords: [finance, accounting, qb]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nQuickBooks Online login loop / 2FA error — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most qb issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor QuickBooks Online login loop / 2FA error: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-qb-002-quickbooks-desktop-multi-user-mode-fail",
   "path_rel": "knowledge-base\\vertical-finance\\l1-qb-002-quickbooks-desktop-multi-user-mode-fail.md",
   "title": "QuickBooks Desktop multi-user mode connection fail",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "QBDT",
    "MULTIUSER"
   ],
   "keywords": [
    "finance",
    "accounting",
    "qb"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: QuickBooks Desktop multi-user mode connection fail\nvertical: finance\ntier: l1\nintent_codes: [QBDT,MULTIUSER]\nkeywords: [finance, accounting, qb]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nQuickBooks Desktop multi-user mode connection fail — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most qb issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor QuickBooks Desktop multi-user mode connection fail: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-qb-003-bank-feed-sync-stuck",
   "path_rel": "knowledge-base\\vertical-finance\\l1-qb-003-bank-feed-sync-stuck.md",
   "title": "Bank feed sync stuck not pulling new transactions",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "BANKFEED",
    "STUCK"
   ],
   "keywords": [
    "finance",
    "accounting",
    "qb"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: Bank feed sync stuck not pulling new transactions\nvertical: finance\ntier: l1\nintent_codes: [BANKFEED,STUCK]\nkeywords: [finance, accounting, qb]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nBank feed sync stuck not pulling new transactions — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most qb issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Bank feed sync stuck not pulling new transactions: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-sage-001-sage-50-payroll-tax-table-out-of-date",
   "path_rel": "knowledge-base\\vertical-finance\\l1-sage-001-sage-50-payroll-tax-table-out-of-date.md",
   "title": "Sage 50 payroll tax table out of date",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "SAGE",
    "PAYROLL"
   ],
   "keywords": [
    "finance",
    "accounting",
    "sage"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: Sage 50 payroll tax table out of date\nvertical: finance\ntier: l1\nintent_codes: [SAGE,PAYROLL]\nkeywords: [finance, accounting, sage]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nSage 50 payroll tax table out of date — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most sage issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Sage 50 payroll tax table out of date: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-xero-001-xero-invoice-not-sending",
   "path_rel": "knowledge-base\\vertical-finance\\l1-xero-001-xero-invoice-not-sending.md",
   "title": "Xero invoice not sending via email",
   "vertical": "finance",
   "tier": "l1",
   "intent_codes": [
    "XERO",
    "INV"
   ],
   "keywords": [
    "finance",
    "accounting",
    "xero"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: Xero invoice not sending via email\nvertical: finance\ntier: l1\nintent_codes: [XERO,INV]\nkeywords: [finance, accounting, xero]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nXero invoice not sending via email — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most xero issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Xero invoice not sending via email: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-audit-001-auditor-requested-access-log-export",
   "path_rel": "knowledge-base\\vertical-finance\\l2-audit-001-auditor-requested-access-log-export.md",
   "title": "Auditor requested access log export (financial systems)",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "AUDIT",
    "LOGS"
   ],
   "keywords": [
    "finance",
    "accounting",
    "audit"
   ],
   "compliance": [
    "SOX",
    "internal_controls"
   ],
   "content": "---\ntitle: Auditor requested access log export (financial systems)\nvertical: finance\ntier: l2\nintent_codes: [AUDIT,LOGS]\nkeywords: [finance, accounting, audit]\ncompliance: [SOX, internal_controls]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nAuditor requested access log export (financial systems) — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most audit issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Auditor requested access log export (financial systems): validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-cra-001-cra-business-account-mfa-locked-out",
   "path_rel": "knowledge-base\\vertical-finance\\l2-cra-001-cra-business-account-mfa-locked-out.md",
   "title": "CRA Business Account MFA locked out during filing",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "CRA",
    "MFA"
   ],
   "keywords": [
    "finance",
    "accounting",
    "cra"
   ],
   "compliance": [
    "CRA",
    "CASL"
   ],
   "content": "---\ntitle: CRA Business Account MFA locked out during filing\nvertical: finance\ntier: l2\nintent_codes: [CRA,MFA]\nkeywords: [finance, accounting, cra]\ncompliance: [CRA, CASL]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nCRA Business Account MFA locked out during filing — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most cra issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor CRA Business Account MFA locked out during filing: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-erp-001-netsuite-saved-search-returns-stale-data",
   "path_rel": "knowledge-base\\vertical-finance\\l2-erp-001-netsuite-saved-search-returns-stale-data.md",
   "title": "NetSuite saved search returns stale data after upgrade",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "NETSUITE",
    "SEARCH"
   ],
   "keywords": [
    "finance",
    "accounting",
    "erp"
   ],
   "compliance": [
    "PCI-DSS",
    "SOX"
   ],
   "content": "---\ntitle: NetSuite saved search returns stale data after upgrade\nvertical: finance\ntier: l2\nintent_codes: [NETSUITE,SEARCH]\nkeywords: [finance, accounting, erp]\ncompliance: [PCI-DSS, SOX]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nNetSuite saved search returns stale data after upgrade — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most erp issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor NetSuite saved search returns stale data after upgrade: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-pci-001-credit-card-data-found-in-uncategorized-email",
   "path_rel": "knowledge-base\\vertical-finance\\l2-pci-001-credit-card-data-found-in-uncategorized-email.md",
   "title": "Credit card numbers found in uncategorized email (PCI)",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "PCI",
    "LEAK"
   ],
   "keywords": [
    "finance",
    "accounting",
    "pci"
   ],
   "compliance": [
    "PCI-DSS",
    "breach_notification"
   ],
   "content": "---\ntitle: Credit card numbers found in uncategorized email (PCI)\nvertical: finance\ntier: l2\nintent_codes: [PCI,LEAK]\nkeywords: [finance, accounting, pci]\ncompliance: [PCI-DSS, breach_notification]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nCredit card numbers found in uncategorized email (PCI) — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most pci issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Credit card numbers found in uncategorized email (PCI): validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-pci-002-payment-terminal-not-tokenizing",
   "path_rel": "knowledge-base\\vertical-finance\\l2-pci-002-payment-terminal-not-tokenizing.md",
   "title": "Payment terminal not tokenizing — sending PAN in plain",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "PCI",
    "TOKENIZATION"
   ],
   "keywords": [
    "finance",
    "accounting",
    "pci"
   ],
   "compliance": [
    "PCI-DSS",
    "breach_notification"
   ],
   "content": "---\ntitle: Payment terminal not tokenizing — sending PAN in plain\nvertical: finance\ntier: l2\nintent_codes: [PCI,TOKENIZATION]\nkeywords: [finance, accounting, pci]\ncompliance: [PCI-DSS, breach_notification]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nPayment terminal not tokenizing — sending PAN in plain — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most pci issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Payment terminal not tokenizing — sending PAN in plain: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-sox-001-month-end-close-gl-rec-mismatch",
   "path_rel": "knowledge-base\\vertical-finance\\l2-sox-001-month-end-close-gl-rec-mismatch.md",
   "title": "Month-end close GL reconciliation mismatch (SOX risk)",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "SOX",
    "RECONCILE"
   ],
   "keywords": [
    "finance",
    "accounting",
    "sox"
   ],
   "compliance": [
    "SOX",
    "internal_controls"
   ],
   "content": "---\ntitle: Month-end close GL reconciliation mismatch (SOX risk)\nvertical: finance\ntier: l2\nintent_codes: [SOX,RECONCILE]\nkeywords: [finance, accounting, sox]\ncompliance: [SOX, internal_controls]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nMonth-end close GL reconciliation mismatch (SOX risk) — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most sox issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Month-end close GL reconciliation mismatch (SOX risk): validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l2-sox-002-suspicious-vendor-change-from-shared-mailbox",
   "path_rel": "knowledge-base\\vertical-finance\\l2-sox-002-suspicious-vendor-change-from-shared-mailbox.md",
   "title": "Suspicious vendor change request from shared mailbox",
   "vertical": "finance",
   "tier": "l2",
   "intent_codes": [
    "FRAUD",
    "VENDOR"
   ],
   "keywords": [
    "finance",
    "accounting",
    "sox"
   ],
   "compliance": [
    "SOX",
    "internal_controls"
   ],
   "content": "---\ntitle: Suspicious vendor change request from shared mailbox\nvertical: finance\ntier: l2\nintent_codes: [FRAUD,VENDOR]\nkeywords: [finance, accounting, sox]\ncompliance: [SOX, internal_controls]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nSuspicious vendor change request from shared mailbox — blocks reporting cycles, may trigger audit / regulatory exposure if mishandled.\n\n## What is happening (1-line cause)\n\nMost often a credential, sync token, or upstream vendor outage. PCI/SOX-category issues need preservation of state before any remediation.\n\n## Fix — try these in order\n\n### 1. Preserve evidence\n\nIf this entry is L2 (SOX / PCI / audit / fraud-adjacent): STOP. Do NOT modify any record yet. Take screenshots of error state. Note exact timestamp. Open a ticket in your ITSM (and CC the firm's controller / compliance officer for SOX or PCI). Failing to preserve evidence is the audit problem, not the original bug.\n\nFor L1 issues: skip this step, go to step 2.\n\n**Escalation:** any SOX-affecting financial system requires evidence preservation BEFORE remediation, per internal controls.\n\n### 2. Verify upstream vendor status\n\nCheck the vendor status page (QuickBooks: status.intuit.com; Xero: status.xero.com; Sage: status.sage.com; ADP: status.adp.com; NetSuite: status.netsuite.com). If vendor reports outage, note ticket reference and wait — do NOT retry-storm, it can corrupt batch state.\n\n**Escalation:** if vendor is up but issue persists >15 min, vendor ticket.\n\n### 3. Standard remediation\n\nFor most sox issues: log out fully, clear cached credentials (Credential Manager on Windows, Keychain on Mac), sign back in. If desktop app: close all sessions across all machines, then reopen on ONE machine. For multi-user accounting: only the admin user reopens first.\n\n**Escalation:** if step 3 does not resolve, vendor ticket with the ticket reference from step 2.\n\n### 4. Specific to this issue\n\nFor Suspicious vendor change request from shared mailbox: validate the related credential is current (most are 90-day rotation per finance vendor policy). Check that user account has not been removed from the necessary permission group during a recent cleanup. Verify backup/sync configuration if data appears stale.\n\n**Escalation:** if scoped to a single user, check their AAD/Workspace group memberships first.\n\n## Compliance reminder\n\n**SOX systems** (any system that produces financial reports going to auditors): every change to permissions, balances, or feeds MUST be logged in the audit trail with date/user/reason. ARIA does NOT modify financial records — only routes to a human with audit-trail capability.\n\n**PCI systems** (anything touching cardholder data): cardholder data MUST NEVER appear in logs, screenshots, support tickets, or chat with vendors. If you find it in a place it should not be, treat as an incident and notify your QSA.\n\n**CRA / tax systems**: never share business number or full Canadian Personal Number in chat or screenshots. Use first 3 + last 3 digits if reference is needed.\n\n**Trust accounting**: balance mismatches are a regulator-reportable event in some jurisdictions. Freeze; do not adjust; escalate to firm compliance officer immediately.\n\n## Related entries\n\n- [[l2-sox-001-month-end-close-gl-rec-mismatch]]\n- [[l2-pci-001-credit-card-data-found-in-uncategorized-email]]\n- [[l2-audit-001-auditor-requested-access-log-export]]"
  },
  {
   "slug": "l1-clinical-printer-001-prescription-printer-out-of-paper",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-clinical-printer-001-prescription-printer-out-of-paper.md",
   "title": "\"Prescription printer out of paper\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "PRINT.PRESCRIPTION",
    "CLINICAL.WORKFLOW",
    "HARDWARE.PAPER"
   ],
   "keywords": [
    "prescription printer",
    "paper",
    "printer",
    "rx",
    "clinic"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Prescription printer out of paper\"\nvertical: healthcare\ntier: l1\nintent_codes: [PRINT.PRESCRIPTION, CLINICAL.WORKFLOW, HARDWARE.PAPER]\nkeywords: [prescription printer, paper, printer, rx, clinic]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nThe prescription printer reports out of paper, wrong paper, or will not print a required prescription.\n\n## What's happening (1-line cause)\n\nThe printer may need approved paper loaded correctly, queue cleanup, or a hardware check.\n\n## Fix - try these in order\n\n### 1. Load approved paper\n\nUse only the clinic-approved prescription paper or tray stock, align it correctly, and close all covers firmly.\n\n**Escalation:** if the printer still reports paper empty, go to step 2.\n\n### 2. Clear local printer errors\n\nCancel duplicate stuck jobs, restart the printer if allowed, and print one non-clinical test page if policy allows.\n\n**Escalation:** if local test printing fails, go to step 3.\n\n### 3. Confirm printer mapping\n\nVerify the EMR or prescribing app is mapped to the correct prescription printer and not a general office printer.\n\n**Escalation:** open a ticket with clinic IT and printer support if printer mapping or hardware failure blocks prescribing workflow.\n\n## Compliance reminder\n\nPrescription output can contain sensitive information. Secure any misprints immediately according to clinic policy. Do not photograph prescriptions for troubleshooting.\n\n## Related entries\n\n- [[l1-emr-004-athenahealth-print-issues]]\n- [[l2-clinical-printer-003-zebra-label-driver-windows-11]]"
  },
  {
   "slug": "l1-clinical-printer-002-label-printer-for-specimens-stuck",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-clinical-printer-002-label-printer-for-specimens-stuck.md",
   "title": "\"Specimen label printer stuck\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "PRINT.LABEL",
    "SPECIMEN.WORKFLOW",
    "HARDWARE.ZEBRA"
   ],
   "keywords": [
    "label printer",
    "specimen",
    "stuck",
    "zebra",
    "clinic"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Specimen label printer stuck\"\nvertical: healthcare\ntier: l1\nintent_codes: [PRINT.LABEL, SPECIMEN.WORKFLOW, HARDWARE.ZEBRA]\nkeywords: [label printer, specimen, stuck, zebra, clinic]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nThe specimen label printer is stuck, labels are not advancing, or labels print misaligned.\n\n## What's happening (1-line cause)\n\nThe label roll, sensor, queue, or driver setting may be out of alignment with the specimen label format.\n\n## Fix - try these in order\n\n### 1. Check media and sensor path\n\nConfirm the approved label roll is installed correctly, labels feed under the guides, and the cover is fully closed.\n\n**Escalation:** if labels still do not advance, go to step 2.\n\n### 2. Calibrate or feed one label\n\nUse the printer feed or calibration process documented for the model, then print one non-clinical test label.\n\n**Escalation:** if calibration fails or labels remain misaligned, go to step 3.\n\n### 3. Verify driver and size\n\nCheck the mapped printer, label dimensions, orientation, and EMR label template setting.\n\n**Escalation:** open a ticket with clinic IT, lab workflow owner, and printer support if specimen labeling is delayed.\n\n## Compliance reminder\n\nDo not leave specimen labels with identifiers exposed or discarded in regular trash. Use blank or test labels for troubleshooting whenever possible. Follow lab downtime labeling policy if printing is unavailable.\n\n## Related entries\n\n- [[l2-clinical-printer-003-zebra-label-driver-windows-11]]\n- [[l1-emr-004-athenahealth-print-issues]]"
  },
  {
   "slug": "l1-emr-001-epic-mychart-login-issues",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-emr-001-epic-mychart-login-issues.md",
   "title": "\"Epic MyChart login issues\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "LOGIN.MFA",
    "EMR.EPIC",
    "PORTAL.MYCHART"
   ],
   "keywords": [
    "epic",
    "mychart",
    "login",
    "password",
    "browser"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Epic MyChart login issues\"\nvertical: healthcare\ntier: l1\nintent_codes: [LOGIN.MFA, EMR.EPIC, PORTAL.MYCHART]\nkeywords: [epic, mychart, login, password, browser]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nUser cannot sign in to Epic MyChart, sees a password loop, or the portal rejects the verification code.\n\n## What's happening (1-line cause)\n\nThe account, browser session, or MFA method is out of sync with the portal identity record.\n\n## Fix - try these in order\n\n### 1. Confirm the right portal and reset path\n\nOpen the official MyChart portal link from the provider website, choose the password reset or username recovery link, and complete the visible prompts.\n\n**Escalation:** if the reset email or code does not arrive within 10 minutes, go to step 2.\n\n### 2. Clear the browser session\n\nOpen an incognito or private window, disable autofill for this login attempt, and sign in again using the recovered username.\n\n**Escalation:** if the same loop appears in a private window, go to step 3.\n\n### 3. Check account lock or identity mismatch\n\nAsk the clinic portal support desk to confirm the account is active and that the recovery email or phone on file is correct.\n\n**Escalation:** open a ticket with Epic portal support plus clinic IT if the account is locked, merged, or mapped to the wrong identity record.\n\n## Compliance reminder\n\nDo not paste screenshots showing appointment details, chart notes, medications, or messages into a general ticket. Keep the ticket to error text, timestamp, browser, and device. If portal access is changed, clinic IT should preserve an access-change audit trail.\n\n## Related entries\n\n- [[l2-hipaa-003-mfa-recovery-for-clinical-staff]]\n- [[l2-patient-portal-001-mychart-account-locked]]"
  },
  {
   "slug": "l1-emr-002-cerner-powerchart-crashes",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-emr-002-cerner-powerchart-crashes.md",
   "title": "\"Cerner PowerChart crashes on launch\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "EMR.CERNER",
    "APP.CRASH",
    "WORKSTATION.CLINICAL"
   ],
   "keywords": [
    "cerner",
    "powerchart",
    "crash",
    "citrix",
    "workstation"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Cerner PowerChart crashes on launch\"\nvertical: healthcare\ntier: l1\nintent_codes: [EMR.CERNER, APP.CRASH, WORKSTATION.CLINICAL]\nkeywords: [cerner, powerchart, crash, citrix, workstation]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nCerner PowerChart opens, freezes, closes, or crashes before the user can reach the patient list.\n\n## What's happening (1-line cause)\n\nThe local workstation profile, Citrix session, or required plugin is failing before the EMR workspace loads.\n\n## Fix - try these in order\n\n### 1. Restart the clinical app session\n\nSign out of PowerChart, close all Citrix or EMR windows, wait 60 seconds, and launch PowerChart from the approved clinical shortcut.\n\n**Escalation:** if the app crashes again on first launch, go to step 2.\n\n### 2. Test another workstation or profile\n\nHave the same user try a known-good clinical workstation, then have another user try the original workstation.\n\n**Escalation:** if only one workstation fails, go to step 3.\n\n### 3. Capture safe crash details\n\nRecord the workstation name, time, Windows event error, app version, and whether Citrix was involved, without including chart data.\n\n**Escalation:** open a ticket with Cerner support plus IT endpoint support if the crash repeats after restart and profile isolation.\n\n## Compliance reminder\n\nDo not include patient names, MRNs, encounter IDs, orders, or chart screenshots in crash logs. If a screenshot is required, crop to the error window only. Store logs in the approved encrypted ticketing system.\n\n## Related entries\n\n- [[l2-emr-006-citrix-receiver-emr-disconnect-frequently]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l1-emr-003-allscripts-sunrise-slow",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-emr-003-allscripts-sunrise-slow.md",
   "title": "\"Allscripts Sunrise is slow\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "EMR.ALLSCRIPTS",
    "PERFORMANCE.SLOW",
    "NETWORK.LATENCY"
   ],
   "keywords": [
    "allscripts",
    "sunrise",
    "slow",
    "performance",
    "workstation"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Allscripts Sunrise is slow\"\nvertical: healthcare\ntier: l1\nintent_codes: [EMR.ALLSCRIPTS, PERFORMANCE.SLOW, NETWORK.LATENCY]\nkeywords: [allscripts, sunrise, slow, performance, workstation]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nAllscripts Sunrise loads slowly, clicks take several seconds, or screens stall during routine charting.\n\n## What's happening (1-line cause)\n\nThe slowdown may be local workstation load, network latency, Citrix session health, or an EMR-side performance issue.\n\n## Fix - try these in order\n\n### 1. Identify whether it is one user or many\n\nAsk two nearby clinical users to load the same general module, without opening the same record or sharing patient details.\n\n**Escalation:** if multiple users are slow at the same time, go to step 3.\n\n### 2. Restart the local session\n\nClose Sunrise, sign out of Citrix if used, restart the workstation, and relaunch from the approved shortcut.\n\n**Escalation:** if the same workstation remains slow after restart, go to step 3.\n\n### 3. Record safe timing details\n\nWrite down module name, location, workstation name, approximate delay, network type, and exact time window.\n\n**Escalation:** open a ticket with Allscripts support plus network or Citrix support if multiple users or modules are affected.\n\n## Compliance reminder\n\nPerformance tickets should not include patient identifiers, screenshots of charts, orders, labs, or messages. Use module names and timestamps only. If logs are exported, store them in an encrypted support location.\n\n## Related entries\n\n- [[l2-emr-006-citrix-receiver-emr-disconnect-frequently]]\n- [[l2-emr-007-emr-database-connection-loss-post-patch]]"
  },
  {
   "slug": "l1-emr-004-athenahealth-print-issues",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-emr-004-athenahealth-print-issues.md",
   "title": "\"athenahealth print issues\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "EMR.ATHENA",
    "PRINT.QUEUE",
    "CLINICAL.PRINTER"
   ],
   "keywords": [
    "athenahealth",
    "print",
    "printer",
    "forms",
    "labels"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"athenahealth print issues\"\nvertical: healthcare\ntier: l1\nintent_codes: [EMR.ATHENA, PRINT.QUEUE, CLINICAL.PRINTER]\nkeywords: [athenahealth, print, printer, forms, labels]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nathenahealth will not print forms, visit summaries, labels, or documents to the expected clinical printer.\n\n## What's happening (1-line cause)\n\nThe browser, printer mapping, print queue, or athenahealth print setting is pointing to the wrong output path.\n\n## Fix - try these in order\n\n### 1. Confirm the selected printer\n\nFrom the print dialog, select the approved clinic printer by name and verify paper size, tray, and label size before printing one test page.\n\n**Escalation:** if the printer is missing from the list, go to step 2.\n\n### 2. Clear the stuck print queue\n\nCancel stuck jobs for that printer, restart the printer if safe, and print a non-clinical Windows test page first.\n\n**Escalation:** if the Windows test page prints but athenahealth does not, go to step 3.\n\n### 3. Test browser and athena print settings\n\nTry the approved browser, disable pop-up blocking for athenahealth, and verify the user is not printing to PDF by default.\n\n**Escalation:** open a ticket with athenahealth support plus clinic IT if only athena print output fails after the local queue works.\n\n## Compliance reminder\n\nDo not leave failed printouts containing ePHI in output trays. Use a generic test page when possible. If clinical documents printed to the wrong device, record the incident through the clinic privacy process.\n\n## Related entries\n\n- [[l1-clinical-printer-001-prescription-printer-out-of-paper]]\n- [[l2-clinical-printer-003-zebra-label-driver-windows-11]]"
  },
  {
   "slug": "l1-emr-005-nextgen-emr-pacs-image-load",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-emr-005-nextgen-emr-pacs-image-load.md",
   "title": "\"NextGen EMR cannot load PACS images\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "EMR.NEXTGEN",
    "PACS.IMAGE",
    "BROWSER.PLUGIN"
   ],
   "keywords": [
    "nextgen",
    "pacs",
    "image",
    "viewer",
    "dicom"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"NextGen EMR cannot load PACS images\"\nvertical: healthcare\ntier: l1\nintent_codes: [EMR.NEXTGEN, PACS.IMAGE, BROWSER.PLUGIN]\nkeywords: [nextgen, pacs, image, viewer, dicom]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nNextGen opens the chart but linked images, DICOM studies, or PACS viewer content do not load.\n\n## What's happening (1-line cause)\n\nThe EMR link, PACS viewer, browser setting, or workstation network route is blocking image retrieval.\n\n## Fix - try these in order\n\n### 1. Test the viewer outside the chart\n\nOpen the approved PACS viewer shortcut or portal directly and confirm whether the viewer loads without opening patient-specific content.\n\n**Escalation:** if the viewer itself does not load, go to step 2.\n\n### 2. Check browser and pop-up permissions\n\nUse the approved browser, allow pop-ups for the EMR and PACS domains, and retry from a fresh browser session.\n\n**Escalation:** if the viewer opens but images do not display, go to step 3.\n\n### 3. Confirm local network access\n\nVerify VPN or clinic network connection, workstation time, and whether other users at the same location can open PACS.\n\n**Escalation:** open a ticket with NextGen, PACS vendor support, and clinic IT if the issue follows the study link or affects multiple workstations.\n\n## Compliance reminder\n\nDo not send image screenshots or study identifiers through email or chat. Use accession-free timing details and approved ticket references only. If image access changes are made, retain the support audit record.\n\n## Related entries\n\n- [[l1-pacs-001-dicom-image-not-displaying]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l1-medical-device-001-imaging-modality-not-on-network",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-medical-device-001-imaging-modality-not-on-network.md",
   "title": "\"Imaging modality not on network\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "DEVICE.IMAGING",
    "NETWORK.CONNECTIVITY",
    "PACS.DICOM"
   ],
   "keywords": [
    "imaging",
    "modality",
    "network",
    "dicom",
    "pacs"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Imaging modality not on network\"\nvertical: healthcare\ntier: l1\nintent_codes: [DEVICE.IMAGING, NETWORK.CONNECTIVITY, PACS.DICOM]\nkeywords: [imaging, modality, network, dicom, pacs]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nAn imaging modality cannot reach PACS, modality worklist, or the clinical network.\n\n## What's happening (1-line cause)\n\nThe device may have lost physical network, IP configuration, VLAN access, or DICOM destination reachability.\n\n## Fix - try these in order\n\n### 1. Check physical link safely\n\nConfirm the network cable is seated, switch port lights are active, and the device has not been moved to an unapproved jack.\n\n**Escalation:** if there is no link light after reseating the cable, go to step 2.\n\n### 2. Confirm network identity\n\nRecord device name, IP address shown on the device, room, wall jack, and last successful send time.\n\n**Escalation:** if the IP is missing, wrong, or duplicated, go to step 3.\n\n### 3. Test DICOM destination reachability\n\nAsk IT or biomedical engineering to validate route, firewall, VLAN, and PACS destination status using approved tools.\n\n**Escalation:** open a ticket with biomedical engineering, network, and PACS support if connectivity does not restore quickly.\n\n## Compliance reminder\n\nDo not photograph images, demographics, or order lists from the modality screen. Use device identifiers, safe timestamps, and room location only. Preserve vendor service logs in the approved support system.\n\n## Related entries\n\n- [[l1-pacs-001-dicom-image-not-displaying]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l1-medical-device-002-infusion-pump-wifi-drops",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-medical-device-002-infusion-pump-wifi-drops.md",
   "title": "\"Infusion pump Wi-Fi drops\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "DEVICE.INFUSION",
    "WIFI.ROAMING",
    "BIOMED.ESCALATION"
   ],
   "keywords": [
    "infusion pump",
    "wifi",
    "wireless",
    "drops",
    "biomedical"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Infusion pump Wi-Fi drops\"\nvertical: healthcare\ntier: l1\nintent_codes: [DEVICE.INFUSION, WIFI.ROAMING, BIOMED.ESCALATION]\nkeywords: [infusion pump, wifi, wireless, drops, biomedical]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nAn infusion pump repeatedly drops from Wi-Fi or cannot sync with the approved medication or device system.\n\n## What's happening (1-line cause)\n\nThe pump may be outside wireless coverage, on the wrong SSID, using stale credentials, or experiencing roaming issues.\n\n## Fix - try these in order\n\n### 1. Confirm location and coverage\n\nRecord the unit, room area, pump model, and whether nearby approved pumps remain connected.\n\n**Escalation:** if multiple pumps drop in the same area, go to step 3.\n\n### 2. Restart through approved biomedical process\n\nFollow the vendor-approved restart or reconnect workflow only if clinical staff confirm it is safe and allowed.\n\n**Escalation:** if the pump reconnects then drops again, go to step 3.\n\n### 3. Validate wireless and device profile\n\nHave IT or biomedical engineering check SSID assignment, certificate/profile age, signal strength, and controller logs.\n\n**Escalation:** open a ticket with biomedical engineering, wireless network support, and the device vendor if drops continue.\n\n## Compliance reminder\n\nDo not record medication names, dosages, patient identifiers, or screen photos in the IT ticket. Clinical safety decisions belong to licensed clinical staff and biomedical policy.\n\n## Related entries\n\n- [[l1-medical-device-001-imaging-modality-not-on-network]]\n- [[l2-hipaa-003-mfa-recovery-for-clinical-staff]]"
  },
  {
   "slug": "l1-medical-device-003-vital-signs-monitor-offline",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-medical-device-003-vital-signs-monitor-offline.md",
   "title": "\"Vital signs monitor offline\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "DEVICE.MONITOR",
    "NETWORK.CONNECTIVITY",
    "BIOMED.ESCALATION"
   ],
   "keywords": [
    "vital signs",
    "monitor",
    "offline",
    "wifi",
    "biomedical"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Vital signs monitor offline\"\nvertical: healthcare\ntier: l1\nintent_codes: [DEVICE.MONITOR, NETWORK.CONNECTIVITY, BIOMED.ESCALATION]\nkeywords: [vital signs, monitor, offline, wifi, biomedical]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA vital signs monitor shows offline, cannot transmit readings, or is missing from the monitoring dashboard.\n\n## What's happening (1-line cause)\n\nThe monitor may have lost power, network connectivity, device registration, or server reachability.\n\n## Fix - try these in order\n\n### 1. Check power and network status\n\nConfirm power, battery, network icon, room location, and whether other monitors nearby are online.\n\n**Escalation:** if several monitors in the same area are offline, go to step 3.\n\n### 2. Reconnect using approved workflow\n\nAsk clinical or biomedical staff to follow the device-approved reconnect process; do not change clinical settings.\n\n**Escalation:** if the monitor stays offline after approved reconnect, go to step 3.\n\n### 3. Verify registration and server path\n\nHave biomedical or IT validate the device registration, VLAN, wireless logs, and monitoring server status.\n\n**Escalation:** open a ticket with biomedical engineering, network support, and the monitoring system vendor.\n\n## Compliance reminder\n\nAvoid screenshots showing readings, demographics, or encounter context. Use device ID, room area, and safe timestamps only. Clinical alarms and patient safety response remain under clinical protocol.\n\n## Related entries\n\n- [[l1-medical-device-002-infusion-pump-wifi-drops]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l1-pacs-001-dicom-image-not-displaying",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-pacs-001-dicom-image-not-displaying.md",
   "title": "\"DICOM image not displaying\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "PACS.DICOM",
    "IMAGE.VIEWER",
    "WORKSTATION.CLINICAL"
   ],
   "keywords": [
    "pacs",
    "dicom",
    "image",
    "viewer",
    "radiology"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"DICOM image not displaying\"\nvertical: healthcare\ntier: l1\nintent_codes: [PACS.DICOM, IMAGE.VIEWER, WORKSTATION.CLINICAL]\nkeywords: [pacs, dicom, image, viewer, radiology]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA DICOM image or study opens to a blank screen, spinner, or viewer error.\n\n## What's happening (1-line cause)\n\nThe issue may be a viewer cache problem, workstation graphics issue, PACS route issue, or missing study availability.\n\n## Fix - try these in order\n\n### 1. Test the viewer with a safe workflow\n\nOpen the PACS viewer home page or test viewer function without sharing or copying image content.\n\n**Escalation:** if the viewer itself fails to load, go to step 2.\n\n### 2. Restart browser or viewer cache\n\nClose the viewer, clear approved viewer cache if documented, reopen, and try the study link again.\n\n**Escalation:** if the same image remains blank on this workstation, go to step 3.\n\n### 3. Compare workstation and study scope\n\nAsk another authorized workstation to test whether the issue follows the workstation or the study link.\n\n**Escalation:** open a ticket with PACS support if the same study fails for multiple authorized users or devices.\n\n## Compliance reminder\n\nDo not attach DICOM screenshots, patient demographics, or accession numbers in general chat. Use approved PACS ticket references and minimal metadata. Store any exported logs in encrypted support storage.\n\n## Related entries\n\n- [[l1-pacs-002-radiology-workstation-slow-load]]\n- [[l1-emr-005-nextgen-emr-pacs-image-load]]"
  },
  {
   "slug": "l1-pacs-002-radiology-workstation-slow-load",
   "path_rel": "knowledge-base\\vertical-healthcare\\l1-pacs-002-radiology-workstation-slow-load.md",
   "title": "\"Radiology workstation slow load\"",
   "vertical": "healthcare",
   "tier": "l1",
   "intent_codes": [
    "PACS.PERFORMANCE",
    "WORKSTATION.RADIOLOGY",
    "STORAGE.NETWORK"
   ],
   "keywords": [
    "pacs",
    "radiology",
    "workstation",
    "slow",
    "images"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Radiology workstation slow load\"\nvertical: healthcare\ntier: l1\nintent_codes: [PACS.PERFORMANCE, WORKSTATION.RADIOLOGY, STORAGE.NETWORK]\nkeywords: [pacs, radiology, workstation, slow, images]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nRadiology studies load slowly, scroll slowly, or hang on a diagnostic workstation.\n\n## What's happening (1-line cause)\n\nLarge image sets can expose workstation resource limits, graphics driver issues, network latency, or PACS storage delays.\n\n## Fix - try these in order\n\n### 1. Check local resource pressure\n\nClose non-clinical apps, confirm disk space, and record CPU, memory, and GPU pressure during the slow load.\n\n**Escalation:** if local resources are normal but loads remain slow, go to step 2.\n\n### 2. Compare another workstation\n\nHave another authorized workstation open the same workflow using approved access, without sharing image content in the ticket.\n\n**Escalation:** if multiple workstations are slow, go to step 3.\n\n### 3. Capture timing and system scope\n\nRecord safe timing, modality type, workstation name, network location, and whether prior studies load normally.\n\n**Escalation:** open a ticket with PACS support, network, and workstation engineering for repeated multi-user slowness.\n\n## Compliance reminder\n\nAvoid screenshots or exports containing patient images or demographics. Use safe technical timing data. If diagnostic workflow is delayed, follow the clinical downtime and escalation procedure.\n\n## Related entries\n\n- [[l1-pacs-001-dicom-image-not-displaying]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l2-clinical-printer-003-zebra-label-driver-windows-11",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-clinical-printer-003-zebra-label-driver-windows-11.md",
   "title": "\"Zebra label driver on Windows 11\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.PRINTING",
    "DRIVER.ZEBRA",
    "WINDOWS11.PRINT"
   ],
   "keywords": [
    "hipaa",
    "zebra",
    "label printer",
    "windows 11",
    "driver"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Zebra label driver on Windows 11\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.PRINTING, DRIVER.ZEBRA, WINDOWS11.PRINT]\nkeywords: [hipaa, zebra, label printer, windows 11, driver]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA Zebra label printer fails, prints blank labels, or prints misaligned labels after Windows 11 setup or update.\n\n## What's happening (1-line cause)\n\nThe Windows driver, label size, print language, or EMR template may not match the Zebra device configuration.\n\n## Fix - try these in order\n\n### 1. Confirm model and approved driver\n\nRecord exact printer model, connection type, driver name, driver version, and Windows build from the workstation.\n\n**Escalation:** if the driver is missing or generic, go to step 2.\n\n### 2. Install or repair through approved IT tooling\n\nUse the approved driver package, print management policy, or endpoint tool to reinstall the Zebra queue.\n\n**Escalation:** if the queue installs but output is wrong, go to step 3.\n\n### 3. Validate label size and language\n\nCheck label dimensions, orientation, darkness, ZPL/EPL mode, and EMR label template mapping with a blank test label.\n\n**Escalation:** open a HIPAA-aware ticket with clinic IT, EMR owner, and Zebra or printer vendor support.\n\n## Compliance reminder\n\nUse blank test labels when troubleshooting. Do not print specimen or patient labels repeatedly for testing. Dispose of any misprints according to HIPAA and clinic policy.\n\n## Related entries\n\n- [[l1-clinical-printer-002-label-printer-for-specimens-stuck]]\n- [[l1-emr-004-athenahealth-print-issues]]"
  },
  {
   "slug": "l2-emr-006-citrix-receiver-emr-disconnect-frequently",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-emr-006-citrix-receiver-emr-disconnect-frequently.md",
   "title": "\"Citrix Receiver EMR disconnects frequently\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.EMR",
    "CITRIX.DISCONNECT",
    "NETWORK.SESSION"
   ],
   "keywords": [
    "hipaa",
    "citrix",
    "receiver",
    "workspace",
    "emr",
    "disconnect"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Citrix Receiver EMR disconnects frequently\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.EMR, CITRIX.DISCONNECT, NETWORK.SESSION]\nkeywords: [hipaa, citrix, receiver, workspace, emr, disconnect]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nThe EMR session disconnects frequently in Citrix Receiver or Citrix Workspace.\n\n## What's happening (1-line cause)\n\nSession drops can come from endpoint network changes, Citrix client version, gateway load, policy timeout, or backend host issues.\n\n## Fix - try these in order\n\n### 1. Separate local network from Citrix\n\nCheck whether the workstation internet or clinic network drops at the same time as the EMR session.\n\n**Escalation:** if local network drops are confirmed, go to step 3 with network support.\n\n### 2. Repair Citrix Workspace client\n\nUpdate or repair the approved Citrix Workspace version, clear stale sessions, and reconnect through the official portal.\n\n**Escalation:** if the same user disconnects across devices, go to step 3.\n\n### 3. Review session logs and policy scope\n\nCheck Citrix Director or gateway logs for disconnect reason, host, policy, idle timeout, and user scope.\n\n**Escalation:** open a HIPAA-aware ticket with Citrix admin, EMR owner, and network support if drops affect care workflows.\n\n## Compliance reminder\n\nHIPAA access logs may be needed when EMR sessions disconnect during care. Do not paste screen content or chart details into the ticket. Preserve session metadata and admin actions.\n\n## Related entries\n\n- [[l1-emr-002-cerner-powerchart-crashes]]\n- [[l2-emr-007-emr-database-connection-loss-post-patch]]"
  },
  {
   "slug": "l2-emr-007-emr-database-connection-loss-post-patch",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-emr-007-emr-database-connection-loss-post-patch.md",
   "title": "\"EMR database connection loss after patching\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.EMR",
    "DATABASE.CONNECTION",
    "PATCH.REGRESSION"
   ],
   "keywords": [
    "hipaa",
    "emr",
    "database",
    "patch",
    "connection loss"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"EMR database connection loss after patching\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.EMR, DATABASE.CONNECTION, PATCH.REGRESSION]\nkeywords: [hipaa, emr, database, patch, connection loss]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nAfter a server, workstation, or application patch, the EMR reports database connection errors or cannot load clinical data.\n\n## What's happening (1-line cause)\n\nThe patch may have changed service state, TLS, firewall rules, driver compatibility, DNS, or database listener availability.\n\n## Fix - try these in order\n\n### 1. Confirm scope and change window\n\nRecord affected modules, locations, timestamps, patch window, server names, and whether read-only downtime mode is available.\n\n**Escalation:** if clinical access is broadly affected, go to step 3 immediately.\n\n### 2. Check service and dependency health\n\nVerify EMR app services, database listener, DNS, firewall, certificates, and service account status in approved admin tools.\n\n**Escalation:** if any dependency changed during patching, go to step 3.\n\n### 3. Activate rollback or vendor incident workflow\n\nFollow the approved rollback, downtime, or vendor escalation plan and preserve logs before changes are reverted.\n\n**Escalation:** open a HIPAA-aware major incident with EMR vendor, database admin, infrastructure, and clinical operations.\n\n## Compliance reminder\n\nHIPAA availability and audit requirements matter during EMR outage response. Do not export clinical data for troubleshooting. Preserve system logs, change records, and access-impact notes in approved incident storage.\n\n## Related entries\n\n- [[l2-emr-006-citrix-receiver-emr-disconnect-frequently]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l2-fax-001-secure-fax-failover-explain",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-fax-001-secure-fax-failover-explain.md",
   "title": "\"Secure fax failover explanation\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.FAX",
    "DOWNTIME.FAILOVER",
    "SECURE.TRANSMISSION"
   ],
   "keywords": [
    "hipaa",
    "secure fax",
    "failover",
    "downtime",
    "efax"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Secure fax failover explanation\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.FAX, DOWNTIME.FAILOVER, SECURE.TRANSMISSION]\nkeywords: [hipaa, secure fax, failover, downtime, efax]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nClinical or administrative users need to send urgent documents while the normal secure fax route is unavailable.\n\n## What's happening (1-line cause)\n\nHIPAA-safe fax failover requires an approved alternate path, recipient verification, and audit trail.\n\n## Fix - try these in order\n\n### 1. Confirm the approved failover path\n\nCheck the downtime binder or IT knowledge base for the approved alternate secure fax, eFax, or manual workflow.\n\n**Escalation:** if no approved path is documented, go to step 3 before sending.\n\n### 2. Verify recipient before sending\n\nConfirm the destination number or secure endpoint from an approved source, not from a copied old email thread.\n\n**Escalation:** if the destination cannot be verified, go to step 3.\n\n### 3. Log the downtime send\n\nRecord sender role, destination organization, timestamp, transmission status, and ticket number, without pasting document content.\n\n**Escalation:** open a HIPAA downtime workflow ticket with IT, privacy, and the fax service owner if failover is undocumented or transmission fails.\n\n## Compliance reminder\n\nHIPAA requires reasonable safeguards when transmitting ePHI. Do not use personal email or consumer file sharing as a fax workaround. Keep the minimum necessary metadata and preserve failed-send logs.\n\n## Related entries\n\n- [[l2-fax-002-rightfax-srfax-troubleshoot]]\n- [[l2-hipaa-001-suspected-ePHI-email-leak]]"
  },
  {
   "slug": "l2-fax-002-rightfax-srfax-troubleshoot",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-fax-002-rightfax-srfax-troubleshoot.md",
   "title": "\"RightFax or SRFax troubleshooting\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.FAX",
    "RIGHTFAX.SRFAX",
    "QUEUE.FAILURE"
   ],
   "keywords": [
    "hipaa",
    "rightfax",
    "srfax",
    "fax",
    "queue"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"RightFax or SRFax troubleshooting\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.FAX, RIGHTFAX.SRFAX, QUEUE.FAILURE]\nkeywords: [hipaa, rightfax, srfax, fax, queue]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nRightFax, SRFax, or another secure fax platform is failing, stuck in queue, or returning failed transmission notices.\n\n## What's happening (1-line cause)\n\nThe failure may be a service outage, bad destination, authentication issue, connector issue, or fax line/provider problem.\n\n## Fix - try these in order\n\n### 1. Check service and queue status\n\nReview the admin dashboard for outage banners, failed queues, connector health, and recent error codes.\n\n**Escalation:** if platform-wide errors or connector failures appear, go to step 3.\n\n### 2. Validate one safe test send\n\nSend a non-ePHI test page to an approved internal test destination and confirm send and receive status.\n\n**Escalation:** if the test fails, go to step 3.\n\n### 3. Isolate destination versus platform\n\nCompare failures by destination, sender, queue, connector, and time window using metadata only.\n\n**Escalation:** open a HIPAA-aware vendor ticket with RightFax or SRFax plus IT messaging/network support.\n\n## Compliance reminder\n\nDo not attach faxed clinical documents to vendor tickets. Use job IDs, timestamps, destination organization, and redacted logs. HIPAA minimum necessary rules apply to fax troubleshooting.\n\n## Related entries\n\n- [[l2-fax-001-secure-fax-failover-explain]]\n- [[l2-hipaa-004-business-associate-agreement-checklist]]"
  },
  {
   "slug": "l2-hipaa-001-suspected-ePHI-email-leak",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-hipaa-001-suspected-ePHI-email-leak.md",
   "title": "\"Suspected ePHI email leak\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.EPHI",
    "EMAIL.LEAK",
    "SECURITY.INCIDENT"
   ],
   "keywords": [
    "hipaa",
    "ephi",
    "email",
    "leak",
    "breach"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Suspected ePHI email leak\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.EPHI, EMAIL.LEAK, SECURITY.INCIDENT]\nkeywords: [hipaa, ephi, email, leak, breach]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA user may have emailed ePHI to the wrong recipient, external address, or unapproved mailbox.\n\n## What's happening (1-line cause)\n\nPotential HIPAA exposure exists until privacy, security, and mail administrators confirm scope and containment.\n\n## Fix - try these in order\n\n### 1. Preserve the evidence without forwarding it\n\nRecord sender, recipient, subject, timestamp, and message ID if available, but do not forward the message or copy ePHI into a new ticket.\n\n**Escalation:** if any external recipient is involved, go to step 2 immediately.\n\n### 2. Start containment\n\nAsk the mail administrator to attempt message recall or purge where supported, block auto-forwarding if relevant, and preserve mailbox audit logs.\n\n**Escalation:** if the message left the organization or cannot be recalled, go to step 3.\n\n### 3. Notify the privacy officer workflow\n\nRoute the incident to the HIPAA privacy or compliance owner with the minimum metadata needed for breach assessment.\n\n**Escalation:** open a formal security incident with privacy officer, legal/compliance, and email administrator ownership.\n\n## Compliance reminder\n\nHIPAA breach analysis must follow the organization's privacy process. Do not promise breach status, notification timing, or legal conclusions in the IT ticket. Keep ePHI out of screenshots, comments, and unencrypted attachments.\n\n## Related entries\n\n- [[l2-hipaa-004-business-associate-agreement-checklist]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l2-hipaa-002-lost-laptop-with-ePHI",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-hipaa-002-lost-laptop-with-ePHI.md",
   "title": "\"Lost laptop with possible ePHI\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.EPHI",
    "DEVICE.LOST",
    "ENDPOINT.ENCRYPTION"
   ],
   "keywords": [
    "hipaa",
    "lost laptop",
    "ephi",
    "encryption",
    "intune"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Lost laptop with possible ePHI\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.EPHI, DEVICE.LOST, ENDPOINT.ENCRYPTION]\nkeywords: [hipaa, lost laptop, ephi, encryption, intune]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA laptop used for clinical or administrative work is lost, stolen, or unaccounted for and may contain ePHI.\n\n## What's happening (1-line cause)\n\nHIPAA risk depends on encryption status, device management state, last check-in, and whether ePHI was stored locally.\n\n## Fix - try these in order\n\n### 1. Capture the minimum facts\n\nRecord asset tag, user, last known location, last seen time, and whether the device was powered on, without documenting patient details.\n\n**Escalation:** if theft is possible or the device contains clinical data, go to step 2 immediately.\n\n### 2. Check management and encryption state\n\nVerify BitLocker or FileVault status, MDM enrollment, last check-in, remote lock or wipe availability, and sign-in audit events.\n\n**Escalation:** if encryption cannot be proven, go to step 3.\n\n### 3. Execute approved containment\n\nUse the approved MDM process to lock, wipe, revoke sessions, rotate exposed credentials, and preserve audit evidence.\n\n**Escalation:** open a formal HIPAA security incident with privacy/compliance, endpoint, and identity owners.\n\n## Compliance reminder\n\nDo not decide breach status inside the help desk ticket. HIPAA reporting decisions belong to the privacy process. Keep evidence in approved encrypted systems and log every remote action taken.\n\n## Related entries\n\n- [[l1-security-001-lost-stolen-device]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l2-hipaa-003-mfa-recovery-for-clinical-staff",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-hipaa-003-mfa-recovery-for-clinical-staff.md",
   "title": "\"MFA recovery for clinical staff\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.ACCESS",
    "LOGIN.MFA",
    "IDENTITY.RECOVERY"
   ],
   "keywords": [
    "hipaa",
    "mfa",
    "authenticator",
    "clinical staff",
    "recovery"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"MFA recovery for clinical staff\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.ACCESS, LOGIN.MFA, IDENTITY.RECOVERY]\nkeywords: [hipaa, mfa, authenticator, clinical staff, recovery]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA clinician cannot complete MFA because the phone, authenticator app, or registered method is unavailable.\n\n## What's happening (1-line cause)\n\nIdentity recovery must restore access quickly while preserving HIPAA access controls and auditability.\n\n## Fix - try these in order\n\n### 1. Verify identity through approved workflow\n\nUse the organization's identity proofing process, such as manager verification, badge check, or approved service desk callback.\n\n**Escalation:** if identity cannot be verified in the approved workflow, stop and go to step 3.\n\n### 2. Re-register MFA safely\n\nIn the identity admin portal, require re-registration, remove stale methods, and guide the user through the approved authenticator setup link.\n\n**Escalation:** if the account shows risky sign-in activity, go to step 3.\n\n### 3. Check for account compromise indicators\n\nReview recent sign-ins, impossible travel, unfamiliar devices, forwarding rules, and privileged group changes.\n\n**Escalation:** open a HIPAA security review ticket with identity/security if recovery involves suspicious activity or emergency bypass.\n\n## Compliance reminder\n\nHIPAA access controls require unique user access and traceable authentication changes. Do not share temporary codes in group chat. Log the requester, approver, admin, and exact access change.\n\n## Related entries\n\n- [[l1-mfa-001-setup-recovery]]\n- [[l2-hipaa-001-suspected-ePHI-email-leak]]"
  },
  {
   "slug": "l2-hipaa-004-business-associate-agreement-checklist",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-hipaa-004-business-associate-agreement-checklist.md",
   "title": "\"Business Associate Agreement checklist\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.BAA",
    "VENDOR.RISK",
    "COMPLIANCE.REVIEW"
   ],
   "keywords": [
    "hipaa",
    "baa",
    "business associate",
    "vendor",
    "checklist"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Business Associate Agreement checklist\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.BAA, VENDOR.RISK, COMPLIANCE.REVIEW]\nkeywords: [hipaa, baa, business associate, vendor, checklist]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA team wants to use a vendor, app, consultant, or support provider that may access ePHI.\n\n## What's happening (1-line cause)\n\nHIPAA may require a Business Associate Agreement before the vendor can receive, process, store, or support ePHI.\n\n## Fix - try these in order\n\n### 1. Identify the ePHI touchpoint\n\nDocument what data the vendor can see, store, transmit, support, or administer, using data categories rather than real records.\n\n**Escalation:** if the vendor touches ePHI in any way, go to step 2.\n\n### 2. Confirm BAA and security review status\n\nCheck whether a signed BAA exists, who approved it, renewal date, security questionnaire status, and subcontractor language.\n\n**Escalation:** if no signed BAA exists, go to step 3.\n\n### 3. Block production ePHI until approved\n\nKeep the vendor in demo or synthetic-data mode until legal/compliance approves the BAA and security controls.\n\n**Escalation:** open a HIPAA vendor-risk ticket with procurement, compliance, legal, and system owner review.\n\n## Compliance reminder\n\nDo not send production ePHI to a vendor before the approved agreement and security review are in place. IT can document technical scope, but BAA approval belongs to compliance/legal.\n\n## Related entries\n\n- [[l2-hipaa-001-suspected-ePHI-email-leak]]\n- [[l2-hipaa-005-encryption-at-rest-audit]]"
  },
  {
   "slug": "l2-hipaa-005-encryption-at-rest-audit",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-hipaa-005-encryption-at-rest-audit.md",
   "title": "\"Encryption at rest audit\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.SECURITY",
    "ENCRYPTION.AUDIT",
    "DEVICE.COMPLIANCE"
   ],
   "keywords": [
    "hipaa",
    "encryption",
    "bitlocker",
    "filevault",
    "audit"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Encryption at rest audit\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.SECURITY, ENCRYPTION.AUDIT, DEVICE.COMPLIANCE]\nkeywords: [hipaa, encryption, bitlocker, filevault, audit]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nIT needs to prove whether devices or systems storing ePHI are encrypted at rest.\n\n## What's happening (1-line cause)\n\nHIPAA security evidence depends on verifiable encryption state, scope, exceptions, and remediation records.\n\n## Fix - try these in order\n\n### 1. Define the audit scope\n\nList device groups, servers, databases, storage buckets, backup locations, and owners, without exporting actual ePHI.\n\n**Escalation:** if the scope includes unmanaged assets, go to step 2.\n\n### 2. Pull technical evidence\n\nExport BitLocker, FileVault, MDM, cloud storage, database, and backup encryption status from approved admin consoles.\n\n**Escalation:** if any asset lacks encryption proof, go to step 3.\n\n### 3. Open remediation for gaps\n\nAssign each gap an owner, due date, compensating control, and validation step.\n\n**Escalation:** open a HIPAA risk register item if ePHI is stored on unencrypted or unmanaged systems.\n\n## Compliance reminder\n\nDo not export patient data for an encryption audit. Store audit evidence in an approved restricted folder. HIPAA documentation should show control state, remediation, approval, and review date.\n\n## Related entries\n\n- [[l2-hipaa-002-lost-laptop-with-ePHI]]\n- [[l2-hipaa-004-business-associate-agreement-checklist]]"
  },
  {
   "slug": "l2-patient-portal-001-mychart-account-locked",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-patient-portal-001-mychart-account-locked.md",
   "title": "\"MyChart account locked\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.PORTAL",
    "ACCOUNT.LOCKED",
    "IDENTITY.RECOVERY"
   ],
   "keywords": [
    "hipaa",
    "mychart",
    "locked",
    "account",
    "portal"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"MyChart account locked\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.PORTAL, ACCOUNT.LOCKED, IDENTITY.RECOVERY]\nkeywords: [hipaa, mychart, locked, account, portal]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA MyChart or patient portal account is locked after repeated sign-in attempts or failed recovery.\n\n## What's happening (1-line cause)\n\nThe portal is protecting access to ePHI until identity recovery is completed through an approved workflow.\n\n## Fix - try these in order\n\n### 1. Confirm approved support route\n\nDirect the user to the provider's official portal support number, portal link, or in-clinic identity verification process.\n\n**Escalation:** if the user cannot verify identity through the standard route, go to step 3.\n\n### 2. Reset using portal tools\n\nHave authorized portal support unlock or reset the account only after approved identity verification.\n\n**Escalation:** if unlock fails or identity data appears mismatched, go to step 3.\n\n### 3. Check duplicate or merged records\n\nAsk authorized portal support to verify whether duplicate records, merged accounts, or outdated contact details are blocking recovery.\n\n**Escalation:** open a HIPAA-aware portal support ticket with clinic IT and the portal vendor if identity mapping needs correction.\n\n## Compliance reminder\n\nHIPAA access safeguards apply to patient portal recovery. Do not disclose account status to unverified callers. Record the recovery action and keep patient details out of general IT notes.\n\n## Related entries\n\n- [[l1-emr-001-epic-mychart-login-issues]]\n- [[l2-patient-portal-002-portal-mfa-recovery-no-email]]"
  },
  {
   "slug": "l2-patient-portal-002-portal-mfa-recovery-no-email",
   "path_rel": "knowledge-base\\vertical-healthcare\\l2-patient-portal-002-portal-mfa-recovery-no-email.md",
   "title": "\"Patient portal MFA recovery when email is unavailable\"",
   "vertical": "healthcare",
   "tier": "l2",
   "intent_codes": [
    "HIPAA.PORTAL",
    "LOGIN.MFA",
    "EMAIL.RECOVERY"
   ],
   "keywords": [
    "hipaa",
    "patient portal",
    "mfa",
    "recovery",
    "email"
   ],
   "compliance": [
    "HIPAA",
    "HITECH"
   ],
   "content": "---\ntitle: \"Patient portal MFA recovery when email is unavailable\"\nvertical: healthcare\ntier: l2\nintent_codes: [HIPAA.PORTAL, LOGIN.MFA, EMAIL.RECOVERY]\nkeywords: [hipaa, patient portal, mfa, recovery, email]\ncompliance: [HIPAA, HITECH]\ncreated: 2026-06-18\nescalation_default: human\n---\n\n## Symptom\n\nA portal user cannot receive MFA or recovery email because the mailbox is inaccessible or outdated.\n\n## What's happening (1-line cause)\n\nThe portal must re-establish identity and contact method control before restoring access to ePHI.\n\n## Fix - try these in order\n\n### 1. Try alternate registered methods\n\nUse the portal's approved SMS, authenticator, phone, or backup recovery option if it is already registered.\n\n**Escalation:** if no registered method works, go to step 2.\n\n### 2. Use official identity verification\n\nRoute the user through clinic-approved identity verification before changing recovery email or MFA method.\n\n**Escalation:** if identity cannot be verified remotely, go to step 3.\n\n### 3. Update recovery details through authorized staff\n\nHave authorized portal support update recovery contact details only after verification and document the change.\n\n**Escalation:** open a HIPAA portal access ticket with clinic IT, portal support, and privacy owner if recovery is disputed.\n\n## Compliance reminder\n\nHIPAA requires reasonable identity verification before portal access changes. Do not accept email-only proof for sensitive recovery. Log who approved the change, what changed, and when.\n\n## Related entries\n\n- [[l2-patient-portal-001-mychart-account-locked]]\n- [[l2-hipaa-003-mfa-recovery-for-clinical-staff]]"
  },
  {
   "slug": "l1-courtfile-001-pacer-cmecf-rejected-filing",
   "path_rel": "knowledge-base\\vertical-legal\\l1-courtfile-001-pacer-cmecf-rejected-filing.md",
   "title": "PACER CM/ECF rejected filing",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "PACER",
    "FILING"
   ],
   "keywords": [
    "legal",
    "law firm",
    "courtfiling"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: PACER CM/ECF rejected filing\nvertical: legal\ntier: l1\nintent_codes: [PACER,FILING]\nkeywords: [legal, law firm, courtfiling]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nPACER CM/ECF rejected filing — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in court-filing category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open court-filing dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most court-filing tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-courtfile-002-canlii-document-cannot-download",
   "path_rel": "knowledge-base\\vertical-legal\\l1-courtfile-002-canlii-document-cannot-download.md",
   "title": "CanLII document cannot download",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "CANLII",
    "DOWNLOAD"
   ],
   "keywords": [
    "legal",
    "law firm",
    "courtfiling"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: CanLII document cannot download\nvertical: legal\ntier: l1\nintent_codes: [CANLII,DOWNLOAD]\nkeywords: [legal, law firm, courtfiling]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nCanLII document cannot download — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in court-filing category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open court-filing dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most court-filing tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-doc-001-docassemble-template-missing-fields",
   "path_rel": "knowledge-base\\vertical-legal\\l1-doc-001-docassemble-template-missing-fields.md",
   "title": "DocAssemble template missing fields",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "DOCASSEMBLE",
    "TEMPLATE"
   ],
   "keywords": [
    "legal",
    "law firm",
    "docautomation"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: DocAssemble template missing fields\nvertical: legal\ntier: l1\nintent_codes: [DOCASSEMBLE,TEMPLATE]\nkeywords: [legal, law firm, docautomation]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nDocAssemble template missing fields — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in doc-automation category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open doc-automation dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most doc-automation tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-doc-002-pdf-form-fields-not-saving",
   "path_rel": "knowledge-base\\vertical-legal\\l1-doc-002-pdf-form-fields-not-saving.md",
   "title": "Acrobat PDF form fields not saving on close",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "ACROBAT",
    "FORM"
   ],
   "keywords": [
    "legal",
    "law firm",
    "docautomation"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Acrobat PDF form fields not saving on close\nvertical: legal\ntier: l1\nintent_codes: [ACROBAT,FORM]\nkeywords: [legal, law firm, docautomation]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nAcrobat PDF form fields not saving on close — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in doc-automation category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open doc-automation dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most doc-automation tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-ediscovery-001-relativity-import-stuck",
   "path_rel": "knowledge-base\\vertical-legal\\l1-ediscovery-001-relativity-import-stuck.md",
   "title": "Relativity import job stuck at 0 percent",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "RELATIVITY",
    "IMPORT"
   ],
   "keywords": [
    "legal",
    "law firm",
    "ediscovery"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Relativity import job stuck at 0 percent\nvertical: legal\ntier: l1\nintent_codes: [RELATIVITY,IMPORT]\nkeywords: [legal, law firm, ediscovery]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nRelativity import job stuck at 0 percent — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in ediscovery category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open ediscovery dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most ediscovery tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-ediscovery-002-everlaw-search-returns-zero-hits",
   "path_rel": "knowledge-base\\vertical-legal\\l1-ediscovery-002-everlaw-search-returns-zero-hits.md",
   "title": "Everlaw search returns zero hits for known terms",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "EVERLAW",
    "SEARCH"
   ],
   "keywords": [
    "legal",
    "law firm",
    "ediscovery"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Everlaw search returns zero hits for known terms\nvertical: legal\ntier: l1\nintent_codes: [EVERLAW,SEARCH]\nkeywords: [legal, law firm, ediscovery]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nEverlaw search returns zero hits for known terms — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in ediscovery category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open ediscovery dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most ediscovery tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-pms-001-clio-login-issues",
   "path_rel": "knowledge-base\\vertical-legal\\l1-pms-001-clio-login-issues.md",
   "title": "Clio practice management login issues",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "CLIO",
    "PMS"
   ],
   "keywords": [
    "legal",
    "law firm",
    "pms"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Clio practice management login issues\nvertical: legal\ntier: l1\nintent_codes: [CLIO,PMS]\nkeywords: [legal, law firm, pms]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nClio practice management login issues — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in pms category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open pms dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most pms tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-pms-002-leap-document-locked-by-another-user",
   "path_rel": "knowledge-base\\vertical-legal\\l1-pms-002-leap-document-locked-by-another-user.md",
   "title": "LEAP document locked by another user",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "LEAP",
    "DOC.LOCK"
   ],
   "keywords": [
    "legal",
    "law firm",
    "pms"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: LEAP document locked by another user\nvertical: legal\ntier: l1\nintent_codes: [LEAP,DOC.LOCK]\nkeywords: [legal, law firm, pms]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nLEAP document locked by another user — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in pms category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open pms dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most pms tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-pms-003-mycase-calendar-sync-fail",
   "path_rel": "knowledge-base\\vertical-legal\\l1-pms-003-mycase-calendar-sync-fail.md",
   "title": "MyCase calendar sync to Outlook fails",
   "vertical": "legal",
   "tier": "l1",
   "intent_codes": [
    "MYCASE",
    "CAL.SYNC"
   ],
   "keywords": [
    "legal",
    "law firm",
    "pms"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: MyCase calendar sync to Outlook fails\nvertical: legal\ntier: l1\nintent_codes: [MYCASE,CAL.SYNC]\nkeywords: [legal, law firm, pms]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: self_serve\n---\n\n## Symptom\n\nMyCase calendar sync to Outlook fails — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in pms category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open pms dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most pms tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-conflict-001-conflict-check-database-down",
   "path_rel": "knowledge-base\\vertical-legal\\l2-conflict-001-conflict-check-database-down.md",
   "title": "Conflict-check database down before matter intake",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "CONFLICT",
    "DB.DOWN"
   ],
   "keywords": [
    "legal",
    "law firm",
    "conflict"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Conflict-check database down before matter intake\nvertical: legal\ntier: l2\nintent_codes: [CONFLICT,DB.DOWN]\nkeywords: [legal, law firm, conflict]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nConflict-check database down before matter intake — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in conflict category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open conflict dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most conflict tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-privilege-001-accidental-cc-of-opposing-counsel",
   "path_rel": "knowledge-base\\vertical-legal\\l2-privilege-001-accidental-cc-of-opposing-counsel.md",
   "title": "Accidental cc of opposing counsel on privileged email",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "PRIV.LEAK",
    "EMAIL"
   ],
   "keywords": [
    "legal",
    "law firm",
    "privilege"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Accidental cc of opposing counsel on privileged email\nvertical: legal\ntier: l2\nintent_codes: [PRIV.LEAK,EMAIL]\nkeywords: [legal, law firm, privilege]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nAccidental cc of opposing counsel on privileged email — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in privilege category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open privilege dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most privilege tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-privilege-002-shared-drive-found-by-paralegal-outside-matter",
   "path_rel": "knowledge-base\\vertical-legal\\l2-privilege-002-shared-drive-found-by-paralegal-outside-matter.md",
   "title": "Shared drive folder accessible to paralegal outside the matter",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "PRIV.ACCESS",
    "SHAREPOINT"
   ],
   "keywords": [
    "legal",
    "law firm",
    "privilege"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Shared drive folder accessible to paralegal outside the matter\nvertical: legal\ntier: l2\nintent_codes: [PRIV.ACCESS,SHAREPOINT]\nkeywords: [legal, law firm, privilege]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nShared drive folder accessible to paralegal outside the matter — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in privilege category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open privilege dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most privilege tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-privilege-003-cloud-backup-jurisdiction-question",
   "path_rel": "knowledge-base\\vertical-legal\\l2-privilege-003-cloud-backup-jurisdiction-question.md",
   "title": "Cloud backup jurisdiction question (Canadian data, US backups)",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "JURISDICTION",
    "DATA"
   ],
   "keywords": [
    "legal",
    "law firm",
    "privilege"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Cloud backup jurisdiction question (Canadian data, US backups)\nvertical: legal\ntier: l2\nintent_codes: [JURISDICTION,DATA]\nkeywords: [legal, law firm, privilege]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nCloud backup jurisdiction question (Canadian data, US backups) — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in privilege category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open privilege dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most privilege tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-time-001-timesolv-billing-export-corrupted",
   "path_rel": "knowledge-base\\vertical-legal\\l2-time-001-timesolv-billing-export-corrupted.md",
   "title": "TimeSolv billing export corrupted, month-end at risk",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "TIMESOLV",
    "EXPORT"
   ],
   "keywords": [
    "legal",
    "law firm",
    "billing"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: TimeSolv billing export corrupted, month-end at risk\nvertical: legal\ntier: l2\nintent_codes: [TIMESOLV,EXPORT]\nkeywords: [legal, law firm, billing]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nTimeSolv billing export corrupted, month-end at risk — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in billing category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open billing dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most billing tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l2-trust-001-trust-accounting-software-balance-mismatch",
   "path_rel": "knowledge-base\\vertical-legal\\l2-trust-001-trust-accounting-software-balance-mismatch.md",
   "title": "Trust accounting software balance mismatch (compliance critical)",
   "vertical": "legal",
   "tier": "l2",
   "intent_codes": [
    "TRUST.ACCT",
    "RECONCILE"
   ],
   "keywords": [
    "legal",
    "law firm",
    "billing"
   ],
   "compliance": [
    "privilege",
    "retention",
    "model_rules"
   ],
   "content": "---\ntitle: Trust accounting software balance mismatch (compliance critical)\nvertical: legal\ntier: l2\nintent_codes: [TRUST.ACCT,RECONCILE]\nkeywords: [legal, law firm, billing]\ncompliance: [privilege, retention, model_rules]\ncreated: 2026-06-18\nescalation_default: partner_referral\n---\n\n## Symptom\n\nTrust accounting software balance mismatch (compliance critical) — interrupts billable work, may have privilege/ethics implications if mishandled.\n\n## What is happening (1-line cause)\n\nConfiguration, sync, or permissions issue in billing category. Most commonly a stale credential, expired token, or platform-side outage.\n\n## Fix — try these in order\n\n### 1. Reproduce + scope\n\nConfirm the issue affects all users or just one. Open billing dashboard / status page if available. Capture exact error text and the matter/file ID involved.\n\n**Escalation:** if multiple users affected, this is a tenant-wide incident — log to /aria-tenant-audit and escalate.\n\n### 2. Standard reset path\n\nFor most billing tools: log out fully, clear browser cache for the vendor domain, sign back in. If desktop app: kill process, restart. If a cloud sync: pause and resume.\n\n**Escalation:** if step 2 does not resolve in 10 min, vendor ticket required.\n\n### 3. Vendor ticket + interim workaround\n\nOpen a ticket with the vendor (Clio / LEAP / Relativity / etc.) with reproduction steps. Provide screen recording NOT screenshot (privilege exposure risk in screenshots that show case captions). Use a generic test matter for the recording.\n\n**Escalation:** if work is time-sensitive (court deadline, statute of limitations approaching), notify managing partner immediately.\n\n## Privilege + ethics reminder\n\nAny troubleshooting that exposes case content (file names, party names, matter notes, privileged communications) must:\n- Be performed by a person authorized to see that matter\n- Avoid screenshots that capture client-identifying or privileged content\n- Avoid sharing logs containing case data with vendor support without redaction\n- Document the troubleshooting in the matter file per firm policy\n- For trust accounting issues specifically: do not adjust balances; freeze and escalate to firm's compliance officer\n\nCross-border data: if the firm has Canadian or EU clients, ensure any cloud backup or screen-share session keeps data in-region per applicable rules (PIPEDA, GDPR, provincial Law Society rules).\n\n## Related entries\n\n- [[l2-privilege-001-accidental-cc-of-opposing-counsel]]\n- [[l2-privilege-002-shared-drive-found-by-paralegal-outside-matter]]\n- [[l2-conflict-001-conflict-check-database-down]]"
  },
  {
   "slug": "l1-ot-001",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l1-ot-001.md",
   "title": "Shop-floor barcode scanner cannot submit jobs",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "barcode scanner",
    "mes",
    "shop floor"
   ],
   "compliance": [],
   "content": "---\ntitle: Shop-floor barcode scanner cannot submit jobs\ncategory: manufacturing\nsupport_level: L1\nseverity: medium\naudience: manufacturing-it\nkeywords: [barcode scanner, mes, shop floor]\ncreated: 2026-06-18\nescalation_trigger: Multiple scanners fail or production line is blocked.\n---\n# Shop-floor barcode scanner cannot submit jobs\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: barcode scanner, mes, shop floor.\n\n## What ARIA should do first\n\nCheck cradle, Wi-Fi SSID, battery, profile, MES URL, and avoid changing PLC or machine controls.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Multiple scanners fail or production line is blocked.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-ot-001."
  },
  {
   "slug": "l1-ot-002",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l1-ot-002.md",
   "title": "Label printer missing production template",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "label printer",
    "zebra",
    "template"
   ],
   "compliance": [],
   "content": "---\ntitle: Label printer missing production template\ncategory: manufacturing\nsupport_level: L1\nseverity: medium\naudience: manufacturing-it\nkeywords: [label printer, zebra, template]\ncreated: 2026-06-18\nescalation_trigger: Wrong labels can ship product or break traceability.\n---\n# Label printer missing production template\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: label printer, zebra, template.\n\n## What ARIA should do first\n\nPause affected print queue, confirm template version, test on blank stock, and escalate before production relabel.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Wrong labels can ship product or break traceability.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-ot-002."
  },
  {
   "slug": "l1-ot-003",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l1-ot-003.md",
   "title": "Operator kiosk stuck after Windows update",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "operator kiosk",
    "windows update",
    "production"
   ],
   "compliance": [],
   "content": "---\ntitle: Operator kiosk stuck after Windows update\ncategory: manufacturing\nsupport_level: L1\nseverity: high\naudience: manufacturing-it\nkeywords: [operator kiosk, windows update, production]\ncreated: 2026-06-18\nescalation_trigger: Kiosk controls production workflow or line is down.\n---\n# Operator kiosk stuck after Windows update\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: operator kiosk, windows update, production.\n\n## What ARIA should do first\n\nRestart kiosk, verify autologon shell, check assigned access, and use rollback only with supervisor approval.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Kiosk controls production workflow or line is down.\n\n## Support tier\n\nDefault tier: L1. Default severity: high. Article ID: l1-ot-003."
  },
  {
   "slug": "l1-ot-004",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l1-ot-004.md",
   "title": "MES terminal loses session every few minutes",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "mes",
    "terminal",
    "session"
   ],
   "compliance": [],
   "content": "---\ntitle: MES terminal loses session every few minutes\ncategory: manufacturing\nsupport_level: L1\nseverity: medium\naudience: manufacturing-it\nkeywords: [mes, terminal, session]\ncreated: 2026-06-18\nescalation_trigger: Several terminals lose sessions at once.\n---\n# MES terminal loses session every few minutes\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: mes, terminal, session.\n\n## What ARIA should do first\n\nCheck local network, browser storage, time sync, proxy, and idle-timeout policy.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Several terminals lose sessions at once.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-ot-004."
  },
  {
   "slug": "l1-ot-005",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l1-ot-005.md",
   "title": "Warehouse handheld cannot sync inventory",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "warehouse",
    "handheld",
    "inventory"
   ],
   "compliance": [],
   "content": "---\ntitle: Warehouse handheld cannot sync inventory\ncategory: manufacturing\nsupport_level: L1\nseverity: medium\naudience: manufacturing-it\nkeywords: [warehouse, handheld, inventory]\ncreated: 2026-06-18\nescalation_trigger: Sync errors affect stock counts or shipping cut-off.\n---\n# Warehouse handheld cannot sync inventory\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: warehouse, handheld, inventory.\n\n## What ARIA should do first\n\nConfirm network, app version, offline queue, device clock, and WMS endpoint reachability.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Sync errors affect stock counts or shipping cut-off.\n\n## Support tier\n\nDefault tier: L1. Default severity: medium. Article ID: l1-ot-005."
  },
  {
   "slug": "l2-ics-001",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-001.md",
   "title": "PLC programming workstation cannot reach controller",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "plc",
    "controller",
    "ics"
   ],
   "compliance": [],
   "content": "---\ntitle: PLC programming workstation cannot reach controller\ncategory: manufacturing\nsupport_level: L2\nseverity: critical\naudience: manufacturing-it\nkeywords: [plc, controller, ics]\ncreated: 2026-06-18\nescalation_trigger: Controller or production cell may be down.\n---\n# PLC programming workstation cannot reach controller\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: plc, controller, ics.\n\n## What ARIA should do first\n\nDo not change ladder logic. Verify maintenance window, network path, engineering workstation firewall, and escalation owner.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Controller or production cell may be down.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ics-001."
  },
  {
   "slug": "l2-ics-002",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-002.md",
   "title": "HMI screen freezes during production run",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "hmi",
    "scada",
    "production"
   ],
   "compliance": [],
   "content": "---\ntitle: HMI screen freezes during production run\ncategory: manufacturing\nsupport_level: L2\nseverity: critical\naudience: manufacturing-it\nkeywords: [hmi, scada, production]\ncreated: 2026-06-18\nescalation_trigger: Operator cannot view or control process state.\n---\n# HMI screen freezes during production run\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: hmi, scada, production.\n\n## What ARIA should do first\n\nEscalate immediately to OT owner, capture time and screen, verify redundant station, and avoid reboot unless supervisor approves.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Operator cannot view or control process state.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ics-002."
  },
  {
   "slug": "l2-ics-003",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-003.md",
   "title": "SCADA historian stops collecting tags",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "scada",
    "historian",
    "tags"
   ],
   "compliance": [],
   "content": "---\ntitle: SCADA historian stops collecting tags\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [scada, historian, tags]\ncreated: 2026-06-18\nescalation_trigger: Batch traceability, quality, or compliance records are affected.\n---\n# SCADA historian stops collecting tags\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: scada, historian, tags.\n\n## What ARIA should do first\n\nCheck historian service, disk, license, tag source, and notify QA if records are missing.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Batch traceability, quality, or compliance records are affected.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-003."
  },
  {
   "slug": "l2-ics-004",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-004.md",
   "title": "OT network switch shows port flapping",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ot network",
    "switch",
    "port flapping"
   ],
   "compliance": [],
   "content": "---\ntitle: OT network switch shows port flapping\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [ot network, switch, port flapping]\ncreated: 2026-06-18\nescalation_trigger: Flapping port connects safety, PLC, HMI, or line equipment.\n---\n# OT network switch shows port flapping\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: ot network, switch, port flapping.\n\n## What ARIA should do first\n\nIdentify port owner, avoid blind shutdown, inspect cable/transceiver, and coordinate with production lead.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Flapping port connects safety, PLC, HMI, or line equipment.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-004."
  },
  {
   "slug": "l2-ics-005",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-005.md",
   "title": "Vendor remote access requested for machine support",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "vendor remote access",
    "ot",
    "support"
   ],
   "compliance": [],
   "content": "---\ntitle: Vendor remote access requested for machine support\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [vendor remote access, ot, support]\ncreated: 2026-06-18\nescalation_trigger: Vendor wants unattended or broad access.\n---\n# Vendor remote access requested for machine support\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: vendor remote access, ot, support.\n\n## What ARIA should do first\n\nRequire approval, time-bound access, MFA, session recording if allowed, and least-privilege route through approved jump host.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Vendor wants unattended or broad access.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-005."
  },
  {
   "slug": "l2-ics-006",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-006.md",
   "title": "Unapproved USB device found on engineering station",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "usb",
    "engineering station",
    "security"
   ],
   "compliance": [],
   "content": "---\ntitle: Unapproved USB device found on engineering station\ncategory: manufacturing\nsupport_level: L2\nseverity: critical\naudience: manufacturing-it\nkeywords: [usb, engineering station, security]\ncreated: 2026-06-18\nescalation_trigger: Unknown media touched OT or engineering workstation.\n---\n# Unapproved USB device found on engineering station\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: usb, engineering station, security.\n\n## What ARIA should do first\n\nDisconnect network if policy allows, preserve device, do not browse files, notify security/OT owner, and collect host details.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Unknown media touched OT or engineering workstation.\n\n## Support tier\n\nDefault tier: L2. Default severity: critical. Article ID: l2-ics-006."
  },
  {
   "slug": "l2-ics-007",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-007.md",
   "title": "Patch reboot risk on production workstation",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "patching",
    "reboot",
    "production"
   ],
   "compliance": [],
   "content": "---\ntitle: Patch reboot risk on production workstation\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [patching, reboot, production]\ncreated: 2026-06-18\nescalation_trigger: Pending reboot may interrupt production.\n---\n# Patch reboot risk on production workstation\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: patching, reboot, production.\n\n## What ARIA should do first\n\nConfirm maintenance window, suppress automatic restart where policy allows, notify production owner, and document exception.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Pending reboot may interrupt production.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-007."
  },
  {
   "slug": "l2-ics-008",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-008.md",
   "title": "Quality station cannot upload inspection results",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "quality station",
    "inspection",
    "upload"
   ],
   "compliance": [],
   "content": "---\ntitle: Quality station cannot upload inspection results\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [quality station, inspection, upload]\ncreated: 2026-06-18\nescalation_trigger: Quality records are blocked or batch release is delayed.\n---\n# Quality station cannot upload inspection results\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: quality station, inspection, upload.\n\n## What ARIA should do first\n\nCheck app queue, database connectivity, credentials, disk, and QA approval for any manual upload.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Quality records are blocked or batch release is delayed.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-008."
  },
  {
   "slug": "l2-ics-009",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-009.md",
   "title": "Time sync drift between OT systems",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "ntp",
    "time sync",
    "ot"
   ],
   "compliance": [],
   "content": "---\ntitle: Time sync drift between OT systems\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [ntp, time sync, ot]\ncreated: 2026-06-18\nescalation_trigger: Traceability timestamps or batch records disagree.\n---\n# Time sync drift between OT systems\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: ntp, time sync, ot.\n\n## What ARIA should do first\n\nCompare NTP source, domain time, isolated OT time server, and historian timestamps before correcting clocks.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Traceability timestamps or batch records disagree.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-009."
  },
  {
   "slug": "l2-ics-010",
   "path_rel": "knowledge-base\\vertical-manufacturing\\l2-ics-010.md",
   "title": "ERP to MES order feed delayed",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [
    "erp",
    "mes",
    "order feed"
   ],
   "compliance": [],
   "content": "---\ntitle: ERP to MES order feed delayed\ncategory: manufacturing\nsupport_level: L2\nseverity: high\naudience: manufacturing-it\nkeywords: [erp, mes, order feed]\ncreated: 2026-06-18\nescalation_trigger: Production orders are missing or duplicated.\n---\n# ERP to MES order feed delayed\n\n## Symptom\n\nThe requester reports a manufacturing support issue that matches: erp, mes, order feed.\n\n## What ARIA should do first\n\nCheck integration queue, middleware errors, order IDs, and do not replay messages without production approval.\n\n## Guardrails\n\n- Collect only the minimum operational details needed to troubleshoot.\n- Do not expose student, patient, employee, or production records in screenshots or notes.\n- Do not make privileged changes, production changes, legal claims, or vendor submissions without owner approval.\n\n## Escalation\n\nEscalate when: Production orders are missing or duplicated.\n\n## Support tier\n\nDefault tier: L2. Default severity: high. Article ID: l2-ics-010."
  },
  {
   "slug": "l1-vpn-anyconnect-001-cisco-anyconnect-secure-client",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-anyconnect-001-cisco-anyconnect-secure-client.md",
   "title": "\"Cisco AnyConnect / Cisco Secure Client — connect to corporate VPN, step by step\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-anyconnect-001\ntitle: \"Cisco AnyConnect / Cisco Secure Client — connect to corporate VPN, step by step\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\", \"Linux\"]\ntech_generation: current\nyear_range: \"Cisco AnyConnect rebranded to Cisco Secure Client 2022. Both names in use 2026.\"\neol_status: \"Current. Use Cisco Secure Client 5.1+ for current security baseline.\"\nprerequisites: [\"AnyConnect / Secure Client installed\", \"VPN server hostname (e.g., vpn.<company>.com)\", \"Credentials + MFA\"]\nkeywords:\n  - cisco anyconnect\n  - cisco secure client\n  - anyconnect\n  - cisco vpn\n  - asa\n  - cisco firepower\n  - umbrella\n  - duo\nrelated_articles:\n  - l1-vpn-001-cant-connect\n  - l1-vpn-generic-001-when-to-call-vs-self-fix\n  - l1-mfa-001-setup-recovery\nescalation_trigger: \"Connection attempts repeatedly fail with 'login failed' despite correct credentials. Or 'untrusted server certificate' that persists after client update.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Cisco AnyConnect / Cisco Secure Client — connect to corporate VPN\n\n## 1. Symptoms\nUser needs to connect to corporate VPN using Cisco's client. Older docs say \"AnyConnect\"; newer say \"Cisco Secure Client\" — same product since 2022.\n\n## 2. Step-by-Step Connection\n\n### Windows\n\n**Step 1 — Open Cisco Secure Client.**\n- Start menu → search **Cisco Secure Client** (or **Cisco AnyConnect**) → open.\n- *(What you should see: A small panel with a single text field labeled \"Ready to connect\" or similar.)*\n\n**Step 2 — Enter VPN server.**\n- In the text field, type the VPN server hostname IT gave you (e.g., `vpn.<company>.com`).\n- Click **Connect**.\n\n**Step 3 — Sign in.**\n- Username + password in the popup.\n- Some companies use SAML — a browser opens for sign-in.\n- MFA: 6-digit code from token app, OR Duo push (tap **Approve** on phone).\n\n**Step 4 — Confirm connected.**\n- Status panel shows **Connected**.\n- A lock icon appears on the Cisco Secure Client tray icon.\n\n### macOS / iOS / Android / Linux\n\nSame flow. macOS first-time install requires Privacy & Security approval for system extension.\n\n## 3. Common Errors and Fixes\n\n**\"Login failed. The VPN server returned an error.\"**\n- Username format: some servers want `domain\\username` or `username@domain`, others just `username`. Check your IT documentation.\n- Try webmail with same credentials to confirm password.\n\n**\"The secure gateway has rejected the connection attempt — no assigned address\"**\n- VPN pool may be full (rare). Wait 5 min and retry.\n- Account may not be in the right group. Call IT.\n\n**\"Certificate validation failure\"**\n- Update Cisco Secure Client to latest. Run Windows Update for current root CAs.\n\n**Duo push not arriving**\n- Open Duo Mobile app manually → check for pending requests.\n- Make sure phone has data / Wi-Fi.\n- Toggle airplane mode off/on.\n\n**\"Connection attempt failed. Please try again\"**\n- Generic error — retry. If persistent: restart Cisco Secure Client (right-click tray icon → Quit, then reopen).\n\n## 4. Verification Steps\n- Tray icon shows lock / connected indicator.\n- Internal site loads.\n- `ipconfig /all` shows Cisco AnyConnect Virtual Miniport Adapter with company IP.\n\n## 5. When to Call IT\n- Persistent login failures despite correct password.\n- \"No license available\" — Cisco licenses are per-user; IT may need to free one.\n- \"VPN service not running\" — system service issue, IT needs to repair install.\n- Brand new device.\n\n## 6. Prevention Tips\n- Keep client updated (Cisco Secure Client → Settings → Check for Updates).\n- Have Duo / authenticator app ready BEFORE clicking Connect.\n\n## 7. User-Friendly Explanation\nCisco Secure Client (older name \"AnyConnect\") is your VPN. Open it, type your work VPN address, sign in, and approve the prompt on your phone. Once it says \"Connected,\" company sites and apps work the same as if you're at the office.\n\n## 8. Internal Technician Notes\n- Modules: Core VPN, ISE Posture, NAM, Umbrella, AMP Enabler, Network Visibility — install only what's needed.\n- ASA vs Firepower head-end: same client, different config back-end. Some features (e.g., Always-On) require specific licensing tiers.\n- Profile XML deployed via ASDM / FMC and pushed to client on connect. Local edits get overwritten.\n- macOS notarization: Cisco Secure Client signed and notarized. Old AnyConnect builds (4.x) NOT notarized — fail on macOS 14+. Must upgrade.\n- Log location: Win `%PROGRAMDATA%\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Logs\\` (path retained); Mac `~/Library/Logs/Cisco/`.\n- Diagnostic bundle: tray icon → Open Cisco Secure Client → gear icon → Diagnostics → Generate.\n\n## 9. Related KB Articles\n- `l1-vpn-001` — Can't connect generic\n- `l1-vpn-generic-001` — When to call IT\n- `l1-mfa-001` — MFA setup\n\n## 10. Keywords / Search Tags\ncisco anyconnect, cisco secure client, anyconnect, cisco vpn, asa, cisco firepower, umbrella, duo, ise posture, nam, amp enabler"
  },
  {
   "slug": "l1-vpn-generic-001-when-to-call-vs-self-fix",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-generic-001-when-to-call-vs-self-fix.md",
   "title": "\"VPN won't connect — universal triage and when to call IT\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-generic-001\ntitle: \"VPN won't connect — universal triage and when to call IT\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current. Applies to any SSL VPN / IPsec VPN client (Ivanti, Pulse, GlobalProtect, AnyConnect, FortiClient, OpenVPN, Zscaler ZPA, Cloudflare WARP, Tailscale, NordLayer).\"\nprerequisites: [\"VPN client already installed and previously configured\"]\nkeywords:\n  - vpn\n  - vpn not connecting\n  - vpn troubleshooting\n  - call it\n  - escalation\n  - self serve\n  - ssl vpn\n  - ipsec\n  - globalprotect\n  - cisco anyconnect\n  - forticlient\n  - zscaler\n  - cloudflare warp\nrelated_articles:\n  - l1-vpn-001-cant-connect\n  - l1-vpn-ivanti-001-ivanti-secure-access-connect\n  - l1-vpn-mobilepass-001-mobilepass-token-setup\n  - l1-wifi-001-cant-connect\n  - l1-internet-001-no-internet\nescalation_trigger: \"After the 6 self-fix steps below all fail. Or any time the VPN gateway returns 'access denied' / 'policy violation.'\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# VPN won't connect — universal triage and when to call IT\n\n## 1. Symptoms\n\"My VPN won't connect.\" Could be any client: Ivanti Secure Access, Pulse Secure, Cisco AnyConnect, Palo Alto GlobalProtect, FortiClient, Zscaler ZPA, Cloudflare WARP, NordLayer, OpenVPN, Tailscale, custom IPsec.\n\n## 2. Universal Triage (do these IN ORDER)\n\n### Step 1 — Confirm internet works WITHOUT the VPN\n- Open a web browser → load `https://google.com` or `https://www.cloudflare.com`.\n- If those don't load → your internet is broken. Fix that first (see `l1-internet-001`).\n- If those load → continue.\n\n### Step 2 — Restart the VPN client\n- Fully quit the VPN app (don't just close the window — right-click in system tray / menu bar → Quit).\n- Wait 10 seconds.\n- Reopen → try to connect again.\n- *Solves about 30% of VPN issues.*\n\n### Step 3 — Verify you have the right URL / server\n- Check your IT documentation OR a previous connection screenshot.\n- Sign-in URL must be EXACT — typos in `vpn.<company>.com` vs `vpn.<company>.co` fail silently or show generic errors.\n\n### Step 4 — Test on mobile hotspot\n- Turn on your phone's hotspot.\n- Connect your laptop to that hotspot.\n- Try VPN again.\n- **If it works on hotspot but not your home/office Wi-Fi** → your network is the problem: captive portal, ISP DPI, double NAT, or local firewall blocking. See `l1-internet-001` to fix the network OR keep using the hotspot for now.\n- **If it fails on both** → not a network issue. Continue to Step 5.\n\n### Step 5 — Check credentials / MFA\n- Open a company web app (webmail, intranet) → sign in with the SAME credentials → if that fails too, your password is wrong or expired. Reset it.\n- If MFA fails: phone time wrong (Settings → Date & Time → \"Set automatically\"). Wait for next 30-second cycle and retype the new code.\n\n### Step 6 — Update the VPN client\n- VPN app → Help menu → Check for Updates.\n- Install if available → restart computer → try again.\n- *Outdated clients are the silent #1 cause for clients more than 6 months old.*\n\n### Step 7 — Reboot the computer\n- Yes really.\n- *Solves another 10-15% of weird issues after Steps 1-6 fail.*\n\n## 3. When to Call IT (Don't Self-Fix Beyond This Point)\n\n**Call IT if you see any of these:**\n\n| What you see | Why call IT |\n|---|---|\n| \"Your account is locked\" / \"Account locked out\" | IT must unlock from the back-end. Multiple failed attempts triggered this. |\n| \"Access denied — policy violation\" | Conditional access policy (location, device compliance, group membership) is blocking you. Only IT can adjust. |\n| Certificate error that persists after client update | The gateway certificate may be invalid OR your local certificate store is broken — needs IT diagnosis. |\n| \"Token revoked\" or \"Authentication failed\" repeatedly with correct credentials | Token may be removed from the back-end. IT re-enrolls. |\n| Brand new device, never connected, even after install | IT may need to pre-register the device or push a config profile. |\n| Multiple coworkers all have the same problem at the same time | Gateway outage — IT should already know but report it. |\n| You're traveling internationally and VPN suddenly stops working | Some countries block VPN protocols (China, UAE, Iran, Russia). IT can advise on alternative routes. |\n| VPN connects but you can't reach ONE specific internal app | ACL / firewall rule on the gateway. Tell IT exactly which app + the URL or IP. |\n| Repeated MFA fails despite correct codes AND phone time correct | Server-side clock drift OR token de-synced from server. |\n\n## 4. Information To Give IT When You Call\n\nTo save time, have this ready:\n\n1. **Your VPN client name and version** (Help → About).\n2. **Your operating system + version** (Win 11 24H2, macOS 15.2, iOS 18.3, etc.).\n3. **The exact error message you see** (screenshot is best).\n4. **What you've already tried** (Steps 1-7 above).\n5. **What network you're on** (home, office, hotel, mobile hotspot, public Wi-Fi).\n6. **Any recent changes** (new phone, password reset, MFA re-enrollment, new laptop).\n7. **Your username / email** (NEVER your password).\n\n## 5. Information IT Should NEVER Ask You For\n\n- **Your password.** IT never asks for it. Anyone asking for your password is a phishing attempt.\n- **Your MFA code unprompted.** IT may ask you to read a code DURING a verified support call, but never to email it.\n- **Remote control of your screen without verifying who they are first.** Always call IT back on the published number to verify identity.\n\n## 6. Verification Steps After IT Helps You\n- Connection establishes.\n- An internal-only URL loads.\n- File share or app you need to reach actually responds.\n\n## 7. Prevention Tips\n- **Test VPN before traveling.** Don't discover it's broken at 11 PM in a hotel.\n- **Keep client updated.**\n- **Save a screenshot of working VPN settings** when it works — gives you and IT a reference if it breaks.\n- **Have a backup MFA method.** If your only token is on a phone that breaks, you lose VPN until IT re-enrolls.\n\n## 8. User-Friendly Explanation\nIf your VPN isn't connecting, try these in order: 1) check the internet still works, 2) restart the VPN app, 3) check the URL is right, 4) try your phone's hotspot to rule out the network, 5) sign in to webmail to confirm your password works, 6) update the VPN app, 7) restart your computer. If you get past all seven and it still doesn't work — call IT with the exact error message and we'll fix it together.\n\n## 9. Internal Technician Notes\n- Capture session logs immediately when user reports — they overwrite on next attempt.\n  - Ivanti: `%LocalAppData%\\Pulse Secure\\Logs\\` (Win) / `~/Library/Logs/Pulse Secure/` (Mac).\n  - GlobalProtect: `%ProgramFiles%\\Palo Alto Networks\\GlobalProtect\\PanGPS.log`.\n  - AnyConnect: `%ProgramData%\\Cisco\\Cisco AnyConnect Secure Mobility Client\\`.\n  - FortiClient: `%AppData%\\FortiClient\\` → `forticlient.log`.\n- Gateway logs (server side): check session establishment / failure reason. SAML auth errors often misreport as generic \"authentication failed\" on the client.\n- For frequent intermittent issues: check MTU. Default 1500 may be too high through some carriers; lower to 1400 in client config and test.\n- For mobile carrier networks blocking IPsec UDP 500/4500: enable SSL fallback (TCP 443) in client settings.\n\n## 10. Related KB Articles\n- `l1-vpn-001` — Can't connect (legacy)\n- `l1-vpn-ivanti-001` — Ivanti Secure Access connect\n- `l1-vpn-mobilepass-001` — MobilePASS+ setup\n- `l1-internet-001` — No internet\n- `l1-wifi-001` — Wi-Fi won't connect\n\n## 11. Keywords / Search Tags\nvpn, vpn not connecting, vpn troubleshooting, when to call it, vpn escalation, self serve vpn, ssl vpn, ipsec, ivanti, pulse secure, globalprotect, cisco anyconnect, forticlient, zscaler, cloudflare warp, nordlayer, tailscale, openvpn"
  },
  {
   "slug": "l1-vpn-globalprotect-001-palo-alto-globalprotect",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-globalprotect-001-palo-alto-globalprotect.md",
   "title": "\"Palo Alto GlobalProtect — connect to corporate VPN, step by step\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-globalprotect-001\ntitle: \"Palo Alto GlobalProtect — connect to corporate VPN, step by step\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\", \"Linux\"]\ntech_generation: current\nyear_range: \"Current\"\neol_status: \"Current. Stay on GP client 6.2+ on Windows and 6.2+ on macOS for current security baseline.\"\nprerequisites: [\"GlobalProtect client installed (from IT or https://gpdownload.<company>.com)\", \"Portal hostname (e.g., gp.<company>.com)\", \"Sign-in credentials\"]\nkeywords:\n  - globalprotect\n  - global protect\n  - palo alto\n  - pan\n  - gp\n  - prelogon\n  - always-on\n  - on-demand\n  - user-logon\nrelated_articles:\n  - l1-vpn-001-cant-connect\n  - l1-vpn-generic-001-when-to-call-vs-self-fix\n  - l1-mfa-001-setup-recovery\nescalation_trigger: \"Portal authentication fails AND credentials work on webmail. Or HIP (Host Information Profile) check fails repeatedly (device compliance issue).\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Palo Alto GlobalProtect — connect to corporate VPN, step by step\n\n## 1. Symptoms\nUser has the GlobalProtect (\"GP\") client and needs to connect. May see a small globe / shield icon in the system tray or menu bar.\n\n## 2. About GlobalProtect\n- VPN client from Palo Alto Networks, paired with PA-Series next-gen firewalls.\n- Three connection modes (set by IT):\n  - **User-logon (recommended for office staff):** prompts to connect when you sign in.\n  - **Pre-logon:** connects BEFORE Windows sign-in (for domain-joined laptops).\n  - **On-demand:** user must explicitly click Connect.\n- Performs a \"HIP check\" (Host Information Profile) on each connection: confirms antivirus is on, disk encryption enabled, OS patched, etc. If HIP fails, you connect but with restricted access (or no access depending on policy).\n\n## 3. Questions To Ask User\n1. Do you see a small **globe / shield icon** in your system tray (Win) or menu bar (Mac)?\n2. What portal hostname were you given? (Often `gp.<company>.com` or `vpn.<company>.com`.)\n3. What's your MFA method?\n\n## 4. Step-by-Step Connection\n\n### Windows\n\n**Step 1 — Find GlobalProtect.**\n- Look for a small globe icon in the system tray (lower-right, near the clock). Click it.\n- *(If missing: Start menu → search \"GlobalProtect\" → open. If still missing → install from your IT portal.)*\n\n**Step 2 — Enter portal.**\n- The panel opens. Click **Sign In** (or it may auto-prompt).\n- **Portal:** type the hostname you were given (e.g., `gp.<company>.com`). No `https://`. Hit **Connect**.\n\n**Step 3 — Sign in.**\n- Username + password.\n- MFA prompt appears (push to phone, 6-digit code, or browser-based SAML).\n\n**Step 4 — Wait for HIP check.**\n- The client checks your device against company policy: AV running, disk encrypted, OS patches up to date, screen lock enabled.\n- *(What you should see: A short progress indicator labeled \"Checking...\" then \"Connected.\")*\n\n**Step 5 — Confirm connected.**\n- Globe icon turns blue / shield with check mark.\n- Right-click the icon → \"Status\" shows your assigned IP + connection time.\n\n### macOS\n\nSame flow. First-time install requires approval in System Settings → Privacy & Security → Allow GlobalProtect's system extension.\n\n### Mobile (iOS / Android)\n\nApp Store / Play Store → install \"GlobalProtect\" by Palo Alto Networks → enter portal hostname → sign in → approve VPN profile when iOS prompts → connect.\n\n## 5. Common Errors and Fixes\n\n**\"Cannot connect to portal\" / \"Portal unreachable\"**\n- Verify portal hostname exactly. Try opening `https://<portal-hostname>/global-protect/portal/portal.esp` in a browser — should show a Palo Alto-branded sign-in page.\n- Try mobile hotspot — captive portal / ISP DPI may block.\n\n**\"Authentication failed\"**\n- Test the same credentials on webmail. If those fail too → password expired.\n- For SAML auth: Allow popups for the portal hostname in your browser.\n\n**\"HIP check failed — restricted access\"**\n- Antivirus running and updated? Make sure Defender / CrowdStrike / SentinelOne is enabled.\n- BitLocker (Win) or FileVault (Mac) enabled? IT may require disk encryption.\n- Are all critical Windows / macOS updates installed? Run updates → reboot → retry.\n- Screen lock enabled with short timeout? (Settings → Personalization → Lock screen → Screen timeout.)\n- *If you don't know which check is failing:* right-click GP icon → Settings → Host Information Profile → see which item is red.\n\n**\"Sign-in completed but no internet through VPN\"**\n- Connection is split-tunnel — only certain traffic goes through VPN. Test the specific internal URL or IP you need.\n- If everything should route through VPN (\"tunnel-all\" mode), and nothing reaches → escalate to IT (gateway policy issue).\n\n## 6. Verification Steps\n- GP icon shows connected status (blue / check).\n- An internal-only URL loads in browser.\n- `ipconfig /all` (Win) shows a PANGP adapter with company-issued IP.\n\n## 7. When to Call IT\n- HIP failed and you don't know what triggered it (sometimes the check looks for very specific AV signatures or patch versions).\n- \"Pre-logon\" mode broke after a Windows update — needs config refresh.\n- Multi-factor auth fails after correct codes — gateway policy or MFA provider issue.\n- Brand new laptop hasn't been domain-joined / Entra-joined — pre-logon mode won't work without that.\n\n## 8. Prevention Tips\n- Keep GP client updated.\n- Make sure Windows / macOS updates install promptly — HIP enforces these.\n- Antivirus must be running — don't disable to \"speed up\" the computer.\n\n## 9. User-Friendly Explanation\nGlobalProtect is the VPN. Click the small globe icon at the bottom-right of your screen, sign in, and approve the prompt on your phone. The system also checks that your computer is up to date and has antivirus running — if any of those are off, the VPN connects but with limited access. Keep Windows updates and antivirus running and you'll never see that issue.\n\n## 10. Internal Technician Notes\n- Portal vs Gateway: portal authenticates + downloads config; gateway is the actual VPN tunnel endpoint. Multi-gateway deployments common.\n- HIP profile XML pushed from Panorama / firewall. Update HIP profiles at the firewall, not at the client.\n- Connection methods controlled by Portal config → Agent → User Login Settings.\n- Pre-logon: requires machine certificate. Stored in LocalMachine cert store (Win) or system keychain (Mac). For Win, deploy via GPO/MDM. For Mac, via Jamf/Kandji/Intune profile.\n- GP icon does not appear on Linux. Linux uses `globalprotect` CLI or `openconnect` with `--protocol=gp`.\n- Log paths: Win `%PROGRAMDATA%\\Palo Alto Networks\\GlobalProtect\\PanGPS.log` and `PanGPA.log`. Mac `/Library/Logs/PanGPS.log`.\n- Common HIP fails: outdated AV definitions (rotation policy), disk encryption not enabled or not 100% complete, OS patch missing (specific KB).\n\n## 11. Related KB Articles\n- `l1-vpn-001` — Can't connect (legacy)\n- `l1-vpn-generic-001` — When to call IT\n- `l1-mfa-001` — MFA setup\n\n## 12. Keywords / Search Tags\nglobalprotect, global protect, palo alto, pan, gp, hip, host information profile, prelogon, user-logon, on-demand, pangp, pan-os, pangps, pangpa"
  },
  {
   "slug": "l1-vpn-ivanti-001-ivanti-secure-access-connect",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-ivanti-001-ivanti-secure-access-connect.md",
   "title": "\"Ivanti Secure Access (formerly Pulse Secure) — connect to corporate VPN, step by step\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-ivanti-001\ntitle: \"Ivanti Secure Access (formerly Pulse Secure) — connect to corporate VPN, step by step\"\ncategory: vpn\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 15\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Pulse Secure rebranded to Ivanti Secure Access 2021; current as of 2026\"\neol_status: \"Current. Note: Ivanti VPN suffered major security incidents (CVE-2023-46805, CVE-2024-21887). Ensure client AND gateway are fully patched.\"\nprerequisites: [\"Ivanti Secure Access client installed\", \"Company-issued sign-in URL (https://vpn.<company>.com)\", \"Username + password + MFA (token / push)\"]\nkeywords:\n  - ivanti\n  - pulse secure\n  - secure access\n  - vpn\n  - ssl vpn\n  - corporate network\n  - remote access\n  - mfa\n  - pulse connect secure\n  - rsa token\n  - mobilepass\n  - duo\n  - okta verify\nrelated_articles:\n  - l1-vpn-001-cant-connect\n  - l1-vpn-pulse-001-pulse-secure-legacy\n  - l1-vpn-mobilepass-001-mobilepass-token-setup\n  - l1-mfa-001-setup-recovery\nescalation_trigger: \"User locked out after 5 failed attempts, or gateway URL unreachable from multiple ISPs (likely gateway-side outage), or persistent certificate errors after fresh install.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Ivanti Secure Access — connect to corporate VPN, step by step\n\n## 1. Symptoms\nUser needs to connect to the company VPN to access internal apps (file shares, intranet sites, internal databases, company email on older setups). They've been told to use \"Ivanti Secure Access\" (or \"Pulse Secure\" if their company hasn't updated the name).\n\n## 2. Likely Causes if it fails\n1. Wrong sign-in URL.\n2. Username or password wrong (especially after rotation).\n3. MFA prompt missed or token expired.\n4. Outdated client version — Ivanti has issued mandatory security updates several times in 2024-2026.\n5. Local firewall or antivirus blocking the connection.\n6. Captive portal (hotel / coffee shop Wi-Fi) intercepting the connection.\n7. Gateway down (rare, but check first if multiple users affected).\n\n## 3. Questions To Ask User\n1. Do you have the Ivanti Secure Access app installed? (Windows: Start menu → search \"Ivanti\". macOS: Applications folder.)\n2. What is the sign-in URL? (Should look like `https://vpn.<company>.com` or `https://remote.<company>.com`.)\n3. What MFA method does your company use? (Push notification on phone, 6-digit code, hardware token, FIDO2 key?)\n4. Are you on home Wi-Fi, public Wi-Fi, or hotspot?\n5. Have you connected successfully from this device before, or is this the first time?\n\n## 4. Step-by-Step Connection Instructions\n\n### Windows 10 / 11\n\n**Step 1 — Open Ivanti Secure Access.**\n- Click **Start** menu → type `Ivanti` → press **Enter**.\n- *(What you should see: A small window with a \"Connections\" panel. If you see \"Pulse Secure\" instead, that's the old name — same app.)*\n\n**Step 2 — Add the connection (first time only).**\n- Click the **+** (plus) button to add a new connection.\n- **Name:** type anything memorable, e.g., `Work VPN`.\n- **Server URL:** type your company's sign-in URL exactly: `https://vpn.<company>.com`\n- Click **Add**.\n- *(What you should see: New row appears in the Connections list with the name you typed.)*\n\n**Step 3 — Connect.**\n- Click your VPN entry → click **Connect**.\n- *(What you should see: A sign-in dialog asking for your username and password.)*\n\n**Step 4 — Enter credentials.**\n- **Username:** your company username (often your email or `firstname.lastname`).\n- **Password:** your company password.\n- Click **Connect**.\n- *(What you should see: A second dialog asking for MFA — either a 6-digit code OR a push notification on your phone.)*\n\n**Step 5 — Approve MFA.**\n- **If push:** open the authenticator app on your phone (MobilePASS+, Microsoft Authenticator, Okta Verify, Duo) → tap **Approve**.\n- **If 6-digit code:** open the authenticator app → read the current 6-digit code → type it into Ivanti → press **Enter**.\n\n**Step 6 — Confirm connected.**\n- *(What you should see: A green check mark or \"Connected\" status. A small lock icon appears in your system tray.)*\n- The VPN status indicator in the system tray turns green / shows a key icon.\n- Open a browser → try the internal URL your IT team gave you (e.g., `https://intranet.<company>.local`) → it loads.\n\n### macOS\n\n**Step 1 — Open Ivanti Secure Access.**\n- Click **Applications** folder → **Ivanti Secure Access.app**.\n\n**Step 2 — Add connection (first time).**\n- File menu → **New Connection** → fill in **Name** + **Server URL**.\n\n**Step 3-6:** Same as Windows above (Connect → username → password → MFA → confirm).\n\n### iPhone / iPad (iOS)\n\n**Step 1 — Install from App Store.**\n- App Store → search **Ivanti Secure Access**.\n\n**Step 2 — Open + add connection.**\n- Plus icon → enter Name + URL.\n\n**Step 3 — Allow VPN configuration.**\n- iOS prompts: \"Ivanti Secure Access Would Like to Add VPN Configurations\" → **Allow** → Face ID / Touch ID / passcode.\n\n**Step 4 — Connect + sign in + MFA as on Windows.**\n\n### Android\n\n**Step 1 — Install from Google Play.**\n- Play Store → **Ivanti Secure Access Client** by Ivanti.\n\n**Step 2-4:** Same as iOS pattern.\n\n## 5. Common Errors and Fixes\n\n**\"Cannot connect to the gateway\"**\n- Try a different network (mobile hotspot from your phone). If it works on hotspot but not Wi-Fi, your Wi-Fi has a captive portal — open a browser and complete the captive portal sign-in, then retry VPN.\n\n**\"Invalid credentials\"**\n- Make sure CapsLock is off.\n- Try signing in to a company web app (e.g., webmail) with the same credentials. If that fails, your password may have expired — reset it first.\n\n**\"Certificate error\" / \"The server certificate is not trusted\"**\n- Do NOT click \"Continue anyway.\" This is a security warning. Close the app. Run Windows Update to install the latest root certificates. Update Ivanti Secure Access to the latest version.\n\n**\"MFA timeout\"**\n- Restart the connection attempt. Have your phone unlocked and the authenticator app open before clicking Connect.\n\n**Connected but internal sites don't load**\n- Check that the company applied \"tunnel all traffic\" or \"split tunnel\" correctly. Run `ipconfig` on Windows (or `ifconfig` on Mac/Linux) → look for an extra adapter showing the VPN-assigned IP (often starts with `10.` or `172.`). If missing, the tunnel didn't establish — disconnect and reconnect.\n\n## 6. Verification Steps\n- System tray (Win) or menu bar (Mac) shows Ivanti connected icon.\n- You can reach an internal URL that doesn't work without VPN.\n- `ipconfig` (Win) or `ifconfig` (Mac/Linux) shows a VPN adapter with a company-issued IP.\n\n## 7. When to Call IT vs Self-Serve\n\n**Self-serve (try these first, in order):**\n- Restart Ivanti Secure Access.\n- Restart the computer.\n- Try mobile hotspot to rule out network issue.\n- Check authenticator app is showing current codes (clock sync).\n- Try a different known-working internal URL.\n\n**Call IT (don't self-fix):**\n- Account locked after multiple attempts.\n- Certificate errors that persist after client update.\n- Repeated MFA failures even with correct codes.\n- \"Your account is not allowed to use this application\" — likely group / conditional access policy.\n- Brand new device that's never connected before — IT may need to pre-register.\n- VPN connects but you can't reach the ONE specific app you need (could be ACL / firewall on the gateway).\n\n## 8. Prevention Tips\n- **Keep the Ivanti client updated.** Open the app → Help → Check for Updates monthly.\n- **Save credentials securely** in a password manager (1Password, Bitwarden, your company's standard tool).\n- **Practice on a slow day** — don't wait until you're traveling on a tight deadline to discover your VPN doesn't work.\n\n## 9. User-Friendly Explanation\nThe VPN is the secure tunnel that lets you reach company files and apps when you're not at the office. Open the Ivanti app, click Connect, sign in with your work password, then approve the prompt on your phone. Once you see the green \"Connected\" badge, you can use company sites the same as if you were at your desk. If you get stuck, restart the app and try again — most of the time that fixes it.\n\n## 10. Internal Technician Notes\n- Ivanti Connect Secure (gateway product) and Ivanti Secure Access Client (endpoint) are paired.\n- Critical CVEs to monitor: CVE-2023-46805 (auth bypass), CVE-2024-21887 (command injection), CVE-2024-22024 (XXE) — all need gateway patches applied.\n- Client install logs: Windows `%LocalAppData%\\Pulse Secure\\Logs\\` (path retained from old name), macOS `~/Library/Logs/Pulse Secure/`.\n- Multi-host group with role-based access: typically configured at gateway, user sees only the connection name.\n- For Mac users with kernel extension prompts: macOS 11+ requires Ivanti's system extension to be approved in System Settings → Privacy & Security → \"Allow\" button.\n- Common Ahead-of-Time Compatibility: Ivanti released a native Apple Silicon build mid-2023. Old Intel-only builds will run under Rosetta but with worse battery.\n- For users behind double NAT or strict carrier-grade NAT (CGNAT) on mobile: enable IPv6 in the gateway profile if available.\n\n## 11. Related KB Articles\n- `l1-vpn-001` — Can't connect to VPN (generic)\n- `l1-vpn-pulse-001` — Pulse Secure (legacy name) reference\n- `l1-vpn-mobilepass-001` — MobilePASS+ token setup\n- `l1-mfa-001` — MFA setup and recovery\n\n## 12. Keywords / Search Tags\nivanti, pulse secure, secure access, vpn, ssl vpn, corporate vpn, remote access, mfa, pulse connect secure, ica, ivanti connect secure, mobilepass, duo, okta verify, microsoft authenticator, rsa token"
  },
  {
   "slug": "l1-vpn-mobilepass-001-mobilepass-token-setup",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-mobilepass-001-mobilepass-token-setup.md",
   "title": "\"MobilePASS+ — install, enroll, and use for VPN MFA tokens\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-mobilepass-001\ntitle: \"MobilePASS+ — install, enroll, and use for VPN MFA tokens\"\ncategory: mfa\nsupport_level: L1\nseverity: high\nestimated_time_minutes: 12\naudience: end-user\nos_scope: [\"iOS 15+\", \"Android 12+\", \"Windows 10/11 desktop variant\"]\ntech_generation: current\nyear_range: \"MobilePASS+ replaced MobilePASS Classic 2018; current\"\neol_status: \"Thales (formerly Gemalto / SafeNet) MobilePASS+ is current. Classic MobilePASS EOL March 2025 — must migrate.\"\nprerequisites: [\"Enrollment email or QR code from IT\", \"Smartphone (preferred) OR Windows / Mac for desktop variant\"]\nkeywords:\n  - mobilepass\n  - mobilepass+\n  - mobilepass plus\n  - safenet\n  - gemalto\n  - thales\n  - otp\n  - one-time password\n  - token\n  - mfa\n  - 6-digit code\n  - hardware token replacement\n  - rsa alternative\nrelated_articles:\n  - l1-vpn-ivanti-001-ivanti-secure-access-connect\n  - l1-mfa-001-setup-recovery\nescalation_trigger: \"Enrollment link expired AND user has critical VPN need — IT must reissue enrollment from SafeNet Authentication Service / Trusted Access console.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# MobilePASS+ — install, enroll, and use for VPN MFA tokens\n\n## 1. Symptoms\n- New user enrolling for VPN access — IT sent an \"enrollment email\" or \"activation link\" for MobilePASS+.\n- Existing user got a new phone — needs to re-enroll.\n- User on old MobilePASS Classic — being migrated to MobilePASS+.\n- VPN sign-in asks for a 6-digit code from MobilePASS+.\n\n## 2. About MobilePASS+\n- OTP (one-time password) generator app from Thales (acquired Gemalto / SafeNet).\n- Replaces physical hardware tokens (key fobs that show a 6-digit number every 60 seconds).\n- Common in VPN, banking, healthcare, government environments.\n- Generates a fresh 6-digit code every 30 seconds.\n\n## 3. Questions To Ask User\n1. Did IT email you an enrollment link or QR code?\n2. Phone (iOS / Android) or desktop?\n3. Have you used MobilePASS before? (Classic version, or a totally new user?)\n4. Is the enrollment email still valid? (Most expire in 7-14 days.)\n\n## 4. Step-by-Step Enrollment\n\n### iPhone / iPad\n\n**Step 1 — Install MobilePASS+.**\n- App Store → search **MobilePASS+** (by Thales).\n- Tap **GET** → wait for install → tap **OPEN**.\n\n**Step 2 — Open the enrollment email or message on your phone.**\n- Look for an email subject like \"Your MobilePASS+ activation\" from IT or `donotreply@<company>.com`.\n- Inside the email, you'll see either:\n  - **Method A:** A clickable activation link (`mobilepass://activate/...` or similar)\n  - **Method B:** A QR code image\n  - **Method C:** A manual enrollment string (long alphanumeric)\n\n**Step 3 — Activate (Method A — link):**\n- Tap the activation link.\n- Phone prompts: \"Open in MobilePASS+?\" → tap **Open**.\n- App launches and auto-imports the token. Skip to Step 5.\n\n**Step 3b — Activate (Method B — QR code):**\n- Open MobilePASS+ app → tap **+** → **Scan QR code**.\n- Allow camera access if asked.\n- Point camera at the QR code in the email (or on the IT portal). Hold steady ~2 seconds.\n- App imports the token automatically.\n\n**Step 3c — Activate (Method C — manual string):**\n- Open MobilePASS+ → tap **+** → **Enter activation code**.\n- Type the activation code exactly from the email. (Copy/paste works — long-press email text → Copy → long-press in app → Paste.)\n- Tap **Activate**.\n\n**Step 4 — Set a token name (and optional PIN):**\n- Name: anything memorable, e.g., `Work VPN`.\n- PIN: 4-6 digits. Optional but **strongly recommended** — protects the token if your phone is unlocked.\n\n**Step 5 — Test the token.**\n- Token entry now shows in the MobilePASS+ home screen with a 6-digit code.\n- The code rotates every 30 seconds — a thin progress bar shows time remaining.\n- *(What you should see: A 6-digit number, large font, with a colored progress indicator.)*\n\n### Android — same flow as iPhone above.\n\n### Windows / Mac desktop (less common)\n\n**Step 1 — Download from your IT portal.** (Look for \"MobilePASS+ for Windows\" or `.msi` / `.dmg` installer.)\n**Step 2 — Install + open.**\n**Step 3 — Activate** with the link / QR / manual code from IT email.\n**Step 4 — Token shows in app window.**\n\n## 5. Using the Token at VPN Sign-In\n\nWhen Ivanti / Pulse / other VPN client prompts for \"Token Code\" or \"OTP\" or \"Authenticator\":\n\n1. Open MobilePASS+ on your phone.\n2. (If you set a PIN) Enter your PIN.\n3. Read the current 6-digit code displayed.\n4. Type it into the VPN sign-in screen exactly. **No spaces. No dashes.**\n5. Press **Enter** or click **Submit** within the 30-second window.\n6. If the timer runs out mid-typing, the code expires — wait for the next code, then retype.\n\n## 6. Verification Steps\n- Token appears in MobilePASS+ home with a name + 6-digit code.\n- Code rotates every 30 seconds.\n- VPN successfully accepts a code (one-time test).\n\n## 7. Common Errors and Fixes\n\n**\"Invalid token\" / \"Invalid OTP\"**\n- Phone time is wrong. iOS: Settings → General → Date & Time → enable \"Set Automatically.\" Android: Settings → System → Date & Time → enable \"Set time automatically.\"\n- You typed yesterday's code. Open the app fresh and use the current code.\n\n**Activation link expired**\n- Ask IT to resend a new enrollment. Old link cannot be reused.\n\n**\"Cannot reach activation server\"**\n- Make sure phone has internet (not just Wi-Fi with no internet pass-through).\n- Some corporate enrollment servers are only reachable from inside the company network — try connecting to Wi-Fi at the office or via a temporary VPN provided for enrollment.\n\n**Code doesn't get accepted no matter what**\n- Token may have been removed from the back-end (rare). Contact IT to verify the token is still active in SafeNet Authentication Service / Trusted Access console.\n\n## 8. When to Call IT vs Self-Serve\n\n**Self-serve:**\n- Fix phone time → almost always resolves \"invalid OTP.\"\n- Re-scan QR / re-paste activation string if first try failed.\n- Restart phone if app crashes on launch.\n\n**Call IT:**\n- Enrollment link expired AND you can't access VPN at all.\n- Token works for some attempts but fails randomly — could be a server-side clock drift.\n- You replaced your phone and didn't migrate the token (token is bound to original device — needs IT re-issue).\n- You see \"Account suspended\" or \"Token revoked.\"\n\n## 9. Prevention Tips\n- **Set up a PIN** on the token. Phone unlock + PIN gives two-factor protection.\n- **Back up — but carefully.** Some companies forbid token cloning to multiple devices for compliance. Confirm policy with IT before \"moving\" or \"duplicating\" a token.\n- **Re-enroll BEFORE you upgrade your phone**, not after. New phone setup with a working old phone makes the migration smooth; phone-already-traded-in makes it painful.\n\n## 10. User-Friendly Explanation\nMobilePASS+ is a small app that makes a fresh 6-digit code every 30 seconds. When you sign in to the company VPN, the VPN asks for that code along with your password. It's like a physical token key fob, just on your phone. IT sends you an activation link or QR code one time to set it up — after that, you just open the app, read the number, and type it in when prompted.\n\n## 11. Internal Technician Notes\n- Back-end: Thales SafeNet Authentication Service (SAS) cloud OR on-prem SAS-PCE, OR Trusted Access (newer SaaS).\n- Token format: time-based OTP (TOTP), RFC 6238 — interoperable with other authenticators in some cases (depends on how IT provisioned it; soft-token-bound tokens are NOT interoperable).\n- Bulk enrollment: SAS admin console → Tokens → New → Activate → email to user. Each link is single-use and time-limited.\n- Migration from MobilePASS Classic to MobilePASS+: SAS admin runs migration job; users receive new activation link via email. Classic app does not migrate token in place.\n- Mobile device theft: SAS console → Token → Revoke → user gets new enrollment. Old token immediately invalid.\n- For audit: enrollment date + last used date visible in SAS reporting.\n\n## 12. Related KB Articles\n- `l1-vpn-ivanti-001` — Ivanti Secure Access connect (where you USE the token)\n- `l1-mfa-001` — MFA setup / recovery (general)\n\n## 13. Keywords / Search Tags\nmobilepass, mobilepass+, mobilepass plus, safenet, gemalto, thales, otp, one-time password, totp, 6-digit code, soft token, hardware token replacement, rsa alternative, vpn token, sas, safenet authentication service, trusted access"
  },
  {
   "slug": "l1-vpn-pulse-001-pulse-secure-legacy",
   "path_rel": "knowledge-base\\vpn\\l1-vpn-pulse-001-pulse-secure-legacy.md",
   "title": "\"Pulse Secure (legacy) — same product as Ivanti Secure Access, when you see the old name\"",
   "vertical": "general",
   "tier": "l1",
   "intent_codes": [],
   "keywords": [],
   "compliance": [],
   "content": "---\nid: l1-vpn-pulse-001\ntitle: \"Pulse Secure (legacy) — same product as Ivanti Secure Access, when you see the old name\"\ncategory: vpn\nsupport_level: L1\nseverity: medium\nestimated_time_minutes: 10\naudience: end-user\nos_scope: [\"Windows 10\", \"Windows 11\", \"macOS 12+\", \"iOS 15+\", \"Android 12+\"]\ntech_generation: current\nyear_range: \"Pulse Secure (Juniper era 2004; rebranded Ivanti Secure Access 2021)\"\neol_status: \"Pulse Secure brand discontinued 2021. Current product is Ivanti Secure Access. Older installer versions still work but should be updated.\"\nprerequisites: [\"Existing Pulse Secure install OR ability to download Ivanti Secure Access\"]\nkeywords:\n  - pulse secure\n  - pulse vpn\n  - juniper pulse\n  - junos pulse\n  - ivanti secure access\n  - rebrand\n  - legacy installer\nrelated_articles:\n  - l1-vpn-ivanti-001-ivanti-secure-access-connect\n  - l1-vpn-001-cant-connect\nescalation_trigger: \"Company is still on Pulse Secure pre-9.1R12 — major CVEs unpatched. Escalate to L2/L3 for gateway upgrade plan.\"\nlast_updated: 2026-05-12\nversion: 1.0\n---\n\n# Pulse Secure (legacy) — same product as Ivanti Secure Access\n\n## 1. Symptoms\nUser says they use \"Pulse Secure\" for VPN. The icon in their system tray says \"Pulse.\" Their IT documentation says Pulse. They want to know if they have the right app.\n\n## 2. Background\n- **Pulse Secure** was originally Juniper Pulse / Junos Pulse (2004-2014), then sold to a private company called Pulse Secure LLC (2014-2020), then sold to Ivanti (2020).\n- **Ivanti renamed the product to \"Ivanti Secure Access\"** in 2021.\n- Same product, same protocol. The newer installer just rebranded.\n- Many companies haven't pushed the rebranded client to users yet, so the old \"Pulse Secure\" icon is still extremely common in 2026.\n\n## 3. Questions To Ask User\n1. What does the system tray icon look like? (Pulse Secure was a stylized \"p\" / Ivanti uses a different mark.)\n2. What's the version number? (Help menu → About.)\n3. Has IT told you to \"update to Ivanti\" yet?\n\n## 4. Action\n\n**Path A — User just wants to use it as is:**\n- Treat exactly the same as Ivanti Secure Access — see `l1-vpn-ivanti-001` for connection steps.\n\n**Path B — User should update (recommended):**\n1. Uninstall Pulse Secure (Settings → Apps → Pulse Secure → Uninstall).\n2. Reboot.\n3. Download Ivanti Secure Access from your company's IT portal OR https://forums.ivanti.com (corporate-issued login required).\n4. Install. Same VPN URL works.\n5. First-time setup: see `l1-vpn-ivanti-001` Step 2.\n\n**Path C — User can't update without IT involvement:**\n- Don't force it. Some companies have specific Pulse Secure versions pinned for compatibility with their gateway.\n- Call IT to confirm before updating.\n\n## 5. Security Note\n- If running Pulse Secure **older than 9.1R12** (released Aug 2021): SEVERAL major CVEs unpatched. Escalate.\n- If running Ivanti Secure Access **older than 22.6R2** (released Apr 2024): newer CVEs unpatched. Escalate.\n\n## 6. Verification Steps\n- Help → About shows the version number.\n- Test connection works with company VPN URL.\n\n## 7. Escalation Trigger\n- Gateway-side Pulse Secure version pre-9.1R12 → critical security gap, immediate L3 escalation.\n\n## 8. Prevention Tips\n- Keep client updated quarterly.\n- Subscribe to Ivanti security advisories (or follow KrebsOnSecurity / CISA for major CVE alerts).\n\n## 9. User-Friendly Explanation\n\"Pulse Secure\" is the older name for the same VPN app — it's now called \"Ivanti Secure Access.\" You don't have to change anything. If you'd like the newer version, IT can swap it for you, or we'll do it together in 10 minutes.\n\n## 10. Internal Technician Notes\n- Configuration profiles built for Pulse Secure transfer cleanly to Ivanti Secure Access — same XML format.\n- Group Policy / Intune deployment scripts referencing `PulseSecure.msi` need updating to `IvantiSecureAccess.msi` post-2024.\n- Pulse Workspace mobile container product also rebranded — Ivanti Neurons for Mobile or Ivanti UEM.\n\n## 11. Related KB Articles\n- `l1-vpn-ivanti-001` — Ivanti Secure Access connect steps\n- `l1-vpn-001` — Generic VPN can't connect\n\n## 12. Keywords / Search Tags\npulse secure, pulse vpn, juniper pulse, junos pulse, ivanti secure access, ivanti rebrand, pulse connect secure, pcs"
  }
 ]
}