Operational Procedures and Professional Practice

A support ticket is a shared work record. Give it enough detail that another technician can continue the job without starting the conversation again.

Record the problem and the work

A ticket needs a unique number, the user's contact details and location, the affected device's hostname or asset tag and operating system, and the issue description. Add a category, priority, status, owner and timestamps. Categories such as "Hardware > Printer" help route work and reveal recurring problems. Update the category when the cause becomes clearer.

Describe what happens, when it started, who is affected, the exact error and what was tried. Compare "Printer broken" with "Since 09:10, Ana in Finance cannot print to PRN-3F-02. The queue says 'Printer offline'. Two coworkers can print. Restarting her laptop did not help." The second report separates a single-device problem from a shared outage.

Write progress notes as dated actions and results: "10:25 Cleared stuck job; still offline. 10:40 Re-added printer; test page printed." Keep opinions and secrets out of tickets. The resolution states the cause, fix, verification and user confirmation: "Old printer address replaced; Ana printed a test page and spreadsheet successfully." Close after the user confirms the result.

Set priority and escalate

Severity describes harm. Priority commonly combines impact, such as the number of affected users or the importance of the service, with urgency, which describes how quickly harm grows. Payroll failing on payday outranks a flickering spare monitor. Apply the organization's criteria; a caller's seniority or anger does not itself set priority.

Tier 1 handles common requests using procedures. Tier 2 handles deeper problems; Tier 3 involves specialists, engineers or vendors. Functional escalation gets expertise. Hierarchical escalation gets authority, such as approval for an urgent replacement. Escalate when skills, permissions, policy or a deadline require it, and pass on findings, attempted actions and the next step.

Calculate the service deadline

A service-level agreement (SLA) sets service promises, including response and resolution times and the hours counted. Response means acknowledging and starting work; resolution means restoring service. Internal agreements cover departments; external agreements cover providers, such as an onsite repair service.

Suppose business hours are Monday–Friday, 08:00–17:00. A ticket arrives Friday at 15:20 with a one-business-hour response target and an eight-business-hour resolution target.

1. The response is due Friday at 16:20.
2. Friday contributes 1 hour 40 minutes toward resolution.
3. The remaining 6 hours 20 minutes start Monday at 08:00, making resolution due at 14:20.

Under a 24/7 agreement, eight hours ends Friday at 23:20. Pause a clock for a user reply only when the agreement allows it; changing a ticket's status alone does not create permission to stop counting.

Hand off a ticket before its target is at risk

A useful escalation note distinguishes known results from the remaining question. For example: "Only this laptop is affected. Restart and printer reinstallation did not resolve it. Network team needed to examine the device's connection; user available until 16:00." Send the existing notes and keep an assigned owner. A new team should not have to repeat the first interview simply because responsibility changed.

If a manager must approve an exception, state the decision needed separately from the technical findings. This lets an authority act without confusing approval with diagnosis.

Good documentation makes support work repeatable. Choose the document that fits the job, give it an owner and review date, and update it when a system or procedure changes.

Turn a fix into a useful article

A knowledge base (KB) is a searchable collection of answers. Use a title that matches a user's search, such as "Outlook keeps asking for my password". State the affected systems, known cause, numbered steps, a check that confirms success and when to contact support. A technician article may contain administrative steps; a user article contains only actions the user is allowed to take.

For example, a user-facing article about a repeated sign-in prompt could name the supported application version, explain the approved sign-in steps and finish with "Open the application again. If the prompt returns, contact the help desk with the error text." Avoid sending users through administrator-only settings. When a resolved ticket reveals a missing answer, create or update the article during closure.

A standard operating procedure (SOP) explains how to perform a routine task consistently. A custom software installation procedure identifies the approved installer, version, source and license. It specifies the installation folder, components and update settings, then the checks and inventory entry. "Install the usual options" leaves the next technician to guess.

Use checklists for account changes

An onboarding checklist covers the account, role-based groups, mailbox, multifactor authentication, software licenses, tagged device, device-management enrollment and acceptable use policy acceptance. Record who completed each step and when. Checking a box records a completed action, not an intention.

Offboarding has a different order. At the agreed time, disable sign-in and revoke remote and other access. Preserve the files and mailbox data required by retention policy and transfer them as instructed. Verify preservation before removing licenses or deleting the account: a cloud service may delete data after its grace period. Recover devices, badges and security tokens, then update asset and license records. Disabling access alone does not preserve every cloud resource.

Record incidents and improvements

An incident report is a factual record of an outage, injury or security event. Capture what happened, discovery time, affected people and systems, actions with times, the known cause and follow-up work. Separate observed facts from unresolved questions. Write "Server stopped responding at 11:08" instead of assigning blame without evidence.

A post-incident review, also called a post-mortem, uses the timeline to examine the root cause, what helped and what needs improvement. Give each action an owner and deadline. After a full disk stops a file server, "Add an alert at 85% disk usage; infrastructure team; due Friday" is actionable. "Be more careful" is not. A review aimed at improving processes makes it easier for staff to report problems honestly.

Make a checklist verifiable

A checklist item should identify an observable result. Replace "Prepare access" with separate entries for the approved role groups, mailbox and multifactor-authentication enrollment. Record completion by the person who performed each step. If an entry is blocked, name the outstanding dependency so another technician can follow it up.

Keep instructions in the procedure and completion evidence in the checklist. A long set of unchecked instructions does not show whether the new employee can actually sign in, and a checked box without a defined result can conceal unfinished work.

An IT asset is something valuable the organization uses: a device, software or a license. Accurate records let the team find equipment, recover licenses, claim repairs and plan replacements.

Identify the item and its relationships

An inventory record usually holds an asset ID, type, make and model, serial number, location, assigned user, purchase date, warranty end and status. Status might be "in stock", "deployed", "in repair" or "retired". Software records add the version, license type, license count and renewal information. Keep license keys in approved restricted records.

An asset tag links a physical device to the organization's record. A barcode, QR code or radio-frequency identification (RFID) label can make that link quick to scan. The manufacturer assigns a serial number; the organization assigns the asset ID. Record both so a technician can connect an internal record with a vendor warranty claim.

A configuration management database (CMDB) adds settings and relationships between configuration items, such as computers, applications, servers and services.

The relationship matters during a storage outage or proposed change: it points to dependent applications and users. An inventory showing a server's location does not supply that dependency by itself.

Update the record through the life cycle

1. Plan: identify the need, approval and budget.
2. Procure: select, buy and receive the asset.
3. Record and deploy: tag it, configure it, assign it and record its location.
4. Operate and maintain: record updates, repairs, warranty claims and transfers.
5. Retire and dispose: remove it from service, complete required data handling and record its destination.

Procurement is the acquisition stage, not the entire life cycle. A device still needs a record after purchase and after it leaves service. During a repair swap, record the user's replacement and the original device's repair status. Otherwise the inventory may show the wrong user holding the wrong device.

Use records to make decisions

A laptop purchased in March 2026 with a three-year warranty is covered until March 2029. A screen failure in 2028 should prompt a warranty check before ordering a replacement. Record the repair and keep the original asset identity when the same device returns.

License records support renewal and recovery. When a device is retired, reclaim transferable licenses under their terms and remove obsolete assignments. During onboarding and offboarding, check the device record and the software allocation together.

An audit compares records with reality through physical checks or network discovery. Investigate a missing tag, an unrecorded device or a device assigned to a former employee. Correct the record after checking what happened; copying the old list into a new report does not establish that it is accurate.

Reconcile a repair swap

Suppose device A-204 is assigned to Salma and a spare A-318 is in stock. When the spare is issued, keep A-204's identity and change its status to "in repair" with the repair location. Change A-318 to "deployed", assigned to Salma at her current location. Link the ticket to both records.

When A-204 returns, record whether Salma receives it again or it becomes available stock. Check any application-license reassignment under its terms.

The user's description gives you symptoms, context and the effect on their work. Listen to the full account before choosing a technical action.

Ask, narrow and confirm

Active listening means giving full attention, letting the person finish, taking useful notes and showing that you follow. A user may begin with "The network is down" but then explain that only one application fails. An interruption at the first sentence can hide that boundary.

Start with an open-ended question: "What were you doing when the error appeared?" Follow with closed questions to narrow the scope: "Does it happen on another computer?" or "What time did it start?" Closed questions can ask for a fact as well as yes or no.

Restate the issue and invite correction: "Printing fails only from the accounting application, while other programs print normally. Is that right?" Correct your notes if the user changes that account before acting on it.

Explain the next action

Use familiar words and define a necessary technical term once. "Your computer didn't receive a network address, so it couldn't connect" explains the practical result without requiring the user to know DHCP or APIPA. Keep detailed technical findings in the technician's notes.

Give instructions in order: "Save your document. Close the application. Open it again and try sending the report." Name the application or button clearly. Simple language should remain respectful.

Use the person's preferred name and title, asking when unsure. Expectations about formality and directness vary between individuals. Speak clearly and avoid idioms when working across languages; "try this step" is easier to interpret than "give it a shot".

Own the next contact

State an action and a time you can meet: "I'll check the account settings and call you by 14:00." Do not promise a repair time you cannot control or claim a cause before checking it.

A written update needs a greeting, finding, completed work, any user action and next contact time. Use numbered steps when order matters. For example: "Hello Imani, the account is unlocked. Please sign in again and open the shared folder. I'll check back at 13:30." Before sending, check that the user knows whether to reply, wait or act.

Professional conduct shows in your attention, commitments and care with information. These habits matter while the issue is open as well as after a repair.

Arrive prepared and stay focused

Follow the workplace dress code, including required protective clothing on industrial or medical sites. Arrive on time. If delayed, contact the user before the appointment, give a revised time and apologize.

Put personal calls, messages and social media aside while supporting someone. An interruption can hide a symptom or leave the user unsure whether you are listening.

Handle tension and decisions

Acknowledge the effect of a problem: "I understand this stopped you from sending the report." Clarify the facts and explain the next action. Do not dismiss the problem, judge the person or match an angry tone.

Seek a supervisor when the user needs an exception or business decision beyond your authority. Explain why that person is joining and pass on the facts. A technician can investigate a failure without being authorized to approve every replacement.

Keep expectations current

Tell the user what you will do, the estimate and the next update time. Keep the update appointment even if the diagnosis is incomplete. When a part is delayed, explain the changed timing promptly.

Present available options with their effects: "We can provide a temporary device today, or repair this one after the part arrives tomorrow." Let the user or authorized manager decide. Do not promise an option before its required approval.

Provide a ticket summary or work order after service, including completed work and follow-up steps. Later, check satisfaction and whether the original problem has returned; record the contact.

Handle private material discreetly

Ask users to close unrelated files and messages or put away private documents before work continues. An open salary spreadsheet should be closed before remote support; do not preserve its contents in a screenshot. Secure or return printer output under policy.

Share case details only with people who need them for work. Do not publish stories about support encounters on social media, even without names, because context may identify the person.

A change is an update, replacement, addition or removal that could affect a service. Change management records its purpose and risks before implementation.

Define the request

Record the purpose, exact scope, type, systems, impact, risks, timing, tests, backup and rollback plans, and responsible staff. For example, "Version 8.3 corrects Finance's tax calculation error" gives the business purpose. "Update 14 Finance workstations from 8.2 to 8.3; leave the database server unchanged" sets the scope.

Check dependencies in the configuration management database (CMDB), and tell affected users the expected downtime. Extra work during implementation is scope creep and needs its own request.

Choose the approval route

Standard approval applies only within its documented bounds. Poor planning does not turn normal work into an emergency.

Risk analysis considers what could fail, likelihood and severity using the organization's criteria. A core-switch change can affect many services, calling for stronger testing, suitable approval and low-use timing.

Reserve recovery time

A maintenance window allows changes during an agreed period. A change freeze suspends normal changes during sensitive business activity, with emergencies following the exception process.

A window runs Saturday 22:00–Sunday 02:00. Implementation needs 90 minutes, testing 30 and rollback 60: a total of 180 minutes. The four-hour window leaves one spare hour, so the latest safe start is 23:00. Starting at midnight leaves too little time for the complete plan.

Name the owner, implementers, approver and failure contacts. Record actions and tests against those responsibilities during the approved window.

An approved change is more than permission to install something. It is a tested plan with a recovery route, named decision-makers and checks that show whether real work still succeeds.

Test and prepare recovery

Use a sandbox, an isolated virtual machine or lab, to try the change without affecting users. Make it resemble production, then record differences in data, load and connected systems. A successful test on one empty workstation does not cover a busy multi-user database.

A rollback plan specifies how to return to the previous state and when to stop trying to fix the new one. A useful decision point names a test and deadline: "Roll back if the test invoice fails at 00:30." This protects the time reserved for recovery.

A backup plan ensures that current, verified data and configuration copies exist before work starts. It covers recovery if the normal rollback steps fail. A plan to uninstall the update and a restorable copy of its settings solve different problems; prepare both.

Get approval and follow the plan

The request names a change owner, implementers, approver and failure contacts. A change advisory board (CAB) brings IT and business representatives together to review normal changes. They consider purpose, scope, risk, timing, tests and recovery. They may approve, reject or request more information. Standard changes are pre-approved; emergencies go through the expedited group.

Announce the start, carry out only the approved work within the window, and log each action and outcome. When a test reaches its rollback condition, follow the plan. Extending the window or adding an unrelated repair requires authority; it is not an implementer's private decision.

Verify and close

Peer review gives a second technician a chance to catch a wrong target, typing mistake or unexpected setting. It can occur before a script or rule is applied and when comparing final settings with the approved plan.

End-user acceptance checks the changed system against real work. Finance posting a test invoice answers a different question from "Did the installer finish?" After acceptance, close the change with its result and update procedures, configuration and asset information.

Consider an accounting update planned for 22:00–02:00. The team has already tested a virtual workstation and obtained approval. At 22:00 it takes the planned backup; installation runs 22:30–00:00. A peer checks settings and a user tests invoices until 00:30. If the invoice still fails then, the team rolls back, verifies that version 8.2 works and reports the unsuccessful change. The record gives the next attempt a reliable starting point.

A backup is a separately stored copy that lets you recover from deletion, corruption, hardware failure, theft or ransomware. A second folder on the same failed disk will not help. A sync service needs retained older versions to recover a deletion or encrypted file that it has already synchronized.

Know what each backup copies

Full backups take the most source time and storage. Incrementals are usually smaller and quicker, but every link matters during recovery. A missing middle incremental prevents a complete reconstruction of the latest state. Differentials grow until the next full backup because each repeats all changes since that full.

Software can track changes with timestamps or change journals. Traditional Windows methods use an archive attribute: full and incremental backups clear it after copying; differential backups leave it set. This explains why the next differential includes files already copied by the previous one.

Work out storage and restore needs

A Sunday full backup contains 200 GB. Each weekday changes a different 6 GB of files.

• Five incrementals contain 6 GB each. Total weekly storage is 230 GB: the 200 GB full plus 30 GB of changes.
• Differentials contain 6, 12, 18, 24 and 30 GB. They total 90 GB, making 290 GB with the full backup.

If the disk fails Thursday before the evening backup, the latest completed state is Wednesday night. An incremental restore needs Sunday, Monday, Tuesday and Wednesday: four sets. A differential restore needs Sunday and Wednesday: two sets. Wednesday's incremental alone does not contain Monday's and Tuesday's separate changes.

A synthetic full moves the combining work to backup storage. It builds a new full from an existing full and subsequent incrementals, sparing the source computer and network another full read. The backup system still needs processing capacity and verification.

Match the schedule to the work

Choose the backup type and frequency by available time, storage, acceptable data loss and restore speed. Weekly full plus daily incremental or differential backups is a common pattern. A completed backup at 23:00 followed by a disk failure at 16:00 the next day leaves 17 hours of changes at risk. More frequent backups reduce the gap; changing the name of the backup type does not by itself make that gap smaller.

Separate the selection from the recovery order

Imagine that one file changes on Monday and a different file on Tuesday. Monday's incremental holds the first change; Tuesday's holds the second. Restoring Tuesday alone omits Monday's work even if Tuesday's job completed successfully. Tuesday's differential holds both changes since the full, so the full and that differential supply the later state.

Before allowing older backup sets to expire, identify every set still required by the retained restore points. Removing a needed incremental can break a later recovery even when that later set is kept.

A backup plan needs useful restore points, safe locations and proof that the copies can be read. A successful job message is a starting point; opening restored data is the test of recovery.

Keep copies with different risks

Onsite backups are nearby and often fast to restore. Offsite copies can survive loss of the building, though retrieval may take longer. Use both. The 3-2-1 rule means three copies in total, on two storage types, with one offsite. The original counts as one of the three. A laptop's internal files, a backup on external storage and a cloud backup illustrate separate copies and locations.

An offline or immutable copy adds protection against ransomware reaching every writable copy. Immutable means it cannot be changed for a set period. Encrypt portable and offsite backups, restrict access and deletion, and use separate backup credentials. Label media and store it in suitable conditions. A permanently connected drive can share the computer's ransomware exposure.

Retain older states

A rotation schedule reuses media or storage while keeping selected restore points. In grandfather-father-son (GFS) rotation, sons are daily, fathers weekly and grandfathers monthly backups. Keeping 7 daily, 4 weekly and 12 monthly points provides at most 23 retained points and reaches back about a year.

Older points matter when corruption is discovered late. Yesterday's daily copy may restore a recent deletion, a weekly point may predate corruption from three weeks ago, and a monthly point may reach a file lost months earlier. Keeping only the newest copy can preserve the problem you are trying to undo.

Test and choose a restore destination

Check job results and alerts, often daily, then test restores at the frequency policy specifies. A monthly sample-file restore and periodic whole-system restore test different levels of recovery. Retest after backup-system changes. Open restored files and confirm their expected contents; counting copied files does not show that an application can use them.

A user overwrites one sheet in a spreadsheet but makes useful edits elsewhere that morning. Restore yesterday's file to another folder, let the user recover the lost sheet into the current file, then remove the temporary copy. An in-place restore would overwrite the newer work too.

Recover services in dependency order

A disaster recovery plan names critical systems, restore order, backup locations, roles and contacts. Restore supporting services before dependent applications: a database or directory server may need to be available first. Test the plan as well as the backup files so the team can find copies, obtain access and complete recovery.

Record a restore test as evidence

For a sample-file test, record the selected restore point, destination, files checked and result. Confirm not only that files were written but that the expected versions open. An application recovery also needs its supporting services and a representative user task.

If a restore fails, preserve the test result and investigate the missing access, damaged set or dependency. The original backup job's success status cannot override a failed recovery test. Retest after correcting the issue so the team knows which recovery point is usable.

Electrostatic discharge (ESD) is a sudden transfer of static charge between objects at different electrical potentials. Friction from carpet or synthetic clothing builds charge, especially in dry air.

Damage can be invisible

People usually do not feel a discharge below about 3,000 V, but many components can be damaged below 100 V. Damage can be immediate or latent: a part works initially, then becomes unreliable or fails later. A successful first boot does not establish safe handling.

Prepare a continuous protective connection

Keep the person, equipment and work surface at the same potential using the approved ESD bench setup. The wrist band must touch bare skin. Its cord typically has a 1 megohm resistor that lets charge drain gradually. Connect the strap, dissipative mat and equipment to the intended common point.

Touching a suitable grounded chassis discharges you once, but movement can build charge again. A correctly connected strap maintains protection throughout handling. Clipping a strap to an isolated object does not establish a continuous path to earth.

Keep parts in antistatic bags until the bench is ready. Handle edges or brackets, avoiding contacts, pins and chips. Do not slide parts across surfaces or pass them to an ungrounded colleague. Put removed parts straight into labeled protective packaging for storage.

Replace memory in order

1. Shut down and unplug the computer; remove a removable battery where applicable.
2. Press the power button to help drain remaining low-voltage charge. Prepare the mat and strap at the approved common point.
3. Remove the new module by its edges, align its notch and seat it until the latches close.
4. Bag the old module and record the replacement.

The module stays protected until you can install it. Force cannot correct a notch facing the wrong way.

An ESD strap protects components from static, not a person from hazardous voltage. Do not wear one near high voltage. Replace power supplies as complete units without opening them; their capacitors can retain dangerous charge after unplugging.

A computer that looks switched off may still contain live circuits or stored energy. Plan internal work, lifting and emergency response before starting the task.

Disconnect and respect stored energy

Shut down, unplug the power cord and remove a laptop battery where possible before repair. A plugged-in motherboard may still receive standby power. Capacitors inside power supplies, displays and laser printers can retain hazardous charge even after unplugging. Replace power supplies as complete units; let a laser printer's hot fuser cool before reaching into its permitted service areas.

Equipment grounding connects exposed metal through the ground pin to a low-resistance return path to the electrical supply. If a fault energizes the case, the resulting fault current lets a breaker or fuse disconnect power. Keep the ground pin intact, report damaged cords and outlets, and take damaged equipment out of use. Do not overload outlets or connect power strips in a chain. Building wiring is work for a qualified electrician.

Move equipment safely

Plan the lift and clear the route. Stand close, bend at the knees and hips, keep your back straight and the load near your body, and turn with your feet. A server or large printer may be awkward even when its mass seems manageable. Use a cart or another person when the task needs it.

The US National Institute for Occupational Safety and Health (NIOSH) lifting equation starts with a 23 kg load constant under ideal conditions. Its recommended limit falls with reaching, low starting positions, frequent lifts and other task factors. Treat that figure as part of a task assessment, not permission for every person to lift a 23 kg device alone.

Respond to fire through the emergency plan

Know the exits, alarms and extinguisher locations. Raise the alarm promptly. Fight a small fire only when trained and authorized, with a clear escape route and the correct extinguisher; otherwise evacuate. For energized electrical equipment, use an extinguisher rated for that hazard, such as an appropriate carbon dioxide extinguisher. Ordinary water conducts electricity. Cut power only when safe, and read the rating because class letters differ by country.

Match protection to the job

Use goggles for compressed-air cleaning, toner cleanup, cutting cables and work involving springs or batteries. Use the specified mask when dust or toner can become airborne and gloves for sharp metal edges. Follow workplace training and protective-equipment rules.

Keep cables off walkways or use approved covers. Route cables through trays, secure and label them, keep them away from heat, and preserve airflow inside cabinets. Good routing prevents trips and makes the correct cable easier to identify during a repair. Report an injury or near miss through the incident process so the hazard can be corrected.

Heat, moisture, dust and unstable power can cause failures that look like software problems. Check the equipment's surroundings as well as its settings.

Keep air moving and moisture controlled

Electronics generate heat. Excess heat can cause thermal throttling, where performance drops to limit temperature, and can shorten component life. Leave vents clear, clean fans and filters, and keep equipment away from heaters and direct sunlight. Avoid closed cabinets without airflow and soft surfaces that cover a laptop's intake. Use stable surfaces above floor-level dust and possible water.

For data-center equipment, ASHRAE's commonly recommended inlet-air range is 18–27 °C. It describes air entering the equipment, not the temperature of a processor. Check the equipment's requirements when applying environmental controls.

Dry air increases static buildup. Excess moisture can lead to condensation and corrosion. Let cold equipment reach room temperature before switching it on in a warm room; moisture may have formed inside it.

Use compressed air in a ventilated area away from people, wearing goggles and the specified mask. Hold fans still and keep the can upright so propellant does not spray out. Use an ESD-safe electronics vacuum when needed; an ordinary household vacuum can generate static.

Match protection to the power problem

A surge suppressor diverts excess voltage. Its joule rating describes energy handling; clamping voltage describes when diversion begins. Protection wears out, so check its indicator. A plain power strip provides outlets only. Neither a power strip nor a surge suppressor supplies battery energy during an outage.

An uninterruptible power supply (UPS) gives time to save work and shut down. A standby model switches to battery on failure. A line-interactive model also corrects modest voltage changes without using the battery. An online double-conversion model continuously supplies the load through its inverter. Runtime depends on load and battery condition, often lasting minutes; test and replace aging batteries. A USB connection can support automatic shutdown.

Check the watt rating

A 280 W desktop, two 35 W monitors and a 15 W switch total 365 W. Adding 25% headroom gives 456.25 W. A 500 VA / 300 W UPS is too small; a 1000 VA / 600 W unit meets that power requirement. Check runtime as well as watt capacity. VA and W are different ratings, so a large VA number alone cannot settle the choice.

Capacity and duration answer different questions

The watt rating asks whether the UPS can support the connected load at all. Runtime asks how long it can do so with the actual batteries and load. A unit may pass the watt-capacity check yet give too little time for the planned shutdown.

List only the equipment that will use the battery outlets, total its demand and apply the planned headroom. Then consult runtime information for that load and test the shutdown arrangement. Do not add a laser printer to use a spare socket: its heater changes the demand beyond the workstation-and-monitor calculation.

Support work creates waste and sometimes exposes people to chemicals or damaged batteries. Use the product's handling information and the approved disposal route before moving or cleaning unfamiliar material.

Find the right safety information

A safety data sheet (SDS) comes from the manufacturer or supplier and explains hazards, handling, storage, protection, first aid, spill cleanup and disposal. Older documents may call it a material safety data sheet (MSDS). The Globally Harmonized System (GHS) uses a 16-section format.

Useful sections include 4 for first aid, 6 for accidental releases, 8 for exposure controls and personal protection, and 13 for disposal. For unfamiliar toner or solvent, read the relevant product sheet before starting. A sheet for a different product may specify different protection or cleanup.

Keep batteries out of ordinary waste

Laptop and phone batteries commonly use lithium-ion chemistry; many UPS batteries use sealed lead-acid. These materials need a collection or recycling program. Protect exposed terminals with nonmetallic tape or individual bags to prevent short circuits.

A swollen lithium-ion battery is a fire risk. Stop using and charging the device, avoid pressure or puncture, and arrange specialist handling through the manufacturer or workplace hazardous-waste process. Isolate it from flammable materials using the approved fire-resistant storage arrangement. Do not force it out of a tight case or put it into an ordinary collection box for undamaged batteries.

Clean toner without spreading dust

Toner is fine powder. Avoid raising dust and use the protection and cleanup method in the product's SDS. A vacuum must be designed for toner with appropriate fine-particle filtration; a household model can spread the powder. Use cold water for residue where the product instructions permit it, because heat can bond toner to surfaces. Return empty cartridges through a manufacturer or recycling program and do not burn them.

Retire equipment with a complete record

Old computers, displays and printers contain recoverable metals and may contain hazardous substances. Older cathode-ray-tube displays can contain lead; older LCD backlights can contain mercury. Use certified e-waste recyclers or manufacturer take-back programs. Working equipment may be suitable for approved donation or resale.

Before a device leaves the organization, complete data removal or storage destruction under security policy, and update its asset record. Keep certificates of recycling or destruction. For an office replacing 30 laptops, record each device's outcome, verify the required data handling, separate working donation devices from broken recycling devices and retain the disposal evidence.

Environmental rules differ by location. The European Union's Waste Electrical and Electronic Equipment (WEEE) framework places collection and recycling responsibilities on producers; many US states have their own rules. Follow the local route and retain its records.

Software use depends on permission from the copyright holder. An end-user license agreement (EULA) sets the rules for installations, users, transfer and restrictions; purchasing a copy usually buys permission to use it, not ownership of the software.

Check the right to use the product

An organization needs enough valid licenses of the correct type and purchase records to demonstrate them. Activation shows that a key passed a technical check; entitlement comes from the applicable license and records. Report unlicensed software and use approved installers.

A perpetual license permits use of a particular version indefinitely, although support and updates can need separate maintenance. A subscription covers a defined period. After expiry, its terms determine whether the product stops or keeps reduced features, such as viewing and printing.

A personal-use or home edition can forbid business use even when it is free to download. Check commercial rights before installing remote-control, security or other software at work. Business, volume and site licenses have their own terms.

Count the licensed unit

The count changes because the contract measures a different thing. Forty employees do not imply 40 licenses under every model. Record installations and assignments so moves, retirements and departures do not leave the counts stale.

Respect open-source conditions

An open-source license permits use, study, modification and sharing under stated conditions. Permissive licenses such as MIT and Apache 2.0 allow broad reuse, including in closed products, while retaining required notices and meeting their other terms.

Copyleft licenses such as the GNU General Public License (GPL) attach source-sharing and licensing obligations when covered modified versions are distributed. Internal use and distribution are different situations. Check the applicable license's requirements before sharing modified software; "open source" does not mean permission without conditions.

Manage activation and retirement

Digital rights management (DRM) enforces restrictions through activation, online checks or device limits. Deactivate transferable licenses as required before reinstalling or retiring a device so they can be assigned correctly to its replacement. Do not bypass controls to solve a licensing problem.

Daily support work connects installation, inventory and licensing. Before deploying an application, confirm approval and entitlement, record where it went and track renewal dates. When a user leaves or a device is retired, reclaim licenses only within their transfer terms. A working application can still have an incorrect license assignment.

Support technicians can see more information than their task requires. Protect personal and confidential data by limiting what you open, copy, store and share.

Recognize protected information

Personally identifiable information (PII) identifies someone directly, such as a name or email address, or through combined details such as a date of birth and postal code. The European Union's General Data Protection Regulation (GDPR) uses the broader idea of personal data relating to an identifiable person, including some IP addresses and device identifiers.

Government identifiers include passport, driver's license, national identity and tax numbers. Payment information includes card numbers and related details. Healthcare information includes diagnoses, treatments and insurance records. These categories can need special controls beyond ordinary support notes.

The Payment Card Industry Data Security Standard (PCI DSS) is an industry standard for organizations handling card data. It prohibits retaining a card security code after authorization. Keep card details out of tickets, chat and email. In the United States, HIPAA protects health information in covered settings; under GDPR, health data is a special category requiring extra protection.

Apply shared privacy principles

Collect only what is needed, use it for the stated purpose, secure it and limit access to people who need it. Keep data only for the permitted period and respect rights to access and correction. Report a suspected breach promptly through the organization's process so responsible staff can assess their duties.

Under GDPR, the controller must notify the supervisory authority without undue delay and, where feasible, within 72 hours of awareness, unless the breach is unlikely to risk people's rights and freedoms. A technician reports internally promptly; the privacy lead coordinates the organization's assessment and notification. Waiting until the last hour can prevent that work.

Retain what policy requires

A retention schedule sets keeping and deletion periods. A legal minimum can require financial records to remain, while unneeded personal data may need deletion. A legal hold suspends normal deletion for specified records. Do not put user copies on personal storage or keep temporary files beyond their approved use.

A non-disclosure agreement (NDA) is a confidentiality contract. In a mutual agreement (MNDA), both parties protect information shared with each other. Access obtained during support remains subject to those duties.

Keep the task narrow

Ask before opening a user's files and inspect only what the task requires. For a mailbox-size problem, settings and folder sizes may be enough; reading message contents adds unrelated exposure. Lock your screen when away, protect data before equipment goes for repair and remove temporary working copies as policy directs. A user agreeing to support access does not make every file relevant to the job.

An acceptable use policy (AUP) sets rules for organizational devices, networks and accounts. It can prohibit unapproved software, harassment, password sharing and illegal content, and explain permitted personal use and monitoring.

Know the policy and report safely

Users usually accept the AUP during onboarding. A logon banner repeats authorization and monitoring conditions at sign-in. The banner supports the organization's compliance process but does not replace the full policy or the required local legal review.

If you encounter prohibited content or activity, stop the support task. Do not browse further, delete material, copy it to a personal drive or forward screenshots. Secure the device or area and report through the designated manager or security channel. Identify what you observed, report it, preserve it and document the response. Management, security and legal staff decide external reporting under policy and law.

Write what was found, where and when, who was present and every action taken with times. Record "Unexpected material displayed when the folder opened" as an observation, not a conclusion about a person's guilt. The report may be used in a formal investigation.

Preserve the handling record

A chain of custody records collection, storage and every transfer of evidence. Each handoff names the people involved, time, location and signatures. Evidence is labeled, sealed and kept under controlled access. If the record has a gap, investigators may be unable to establish who could have changed it.

Trained responders can make a forensic image, a bit-for-bit drive copy, through a write blocker to protect the original. They analyze the copy while the original stays sealed. Comparing cryptographic hashes, such as SHA-256, checks the copied content's integrity. Matching values provide strong evidence that the compared data match; they do not identify the person responsible for an incident.

Understand why restarting can lose evidence

The order of volatility ranks evidence by how quickly it can disappear. RFC 3227 gives this sequence:

1. CPU registers and cache.
2. Routing and ARP caches, process information, kernel statistics and memory.
3. Temporary file systems.
4. Disk data.
5. Remote logging and monitoring data.
6. Physical configuration and network topology.
7. Archival media.

Memory can hold running processes and connections that vanish when power is removed. Do not restart or power off a serious-incident device unless the response procedure directs it. Wait for trained responders to choose the collection and containment steps.

A technician can weaken evidence while trying to help: deleting material changes the original, copying it creates uncontrolled handling, and an email screenshot can expose illegal or confidential material to more people. Preserve the situation and make a factual record through the approved channel.

Generative AI can summarize tickets, search articles, draft replies and propose scripts. Its output needs review before it becomes a support action.

Check permission and data access

An AI policy names approved tools, permitted data, allowed tasks and review or disclosure requirements. An assistant integrated into a ticketing system can access data through its connection, so restrict its permissions.

Public services and private enterprise tools differ in actual storage, access, training use, search sources and privacy controls. Check those controls and the organization's approval before entering data. The label "private" does not authorize every customer log.

Mask personal and confidential details as required. Change "user jsmith at 10.20.4.17 failed to sign in" to "user A at host X failed to sign in". Keep passwords, tokens and keys out. Masking does not make an unapproved service acceptable.

Verify technical advice

A hallucination is plausible false output, such as a nonexistent command, invented source or wrong setting path. Check the product's official documentation for the actual version and parameters, then test the supported action in a sandbox.

A real command can also be outdated, incomplete or wrong for your configuration. Give relevant permitted context and check the result against the managed system. The technician applying the advice remains responsible for its effect.

Review fairness and reuse

Bias systematically favors or disadvantages groups or cases. If AI downranks non-native English tickets despite equal impact and urgency, review affected decisions against the priority rules and report the pattern.

Plagiarism presents another's work as your own. Follow required attribution and disclosure, and check copyright or code-license conditions before reuse. Correct technical output can still carry reuse obligations.

For an AI-assisted knowledge article, verify each instruction on the supported system and have the responsible person review it before publication.

Choose remote access by the task: seeing a user's screen, administering a server, entering a private network and managing a fleet are different needs. Start with the kind of access required, then select an approved tool.

Compare desktop, command and network access

Windows Pro, Enterprise, Education and Server can accept incoming RDP connections; Home cannot act as that host. On client editions, RDP normally locks the local screen and can disconnect another session. Locking or disconnecting preserves running programs; signing out ends the session. Use it for administration where shared viewing is unnecessary.

VNC shares the screen the user already sees and works across Windows, macOS and Linux. Classic VNC needs an encrypted tunnel or an encrypted implementation. SSH supports key authentication and secure file transfer through SFTP or SCP. It suits a Linux server service check without needing a desktop.

A VPN connects a remote device to the private network; it does not control a desktop itself. A technician can first connect through the VPN and then use RDP or SSH. WinRM supports scripted Windows management without opening a graphical session on each computer.

Match special tools to the job

Remote monitoring and management (RMM) uses agents to monitor health, raise alerts, deploy patches, run scripts and open remote-control sessions from one console. It suits a large device fleet or a managed service provider supporting several organizations. Desktop management tools also deploy applications, collect inventory and apply settings.

The Simple Protocol for Independent Computing Environments (SPICE) provides remote display access to virtual machines, for example through KVM/QEMU. A hypervisor console can remain useful when the guest's own network is down.

Screen-sharing tools such as Microsoft Quick Assist let a user start an attended session, often with a one-time code. Videoconferencing tools can share a screen or grant control; secure file-transfer tools move data without supplying a full desktop.

For a user who needs to watch a settings change, choose approved screen sharing or VNC. For a command across 20 Windows computers, choose WinRM. For patching 300 laptops, use RMM or desktop management. Choosing a familiar full-desktop tool for every task can interrupt users and add unnecessary work.

Remote access needs protection for its route, identities, permissions and session history. An attacker with control can act on a device from a distance or reach a whole managed fleet.

Protect the route and sign-in

Do not expose RDP, VNC or SSH directly to the internet. Use the approved VPN or gateway and restrict source networks. A different port does not authenticate users or encrypt traffic.

Use multifactor authentication (MFA), strong unique passwords, suitable lockout controls and least privilege. Prefer SSH keys where supported. RDP's Network Level Authentication (NLA) authenticates before a desktop session starts. Restrict RMM administrators tightly because one account can reach many devices.

Use encrypted transport such as SSH, RDP with TLS, HTTPS or VPNs. Avoid Telnet, plain FTP and untunneled classic VNC. WinRM follows the approved HTTPS setup and source limits. Encryption does not stop an attacker using stolen authorized credentials.

Verify identities and consent

Confirm the caller through the help desk procedure before granting access or resetting credentials. Users should verify unexpected remote requests through the known help desk number or official vendor channel, not a callback number supplied by the unexpected caller.

For attended support, explain the work, ask permission and let the user watch. Close unrelated private material before continuing and use expiring session codes where supported. Unattended access requires policy authorization and logging; permission for one attended session does not grant permanent access.

Finish and review access

Log who connected, to which device, when and for how long. Review unusual locations or out-of-hours activity. End the connection and confirm disconnection after the task.

Keep approved tools and VPN devices patched, and remove unused remote applications. A personal-use tool may also violate licensing terms. For remote Windows administration, use the approved MFA-protected gateway, permitted account and encrypted host session, then record the work and close the connection.

A script is a text file of commands executed by an interpreter. It can repeat support work consistently, but it can also repeat a mistake across every device it reaches. Read it before running it.

Recognize the file and interpreter

An extension helps identify the intended tool; the required interpreter must still be available. Microsoft deprecated VBScript and made it a feature on demand in Windows 11 version 24H2, initially enabled by default, with later disabling and removal planned. Use PowerShell for new Windows automation.

Read values, choices and repetition

A variable names a value. Values can be text strings, integers, true/false values or collections such as lists. A condition such as if chooses an action; a loop such as for repeats one. Comments explain intent to people: # starts a comment in Python, PowerShell and Bash; batch files commonly use REM or ::. An environment variable such as %USERNAME% supplies a system value.

computers = ["PC-101", "PC-102", "PC-103"]
for name in computers:
    print("Checking", name)

computers refers to a list of three strings. The loop assigns each string to name, then runs the indented line. It prints "Checking PC-101", then the corresponding line for PC-102 and PC-103. Adding one name repeats the action once more without copying the command.

Know the effect before executing

Scripts can collect inventory, map drives, install software, run backups, restart machines or start updates. For example, shutdown /r /t 0 restarts a Windows computer immediately; its effect can interrupt a user's work.

A shell script can begin with #!/bin/bash to name its interpreter. chmod +x backup.sh gives execute permission before ./backup.sh runs it. PowerShell execution policy controls script execution; Windows client defaults are commonly Restricted, while organizations may set RemoteSigned. This helps prevent accidental execution but is not a security boundary. Follow managed policy instead of bypassing it.

Inspect targets, paths, permissions and every destructive operation. Test in a sandbox, then one computer, then a small pilot before wider use. Keep backups, comments and version history, use least privilege and take fleet changes through change management. Never hard-code passwords. An untrusted script may contain malware; an endless loop or uncontrolled process creation can exhaust resources even without deleting anything.

Trace a choice before repeating it

A condition can select which listed devices receive an action. For example, an inventory script may print a warning only when a device's reported free space is below its configured threshold. Check the measured value, then the condition, then the action inside that branch. Next check which computer supplies the value on the following loop pass.

This reading order catches a common targeting error: reusing the previous device's value while the loop moves to the next name. In a sandbox, compare each output line with its input so a plausible-looking report does not hide a repeated stale value.