Memory hook: Pick the tool that exposes the failing layer.
Must remember
| Tool | Useful question |
|---|---|
| Task Manager / Resource Monitor | Which process or resource is busy? |
| Event Viewer | What happened, when and in which component? |
| Device Manager | Is a device/driver recognized and functioning? |
| Services | Is a service running and configured to start? |
| Disk Management | How are disks/volumes allocated and mounted? |
| Registry Editor | What low-level setting exists? Change only with a justified backup/plan. |
| System Information / msinfo32 | What hardware, firmware and system configuration is present? |
Command tools include ipconfig, ping, tracert, nslookup, netstat, hostname, whoami, gpupdate and gpresult. File/process tools include dir, copy, robocopy, tasklist and taskkill. Use the correct shell: Command Prompt and PowerShell have different syntax and object/pipeline behavior.
sfc checks protected system files; DISM services/repairs Windows images under the chosen options; chkdsk checks filesystem-related structures and can require disruptive repair. Understand the command's effect before running a repair switch. Read-only inspection should precede changes when evidence is needed.
Local accounts, domain identities and Microsoft Entra/work accounts have different authority and policy paths. Local groups and UAC affect privilege; elevating a process is not the same as granting every user administrator rights. Group Policy can enforce settings that local manual changes later lose.
Use logs, version information and recent changes to choose a fix. Protect sensitive output in support tickets and avoid copying secrets into commands, scripts or screenshots.
Choose under exam pressure
| Requirement | Choice and reason |
|---|---|
| One process consumes memory | Task Manager/Resource Monitor, then process-specific diagnosis. |
| Policy resets a local setting | Inspect applied policy and its management source. |
| Device fails after update | Device Manager, driver history and vendor compatibility. |
Traps
- Registry edits are not a universal first troubleshooting step.
- Administrative elevation does not repair an incorrect command or target.
Active recall
1. Which tool shows applied Group Policy?
gpresult, with appropriate options and permissions.
2. SFC versus CHKDSK?
SFC checks protected system files; CHKDSK addresses filesystem/disk structures under its options.
3. Why distinguish PowerShell from cmd?
Their parsing, pipelines and command behavior differ.
4. What can explain a setting reverting?
A managed policy or configuration service may reapply its intended state.
5. Why avoid granting everyone admin?
It expands impact of mistakes and compromise rather than fixing the specific permission need.