By Richard Gamarra
A categorized cheat sheet for Tier 2 and Tier 3 Help Desk engineers: Windows 11 local triage, CMD and PowerShell commands, Outlook and Teams troubleshooting, Microsoft 365 admin tools, Exchange message flow, remote support, service health, internal OS diagnostics, Splunk searches, account lockouts, and Duo triage.
Before rebuilding a profile or reimaging a machine, compare: Outlook desktop vs OWA, Teams desktop vs Teams web, local device vs known-good device, and user account vs alternate test account.
Always verify whether the issue is local, profile-based, network-based, or tenant-side.User UPN: Device name: Time issue started: Exact error: VPN on/off: Client or web: Recent password change: Recent update / patch: Mailbox migrated?: Other users affected?:
ipconfig /all ipconfig /flushdns ipconfig /registerdns nslookup contoso.com ping hostname tracert hostname pathping hostname netstat -ano arp -a route print
Use for DNS, route, NIC, port, and reachability checks.
sfc /scannow DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /RestoreHealth chkdsk C: /scan
Use for system file integrity and component store repair.
Run in elevated CMD or PowerShell.whoami whoami /all whoami /groups hostname systeminfo gpresult /r gpresult /h c:\temp\gp.html
Useful for GPO, token, local machine state, and elevation questions.
tasklist taskkill /PID 1234 /F taskkill /IM outlook.exe /F sc query sc queryex sc qc wuauserv shutdown /r /t 0
Use when a process is hung, a service is stopped, or a restart is required.
Get-NetIPConfiguration Get-NetAdapter Get-DnsClientServerAddress Resolve-DnsName outlook.office365.com Test-NetConnection outlook.office365.com -Port 443 Test-NetConnection smtp.office365.com -Port 587 Get-NetTCPConnection | Sort-Object State
Faster and more scriptable than legacy CMD tools for port and adapter diagnostics.
Get-WinEvent -LogName System -MaxEvents 50 Get-WinEvent -LogName Application -MaxEvents 50 Get-WinEvent -LogName Microsoft-Windows-WindowsUpdateClient/Operational -MaxEvents 50 Get-EventLog -LogName System -Newest 20
Use when Event Viewer is too slow or you need fast exportable output.
Get-ComputerInfo Get-Service | Sort-Object Status,DisplayName Get-Process | Sort-Object CPU -Descending | Select-Object -First 15 Get-Printer Get-Volume Get-CimInstance Win32_OperatingSystem
Useful for quick inventory, printer checks, storage checks, and service review.
Get-AppxPackage *Microsoft.GetHelp* Get-AppxPackage *Teams* Get-AppxPackage *WindowsStore* Get-AppxPackage | Select Name, PackageFullName winget list
Useful when Get Help, Store apps, or built-in Windows packages are missing or broken.
Use Microsoft diagnostics first for connectivity, profile, sign-in, activation, and known Outlook issues.
Classic Outlook quick tests: - SaRA / Enterprise SaRA - Get Help app - Advanced Diagnostics for Outlook
outlook.exe /safe outlook.exe /resetnavpane outlook.exe /profiles outlook.exe /cleanviews
Use Safe Mode first to isolate add-ins, then reset nav pane or views if the UI is broken.
Use Exchange Admin Center message trace for send/receive, delay, block, and transport path questions.
Key questions: - Did the service receive it? - Was it delivered, deferred, failed, quarantined, or blocked? - Internal only or external only? - Sender, recipient, timestamp, subject?
For spoofing, routing, and external delivery questions, extract full headers from Outlook or OWA and correlate them with message trace results.
Headers + message trace together usually solve mail path questions faster than client-side guesswork.Capture logs before cache clearing or reinstall steps.
Windows Teams log collection: Ctrl + Alt + Shift + 1 Also: Settings / tray icon > Collect support files
Use CQD for org-wide quality patterns. Use per-user analytics for individual bad call or meeting investigations.
For meeting quality, sign-in, intermittent drops, and high latency issues, run Microsoft 365 connectivity testing and compare by site or VPN path.
Before deep workstation troubleshooting, verify service incidents, advisories, and planned maintenance in Microsoft 365.
Use for user experience complaints tied to route quality, DNS path, front door proximity, and network perimeter design.
Check Application, System, Setup, WindowsUpdateClient/Operational, and app-specific logs before concluding that an issue is random.
eventvwr.msc
taskmgr resmon perfmon
windowsdefender: ms-settings:windowsdefender
Verify quarantine, protection history, and controlled folder access when apps behave strangely.
perfmon /rel
One of the most underrated tools for finding crash patterns, failed installs, and update-related breakpoints.
Excellent for proving "it started after update X" or repeated app faulting.ms-contact-support: Get Help app
Useful for Microsoft-guided remediation and built-in self-help paths for Windows and Microsoft 365 apps.
Preferred Microsoft-native interactive support tool for many help desk scenarios requiring screen share or control.
quickassist
mstsc
Still essential for admin access, server work, jump hosts, and controlled remote troubleshooting.
ping hostname tracert hostname Test-NetConnection hostname -Port 443 Test-NetConnection hostname -Port 3389 nslookup hostname Resolve-DnsName hostname
Use to isolate DNS vs route vs port vs service issues quickly.
index=wineventlog sourcetype=WinEventLog:Security | table _time host EventCode Account_Name Message Useful commands: search table stats sort dedup where eval rex transaction
These are the day-to-day commands most help desk engineers use to narrow scope, summarize results, and isolate patterns.
index=wineventlog EventCode=4740 | stats count by user host index=wineventlog sourcetype=WinEventLog:Security | stats count by EventCode index=wineventlog host=PC123 | stats count by SourceName EventCode
Use stats to answer "how many", "by who", "by host", and "what event codes are recurring".
index=wineventlog EventCode=4740 | table _time host user Caller_Computer_Name Message | sort - _time index=o365* | table _time user operation workload result status | sort - _time
Use table to keep only the fields you care about and sort to put newest evidence first.
index=wineventlog EventCode=4740 | dedup user | table _time user host Caller_Computer_Name index=wineventlog | where EventCode=4740 OR EventCode=4771 OR EventCode=4776 | table _time host EventCode user Message
Use dedup to keep one result per user or machine, and where when you need Boolean filtering logic.
index=duo* | rex field=_raw "username[=:]\s*(?<duo_user>[^,\s]+)" | table _time host duo_user result reason index=wineventlog EventCode=4740 | eval target=coalesce(user, Account_Name, TargetUserName) | table _time host target Message
Use rex when fields are buried in raw text and eval to standardize field names across sources.
index=wineventlog user=jdoe | sort - _time | transaction user maxspan=10m | table _time user duration eventcount index=duo* user=jdoe | sort - _time | transaction user maxspan=5m | table _time user duration eventcount result
Use transaction sparingly for short timelines. If you use it, keep sort - _time immediately before it.
transaction is heavier than stats; use it only when you really need related-event grouping.Event 4740 means a user account was locked out. In practice, correlate it with nearby 4771 or 4776 failures to find the bad credential source.
Splunk example: index=wineventlog sourcetype=WinEventLog:Security EventCode=4740 | table _time host user Caller_Computer_Name Message | sort - _time
Broader lockout hunt: index=wineventlog sourcetype=WinEventLog:Security (EventCode=4740 OR EventCode=4771 OR EventCode=4776) user=jdoe | table _time host EventCode user Caller_Computer_Name Message | sort - _time
Duo issues often come from user state, device enrollment, wrong push target, stale app activation, or policy behavior.
What to verify: - Is the user Locked Out or Disabled in Duo? - Did the user recently change phones or lose device activation? - Is the wrong device receiving push? - Is the user denying pushes because of stale app prompts? - Is offline access / Windows Logon involved?
Check install state, policy behavior, username matching, offline access, and Windows-side prompt behavior.
Common checks: - Does Duo username match Windows username? - Is the user enrolled and active? - Is offline access enabled? - Is the issue local logon, unlock, UAC, or RDP only? - Did the issue start after an upgrade?
index=duo* | stats count by user result reason index=duo* user=jdoe | table _time host user result reason application factor | sort - _time index=duo* (result="deny" OR result="failed" OR result="error" OR result="locked out") | stats count by user result reason
Use these to separate push denial, failed factor, policy failure, and lockout patterns by user.