IT Support interview questions and answers

I follow the same steps every time, so I do not guess:

1. Define the problem. Ask what is wrong, when it started, what changed, who is affected, and what error message appears.
2. Reproduce it if possible. Check the scope: one user, one machine, or everyone.
3. Make a guess (hypothesis). Start with the simplest and most likely causes, such as the cable, power, a restart, or a recent change.
4. Test one change at a time. Write down the result.
5. Fix it and check with the user.
6. Document the cause and the fix in the ticket for next time.

If I cannot fix it within the SLA (the agreed time limit) or my permission level, I escalate. I pass on everything I tried, so the next person does not repeat the steps.

What they are checking: Clear, step-by-step thinking instead of random trial and error

First I ask when it became slow, whether it is everything or one app, and what changed. Then I check:

• Task Manager: CPU, memory, disk, and startup use. Find the process that uses the most.
• Disk space. Low free space slows Windows. A disk at 100% on an old HDD points to a hardware problem.
• Startup programs and background apps. Remove or turn off the ones that are not needed.
• A malware scan with the approved antivirus.
• Waiting Windows updates and driver updates. Restart if the PC has been on for weeks.
• Heat and dust or fans, if the laptop is hot.
• The network, if only web or cloud apps are slow.

If RAM is always full, or the drive is a failing HDD, I suggest an upgrade (more RAM or an SSD).

What they are checking: A practical checklist for finding the cause

I start at the bottom of the network layers and go up:

1. Physical: the cable is plugged in, Wi-Fi is on, airplane mode is off, and the link lights are on.
2. Is it only this device? Try another device on the same network.
3. ipconfig /all: does the device have a valid IP, subnet, gateway, and DNS? An address like 169.254.x.x means DHCP failed.
4. ping the default gateway. Then ping an outside IP such as 8.8.8.8. Then ping a domain name.
5. If the IP works but the name does not, it is a DNS problem. Use nslookup and ipconfig /flushdns.
6. Check proxy or VPN settings, the firewall, and problems that affect only the browser.
7. Restart the router or switch. If many users are affected, escalate to the network team.

What they are checking: Troubleshooting the network layer by layer

DHCP (Dynamic Host Configuration Protocol) gives devices an IP address, subnet mask, default gateway, and DNS servers automatically. Nobody has to set up each machine by hand.

The steps are called DORA:

1. Discover: the client sends a broadcast to find a server.
2. Offer: a DHCP server offers an address.
3. Request: the client asks for the offered address.
4. Acknowledge: the server confirms. The client gets a lease (the right to use the address) for a set time.

Addresses are leased and renewed. A reservation ties an address to a device's MAC address. This is useful for printers.

What they are checking: Basic networking knowledge

DNS changes domain names into IP addresses. When you type a URL, this happens:

1. The browser and the OS check their caches.
2. If the answer is not there, the request goes to the DNS resolver you set up.
3. The resolver asks the root, TLD (.com), and authoritative name servers if needed. It returns the IP.
4. The browser opens a TCP connection to that IP (with TLS for HTTPS).
5. It sends the HTTP request and shows the response.

Common records: A (IPv4), AAAA (IPv6), CNAME (alias), MX (mail), TXT (verification, SPF). Test with nslookup example.com.

What they are checking: Do you understand how a name becomes an IP address?

• ping host: sends ICMP echo requests to test if the host is reachable and how long a round trip takes.
• ipconfig /all: shows the IP settings of each adapter (IP, mask, gateway, DNS, DHCP, MAC). /release and /renew refresh a DHCP lease. /flushdns clears the DNS cache.
• tracert host: shows the hops (routers) between you and the destination. It shows where delays or drops happen.
• nslookup name: asks DNS to check if a name resolves.
• netstat -an: lists connections and listening ports.

On Linux and macOS, use ip a or ifconfig, and traceroute.

What they are checking: Hands-on knowledge of the tools

Active Directory (AD) is Microsoft's directory service. It stores users, computers, groups, and policies in one place, called a domain. It also checks who you are and what you may access.

Key parts:

• Domain controllers: the servers that hold AD.
• Organisational units (OUs): folders for organising objects.
• Security groups: used to give permissions.
• Group Policy: used to apply settings.

Admins manage it with Active Directory Users and Computers (ADUC). Today it is often synced to cloud identity (Microsoft Entra ID).

What they are checking: Basics of Windows in companies

First I check the person's identity using the company process (call-back, security questions, or manager approval). Attackers use social engineering to get password resets.

Then in ADUC: find the user, right-click, and choose Reset Password. Set a temporary password and tick 'User must change password at next logon'. For a lockout, tick 'Unlock account' on the Account tab. In PowerShell:

Unlock-ADAccount -Identity jdoe
Set-ADAccountPassword -Identity jdoe -Reset -NewPassword (Read-Host -AsSecureString)
Set-ADUser -Identity jdoe -ChangePasswordAtLogon $true

If the account keeps locking, find the source. It may be an old phone, a mapped drive, or a scheduled task with a saved password. Do not just reset it again.

What they are checking: Do you know the steps, and do you think about security?

A BSOD is Windows stopping itself after a fatal error. Common causes are a bad driver, failing hardware (RAM, disk), file corruption, or overheating. The screen shows a stop code such as IRQL_NOT_LESS_OR_EQUAL or DRIVER_POWER_STATE_FAILURE.

Steps:

• Write down the stop code.
• Remember what changed (new driver, update, device).
• Boot into Safe Mode. Roll back or remove the driver or update.
• Run sfc /scannow and DISM /Online /Cleanup-Image /RestoreHealth.
• Test the RAM (Windows Memory Diagnostic) and the disk (chkdsk, SMART).
• Check the temperatures.
• Read the minidump (WinDbg or BlueScreenView) to find the faulty module.

If the hardware is failing, replace it.

What they are checking: A systematic way to handle a serious fault

1. Check the basics: power, paper, toner, error lights, cables, or the network connection.
2. Is it one user or all users? Check the print queue for stuck jobs and cancel them.
3. Restart the Print Spooler service (net stop spooler, clear C:\Windows\System32\spool\PRINTERS, net start spooler).
4. Make sure the right printer is the default and is not set to Offline.
5. For a network printer, ping its IP. Check that the port and IP did not change (use a DHCP reservation).
6. Reinstall or update the driver.
7. Print a test page from the printer itself. This shows if the fault is in the printer or in the PC or network.

What they are checking: Hands-on problem solving

First I check the internet and whether webmail works. This shows if the problem is the account or the Outlook client. Then:

• Start Outlook in safe mode (outlook.exe /safe) to rule out add-ins.
• Check that the account is not locked and the password was not changed recently. Clear saved credentials in Credential...

A ticketing system (ServiceNow, Jira Service Management, Freshservice, Zendesk, and others) records every request and incident. It gives each one an owner, tracks status and time, and keeps a history.

An SLA (service level agreement) sets the response and fix times that a support team promises. The times usually depend on priority.

Phishing is a fake message that tricks people. It tries to get passwords, make them click bad links, or make them open infected attachments.

Warning signs:

• Urgency or threats.
• A sender address or link that does not match.
• Unexpected attachments.
• Requests for passwords or payments.
• Poor spelling.

This is probably an infrastructure problem. I check the scope first and then tell people what is happening.

I stay calm and listen without interrupting. I say sorry for the delay and I do not blame others. I repeat the problem back to confirm I understand it. I read the ticket history and take ownership.

A MAC address is a hardware ID built into a network card. It has 48 bits, for example 3C:52:82:AA:10:BE. It is used for talking inside a local network (layer 2).

An IP address is a logical address given by a network. It is used to route traffic between networks (layer 3). It can change.

Private addresses are for internal networks. They cannot be routed on the internet. The ranges are 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Public addresses are unique and can be reached on the internet.

A subnet mask (for example 255.255.255.0 or /24) splits an address into a network part and a host part. With it, a device knows if another IP is on its own network or must go through the router.

Group Policy lets admins apply settings to users and computers in a domain. Examples are password rules, drive mappings, software deployment, firewall, and desktop limits.

Safe Mode starts Windows with only a few basic drivers and services. You can fix problems that stop a normal boot.

Use it to:

• Troubleshoot a bad driver.
• Remove malware.
• Uninstall a problem update.
• Fix a BSOD loop.

• sfc /scannow scans the protected Windows system files. It replaces damaged ones from the local cache.
• DISM /Online /Cleanup-Image /RestoreHealth repairs the Windows component store that SFC uses. It uses Windows Update or a source image. Run it first if SFC cannot fix things.
• chkdsk C: /f checks the file system and fixes logical errors. It may need a reboot. /r also scans for bad sectors.

For one machine:

1. Make a bootable USB with the Media Creation Tool or an ISO.
2. Boot from it using the BIOS/UEFI boot menu.
3. Choose the edition, set up the partitions, and install.
4. Install drivers, updates, antivirus, and the needed software.
5. Join the domain.

• Incident: an unplanned break or slowdown of a service. Example: email is down. Goal: restore the service fast.
• Problem: the root cause of one or more incidents. Example: a faulty switch behind repeated outages. Goal: find the root cause and stop it from coming back.
• Service request: a standard request. Example: a new account or a software install.
• Change: a planned modification to the environment. It goes through change management.

• L1 (service desk): first contact. Logs tickets, does basic troubleshooting, resets passwords, and uses known fixes.
• L2: deeper technical support for issues that L1 cannot solve, such as configuration, software, and network problems.
• L3: specialist engineers or vendors. They handle complex problems, code, or architecture.

Common tools are Microsoft Quick Assist, Remote Desktop (RDP), TeamViewer, AnyDesk, and enterprise tools in the management platform.

A VPN makes an encrypted tunnel between the user's device and the company network. When it fails, I check:

• The user's internet works.
• The password and MFA are correct.
• The account is not locked or expired.
• The VPN client version and certificate.
• The firewall or public Wi-Fi is not blocking the VPN ports.
• The system date and time.
• The server status. Are other users affected?

MFA needs two or more factors:

• Something you know (a password).
• Something you have (a phone or token).
• Something you are (a fingerprint).

If a password is stolen, the attacker still cannot sign in without the second factor. Authenticator apps and hardware keys are stronger than SMS codes.

I find which device is sending the wrong password. On a domain controller, security event 4740 (account lockout) shows the name of the computer that caused it. Tools like Microsoft's Account Lockout Status help trace it.

I prepare in advance from the HR request:

• Create the AD/Entra account in the correct OU and groups.
• Set up a mailbox and licences, MFA enrolment, and access to the needed apps and shares.
• Prepare a laptop with the standard image, install software, encrypt the drive, and join the domain.
• Get accessories, and a phone if needed.

I explain politely that the company policy protects the user and the network. I ask what they are trying to do. Often there is an approved alternative.

Act quickly, because data is at risk.

1. Log a high-priority ticket and tell the security team.
2. End the user's sessions and reset passwords. Revoke tokens and VPN certificates.
3. Use MDM (device management) to lock the device or wipe it remotely.
4. Check whether the disk was encrypted (BitLocker). If it was, the...

Check power first: the outlet, the power cable and adapter, and the laptop charger light. Remove the battery and put it back. Try another cable or outlet.

Hold the power button for 15 to 30 seconds to drain leftover power. Then try again. Listen and look for fan noise, lights, and beep codes.

• A user account represents a person.
• A security group is a collection of users. You use it to give permissions once to many users. Add the user to the group, not to each resource.
• An OU (organisational unit) is a container. It organises objects, applies Group Policy, and delegates admin rights. It is not used to give permissions to resources.

Sysprep prepares a Windows installation for imaging. It removes machine-specific information (SID, computer name, driver cache). Then the image can be deployed to many computers. Each one makes its own identity at first boot.

Both are firmware. They start the hardware and load the operating system.

• BIOS is the older 16-bit design. It uses MBR disks (up to 2 TB, four primary partitions) and text menus.
• UEFI is the modern replacement. It supports GPT disks over 2 TB, faster boot, Secure Boot, a graphical interface, and a mouse.

• POP3 downloads mail to one device and usually removes it from the server. It does not sync.
• IMAP keeps mail on the server. It syncs folders and read status across devices.
• Exchange (MAPI/EWS, or Exchange ActiveSync on phones) also syncs calendar, contacts, and tasks with the server.
• SMTP is used to send mail.

1. Isolate the machine (unplug it or turn off the network).
2. Do not delete evidence without thinking. Record the alert.
3. Run a full scan. Quarantine or remove the threat.
4. Find out how it arrived (email, download, USB).
5. Update the definitions and patch the system.
6. Reset credentials if they may be exposed.

I do it from one central place. I use a management platform such as Microsoft Intune, SCCM/Configuration Manager, Group Policy software deployment, or scripts through an RMM tool.

I test packages on a small pilot group first. Then I deploy in stages (rings) and watch for failures.

Common causes:

• Weak signal or distance.
• Interference from other networks or devices.
• Crowded channels.
• Wrong password or security type.
• Too many clients.
• Old drivers.
• Access point faults.