Fix common IT issues, step by step

What to do

Path A — Use vendor's latest universal driver (preferred):

1. Download HP Universal Print Driver (UPD) PCL6 or PostScript from HP support site. Works for most HP devices 2005 onward.
2. For Brother: download "Brother Universal Printer Driver" from brother.com support.
3. For Canon: try Canon Generic Plus PCL6 / UFR II driver.
4. Install the universal driver. Add the printer using the new driver: Settings → Bluetooth & devices → Printers & scanners → Add device → "The printer I want isn't listed" → Add a local printer or network printer with manual settings.

Path B — Force inbox / Microsoft IPP driver (when vendor has no Win 11 driver):

1. Settings → Printers & scanners → Add device → "The printer I want isn't listed".
2. Select "Add a printer using an IP address or hostname".
3. Device type: "TCP/IP Device". Enter printer IP. Wait for detection.
4. When prompted for driver: pick Microsoft IPP Class Driver or Generic / Text Only.
5. Test print.

Path C — USB-only printer with no signed driver:

1. Buy a small print server (TP-Link TL-WPS510U, StarTech NETPRINT2) or convert via a Raspberry Pi running CUPS.
2. The print server speaks IPP / IPPS to Windows — bypasses the vendor driver dependency entirely.
3. On the PC, add the printer as an IPP network printer using Microsoft IPP Class Driver.

Path D — Replace the printer (recommended for pre-2012 models being used in a business):

1. Modern entry-level laser: Brother HL-L2460DW ($230). Modern entry-level inkjet: HP OfficeJet Pro 8135e ($230).
2. Both support AirPrint, Mopria, IPP — no driver hell on any OS.

What to do

If queue stuck:

1. Stop Print Spooler service.
2. Open C:\Windows\System32\spool\PRINTERS\ — delete all files inside.
3. Start Print Spooler.
4. Re-send job.

If "Offline" persists:

• Power-cycle printer (off 30 sec, on, wait 2 min for boot).
• Verify network: ping printer IP. If fails, DHCP changed IP — reconfigure printer port to current IP, or use hostname.

If wrong / stale driver:

• Settings → Printers & scanners → printer → Remove device.
• Re-add: + Add device → wait for discovery → install.
• For corporate printers, use the print server queue (\\printserver\printername) instead of direct IP.

If hardware error on display:

• Note exact error code from printer (e.g., HP "59.40", Brother "TS-02").
• Refer to printer's manual or vendor support.
• Often fixed by reseating toner cartridge or clearing paper path.

If garbage output:

• Wrong driver — uninstall, install printer's exact model driver from vendor site (not the generic).

What to do

Wrong driver type:

1. Identify printer model (label on physical printer).
2. Visit vendor support site → download "PCL 6" driver if printer supports PCL, or "PostScript / PS" for PS printers (most modern enterprise printers prefer PCL 6 for Windows).
3. Settings → Printers & scanners → remove existing printer.
4. Install fresh driver from downloaded package (vendor's installer is best).
5. Re-add printer.

Corrupt driver:

1. Print Management (printmanagement.msc) → All Drivers → right-click old driver → Remove driver package.
2. Reinstall fresh.

Stuck job poisoning queue:

1. Stop spooler service.
2. Delete files in C:\Windows\System32\spool\PRINTERS\.
3. Start spooler.
4. Re-add the print job from Word/Excel/etc.

Universal driver issue:

• For HP devices, "HP Universal Print Driver" can confuse some printers. Use the device-specific PCL 6 driver instead.

Application-side issue:

• Try Print to PDF first, then send PDF to printer. If PDF looks fine but printed garbage → driver. If PDF is also garbage → app problem.

What to do

A. Agent won't connect:

1. Restart agent; if still failing, re-enroll/re-authenticate the device.
2. Verify outbound reachability to the vendor's PoP/cloud (corporate firewall/proxy may block required ports/FQDNs — allow them).
3. Clear a captive-portal state on hotel/guest Wi-Fi (open a plain HTTP site to trigger the portal, authenticate, then reconnect).

B. "Can't reach internal app" (ZTNA triage):

1. Confirm the app is published in the ZTNA policy and the user/group is entitled.
2. Confirm the connector for that app's network segment is online (vendor console shows connector health).
3. Resolve the app's hostname while connected — it should resolve to the ZTNA service, not a public/stale IP.
4. Verify posture is passing; a posture failure silently removes entitlement to sensitive apps.
5. Test from a second known-good user to isolate user-specific vs app-wide.

C. Access denied / posture/identity block:

1. Read the policy decision in the vendor logs (which rule denied, on what attribute).
2. Remediate the failing posture attribute (update OS, enable encryption, restart EDR, reissue cert) or correct group membership.
3. Re-evaluate posture / re-sign-in and retest.

D. App breaks only with agent on (inspection):

1. Identify if TLS decryption is applied; install/trust the SWG root CA on the device.
2. Add cert-pinned or sensitive apps (banking, native clients) to a bypass/no-decrypt policy.

What to do

Authentication issue:

• Sign in to https://office.com first to confirm password works for cloud.
• Approve any MFA prompt on phone.
• Update VPN client to latest version.

Network blocking:

• Switch to mobile hotspot to confirm.
• For public Wi-Fi, complete captive portal first, then try VPN.
• Disable IPv6 temporarily if VPN client doesn't handle dual-stack: Network adapter → Properties → uncheck IPv6.

Certificate issue:

• For corporate device cert: connect on corporate LAN once to refresh; or contact L2 to push new cert.
• For user cert: re-enroll via portal.

DNS resolution failure:

• Switch DNS to 1.1.1.1 / 8.8.8.8 → retry.

Split-tunnel routes wrong:

• After connect, run route print (Windows) → corporate subnets should appear via VPN tunnel adapter.
• If missing, reconnect; persistent fix from L2 (gateway config).

Reinstall:

• Settings → Apps → uninstall VPN client → reinstall current version from corporate portal or vendor.

What to do

Cache clear (most common fix):

• New Teams: close → File Explorer → %localappdata%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache → delete contents → relaunch.
• Classic Teams: close → %appdata%\Microsoft\Teams\ → delete contents (or just Cache, Code Cache, Local Storage, IndexedDB).

Credential clear:

• Control Panel → Credential Manager → Windows Credentials → remove msteams_* and MicrosoftAccount:user=* (related entries) → relaunch Teams.

Reinstall:

• Settings → Apps → Installed apps → uninstall both "Microsoft Teams" and "Microsoft Teams (work or school)" if both present.
• Also remove %localappdata%\Microsoft\Teams\ folder.
• Reinstall: New Teams via Microsoft Store, or via M365 admin pushed app, or https://teams.microsoft.com/downloads.

Antivirus check:

• Temporarily allow Teams in security software (whitelisting Teams.exe and the Microsoft Store ms-teams package).
• Re-enable AV after testing.

What to do

If wrong device selected:

• In Teams Settings → Devices, pick the correct hardware. Teams will remember per device.

If permission denied:

• Settings → Privacy → Microphone → Enable for Teams. Restart Teams.

If exclusive access conflict:

• Right-click speaker icon (taskbar) → Sound settings → More sound settings → Recording tab → device → Properties → Advanced → uncheck "Allow apps to take exclusive control".

If Teams is misbehaving:

• Quit Teams completely (right-click tray icon → Quit, AND Task Manager kill Teams.exe and ms-teams.exe).
• Clear Teams cache:
• Classic Teams: %appdata%\Microsoft\Teams — close, delete contents, reopen.
• New Teams: %localappdata%\Packages\MSTeams_8wekyb3d8bbwe\LocalCache — close, delete contents, reopen.
• Reopen Teams, sign back in.

If Bluetooth headset:

• Pair fresh: Settings → Bluetooth & devices → Remove device → re-pair.
• Many headsets require selecting "Hands-free profile" vs "Stereo" — Teams audio works on hands-free.

If Windows doesn't see device at all:

• Device Manager → Audio inputs and outputs → check for warnings.
• Update driver (right-click → Update driver).
• For Realtek issues, get latest from OEM support page (NOT third-party "driver booster").

What to do

If OS Camera app works but Teams/Zoom doesn't:

1. Sign out and back into the app.
2. In Teams: Settings → Devices → Camera dropdown → pick the right device.
3. In Zoom: Settings → Video → Camera dropdown.

If OS Camera app shows "We can't find your camera" (Windows):

1. Device Manager → Cameras → right-click your device → Update driver → Search automatically.
2. If still failing → right-click → Uninstall device → reboot. Windows will reinstall on boot.

If on macOS and the Camera privacy panel doesn't list the app:

1. Quit the app completely (Cmd+Q).
2. Re-open. macOS will prompt for camera permission on first use.

External webcam not detected at all:

1. Try a different USB port (preferably directly on the laptop, not a hub).
2. Test on another machine to rule out hardware failure.

What to do

If paused / network:

• Resume; if still stalled, switch to a different network briefly to confirm reachability.

If file-level sync errors:

• Right-click cloud → View sync problems.
• Click each entry → fix per error message.
• Common: rename file (drop emoji / special chars), shorten path, close app holding lock, or move file to a shorter folder.

If OneDrive itself is stuck:

1. Right-click cloud → Quit OneDrive.
2. Run reset: Win+R → %localappdata%\Microsoft\OneDrive\onedrive.exe /reset → Enter.
3. If icon doesn't reappear in 5 min, run %localappdata%\Microsoft\OneDrive\onedrive.exe.
4. Sign in fresh.

If credentials expired:

• Same reset; on relaunch, sign in with work account.

If quota:

• Web: onedrive.live.com → file usage report → archive or delete.
• Or: admin assigns 1 TB → 5 TB upgrade per Microsoft 365 SKU.

What to do

For Word docs (most graceful):

1. Open both files in Word.
2. Review tab → Compare → Combine.
3. Pick original document and your conflict copy → OK.
4. Word produces merged view; accept changes you want.
5. Save As original filename → overwrite when prompted.
6. Delete the conflict file.

For Excel:

• No native compare — manually review sheets, copy cells from conflict copy as needed.
• Save merged as original.

For other file types (PDF, images, etc.):

• Pick the version you want to keep; rename it back to the original name; delete the loser.

Prevent recurrence:

• Enable Office AutoSave (top-left toggle in Word/Excel/PowerPoint when file is on OneDrive).
• Use real-time co-authoring (Office 2016+) — multiple editors stay in sync.
• Don't edit the same file offline on multiple devices.

What to do

Single deleted file (last 30 days personal / 93 days work):

1. onedrive.live.com (or office.com → OneDrive) → Recycle bin.
2. Find file → right-click → Restore. File returns to its original folder.

Older deleted file (work account, second-stage bin):

1. Recycle bin → "Second-stage recycle bin" link at bottom — accessible to admins; user requests via L2.

Restore prior version:

1. Web view → right-click file → Version history.
2. Click ⋯ on a version → Restore. Saves current as new version, makes restored version current.

Bulk / time-machine restore:

1. onedrive.live.com → Settings (gear) → Options → Restore your OneDrive.
2. Pick a date — slider shows daily activity histogram.
3. Confirm restore. ALL changes after that timestamp roll back. Use only when sure.

Suspected ransomware:

1. Disconnect device from network immediately.
2. Do NOT attempt restore yet — escalate to L2/L3 (see escalation).
3. Report to IT security per your incident response policy.

What to do

1. Do not act on the video's instructions until identity is confirmed out-of-band.
2. Look for detection cues: lip-sync drift, irregular blinking, facial-edge/lighting artifacts, unnatural head/body motion, audio-video desync, evasive responses to spontaneous questions.
3. Attempt a live liveness check (see protocol below) — deepfakes often fail real-time, unscripted interaction.
4. Check whether action already occurred; if so, pivot to incident response/fraud handling immediately.

What to do

SPF — build/repair the record:

• One TXT record only: v=spf1 include:spf.protection.outlook.com include:_spf.google.com ip4:203.0.113.10 -all (use only the includes/IPs your senders actually need).
• ~all = SoftFail (mark suspicious); -all = HardFail (reject). Start with ~all while validating, move to -all once all senders are confirmed.
• If over 10 lookups: remove unused includes, replace bulky includes with specific ip4:/ip6: entries, or flatten/consolidate. Never publish two v=spf1 records.

DKIM — enable signing:

• At the mail provider, enable DKIM for the domain; it generates one or more selectors.
• Publish the provider's CNAME records (e.g. selector1._domainkey → provider host) or the TXT public key.
• Turn signing on only after the DNS records resolve. Rotate selectors per provider guidance; keep old selector live until rotation completes.

DMARC — deploy gradually:

1. Start monitoring: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain; fo=1.
2. Read aggregate (rua) reports for ~2–4 weeks; identify and authenticate every legitimate source via SPF/DKIM until they show aligned pass.
3. Tighten to p=quarantine (optionally with pct= ramp), then to p=reject once reports are clean.
4. Optionally add ruf= for forensic/failure reports and aspf/adkim for strict alignment if needed.

Diagnose specific complaints:

• *Mail to spam:* ensure SPF + DKIM both pass and align; missing DKIM is a common cause.
• *Being spoofed:* a p=reject DMARC (once legit mail is authenticated) is what stops spoofing.
• *External mail rejected:* find which check failed in the bounce, authenticate that source, or correct alignment.

What to do

Message trace:

• Exchange Admin Center → Mail flow → Message trace.
• Recipient + date range → click traced message → see hop-by-hop.
• Status: Delivered, Filtered as spam, Failed, Pending, Expanded.

For inbound from external:

• Check anti-spam / anti-malware policies (Defender for O365).
• Check connectors (especially partner orgs with hybrid).

For outbound to external:

• DKIM signed: Defender → Policies → DKIM → enabled per domain.
• SPF record correct in DNS: v=spf1 include:spf.protection.outlook.com -all.
• DMARC published, enforcement level matches readiness.

What to do

Path A — Stay on Classic Outlook for now (recommended for most business users mid-2026):

1. In New Outlook, click the toggle in the top-right corner: "New Outlook" → switch OFF.
2. Outlook closes. Classic Outlook (OUTLOOK.EXE) opens next time you launch.
3. If toggle is missing: open Settings → General → Switch to classic Outlook.
4. Group Policy or Intune can lock the experience: search "Default Outlook" policy.

Path B — Switch TO New Outlook (when Copilot and lightweight UX matter more than legacy features):

1. In Classic Outlook, top right "Try the new Outlook" toggle ON.
2. New Outlook downloads + opens. Sign in if prompted.
3. Mail, calendar, contacts sync via M365 — no PST migration needed (server-side).
4. Pre-migration checklist:

• Export any PST data you need locally to a server location (OneDrive or shared drive).
• List your COM add-ins (Classic → File → Options → Add-ins) — flag any that aren't yet web add-ins.
• Note your client-side rules — manually recreate any server-side rule isn't already covering.

Path C — Use both side-by-side (developer / power user pattern):

1. Both Outlook clients can be installed concurrently on Windows 11.
2. New Outlook from the Start menu, Classic from OUTLOOK.EXE (Microsoft 365 Apps install).
3. Two profiles, two sets of running rules — be cautious about duplicate / overlapping rules.

What to do

Path A — Replace Outlook 2010/2013 with a supported client (preferred and almost always required):

1. Best: install Microsoft 365 Apps (subscription) or buy Office 2021 / 2024 perpetual license. New Outlook supports Modern Auth out of the box.
2. Free fallbacks: Outlook on the Web (https://outlook.office.com), or eM Client free tier (supports OAuth to M365 / Gmail).
3. Re-import old PST: in new Outlook, File → Open & Export → Import/Export → Import from another program → Outlook Data File (.pst) → point to old PST.
4. Set up the account fresh using auto-discovery (just enter email + password, modern client handles OAuth redirect).

Path B — Use IMAP / SMTP via an app password (works only on Gmail-style providers, NOT M365):

1. Sign in to the email provider's web UI.
2. Enable 2FA on the account.
3. Generate an "app password" (Google: Security → App passwords; Yahoo: Account Security → Generate app password).
4. In Outlook 2010/2013: Account Settings → Change → use IMAP server settings with the app password.
5. Note: Microsoft 365 / Exchange Online does NOT issue app passwords for Outlook 2010/2013 — Path A is required.

Path C — On-prem mail relay (for businesses that genuinely can't upgrade):

1. Stand up a small SMTP relay (hMailServer, Postfix, or Exchange 2019 in mailbox-less hybrid mode) on a modern Windows Server.
2. Configure the legacy Outlook to send through the relay over plain SMTP / no TLS or TLS 1.0.
3. Relay authenticates to M365 with Modern Auth on the outbound leg.
4. Inbound: configure transport rules to forward to a shared mailbox the legacy client reads via POP3 over the relay.
5. This is non-trivial L2/L3 work — escalate.

What to do

If a stuck message blocks Outbox:

1. Outlook → Send/Receive → Work Offline (toggle ON to halt sending).
2. Drag the stuck message from Outbox to Drafts.
3. Toggle Work Offline OFF.
4. Open the Drafts copy — re-attach files if needed — Send.

If attachment too large:

• For corporate users: upload to OneDrive → share link → paste link in email instead.
• M365 default 25 MB per send (some tenants 35 MB or 150 MB). External providers vary.

If NDR cites 5.7.x (security/policy):

• 5.7.1 → recipient or domain blocked your tenant. Contact recipient via phone.
• 5.7.135 → SPF/DKIM authentication block. Escalate to L2.
• 5.7.708 → access denied; user may be on M365 sender block list. Escalate.

If authentication issue (recent password change):

1. File → Account Settings → Account Settings → highlight account → Change → re-enter password.
2. If MFA recently enabled, complete the modern auth prompt.
3. If repeated auth pop-ups: File → Account Settings → Account Settings → Email → Repair.

If quota:

• Cannot send while over quota. Archive or delete old items first (see l1-outlook-001 §5).

What to do

Disable problem add-ins:

1. File → Options → Add-ins → Manage: COM Add-ins → Go.
2. Uncheck all non-essential add-ins → OK → restart Outlook. Re-enable one at a time to find the offender.

Right-size Cached Exchange Mode (big win on large mailboxes):

1. File → Account Settings → Account Settings → double-click the Exchange account → set "Mail to keep offline" to 3 or 6 months instead of "All".
2. Restart Outlook; it rebuilds a smaller OST. Confirm OST shrinks under %LOCALAPPDATA%\Microsoft\Outlook.

Rebuild the OST (clears local corruption):

1. Close Outlook. Rename the .ost (e.g., outlook.ost → outlook.ost.old) in %LOCALAPPDATA%\Microsoft\Outlook.
2. Reopen Outlook — it rebuilds the OST from Exchange Online (no data loss; the mailbox is the source of truth). Allow time to re-sync.

Rebuild the search index (if search is the slow part):

1. File → Options → Search → Indexing Options → Advanced → Rebuild. Let it complete (can take an hour on large mailboxes).

Create a fresh Outlook profile (if still slow / profile corruption):

1. Control Panel → Mail (Microsoft Outlook) → Show Profiles → Add a new profile → configure the account.
2. Set Outlook to "Prompt for a profile" or set the new one as default → launch with the new profile.

Reduce/relocate PSTs:

1. Move large archive .pst files off network shares to local disk, or migrate them into Online Archive. PSTs on network shares are unsupported and slow.

What to do

If Outlook is offline:

• Send/Receive → uncheck Work Offline.

If specific senders only:

• Home → Junk → Junk E-mail Options → check Blocked Senders, Safe Senders, and Filters.
• Ask sender to resend; check delivery in Outlook Web first.

If OST file corrupted:

1. Close Outlook completely (verify no OUTLOOK.EXE in Task Manager).
2. File → Account Settings → Account Settings → Data Files tab.
3. Note the OST file location.
4. Open File Explorer to that folder, rename *.ost to *.ost.old.
5. Reopen Outlook — it will rebuild the OST from server (15–60 min for typical mailbox).

If quota:

• Archive items: File → Cleanup Tools → Archive (or Online Archive if licensed).
• Empty Deleted Items.
• Empty Junk.
• For corporate: request quota increase from L2.

What to do

iPhone (iOS) — recommended (Outlook app):

1. Install Microsoft Outlook from the App Store and open it.
2. Tap Add Account, enter your full work email, tap Continue.
3. Enter your password, then approve the MFA prompt in Authenticator or via text/call.
4. If asked, allow notifications and complete any device registration step.
5. Wait a minute for mail, calendar, and contacts to sync.

Android — recommended (Outlook app):

1. Install Microsoft Outlook from Google Play and open it.
2. Tap Add account, enter your work email, tap Continue.
3. Enter your password and approve the MFA prompt.
4. Complete any "register device" / Company Portal step if prompted.
5. Wait for the inbox to populate.

If your company uses Exchange via the built-in Mail app instead:

• iOS: Settings → Mail → Accounts → Add Account → Microsoft Exchange → enter email → sign in → approve MFA.
• Android: Settings → Accounts → Add account → Exchange / Corporate (varies by phone) → enter email → sign in.

What to do

If you have NOT interacted with it:

1. In Outlook → select message → Home tab → Report dropdown → "Report Phishing".
2. Or: forward email as attachment to your IT phishing inbox (e.g., phishing@iisupp.net) — drag-drop into a new message to preserve headers.
3. After reporting, delete from Inbox AND Deleted Items.
4. Block the sender if pattern continues (Junk → Block Sender).

If you HAVE clicked a link:

1. Don't enter anything; close the tab/window.
2. Run a full antivirus scan: Windows Security → Virus & threat protection → Scan options → Full scan.
3. Report the email to IT — escalate.

If you HAVE entered credentials:

1. Immediately change your password from a known-good device.
2. Sign out of all sessions: https://mysignins.microsoft.com → Sign out everywhere.
3. Notify IT immediately — escalate to L2/L3.
4. Watch your inbox for unexpected sent items, mailbox rules, MFA-prompts.

If you HAVE replied with information (BEC):

1. Do NOT engage further.
2. Notify IT and finance leadership — wires can sometimes be reversed within 24h.
3. File an IC3 report (US) or local equivalent if money was sent.

What to do

Cached creds on phone (Outlook / ActiveSync):

• Have user remove + re-add the work profile / mail account on phone with new password.
• For Intune-enrolled phones, force update profile.

Mapped drive with saved cred:

• On caller machine: cmdkey /delete:server.domain.local.
• Reconnect drive with current creds (or via GPO).

Scheduled task with old password:

• Task Scheduler → identify tasks running as user → Actions → update creds.

Wi-Fi enterprise SSID:

• Forget + reconnect with current creds.

Service account:

• Find every place the password is used (DSC, SCCM, scripts, services).
• Change all in coordination, then reset AD password.
• Best practice: convert to Group Managed Service Account (gMSA) — auto-rotated.

Brute force:

• Check 4625 source IPs and counts. If external, escalate to L3/Security.
• Consider implementing Smart Lockout in Azure AD / Microsoft Defender for Identity.

What to do

If password recently changed:

• Sign in fresh on each Office app; for Outlook, also: File → Account Settings → Email → Change → re-enter.

If MFA prompt is missed:

• Open Microsoft Authenticator app on phone — manually scroll for any pending request, approve.
• Or use https://aka.ms/mfasetup to verify methods are current.

If account locked (AADSTS50053):

• Wait 30 minutes for soft unlock OR request L2 to unlock via Azure AD admin.

If Conditional Access block (AADSTS53003):

• Compliant device required — verify Intune / Endpoint enrollment status.
• Or switch to a compliant network if location-based.

If clock skew:

• Reset time via Settings; also check BIOS clock if persistent (laptop battery often dead).

What to do

> Section 5 is for a senior engineer running the project. Irreversible steps (domain move, MX cutover) require sponsor sign-off; vendor engagement is noted.

1. Prepare the target tenant: licensing, provisioned users/groups, SharePoint/Teams scaffolding, security/compliance settings, and verified routing domains.
2. Pilot migration: migrate a representative pilot group end-to-end (mail, OneDrive, SharePoint, Teams), validate fidelity and permissions, and measure throughput vs throttling. Fix issues before scaling.
3. Pre-stage bulk data: run incremental/pre-sync passes so the final delta at cutover is small (lowers downtime). Stagger batches within throttling limits.
4. Stand up coexistence: enable cross-tenant mail routing and free/busy so users in both tenants interoperate during a staged move.
5. Cutover (the irreversible part — sponsor sign-off): schedule the maintenance window; perform the final delta sync; move the custom domain (remove from source, verify in target) and cut MX/Autodiscover/SPF/DKIM/DMARC/CNAME DNS to the target. Sequence carefully — the domain can exist in only one tenant at this moment.
6. Engage vendors for blockers: the migration-tool vendor for fidelity/permission/throttling issues; Microsoft/Google for tenant-side domain-move, throttling, or routing problems.
7. Hold a rollback plan: keep the source tenant intact and data retained until validation passes; define per-batch rollback (re-point routing back, re-enable source) so a failed batch doesn't strand users. True cutover rollback is costly — minimize risk with pilot + pre-staging rather than relying on it.

What to do

If wrong account signed in:

1. File → Account → Sign Out → confirm.
2. Close all Office apps (verify in Task Manager).
3. Reopen Word, sign in with correct work email.
4. Activation completes silently if license is assigned.

If duplicate installs:

1. Settings → Apps → Installed apps.
2. Uninstall any non-current Office version.
3. Repair the M365 install: right-click Microsoft 365 Apps → Modify → Quick Repair (then Online Repair if needed).

If proxy / network blocking activation:

1. Confirm device can reach https://officeclient.microsoft.com, https://login.microsoftonline.com, https://activation.sls.microsoft.com.
2. On corporate proxy, request whitelisting per Microsoft's published M365 endpoint list.

If license truly missing:

1. Tenant admin (or L2): M365 admin center → Users → Active users → user → Licenses & apps → ensure correct SKU assigned.
2. After assignment, allow up to 30 minutes for propagation; user signs out + back in.

What to do

Path A — Replace consumer router with prosumer Wi-Fi 6E / 7 mesh (most offices < 5,000 sq ft):

1. Pick a mesh kit:

• TP-Link Deco BE85 (Wi-Fi 7, $999/3-pack) — best value for 4,000-6,000 sq ft.
• eero Pro 7 (Wi-Fi 7, $599-1,499) — easiest setup, Amazon ecosystem.
• Ubiquiti UniFi Express 7 Pro (Wi-Fi 7, $279 per AP + $199 dream router) — best for offices wanting VLANs and growth.

1. Set 3 SSIDs minimum:

• iisupp-corp — WPA3-SAE only, VLAN 10
• iisupp-iot — WPA2/WPA3 mixed (some smart devices still need WPA2), VLAN 20, isolated
• iisupp-guest — WPA3-SAE + captive portal, VLAN 30, internet-only

1. Configure band steering: prefer 6 GHz for Wi-Fi 6E/7 clients, 5 GHz for older devices, 2.4 GHz only for IoT.
2. Enable MLO (Multi-Link Operation) for Wi-Fi 7 clients — gives 30%+ latency improvement on video calls.

Path B — UniFi structured deployment (offices > 5,000 sq ft, multi-floor, or compliance):

1. UniFi Dream Machine Pro Max + 3-6 U7 Pro APs ($1,400-3,000 hardware).
2. Cat6A drops to each AP location, PoE+ injectors or PoE switch.
3. Site-to-site VPN to remote workers, RADIUS for 802.1X enterprise auth on iisupp-corp SSID.
4. ~2-day install for licensed cable + AP placement.

Path C — Cheapest stop-gap (until budget allows replacement):

1. Buy a single ASUS RT-AX86U Pro ($230) — Wi-Fi 6, supports WPA3.
2. Replace ISP-supplied router. Keep ISP modem in bridge mode.
3. Configure: WPA3-SAE primary SSID + WPA2/WPA3 transitional for legacy IoT.

What to do

Self-service reset (SSPR):

1. From sign-in page, click "Can't access your account?" / "Forgot password?".
2. Enter UPN (email) and the captcha.
3. Pick a verification method (phone text, phone call, Authenticator code, or email).
4. Receive code → enter.
5. Set new password (must satisfy: min length 8, mix of upper/lower/number/symbol, not reused).
6. Wait 30 seconds for sync.
7. Sign in.

For a Windows-joined device, when a remote user resets cloud password but local cache is stale:

• Connect to corporate VPN, then lock + unlock with new password to refresh local cached credentials.
• Or: use "Reset password" link on Windows lock screen if SSPR-from-Windows is enabled.

For password expired:

• Sign-in normally prompts "Your password has expired" — change in-flow.
• If sign-in screen doesn't show option: log in via web (office.com), it'll prompt there.

What to do

A. Enroll a passkey on Windows (Windows Hello as the passkey):

1. Go to your account security/My Sign-Ins page (for M365: https://aka.ms/mysignins → Security info).
2. Choose Add sign-in method → Passkey (or "Security key / Passkey").
3. When prompted "Where do you want to save this passkey?", choose This device (Windows Hello).
4. Approve with your fingerprint, face, or Hello PIN. The passkey is now stored in the PC's secure hardware (TPM).

B. Enroll a passkey on a phone (phone-as-passkey):

1. On the account security page on your computer, choose Add passkey → iPhone, iPad, or Android device (or "Use a different device").
2. A QR code appears on the computer screen.
3. Scan the QR code with the phone's camera. The phone connects over Bluetooth (keep both devices close and Bluetooth on).
4. Approve on the phone with Face ID / fingerprint / screen lock. The passkey is saved to the phone's keychain (iCloud Keychain on iPhone, Google Password Manager on Android).

C. Enroll a roaming passkey on a security key (USB/NFC FIDO2 key):

1. Choose Add passkey → Security key.
2. Insert the USB key (or tap an NFC key to the device).
3. Create or enter the key's PIN, then touch the gold disc/sensor to confirm presence.
4. The passkey now lives on the physical key and works on any device you plug it into.

D. Sign in with a passkey afterward:

1. At the sign-in screen, enter the username (or it may be remembered), then choose Sign in with a passkey / other ways to sign in → Passkey.
2. For a device passkey: approve with Hello/Touch ID/PIN.
3. For a phone passkey on a different computer: choose "phone," scan the QR with the phone, approve on the phone.
4. For a security key: insert/tap the key, enter its PIN, touch the sensor.

What to do

To deliver Wi-Fi 7 throughput to clients that support it:

1. Use single SSID with band steering rather than separate 6 GHz SSID. Modern routers do this well (eero, Deco, UniFi U7 Pro).
2. Enable 320 MHz channel width on 6 GHz radio (router admin → 6 GHz → channel width: 320 MHz auto). 320 MHz only available in 6 GHz.
3. Enable MLO (Multi-Link Operation) — clients can use 2.4 / 5 / 6 GHz simultaneously, ~30% latency drop, much smoother for video calls. Requires Wi-Fi 7 on both ends.
4. Enable 4K-QAM — higher modulation = more throughput on short range. Most Wi-Fi 7 routers ON by default.
5. Use WPA3-SAE or WPA3 + WPA2 transitional. 6 GHz spec requires WPA3 — Wi-Fi 7 clients refuse WPA2-only on 6 GHz.

For older clients on the same network:

• Wi-Fi 6E client → 6 GHz, max ~1.6 Gbps real-world.
• Wi-Fi 6 client → 5 GHz, max ~800 Mbps real-world.
• Wi-Fi 5 client → 5 GHz, max ~400 Mbps real-world.
• Wi-Fi 4 / b/g/n client → 2.4 GHz, max ~50 Mbps real-world.

Common upgrades to unlock Wi-Fi 7 on existing fleet:

1. Replace internal Wi-Fi card on desktop / older laptop: Intel BE200/202 (M.2 module, ~$30) → upgrades a Wi-Fi 6E laptop to Wi-Fi 7 if mainboard + driver support it. Check vendor / Linux kernel compat.
2. USB Wi-Fi 7 adapter for desktops: not many shipping yet (early 2026), early ones from MediaTek, ASUS.
3. For phones / iPads: no upgrade path — must buy newer hardware.

What to do

1. Onboarding (issue): Every agent gets a dedicated, named non-human/service identity — never a person's login, never a broad shared account.
2. Least privilege: Grant only the specific scopes/tools the agent needs for its job; deny by default and add narrowly.
3. Secrets management: Store credentials in a secrets store (not in code/config/chat). Use short-lived, scoped tokens where possible.
4. Rotation: Define and automate a rotation schedule for keys/secrets; rotate immediately on suspected compromise or after an incident (t4-aigov-002).
5. Lifecycle binding: Tie the identity's existence to the agent's lifecycle in the register — created when the agent is approved, reviewed periodically.
6. Offboarding (deprovision): When an agent is retired or re-scoped, disable its identity, revoke and delete its keys/tokens, and remove its access. Confirm no orphaned credentials remain.
7. Attribution: Per-agent identities also enable cost attribution (t4-aigov-004) and clean audit trails (t4-aigov-003).

What to do

Device not compliant:

• Have user open Company Portal → Check status. Resolve any flagged item (encryption, updates).
• Or: temporarily exclude user from policy for break-fix; re-include after device fixed.

Policy misconfiguration (target/exclude wrong):

• Edit policy → Users → adjust group inclusion/exclusion.
• Bring up CA "What If" tool to verify before save.

Location-based block (legitimate user travel):

• Add the user's country to a Trusted Locations or excluded location for the policy.

Break-glass scenario:

• Use the documented break-glass account (always excluded from all CA policies) to make the change.
• After fix, audit-log the use.

Token theft suspicion:

• Revoke sessions: Revoke-MgUserSignInSession -UserId <id>.
• Reset password.
• Investigate sign-in logs for foreign IPs / devices.

What to do

Setting up MFA for the first time:

1. Visit https://aka.ms/mfasetup (or follow the prompt during sign-in).
2. Click "Add sign-in method" → choose Microsoft Authenticator.
3. Install Microsoft Authenticator on phone (iOS App Store / Google Play).
4. In the app: Add account → Work or school account → Scan QR code shown on the website.
5. Approve the test prompt.
6. Add a backup method (phone number for text, in case device lost).

New phone (old phone still works):

1. Install Authenticator on new phone.
2. On old phone, in Authenticator: Settings → Backup → ensure cloud backup ON (with iCloud / Microsoft account).
3. On new phone, in Authenticator: Begin recovery → sign in with same recovery account → entries restore.
4. Re-verify each entry — Authenticator may require re-verification on new device.

New phone (old phone gone):

1. Try sign-in with backup method (text/call to phone number on file).
2. If backup works → https://aka.ms/mfasetup → remove old Authenticator entry → add new.
3. If no backup methods work → Escalate (admin reset).

Lost phone, no backup methods:

1. Submit identity verification request to IT (photo ID, manager confirmation per policy).
2. Admin (L2) clears MFA registration via Entra portal.
3. User signs in once with password only → re-enrolls fresh.

What to do

A. Sign in with a backup method (preferred — no admin needed):

1. At sign-in, choose Other ways to sign in / I can't use my passkey.
2. Pick a remaining method: a second passkey, the Microsoft Authenticator app, or a text/call to a registered phone number.
3. Complete sign-in with that method.

B. Register a new passkey on the replacement device:

1. Once signed in, go to Security info (work/school: https://aka.ms/mysignins → Security info; personal: account.microsoft.com → Security → Advanced security options).
2. Choose Add sign-in method → Passkey and follow l1-passkey-001 to enroll on the new device or phone.

C. Remove the lost device's passkey from the account:

1. In Security info / sign-in methods, find the entry for the old/lost device (named by device, with the date added).
2. Select it and choose Delete / Remove. This revokes that passkey so a thief cannot use it.
3. Repeat for any other stale entries.

D. All passkeys lost and NO backup method (admin reset):

1. Contact IT to verify identity per policy (photo ID, manager confirmation).
2. An admin (L2) resets the account's authentication methods in Entra.
3. The user signs in with the temporary method provided, then immediately enrolls a fresh passkey and a second backup method.

What to do

Windows (OOBE / Autopilot):

1. Power on; choose region and keyboard.
2. Connect to Wi-Fi or Ethernet.
3. At the sign-in screen, enter your work email and password, then approve the MFA prompt.
4. Let the device run "Setting up your device / account" (Autopilot Enrollment Status Page) — it applies security settings and installs core apps. Leave it plugged in and online.
5. When you reach the desktop, open the Company Portal / Software Center (if present) to install any optional apps you need.
6. Sign in to OneDrive so your files start syncing; sign in to Outlook and Teams.

macOS (company-enrolled):

1. Power on; choose region, keyboard, and connect to a network.
2. Sign in / complete Remote Management / enrollment when prompted (this registers the Mac with the company).
3. Create your local account, then sign in to Microsoft 365 apps (Outlook, Teams) with your work account and approve MFA.
4. Let managed apps install, then sign in to OneDrive to sync files.

What to do

• Capture SAML / OIDC trace: SAML-tracer Firefox / Chrome ext, or browser DevTools network.
• Decode SAML assertion: Base64 → XML; or jwt.io for OIDC tokens.
• Verify timestamps (not before / not on or after).
• Verify signatures with IdP cert.
• Verify Audience / Issuer / Subject.

What to do

A) Add an existing user to an already-integrated app (most common):

1. Entra ID → Enterprise applications → select the app → Users and groups → Add user/group.
2. Prefer adding the user to the security group that grants the app (group-based access) rather than a direct assignment — it scales and audits cleanly.
3. Assign the correct role if the app exposes app roles.
4. If the app uses SCIM provisioning, confirm the user appears in Provisioning → on-demand provision (provision them on demand to avoid waiting for the sync cycle).
5. Confirm a license is assigned if the app requires one.

B) Onboard a brand-new SaaS app to SSO (SAML):

1. Entra ID → Enterprise applications → New application → search the gallery; if present, add it (pre-built claims). If not, "Create your own application" → non-gallery.
2. Single sign-on → SAML. Exchange metadata with the app owner:

• Give the app the IdP metadata / Login URL / Entity ID / signing certificate.
• Enter the app's Reply URL (ACS), Identifier (Entity ID), and Sign-on URL.

1. Set Attributes & Claims to match what the app keys on (commonly NameID = user.mail or user.userprincipalname).
2. Download the federation metadata XML (or Base64 cert) and hand it to the app owner to finish their side.
3. Assign the pilot user/group under Users and groups and test.

C) Turn on automatic provisioning (SCIM) so accounts auto-create:

1. App → Provisioning → mode Automatic → enter the app's Tenant URL and Secret Token (from the SaaS admin).
2. Test Connection, map attributes, set scope to "assigned users and groups", then turn provisioning On.

What to do

1. If nothing has happened yet: halt the request, verify out-of-band, and only proceed once identity is independently confirmed.
2. Callback verification: hang up and call back on a number from your own directory/records, never a number the caller supplied.
3. Use a verification challenge: a pre-agreed code word/passphrase or a question only the real person can answer (and that is not findable online).
4. Enforce dual-control for money/credentials: any wire, banking-detail change, credential reset, or MFA bypass requires a second approver and out-of-band confirmation — no single-call authorization.
5. If action already taken (fraud in progress):

• For wires: contact the bank immediately to recall/freeze; time is critical.
• For credentials/MFA: treat as account compromise — reset, revoke sessions/tokens, investigate access.
• Engage security IR and management.

1. Report: preserve the voicemail/call details and report internally (and to relevant authorities/bank as appropriate).

What to do

> Section 5 is for a senior network/security engineer, frequently in a bridge with the ISP and DDoS vendor. Upstream engagement is mandatory at scale.

1. Engage the ISP and DDoS-protection/scrubbing vendor early to divert traffic through scrubbing (often via DNS redirection or BGP advertisement to the scrubbing center) and to apply upstream filtering. This is the primary lever for volumetric attacks.
2. Volumetric: request upstream rate-limiting/filtering; as a blunt last resort, remote-triggered black-hole (RTBH) of the targeted IP at the ISP drops all traffic to it (it sacrifices that IP to save the rest of the network — a deliberate trade-off, decided with the ISP).
3. Protocol/state-exhaustion: enable SYN cookies, tune connection/rate limits, drop malformed/fragmented traffic, and lean on stateful protections at the edge/scrubber.
4. Application-layer (L7): front the service with a CDN/WAF; apply rate-limiting, challenge/CAPTCHA or JS challenges, bot management, and targeted rules for the abused endpoints. Hide/relocate the origin and restrict it to accept only CDN/WAF traffic.
5. Tactical filters: apply geo/ACL/source filtering only when it reliably separates attack from legitimate traffic — the goal is keeping real users up, so avoid over-broad blocks that cause self-inflicted outage.
6. If exploited as cover for intrusion, run incident response in parallel (l3-security-001). For ransom-DDoS, do not communicate with or pay attackers without leadership/legal direction.

What to do

> Section 5 is for a senior responder, ideally the external IR firm. Acquisition must preserve integrity (write-blocking, hashing, custody). Mandatory human/vendor/legal engagement is called out.

1. Engage the external IR firm, legal/privacy counsel, and cyber-insurance now. Insurance often dictates approved vendors and notification timing; legal involvement helps preserve privilege. This step gates the rest.
2. Acquire volatile data first: capture a memory image from the live, isolated system using forensically sound tooling before any shutdown; record running processes/connections. Memory is lost the instant power is removed.
3. Acquire disk images as forensic (bit-for-bit) copies using write-blocking; compute and record cryptographic hashes of each image to prove integrity. Work from copies — never investigate on the original.
4. Establish chain of custody: label evidence, record every handler/transfer with timestamps, and store securely. Gaps in custody can render evidence unusable.
5. Preserve cloud/SaaS and identity evidence (audit logs, sign-in logs, mailbox/audit exports, snapshots) per provider guidance before retention windows expire.
6. Build the timeline from preserved sources to establish initial access, scope, and impact — this drives the eventual eradication/recovery in l3-security-001, which only proceeds once evidence is secured and IR approves.
7. Coordinate law-enforcement notification where applicable through legal — do not contact attackers; preserve any extortion communications as evidence.

What to do

1. Provision under management: enroll via the supported path; apply passcode/lock, encryption where available, app controls, and managed updates.
2. Secure access + loss handling: scope corporate access to the minimum; ensure a remote lock/wipe or access-revoke path for lost/stolen units.
3. Stabilize connectivity: fix pairing/coverage issues; plan failover where field reliability matters (t4-frontier-004) and cellular where needed (t4-frontier-003).
4. Apply data minimization + privacy: collect only what the use case needs; define storage, retention, and access for sensor data; obtain consent where required; restrict location/health-adjacent data per policy.
5. Plan battery/charging logistics for shifts; standardize a clean reset/handoff for shared units.
6. Document setup, common fixes, and the privacy/data-handling posture.

What to do

What you should do:

1. Report the loss to IT/security through the normal channel as your first action.
2. From a trusted device, change your account password and sign out of all sessions where the option exists (for example, in your account security page).
3. If the device had cellular service and is a phone, consider asking your carrier to suspend the SIM (IT can advise).
4. If theft is involved, file a police report and keep the report number — IT and insurance may need it.

What IT does (so you know what to expect):

1. Revoke active sessions and tokens so existing sign-ins on the device stop working.
2. Remote lock or remote wipe the device through MDM (for example, Microsoft Intune) or Find My — this can lock the screen and erase company data remotely once the device is online.
3. Reset or require re-registration of MFA if the device was an authenticator.
4. Disable or reset the account temporarily if needed, then re-enable once you are secured.
5. Confirm disk encryption (BitLocker on Windows, FileVault on macOS) so that even if the disk is removed, the data stays unreadable.

What to do

Path A — Upgrade to the latest supported macOS for the hardware (preferred):

1. System Settings → Software Update → install the offered upgrade.
2. Back up first via Time Machine to an external drive.
3. Verify essential apps still work post-upgrade before retiring the old install.

Path B — Replace the Mac (recommended for business-critical use):

• Mac mini M4 ($599) is the cheapest path to a current Mac that will get OS support through ~2032.
• MacBook Air M3 ($999-1,299) for portability.
• All current Macs are Apple Silicon — confirm any business app has an Apple Silicon native or Rosetta-compatible build before buying.

Path C — OpenCore Legacy Patcher (technician judgment, NOT for compliance / regulated use):

1. Free open-source tool that patches macOS Ventura / Sonoma onto Macs Apple dropped (2009-2017 hardware).
2. Risks: kernel patches may be unstable; Apple updates may break the patch; no Apple support; some peripherals (T2 chip Macs, certain Wi-Fi cards) lose features.
3. Reasonable for personal / home use or single-purpose machines. Do NOT use for regulated data or production line.

Path D — Browser + app workarounds (until budget allows replacement):

1. Switch to Firefox ESR for sites that reject Chrome 116.
2. Use webmail / web-based versions of apps instead of native (Outlook web, Zoom web client, etc.).
3. Move banking / sensitive sites to a phone or a modern computer.
4. Never enter banking credentials on an unsupported OS — keyloggers / malware risk is real.

What to do

Mitigations are defense-in-depth; no single control is sufficient.

1. Contain first if active: treat as an incident — disable the agent and revoke tokens (t4-aigov-002).
2. Input handling: separate and clearly delimit untrusted content from instructions; do not let retrieved/external text be treated as commands. Sanitize/strip active content where feasible.
3. Least privilege & least agency: give the agent only the tools and data scopes it truly needs (t4-aigov-005). Remove powerful tools from agents that read untrusted content.
4. Human-in-the-loop for high-impact tool actions (send, transfer, delete, deploy) so an injected instruction cannot act unattended.
5. Output handling: validate, encode, and constrain model output before any downstream use; never execute or render it raw.
6. Isolation/sandboxing: run tool execution in constrained environments with egress controls so exfiltration paths are limited.
7. RAG hygiene: enforce per-user authorization on retrieval (the model must not surface data the user cannot access); keep secrets out of prompts/context; vet ingested documents.
8. Monitoring: alert on anomalous tool calls, unexpected outbound data, and signs of instruction-override in inputs.
9. Test continuously: red-team with injection payloads (reference OWASP LLM Top 10 and MITRE ATLAS techniques) before and after deploy.

What to do

1. Restore the edge node within IT's scope: fix power/boot/disk/network, restart the gateway/collector service, restore from a known-good image/config — never modify control or safety logic.
2. Fix network/segmentation so authorized OT↔IT flows work while keeping OT segmented from general IT (Purdue-model layering as a reference design).
3. Coordinate OT actions: any change to the robot/cobot/PLC or safety system is performed or approved by OT/controls engineering, with IT supporting the network/edge side.
4. Validate before re-enabling motion: the device is only returned to operation by qualified OT staff after safety checks — IT does not "turn the robot back on."
5. Security hardening (advisory): segment OT, restrict remote access, patch within OT change windows (with OT approval), and monitor — handle suspected incidents via t4-aigov-002.
6. Document the fault, the IT-scope actions taken, and the OT-owned actions, in a shared record.

What to do

Path A — Migrate off Windows 7 (preferred):

1. Buy a Windows 11 license + capable hardware (TPM 2.0, Secure Boot, 8 GB RAM minimum, 256 GB SSD).
2. Re-install / upgrade the LOB app if a newer version exists. Pay vendor for upgrade if needed.
3. Test on the new machine for 5 business days before retiring the Win 7 box.

Path B — Isolate Windows 7 (when migration is genuinely blocked):

1. Disconnect from the internet. Pull the Ethernet cable. Disable the Wi-Fi adapter in Device Manager.
2. Move to an isolated VLAN. On the router/switch, assign this PC's MAC to a VLAN with no internet route and no access to other internal devices except the specific server/printer it needs.
3. Disable unused services: RDP, SMB v1, remote registry, Windows Remote Management. Open services.msc and set each to Disabled.
4. Local user only. Don't domain-join. Don't use the same password as any modern account.
5. USB lockdown. Block USB mass storage in Group Policy (gpedit.msc → Computer Configuration → Administrative Templates → System → Removable Storage Access → Removable Disks: Deny all access).
6. Block outbound traffic. Windows Firewall → Outbound rules → Block all programs except the specific LOB app's required endpoints.
7. Image the disk monthly so a hardware failure doesn't kill the LOB app for good. Use Macrium Reflect Free (still supports Win 7) or a simple dd image to an external drive.

Path C — Virtualize Windows 7 on a modern host:

1. P2V (physical-to-virtual) using Disk2VHD (Microsoft Sysinternals) or VMware Converter.
2. Move the VHDX/VMDK file to a Windows 11 host running Hyper-V or VMware Workstation Player.
3. Boot the VM. Set its virtual network to "Internal only" (no external NAT).
4. Connect the legacy peripheral via USB passthrough on the host.

What to do

> Section 5 is senior-engineer execution under an approved emergency change. Decision authority and vendor engagement points are mandatory where noted.

1. Apply interim mitigations immediately on exposed assets where no patch exists or patching will take time: restrict access (ACL/firewall/geo), disable the vulnerable feature, deploy WAF/IPS virtual-patch signatures, or isolate. Document each compensating control.
2. Invoke the emergency change process (not the normal cycle) with security leadership/CISO approval. Capture risk acceptance, rollback plan, and comms.
3. Deploy the patch in rings (ring-0 → broad): pilot on a small, representative ring to catch breakage, then accelerate to the full fleet. For critical internet-facing assets, prioritize speed over broad pilot soak — leadership owns that trade-off.
4. Engage the vendor for guidance/fixed builds, especially appliances and anything where the mitigation or upgrade path is non-obvious; follow vendor severity-1 channels.
5. If compromise is confirmed, stop treating this as patching and follow the incident-response runbook (l3-security-001) and forensic preservation (l3-forensics-001) — contain, preserve evidence, then eradicate and recover. Do not wipe assets you may need as evidence.
6. Track unpatched/EOL stragglers with continued compensating controls and a remediation/replacement plan; nothing exposed should be left both unpatched and unmitigated.

What to do

1. On client: ipconfig /all — confirm DNS servers point to internal DCs.
2. nslookup <internal-host> — check authoritative response.
3. nslookup _ldap._tcp.dc._msdcs.<domain> — should list DCs.
4. On DC: dcdiag /test:dns /v — comprehensive DNS health.
5. Get-DnsServer | fl and check zones.
6. repadmin /replsummary — replication health.

What to do

• ping -t <host> — quick loss/latency check.
• mtr -i 1 -c 100 <host> (or pathping/tracert) — per-hop loss.
• iperf3 — throughput between two endpoints.
• Test-NetConnection -InformationLevel Detailed — RTT + port + diagnostic.
• Packet capture: Wireshark, Microsoft Message Analyzer.

What to do

1. Validate the use case vs. Wi-Fi: confirm private cellular is justified (coverage/mobility/determinism/density) rather than a Wi-Fi tuning problem.
2. Confirm spectrum authorization for the region/site (e.g., CBRS-style shared access in the US — reference only; rules vary by country).
3. Diagnose attach failures: check SIM/eSIM provisioning in the mobile core, the device's subscription profile, and that the radio is broadcasting the correct network identity.
4. Assess coverage/capacity: RF survey for radio count/placement; account for obstructions and device density; verify core capacity.
5. Check integration: routing, IP assignment, DNS, security/segmentation, and internet egress from the private network.

What to do

1. Fix line-of-sight: relocate/raise the antenna to clear obstructions; secure the mount against movement/wind.
2. Engineer failover: configure SD-WAN or dual-WAN with reliable health checks so cutover is automatic and fast; prioritize critical traffic on the backup path's limited capacity.
3. Handle CGNAT: where inbound/VPN is required, use an outbound-initiated/overlay approach (e.g., VPN that tolerates CGNAT) or a public-IP option from the provider if available.
4. Protect real-time apps: apply QoS, accept that voice/video may degrade on the variable path, and set user expectations for failover periods.
5. Mitigate weather fade: ensure adequate antenna siting; treat brief weather drops as expected and design apps to reconnect gracefully.
6. Document the design including which traffic is protected, expected backup performance, and failback behavior.

What to do

If APIPA (169.254.x.x):

• Router restart fixes ~70%. If persists, check router DHCP scope (admin) or pool exhaustion (more devices than scope).

If DNS-only failure (you can ping IPs but not load sites):

1. Settings → Network → Wi-Fi → adapter properties → Edit DNS → Manual → IPv4: 1.1.1.1 and 8.8.8.8.
2. ipconfig /flushdns.
3. Re-test web.

If wrong password saved:

• Forget + reconnect with correct password.

If captive portal (hotel/airport):

• Open browser → navigate to any HTTP site (try neverssl.com) → portal page should auto-redirect → log in.

If driver:

• Device Manager → Network adapters → Wi-Fi adapter → right-click Update driver → Search automatically.
• For Intel/Realtek, get latest from OEM support page.

If adapter disabled:

• Device Manager → adapter → Enable.
• Or: Settings → Network → adapter properties → Enable.
• Hardware Wi-Fi switch / Fn-key combo: re-enable.

What to do

Windows — stop the adapter from powering down (most common fix):

1. Device Manager → Network adapters → right-click your Wi-Fi adapter → Properties → Power Management tab → uncheck "Allow the computer to turn off this device to save power" → OK.
2. Settings → System → Power & battery → set Power mode to Balanced (not Best power efficiency) while troubleshooting.

Windows — lock to the stronger band / stop roaming churn:

1. Device Manager → Wi-Fi adapter → Properties → Advanced tab.
2. Set Roaming Aggressiveness / Roaming Sensitivity to Low / 1.
3. If 2.4 GHz is congested and 5 GHz reaches the desk, set Preferred Band to 5 GHz (Prefer 5 GHz).

Windows — refresh the driver:

1. Device Manager → Wi-Fi adapter → right-click → Update driver → Search automatically.
2. If still flaky, download the latest driver from the laptop maker's support site (Dell/HP/Lenovo ship newer Wi-Fi firmware than Windows Update).

Windows — clear a bad network stack (if drops persist):

1. Open Command Prompt / PowerShell as admin and run, in order:

• netsh winsock reset
• netsh int ip reset
• ipconfig /flushdns

1. Reboot.

macOS — rebuild Wi-Fi settings:

1. System Settings → Wi-Fi → Details → Forget the network → re-join.
2. If it keeps dropping: remove and re-add Wi-Fi in System Settings → Network, then reboot. (On older macOS, deleting the SystemConfiguration network preference files achieves the same — L2 task.)

What to do

1. Band strategy: treat 2.4 GHz as coverage-only (use channels 1/6/11 at low density, often reduced power or disabled radios), put capacity on 5 GHz, and use 6 GHz (Wi-Fi 6E/7) for clean, high-capacity zones where clients support it.
2. Channel width: prefer 20 or 40 MHz on 5 GHz in dense deployments — wider 80/160 MHz channels boost peak speed but cause overlap and co-channel contention. Reserve wide channels for low-density/6 GHz.
3. AP placement & density: place APs for cell overlap (~15–20%) without excessive co-channel reuse; favor more APs at lower power over fewer at high power. Avoid mounting above hard ceilings/metal; keep away from large RF blockers.
4. Tune power: lower 2.4 GHz and trim 5 GHz TX power so cells are appropriately sized and clients roam instead of sticking.
5. Reduce interference: re-channelize to break co/adjacent-channel overlap; eliminate or relocate non-Wi-Fi sources; handle DFS flapping by selecting stable channels where radar is frequent.
6. Fix roaming: ensure consistent SSID/security across APs, enable roaming-assist features (e.g. 802.11k/v/r where clients support them), and right-size cells so handoff happens.
7. Fix backhaul: correct uplink speed/duplex, PoE budget, and switch errors before blaming RF.
8. Validate with a fresh active survey along the same path.

What to do

1. Enroll under management: bring devices into MDM in an appropriate mode (often kiosk/single-app for field use); apply security baselines, app allow-lists, and managed updates.
2. Provision apps + identity: deploy the AR/remote-assist app, configure SSO/identity, and lock down to intended use.
3. Ensure connectivity: verify Wi-Fi/cellular coverage and quality where used; add failover where field reliability matters (t4-frontier-004).
4. Optimize the environment: improve lighting/markers where tracking struggles; plan battery swaps/charging for long shifts.
5. Govern privacy: define and enforce camera/mic policy — recording rules, consent, sensitive-area restrictions, and data handling/retention; disable capture where not permitted.
6. Support workflow: document setup, common fixes, and a clean return-to-service/wipe process for shared devices.

What to do

If a recent update is suspected:

1. Settings → Windows Update → Update history → Uninstall updates → remove the most recent quality update.
2. Reboot and use the PC normally for 30 min to confirm stability.

If a recent driver is suspected:

1. Open Device Manager (devmgmt.msc).
2. Locate the suspect device (yellow warning icon, or recently updated by date).
3. Right-click → Properties → Driver tab → Roll Back Driver.
4. Reboot.

If random / no clear cause:

1. Run sfc /scannow from elevated Command Prompt (System file checker).
2. Run DISM /Online /Cleanup-Image /RestoreHealth.
3. Run Windows Memory Diagnostic (mdsched.exe) — schedules a reboot test.
4. Run chkdsk C: /f /r — schedules at next reboot.
5. Check Event Viewer → Windows Logs → System for "BugCheck" entries; record full stop code and parameters.

What to do

If pairing keeps failing on Windows:

1. Settings → Bluetooth & devices → Devices → click the device → Remove.
2. Put the accessory in pairing mode (usually hold the action button for 5–7 seconds until the LED blinks fast).
3. Add device → Bluetooth → wait for it to appear.
4. If it still won't appear: Device Manager → Bluetooth → right-click your radio → Disable, wait 10s, Enable.

If headset connects but Teams/Zoom can't hear:

1. Sound settings → Input → pick the Hands-Free profile of the headset (different from the Stereo / A2DP entry).
2. In Teams: Settings → Devices → Speaker AND Microphone → set both to the Hands-Free entry.
3. Audio quality drops to mono on calls — that's expected; Bluetooth can't run hi-fi music and a mic at the same time.

If audio cuts out periodically:

1. Move USB 3 / USB-C dongles 2 feet away from the Bluetooth dongle (USB 3 emits 2.4 GHz noise).
2. Switch your Wi-Fi to 5 GHz if you're on 2.4 GHz.
3. Update the Bluetooth driver from the OEM site (not Windows Update — OEMs often ship newer firmware).

On macOS:

1. Bluetooth menu → ⌥+click for advanced reset → Reset the Bluetooth module.
2. If that fails: System Settings → Bluetooth → forget the device → re-pair.

What to do

If "USB device not recognized" toast keeps appearing:

1. Device Manager → Universal Serial Bus controllers → look for entries with yellow ⚠.
2. Right-click each → Uninstall device. Don't tick "delete driver software" — just uninstall.
3. Action menu → Scan for hardware changes. Windows reinstalls them.

If the device shows as "Unknown device" with code 43:

1. Device Manager → right-click the unknown device → Properties → Driver tab → Uninstall device.
2. Unplug the device, wait 10s, replug.
3. If still code 43 → device or cable is failing on the host side; try another machine to confirm.

If an external drive disappears under load:

1. Powered USB hub fixes most underpowered-port issues. Cheap solution.
2. Self-powered (wall-plug) external drives don't have this problem — switch if available.

Power-saving fix (Windows):

1. Device Manager → Universal Serial Bus controllers → for each USB Root Hub: Properties → Power Management → uncheck "Allow the computer to turn off this device to save power".
2. Reboot.

On macOS:

1. System Information → USB → confirm the device shows up at all. If it doesn't, it's a hardware/cable issue.
2. Reset NVRAM (Intel Macs): shutdown → power on while holding ⌥+⌘+P+R until you hear the second startup chime.
3. Try a different USB-C-to-USB adapter — Apple's official ones are most reliable.

What to do

If above completes successfully:

1. Exit and reboot. Most boot-config issues resolve here.

If BitLocker prompt appears:

1. Retrieve the recovery key from one of:

• User's Microsoft account → https://account.microsoft.com/devices/recoverykey
• Azure AD / Entra ID portal (admin) → Devices → Device → BitLocker keys
• Active Directory (admin) → Computer object → BitLocker tab

1. Enter the 48-digit key.
2. Once booted, run manage-bde -protectors -get C: to confirm protector state, and re-enable TPM protector if needed.

If still stuck:

1. Boot from a Windows 10/11 USB installer.
2. Choose "Repair your computer" → Troubleshoot → System Restore. Pick a restore point from before the failure.
3. Or: Reset this PC → Keep my files (last resort before reimaging).

What to do

Wrong default:

• Settings → Sound → Output → set correct device.

Service not running:

1. Win+R → services.msc.
2. Find "Windows Audio" and "Windows Audio Endpoint Builder" → both should be Running, Automatic.
3. Right-click → Restart.

Driver glitch:

1. Device Manager → Sound, video and game controllers.
2. Right-click your audio device → Uninstall device → check "Delete the driver software" → OK.
3. Reboot. Windows reinstalls automatically.
4. If issue persists, install OEM driver from manufacturer's support page.

Headphone jack stuck "plugged in":

• Sometimes after physical unplug, OS still believes headphones are present. Plug + unplug 2–3 times, or restart.

Bluetooth audio:

• Settings → Bluetooth & devices → device → make sure "Connected voice/audio" is on.
• Re-pair if needed.

After Windows Update broke audio:

• Settings → Windows Update → Update history → uninstall most recent update.
• Or roll back driver: Device Manager → device → Properties → Driver → Roll Back Driver.

What to do

1. Pin or defer the update where the platform supports it: hold the AI feature/model at the last known-good version while you validate the new one (use managed-update controls; do not disable security updates to do this).
2. Roll back to the prior model/app version if a supported rollback path exists and the regression is business-critical.
3. Adapt the workflow when rollback isn't possible: update prompts/templates and any downstream parser to the new output contract.
4. Re-anchor expectations for data/concept drift: refresh examples, adjust the prompt, or request a re-tuned/updated model from the vendor.
5. Stage and validate future AI updates in a test ring before broad rollout (treat AI updates like any other change).
6. Document the known-good versions (app + model + runtime) so the configuration is reproducible.

What to do

Cache / cookies:

1. Ctrl+Shift+Delete → choose "All time" → check Cached images, Cookies, Site data → Clear.
2. Restart browser.

Extension conflict:

1. Disable all → restart browser → re-enable one at a time.
2. Identify culprit; remove or update it.

Reset browser settings:

• Chrome: Settings → Reset settings → Restore settings to original defaults.
• Edge: Settings → Reset settings → Restore.
• Firefox: about:support → Refresh Firefox.

Cert error specifically:

1. Verify clock first.
2. If error says "issuer unknown" and it's an internal corporate site, the corp root CA may not be on this device — escalate to L2 to deploy.
3. Don't override cert warnings unless explicitly directed by IT for known internal site.

Browser crashes on launch:

1. Disable hardware acceleration:

• Chrome: chrome://settings/system → Use hardware acceleration → off.
• Edge: similar.

1. Reinstall: Settings → Apps → uninstall → reinstall fresh from official site.

For Windows: reset HOSTS file if a single site fails:

1. Open Notepad as admin → File → Open → C:\Windows\System32\drivers\etc\hosts.
2. Look for entries with the failing site domain → comment with # or remove.
3. Save → flush DNS: ipconfig /flushdns.

What to do

If startup is the issue:

1. Disable: OneDrive (if not work-required at startup), Spotify, Teams (if not corporate-required), any chat clients, Adobe updaters.
2. Keep: Antivirus, security agents, OEM device manager, Microsoft 365 apps.

If disk space is the issue:

1. Storage Sense → On.
2. Empty Recycle Bin and Downloads folder.
3. Move large files (Videos, ISOs) to OneDrive / external.
4. Run Disk Cleanup as administrator → "Clean up system files" → Windows Update Cleanup, Previous Windows installations, Delivery Optimization Files.

If a process is pegging CPU/disk:

1. In Task Manager, right-click the process → Properties → check Publisher.
2. If unknown publisher and high resource use → suspect malware. Run Windows Defender full scan (Virus & threat protection → Scan options → Full scan).
3. If "Antimalware Service Executable" / MsMpEng.exe — wait, it's an active scan; will subside.
4. If "System" or Ntoskrnl.exe is high — likely driver issue, escalate.

What to do

Standard cleanup:

1. Storage → Cleanup recommendations → run all suggested.
2. Disk Cleanup utility (cleanmgr.exe) → C: → click "Clean up system files":

• Windows Update Cleanup
• Previous Windows installations (Windows.old) — frees 10–30 GB
• Delivery Optimization Files
• Recycle Bin
• Temporary files

OneDrive bloat:

1. Right-click OneDrive cloud icon → Settings → Sync and backup → Free up space (Files On-Demand).
2. Files become cloud-only icons; opens download on click.

Outlook OST too large:

1. File → Account Settings → Account Settings → Data Files tab → see OST size.
2. Reduce: File → Account Settings → Account Settings → Email → Change → Mail to keep offline → reduce slider (e.g., to 6 months).

Browser caches:

• Clear Chrome/Edge/Firefox cache (Ctrl+Shift+Del).

Disable hibernate (saves up to 16 GB on big-RAM laptops):

• Run as admin: powercfg -h off. Note: disables Fast Startup; usually fine on SSDs.

Move large folders:

• Documents/Pictures/Videos: right-click → Properties → Location → move to D: or external.
• For OneDrive users, store in OneDrive instead.

What to do

A. Build the cadence (program):

1. Rings: Pilot/Test → Early adopters → Broad → (Critical/sensitive last). Each ring validates before the next.
2. Cadence: ship monthly quality updates on a fixed schedule after a short soak in the pilot ring; schedule feature updates less often with broader validation.
3. Maintenance windows: define per device class (workstations vs servers) with reboot windows; use deadlines + grace periods to force compliance while respecting user disruption.
4. Emergency / out-of-band: define an expedited path for actively exploited criticals — shorten/skip soak, push to all rings within the SLA, with a documented approver.

B. Tooling (use what's in place, generically):

• WSUS for on-prem approval/distribution; Intune / Windows Update for Business for cloud ring policies and deadlines; Windows Autopatch for managed ring orchestration; third-party patching tools for browsers, runtimes, and apps the OS updater ignores. Pick one authority per scope to avoid conflicting policies.

C. Compliance & measurement:

• Track % of devices at the latest approved patch level by ring, age of oldest missing critical, and failure counts. Surface non-compliant and unreachable devices for remediation.

D. Failed updates:

• Remediate per Troubleshooting (cache reset, servicing repair, reachability). For widespread failures, suspect a bad approval/policy or a source outage and pause the rollout.

E. Third-party app patching:

• Enroll the common high-risk apps (browsers, Java/.NET runtimes, PDF/Office add-ins, conferencing) into the patcher with their own cadence; these are frequent exploit targets.

F. Server cadence:

• Patch servers in a separate, more conservative ring with explicit change windows, HA/failover order, pre-patch snapshots/backups, and a tested rollback.

G. Exceptions & risk acceptance:

• When a patch can't be applied (app incompatibility, legacy system), document the exception: asset, missing patch, business reason, compensating controls, owner, and a review/expiry date. Track it; don't let it become permanent silently.

What to do

1. Give each agent its own key/identity so cost is attributable (ties to t4-aigov-005).
2. Set per-agent budgets and quotas: a daily and monthly cap per agent, sized to its job. Tier 3 agents get tighter scrutiny.
3. Enforce rate caps: maximum calls per minute/hour to blunt runaway loops.
4. Add hard kill behavior: when an agent hits its budget cap, it pauses/disables rather than continuing — a spend kill switch (coordinate with t4-aigov-002).
5. Instrument cost in the audit trail: record tokens/cost per action (t4-aigov-003) so spend is queryable per agent.
6. Alert on velocity, not just totals: notify when spend rate or call rate is anomalous, well before the budget is exhausted.
7. Apply FinOps practice for AI: regular cost reviews, right-size models (smaller/cheaper where adequate), cache where safe, and trim oversized context to cut tokens.

What to do

1. Define what to capture per agent action (minimum set):

• Timestamp, agent ID/version, and triggering identity/event.
• Input/context the agent received (sanitized of secrets/PII where required).
• The decision/plan and, where feasible, the reasoning or chosen path.
• Each tool/API call: name, parameters (redacted as needed), and result.
• Final action taken and its outcome (success/failure).
• Cost/tokens consumed (ties to t4-aigov-004).

1. Centralize logs into an append-only store the agent cannot retroactively edit.
2. Make it tamper-evident: use write-once/append-only storage or hash-chaining/signing so any alteration is detectable. Separate the log-writer identity from the agent's action identity.
3. Set retention per a written policy aligned to business/compliance needs (e.g., a defined number of months/years); document the basis.
4. Build observability: a dashboard (the Aperture concept fits here) showing live agent activity, per-agent action timelines, error/anomaly indicators, and spend.
5. Wire to IR: ensure the audit trail is the first source consulted during incident response (t4-aigov-002) for blast-radius assessment.

What to do

1. Publish an AI Agent Register (the inventory) as the single source of truth; require new agents to be registered before production use.
2. Adopt a tiered control matrix:

• Tier 1: registration, basic logging, owner named.
• Tier 2: above + scoped service identity, audit trail (see t4-aigov-003), rollback plan.
• Tier 3: above + mandatory human-in-the-loop approval, spend guardrails (see t4-aigov-004), incident runbook (see t4-aigov-002), and sign-off by the business owner before launch.

1. Implement an approval gate: a lightweight intake/review where a new or changed Tier 2/3 agent is assessed against the matrix before it can act.
2. Require human-in-the-loop for irreversible or high-impact actions — the agent proposes, a human confirms.
3. Document the policy (1–3 pages): scope, definitions, tiers, required controls per tier, owner responsibilities, and the review cadence (e.g., quarterly).
4. Schedule a recurring review of the register and tiers; retire or re-scope agents that no longer have a clear owner or purpose.

What to do

Follow the IR phases in order. Speed of containment beats perfect diagnosis.

1. Contain (immediately):

• Disable the agent (stop the process / flip its kill switch / disable the schedule).
• Revoke its credentials and tokens so it cannot act even if it restarts.
• Cut tool/API access (disable the service account, rotate the key).

1. Assess blast radius:

• Enumerate every action taken in the incident window using the audit trail.
• List affected systems, records, customers, and any money moved.
• Flag irreversible actions for manual remediation/notification.

1. Roll back / remediate:

• Restore changed/deleted data from history or backup.
• Recall or correct erroneous communications where possible; notify affected parties for what cannot be recalled.
• Reverse or dispute financial actions through the appropriate channel.

1. Root cause:

• Determine *why* the agent acted wrongly (instruction flaw, injection, permission gap, missing human gate, dependency change).
• Capture a timeline and the triggering input.

1. Recover safely:

• Fix the root cause, tighten permissions, add/restore guardrails, and add a human-in-the-loop gate if the action was irreversible.
• Re-enable the agent only after the owner signs off.

1. Document & learn:

• Write the incident up; feed lessons back into the governance framework (t4-aigov-001) and update the runbook.

What to do

Repair the app:

• Settings → Apps → Installed apps → app → ⋮ → Modify / Repair (where supported, e.g., M365, most enterprise apps).

Reinstall:

• Uninstall via Settings → Apps → Installed apps.
• Restart.
• Reinstall from official source.

Missing runtime:

• For "0xc000007b" or "MSVCP*.dll missing" → install latest Visual C++ Redistributables (x86 + x64) from Microsoft.
• For ".NET Framework x.x is required" → install via Settings → Optional features.

Compatibility:

• Right-click .exe → Properties → Compatibility tab → Run this program in compatibility mode for Windows 7/8 → try.

Antivirus:

• Check Windows Security → Virus & threat protection → Protection history. If app blocked, restore + add exclusion (only if from known-good vendor).

User profile corrupt:

• Test with a different user account. If app launches for them and not for current user → profile rebuild required (escalate to L2).

What to do

> Section 5 is for a senior engineer / PKI lead. Public-trust and HSM-backed CA operations require vendor/CA engagement — called out inline.

1. Expired/expiring leaf certificate: Renew or re-key it through the existing CA (internal AD CS per l3-certificates-001, or the public CA), deploy to all dependents, and restart/reload the consuming services.
2. Expired CRL (fastest, highest-impact fix): Re-publish a fresh CRL from the issuing CA to all CDP locations and confirm clients pick it up. This often restores mass functionality immediately without touching any leaf cert.
3. Issuing (subordinate) CA expiry: Renew the subordinate CA certificate from the root (renew with existing or new key per policy), publish the new CA cert into trust stores, then renew/re-issue leaf certs as needed. PKI lead drives this; engage vendor if HSM-backed.
4. Root CA expiry (highest blast radius): This is a planned, human-led operation — generate/renew the root, distribute the new root to all trust stores (GPO/MDM/manual), and cross-sign old↔new where possible so existing chains keep validating during transition. Mandatory: PKI lead + management approval; vendor engagement for public roots and HSM.
5. Public/third-party certificate or CA: Perform emergency reissue through the public CA/vendor account; you cannot self-sign these. Engage the vendor's emergency/expedited process.
6. Restore the renewal automation (ACME/autoenroll) so this does not recur, and document the new expiry dates.

What to do

> Section 5 covers building the program and the invocation sequence for a senior engineer / DR owner. Declaring a disaster and any failover/failback are management-authorized; vendor engagement is noted.

1. Author tiered DR runbooks with explicit recovery order (dependencies first), step-by-step actions, owners, and verification points (align technical runbooks with l3-disaster-recovery-001).
2. Validate backups and prove restores: schedule regular restore tests to verified-clean, immutable/offline copies (l3-backup-dr-002). An untested backup is not a recovery capability.
3. Document and rehearse failover AND failback: failback is frequently neglected and is where unrehearsed plans fail — plan the return to primary, not just the jump to DR.
4. Define the disaster-declaration process: criteria, the authorized decision-maker(s), invocation trigger, and the communications plan. Declaration and invocation are leadership decisions, not technician calls.
5. Run tabletop exercises (and, where feasible, live failover tests) at least periodically; capture findings and remediate the plan.
6. Invocation (during a real event): confirm the declaration from the authorized decision-maker → activate the comms plan and roles → execute runbooks in recovery order → engage vendors (cloud, storage, hypervisor) where required → meet RTO/RPO and validate before returning to service → plan failback once primary is healthy.
7. Maintain the program: review after every change/incident and on a fixed cadence; keep contacts, dependencies, and objectives current.

What to do

> Staged recovery order: storage → network/quorum → cluster/management → VMs. Section 5 is for a senior engineer; vendor engagement points are mandatory where noted.

1. Restore shared storage first. Resolve the SAN/iSCSI/NFS/vSAN outage (see l3-storage-001). For PDL, follow the vendor's device-removal/re-add procedure. Do not bring VMs up until storage is confirmed stable — restarting on flaky storage causes corruption.
2. Restore cluster network and quorum. Heal the management-network partition; bring the witness back. Recompute quorum only after connectivity is genuinely restored. Force quorum only as a last resort and ideally with vendor guidance, having first confirmed no other partition is also alive (split-brain prevention).
3. Recover the management plane. Bring vCenter (and its DB/PSC) or the cluster service back; validate it sees true, consistent state before issuing power operations.
4. Bring hosts back into the cluster cleanly (exit maintenance/isolation), confirming each sees storage and the network correctly and is firmware/patch-compatible.
5. Power on VMs in priority order, on one owner each. Let HA/the cluster place them, or place manually — but ensure each VM starts on exactly one host. Verify guest health before moving to the next tier.
6. If storage data integrity is in doubt or recovery is unsafe, this becomes a DR decision: fail over to the DR site or restore from backup (see l3-disaster-recovery-001 / l3-backup-dr-002) — a management call weighing RTO/RPO.

What to do

Compliance reason: BitLocker:

• Verify on device: manage-bde -status C: shows "Protection On".
• If missing, push BitLocker policy via Intune; ensure TPM present (tpm.msc).

Compliance reason: AV signatures:

• Update Defender: Win+R → cmd → "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate.

Autopilot device not registered:

1. Run on the device (admin PowerShell): Install-Script Get-WindowsAutopilotInfo -Force; Get-WindowsAutopilotInfo.ps1 -Online.
2. Provide creds with Intune permission. This uploads hardware hash to Autopilot service.
3. Wait 5–10 min, then run user OOBE.

Autopilot profile assignment:

• Endpoint Manager → Devices → Enroll → Deployment Profiles → assigned to group containing this device.
• Confirm group includes by device ID, not just user.

Hybrid AAD join (more complex):

• Confirm on-prem AD Connect SCP set: Get-ADObject -Identity "CN=62a0ff2e-97b9-4513-bf6b-4a0aabe4ba9c,CN=Device Registration Configuration,CN=Services,CN=Configuration,$(Get-ADRootDSE).configurationNamingContext)" -Properties keywords.
• Confirm device successfully creates dsregcmd /status shows AzureAdJoined: YES, DomainJoined: YES.

Wipe and reset:

• Endpoint Manager → device → Wipe (Autopilot reset) — re-runs OOBE clean.

What to do

1. Reconcile — pull a CSV from Intune (or your MDM), pull purchase orders for the period, compare. Anything in MDM not in PO = grey-market or BYOD. Anything in PO not in MDM = unenrolled.
2. Tag every active device with both a physical sticker AND a digital tag stored in MDM custom attribute.
3. Define states: Procured · In stock · Deployed · Returned · In repair · Retired · Lost.
4. Set a refresh cadence — typical: laptops 3 yrs (knowledge workers) / 4 yrs (light users) / 5 yrs (servers); phones 2 yrs.
5. Wipe on return — auto-trigger MDM wipe on offboarding. Don't shelve a device until wipe-success is logged.

What to do

1. Establish the privacy/residency requirement first — it's usually the reason for on-prem and dictates that nothing egresses.
2. Estimate VRAM need: model parameter count × bytes-per-parameter (precision) + KV-cache for the context length × concurrency, plus headroom. Bigger context and more concurrent users cost VRAM fast.
3. Pick precision/quantization to fit VRAM while preserving acceptable quality — validate quality, don't assume.
4. Match the stack: GPU + driver + compute toolkit (CUDA-or-equivalent) + inference server must be a supported, version-aligned set.
5. Diagnose OOM/slowness: check VRAM headroom, batch/concurrency settings, context length, and whether the model fell back to CPU.

What to do

Writing Tools (rewrite, proofread, summarize, change tone):

1. Select any text in any app.
2. Right-click → Writing Tools (or Edit menu → Writing Tools).
3. Choose: Proofread, Rewrite, Friendly, Professional, Concise, Summary, Key Points, Table, List.
4. Works on-device for shorter passages; longer / complex requests go through Private Cloud Compute (PCC) — Apple's encrypted server enclave.

Genmoji (custom emoji from a description):

1. In Messages, Mail, Notes, or any text field that supports emoji.
2. Click emoji picker → Genmoji tab → describe what you want: "a cat wearing a tiny hat at a cafe."
3. Generates 3-4 variations. Tap to insert; pinned to recent emoji thereafter.
4. Genmoji are images, not Unicode — recipients on older OS see a fallback sticker.

Image Playground:

1. Launch via Spotlight or Image Playground app.
2. Pick a person from Photos, or text prompt, or both.
3. Choose style: Animation, Illustration, Sketch.
4. Generates images on-device. Hard refusal on photorealistic / political / sensitive prompts — Apple bans by design.

Notification Summaries:

1. System Settings → Notifications → Summarize Notifications → ON.
2. Pick apps to summarize (Mail, Messages, news apps).
3. Group of notifications gets a 1-line AI summary at the top.

Siri (new ChatGPT integration + product knowledge):

1. Trigger Siri (hotword "Hey Siri" or pinned icon).
2. Ask product-specific questions: "How do I change my login items?"
3. Complex / open-ended questions: Siri can hand off to ChatGPT (free GPT tier or your paid ChatGPT account if signed in via System Settings → Apple Intelligence & Siri → ChatGPT).
4. Always asks permission before sharing content with ChatGPT.

What to do

If panic log mentions a third-party kext (e.g., com.vendor.driver.something):

1. Identify the vendor from the kext name.
2. Update or uninstall that vendor's app.
3. macOS Big Sur+ uses System Extensions — System Settings → General → Login Items & Extensions → review.

If a specific app freezes (beach ball):

1. Activity Monitor → CPU tab → sort by CPU. Force-quit the top offender.
2. If the same app always freezes: reinstall it via the Mac App Store or vendor's site.

If random panics with no obvious cause:

1. Apple Diagnostics — shutdown, hold D while powering on. Apple Silicon: hold the power button until startup options, then ⌘+D. Run the test; note any error codes.
2. Safe Mode — Apple Silicon: hold power until startup options, hold Shift, click Continue in Safe Mode. Intel: hold Shift while powering on. Use the Mac for an hour. If it's stable in Safe Mode, the issue is a login item or kext.

If macOS update is half-installed:

1. App Store → Updates → re-run the macOS update.
2. If it fails: Apple menu → System Settings → General → Software Update → Reinstall.

For storage cleanup:

1. Apple menu → About This Mac → Storage → Manage.
2. Empty the Trash. Move large files to iCloud or external storage.

What to do

Windows — standard user enrollment (Entra join):

1. Settings → Accounts → Access work or school → Connect → Join this device to Azure AD (full join = MDM enroll), sign in with the work account, complete MFA.
2. *Or* if already Entra-joined: Settings → Access work or school → click the account → Info → confirm MDM is connected; if not, "Connect" enrolls into MDM.
3. Force a policy sync: Settings → Access work or school → Info → Sync, or dsregcmd /status to confirm AzureAdJoined: YES and MDM URLs present.

Windows — Autopilot (new corporate device):

1. Ensure the hardware hash is uploaded and an Autopilot deployment profile is assigned to the device group.
2. OOBE → connect network → sign in with work account → Autopilot applies the profile and enrolls automatically.
3. If it falls back to a normal OOBE, the profile wasn't assigned in time (→ check group membership / escalate).

iOS/iPadOS (BYOD or corporate):

1. Install Intune Company Portal from the App Store.
2. Open it → sign in → Begin → install the management profile (Settings prompts to allow) → trust it.
3. Confirm the device appears in Intune and the management profile is installed under Settings → General → VPN & Device Management.

Android (work profile / fully managed):

1. Install Intune Company Portal from Google Play → sign in → follow the work profile setup.
2. Approve the managed Google Play account; corporate apps land in the work-profile section.

Fix common failures:

• 0x80180014 / "blocked": almost always an enrollment restriction or MDM scope excluding the user, or a missing license — fix in §4 then retry.
• "Already enrolled" / orphaned record: delete the stale device object in Intune, then on the device run dsregcmd /leave (Windows) or remove the management profile (mobile), reboot, re-enroll.
• Device cap reached: raise the per-user device limit in enrollment restrictions or remove old devices.

What to do

Effective Access:

• File Properties → Security → Advanced → Effective Access tab → pick user/group → View effective access.

ACL inspection:

• icacls "C:\Path\To\Folder" — current ACEs.
• icacls "C:\Path\To\Folder" /verify — list inconsistencies.

Share permissions:

• Most restrictive of share + NTFS applies.
• Get-SmbShareAccess -Name <share> shows share ACL.

Token bloat:

• User in 50+ groups can hit Kerberos token size cap; symptoms: random access denied, sign-in delays.

What to do

1. Update the NPU driver from the OEM/silicon vendor channel (not just generic GPU drivers); on Windows pull via the managed update channel, on macOS via OS update.
2. Install/repair the AI runtime and its NPU execution provider; re-register if the app reports it missing.
3. Point the app at the NPU in its settings if it defaulted to CPU/GPU; ensure the model is in an NPU-supported format/precision.
4. Address thermal/power: set the device to a balanced/performance power mode for sustained AI work, ensure ventilation, and update firmware/BIOS if a thermal fix is published.
5. Roll back a bad driver/runtime if the fault began right after an update, then pin to the known-good version.
6. Reboot after driver/runtime changes so the accelerator re-initializes.

What to do

> Sections 5 steps are for a senior engineer, typically in a live session with the vendor. Mandatory human/vendor engagement is called out inline.

1. Single failed disk, array still degraded-but-redundant (the safe path):

• Confirm the replacement disk meets vendor spec (size/type/firmware). Identify the correct physical slot using the management tool's locate/blink function — never by guessing.
• Replace the failed disk; allow the controller to rebuild onto the new disk (or onto the hot-spare, then copyback). Monitor rebuild progress and watch for additional errors.
• Keep the array on backup power and avoid heavy I/O during rebuild to reduce the chance of a URE-triggered second failure.

1. Second failure or URE during rebuild, or array reported FAILED/OFFLINE: STOP. Engage the storage/array vendor's severity-1 support immediately. Do not attempt to force-online, re-initialize, or recreate the array — these typically destroy any chance of vendor-led recovery and the data.
2. Suspected controller / backplane / cabling fault: Replace the suspect component under vendor guidance. After a controller swap, import the existing/foreign configuration only as directed by the vendor — never clear it blindly.
3. Cache/BBU fault: Replace the battery/flash-backup module per vendor procedure; the vendor confirms whether any cached writes were lost and whether a filesystem/database consistency check is required.
4. SAN path/LUN issue: Correct zoning/masking/multipath; bring paths back; have the vendor confirm SP/controller health before returning the LUN to production.
5. If recovery is not safe or not possible — restore from backup: This is a management decision (data loss/RPO vs downtime). Restore to healthy hardware/array from the most recent verified backup, then validate integrity before returning to production.

What to do

1. Stabilize first: if the device is in an unsafe/half-remediated state, restore to the captured known-good point before continuing.
2. Take a clean handoff: the human assumes the action with the agent's full context (what was tried, why it stopped, the restore path).
3. Complete or reverse the remediation manually, recording each step back into the same audit trail so the record stays continuous.
4. Resolve the root cause the agent couldn't reach (out-of-scope dependency, ambiguous fault) using standard L3 procedures.
5. Close the loop with the agent: mark the incident resolved, and if the case is now a known pattern, feed it back so the playbook can safely handle it next time (governance review, not silent auto-expansion of scope).
6. Re-enable autonomy only after confirming the device is healthy and the guardrail logic behaved correctly.

What to do

1. Triage each discovered tool: sanction, restrict, or block, based on risk and data handling.
2. Run the sanctioning workflow for tools worth keeping:

• Assess vendor data handling/retention and where data goes.
• Define allowed use and what data may/may not be entered.
• Bring it under governance: owner, register entry (t4-aigov-001), and identity/permissions if it acts (t4-aigov-005).
• Approve and add to the published approved-AI list.

1. Block or restrict high-risk or non-compliant tools (extension allow/deny lists, egress controls, DLP rules on sensitive data).
2. Provide a sanctioned alternative so the underlying need is met — shadow AI thrives where official tools are missing.
3. Publish the approved-AI list and a simple request path so future adoption flows through IT instead of around it.
4. For confirmed data exposure, treat it as a data incident (notify, assess scope; coordinate with t4-aithreat-001 if injection/exfil is involved).

What to do

1. The technical problem is usually L1, but the time pressure is L3.
2. VIP is using a non-standard device or app for the first time.
3. Stakes (earnings call, customer demo, regulator) raise the cost of any miss.
4. VIPs rarely run troubleshooting steps themselves — they expect the tech to drive.
5. Outage may be on the network/SaaS side, not their device.

What to do

Recall (timeline of snapshots):

1. Settings → Privacy & security → Recall & snapshots.
2. Toggle "Save snapshots" ON.
3. Configure: storage limit (25 GB default), excluded apps (browsers in private tabs auto-excluded), filter sensitive content (passwords, ID numbers auto-redacted by AI).
4. Open Recall: Win+J or pinned Taskbar icon. Search natural language: "the spreadsheet I had open yesterday morning."
5. Privacy guidance for business users: Recall data is encrypted with BitLocker + VBS Enclaves. Snapshots never leave the device. But: anyone with the device's Windows Hello can access. Treat as you would a screen recording.

Click to Do (right-click intelligence on anything on screen):

1. Win+Click on any image, text, or area of the screen.
2. Options appear: summarize text, rewrite, copy text from image, blur background, erase object, search the web for similar image.
3. Works without internet for text + image features (NPU local). Web-search options call the network.

Paint Cocreator (text-to-image inside Paint):

1. Open Paint → click Cocreator button (top right).
2. Type a prompt like "watercolor painting of a coffee shop at sunrise."
3. Use credits (50 free per Microsoft account, then $0.10 each via Microsoft Designer credits).
4. Pick a style: pencil sketch, ink sketch, watercolor, oil painting, digital art, photographic.

Live Captions (with translation):

1. Win+Ctrl+L to toggle.
2. First use prompts to download the on-device speech model (~1.5 GB).
3. Settings (gear icon in caption bar) → Caption language: select from 44 languages. Pick "Translate to" for live translation.
4. Works on any audio — meetings, YouTube, in-person via mic input.

Studio Effects (camera & mic AI):

1. Settings → Bluetooth & devices → Cameras → Default camera → Studio effects.
2. Toggle: Automatic framing, Background blur (standard / portrait), Eye contact (standard / teleprompter), Creative filters.
3. Mic Studio Effects: Voice focus, Background noise suppression — same Settings page under Sound.
4. Applies system-wide (Zoom, Teams, Discord all benefit).