220-1202 Cheat Sheet

Four Windows install paths differ mainly by what they preserve: a clean install wipes the volume and starts fresh, an in-place upgrade keeps files, apps, and settings, image deployment clones one standard image onto many machines, and a repair installation reinstalls the same version over itself to fix corruption while keeping data. Name the goal first (keep data, wipe, or standardize) and the path follows.

Trap Running a clean install to fix a single corrupt OS, erasing data that a repair installation or Reset with Keep my files would have preserved.

An in-place upgrade runs Windows Setup from inside the running OS and keeps personal files, apps, and settings, which is how you move Windows 10 to Windows 11 and between feature versions. Aimed at the same version already installed, it also becomes a repair. Nothing needs reinstalling afterward, unlike a clean install.

Trap Assuming a clean install is required to go from Windows 10 to 11; the in-place upgrade carries apps and files across.

Before capturing a reference machine for image deployment, run Sysprep with the /generalize switch, which removes the machine-specific security identifier (SID) and hardware bindings so every cloned PC ends up with a unique identity. Deployment tools such as WDS, MDT, or Configuration Manager then push the image, usually over the network.

Trap Cloning a Windows image without running Sysprep generalize first; duplicate SIDs break domain membership and some management tooling.

Push-button reset rebuilds Windows from on-box recovery files, or a cloud download, in two modes: Keep my files removes apps and settings but leaves personal data, while Remove everything wipes the volume and adds a data-cleaning option for a device you are handing on. Neither needs external media.

Trap Selecting Keep my files when repurposing a PC for a new user; personal data survives, so Remove everything is the correct wipe.

Firmware mode fixes the boot disk's partition style: UEFI boots Windows from a GPT disk and legacy BIOS boots it from an MBR disk, and the two are not interchangeable for the volume Windows starts from. Match them at install time or Setup rejects the disk or the machine will not boot.

Trap Installing to a GPT disk while firmware is still in legacy BIOS mode (or MBR under UEFI); the mismatched pair will not boot.

An MBR (Master Boot Record) disk stores its partition table in the first sector, allows only four primary partitions (or three primary plus one extended holding logical drives), and cannot address space beyond 2 TB. A disk that shows only 2 TB usable out of a larger drive is the classic MBR symptom.

Trap Treating a 3 TB drive that shows only 2 TB as failing hardware; it is an MBR disk that cannot address the rest, so convert it to GPT.

A GPT (GUID Partition Table) disk, part of the UEFI standard, supports up to 128 partitions in Windows and boots disks far larger than 2 TB, and it keeps a backup partition table with CRC checksums so one corrupt sector does not lose the layout. It is the required style for a Windows 11 system disk.

mbr2gpt.exe converts a system disk from MBR to GPT without deleting data, after which you switch firmware from BIOS to UEFI. The destructive alternative is DiskPart's clean followed by convert gpt, which erases the selected disk, so it fits a fresh install disk only.

Trap Running DiskPart clean against the wrong disk number; it erases whatever disk is selected, so confirm the number against list disk first.

A PXE (Preboot Execution Environment) boot uses the network card's ROM to get an address and boot-server name from DHCP, then downloads a WinPE boot image over TFTP that runs Setup or applies a deployment image. Backed by a server role such as WDS, it images many identical machines without carrying media to each one.

When Windows Setup lists no disks to install to, the installer is missing the storage controller driver (often NVMe or RAID), so you supply the vendor driver via Load driver rather than assuming the disk is dead. Newer install media usually include it; older media may not.

Trap Concluding the disk has failed when Setup shows no drives; the missing storage controller driver is the far more common cause.

A Mac reinstalls from macOS Recovery, reached by holding the power button on Apple silicon or Command-R on Intel, and Disk Utility there erases the disk to APFS, the default file system since macOS High Sierra and the right choice for SSDs. Migration Assistant then brings apps, accounts, and files from another Mac, a Time Machine backup, or a PC.

Installing a Linux distribution from a live USB alongside Windows partitions free space for Linux (commonly ext4 for root plus swap) and installs the GRUB boot loader, which shows a menu at power-on to pick Windows or Linux. Choosing to use the whole disk instead would overwrite the existing Windows install.

Trap Selecting erase disk or use entire disk in the Linux installer when you meant to dual-boot; it wipes the Windows partition.

OOBE's account choice has the longest reach: a local account is offline and specific to that PC, a Microsoft account is a cloud identity that syncs settings, a domain join hands management to on-premises Active Directory, and a Microsoft Entra join does the same for cloud identity. Domain and Entra joins require Windows Pro or higher.

Trap Confusing a Microsoft account (one person's cloud login) with a domain or Entra join (an organization taking management of the device); they are different choices.

A freshly installed or newly imaged Windows machine is months behind on security patches, so Windows Update (cumulative, driver, and feature updates) is the first task before the machine is trusted on the network. Windows 11 Home also requires an internet connection and a Microsoft account to finish OOBE at all.

The common distributions split by purpose: Ubuntu and its friendly Mint spin suit general desktops with long-term-support releases and huge communities, while Lubuntu's lightweight desktop revives old, low-RAM hardware. Debian is the rock-solid, fully community-run upstream that many other distributions are built on; Fedora is the fast-moving upstream proving ground for Red Hat Enterprise Linux; and Rocky Linux (like AlmaLinux) is a free, RHEL-binary-compatible drop-in replacement for CentOS.

Trap Treating Fedora as a stable long-term server base, when it is the bleeding-edge upstream and Debian or Rocky is the stable choice.

The Windows Media Creation Tool downloads Windows and writes it either to a bootable USB flash drive of 8 GB or larger or to an ISO file you can burn to DVD, which makes it the way to upgrade a PC that has no internet by preparing the media on another machine. It requires administrator rights on the computer running it.

Trap Assuming the Installation Assistant can upgrade an offline PC, when only Media Creation Tool media works without internet on the target.

Home is the low-cost consumer edition for everyday use; stepping up to Pro adds domain and Entra join, BitLocker, the Hyper-V hypervisor, Group Policy and Windows Update for Business controls, and support for far more RAM, since Home caps at 128 GB while Pro reaches into terabytes. Education and Enterprise carry Pro's capabilities plus academic or large-organization management and licensing.

Trap Reaching for Home when the requirement is domain join, Hyper-V, Group Policy, or more than 128 GB of RAM, all of which need at least Pro.

After an in-place upgrade to Windows 11, Settings > System > Recovery offers Go back to the previous Windows version, but only for a default window of 10 days, after which Windows deletes the old files in the Windows.old folder to reclaim space and the option greys out. Once that window has passed, reverting to Windows 10 requires a clean installation from media.

Trap Assuming Go back is available indefinitely, when reverting after the 10-day window needs a full clean install.

Beyond the TPM 2.0, Secure Boot, and CPU hardware floor, the Windows 11 Installation Assistant only runs on a PC already updated to Windows 10 version 2004 or later, only supports x64 processors so it will not launch on an Arm device, and must be run with administrator rights. A machine that passes PC Health Check can still be blocked by an out-of-date Windows 10 build or an Arm CPU.

Trap Assuming a PC Health Check pass guarantees the Installation Assistant will run, when an old Windows 10 build or an Arm processor still stops it.

At Windows Setup's 'Where do you want to install Windows?' screen, selecting an unallocated or empty drive and clicking Next lets Setup automatically create the required system, recovery, and primary partitions. Selecting an existing Windows partition without first formatting or deleting it installs alongside it and moves the prior installation into a Windows.old folder rather than erasing it.

Trap Assuming Setup always wipes the disk, when installing to an unformatted existing partition instead preserves the old system in Windows.old.

Full-disk encryption (FDE) is the control for data at rest on portable devices, because it turns a removed drive into ciphertext an attacker cannot read on another machine. A screen lock or account password only blocks a live login; it does nothing once the disk is pulled out. BitLocker (Windows), FileVault (macOS), and LUKS (Linux) all encrypt the whole volume with AES.

Trap Relying on a login or screen-lock password to protect data at rest; it is bypassed the moment the drive is removed and read on another computer.

Each OS has its own full-disk encryption tool: BitLocker on Windows, FileVault on macOS, and LUKS on Linux. They are not interchangeable, so the right answer follows the platform in the stem. All three encrypt the entire volume rather than selected files.

Trap Answering BitLocker for a Mac or Linux host; BitLocker is Windows-only, and those platforms use FileVault and LUKS.

BitLocker is available on the Pro, Enterprise, and Education editions of Windows, not Home, and it encrypts an entire volume with AES. You manage it from the Control Panel applet or the manage-bde command line. Windows Home instead offers Device Encryption on hardware that supports it, which is a more limited, automatic form.

Trap Expecting the full BitLocker management tools on Windows Home; Home only has Device Encryption where the hardware qualifies.

The Trusted Platform Module (TPM) is a hardware chip that seals BitLocker's volume key and releases it only when the measured startup path is unchanged. Change the firmware or boot loader, or move the disk to another machine, and the TPM withholds the key, forcing the recovery key. You can layer a startup PIN or USB key on top of the TPM for a pre-boot factor.

Trap Assuming a BitLocker disk moved into another PC will simply unlock; the TPM is bound to the original machine's boot, so it demands the recovery key.

BitLocker's recovery key is a 48-digit number that unlocks the volume when the TPM refuses, a PIN is forgotten, or hardware changes. Back it up somewhere off the encrypted drive: a Microsoft account, Active Directory, a printout, or a file on other media. A recovery key saved only on the encrypted disk cannot be reached when you need it.

Trap Saving the recovery key only onto the encrypted drive itself, leaving no way in once the volume locks.

BitLocker To Go applies BitLocker's volume encryption to removable media such as USB flash drives and external disks, unlocked by a password or a smart card. It is the answer for encrypting portable media, whereas standard BitLocker targets fixed system and data volumes.

The Encrypting File System (EFS) encrypts selected files and folders on NTFS, keyed to a single user's certificate, and decrypts them transparently while that user is signed in. It protects a file from other users of the same running machine, which BitLocker does not, but leaves the rest of the disk in the clear. Lose the user's certificate and the encrypted files become unrecoverable.

Trap Choosing BitLocker to encrypt just a few files for one user; BitLocker works on whole volumes, while EFS is the per-file tool.

Resetting a user's Windows password from an administrator account, rather than the user changing it themselves, can leave that user's EFS-encrypted files unrecoverable, because the file-encryption certificate is tied to the original credentials. Use a proper password change or a configured data-recovery agent when EFS is in play.

Trap Force-resetting a password from another admin account for a user with EFS-encrypted data, then finding the encrypted files can no longer be opened.

Least privilege means each account gets only the access its job needs, so routine work should run under a standard account. Malware or a mistake in a standard session inherits only standard-user power and cannot silently reconfigure the system, install services, or touch other users. Administrator accounts are reserved for installs and configuration changes.

Trap Running day-to-day as a local administrator for convenience; any malware in that session immediately has full administrative control.

User Account Control (UAC) interrupts before any change that needs administrator rights and asks for approval on a secure desktop. A standard user must supply an administrator's credentials, while an administrator just consents, and even admins run with a standard token until elevated. The prompt is the system working as designed.

Trap Disabling UAC to stop the prompts; that removes the elevation gate malware would otherwise have to clear.

NTFS permissions are assigned to a user or group and build up in scope: Read, then Read & Execute and List Folder Contents, then Write, then Modify, then Full Control. Full Control adds the ability to change permissions and take ownership, which the lower levels do not. NTFS permissions apply to both local and network access.

By default a subfolder or file inherits the NTFS permissions of its parent folder, so a permission set once high in the tree flows down without being reassigned. You can break inheritance on a child to manage it independently, which converts the inherited entries to explicit ones or removes them. This is why auditing one top-level folder tells you most of what its contents allow.

When NTFS permissions conflict, an explicit Deny beats an Allow, and an explicit permission on the object beats one it inherited. The Allows a user picks up from several groups are cumulative, so Read plus Modify adds up to Modify, but one explicit Deny still overrides them all. So a user who is allowed access through one group but explicitly denied through another is denied. Deny entries are strong, which is why least-privilege designs prefer granting narrow Allows over stacking Denies.

Trap Assuming a user's group Allow wins when another of their groups carries an explicit Deny; the Deny takes precedence.

Share permissions apply only when a folder is reached over the network, while NTFS permissions apply to every access, local or remote. When both are set, a network user's effective permission is the most restrictive of the two combined. A local user never crosses the share layer, so NTFS alone governs them.

Trap Granting Full Control on the share and overlooking a Read-only NTFS permission underneath; the remote user still gets only Read.

An account-lockout policy locks an account after a set number of failed sign-in attempts, which halts automated online password guessing that a longer password alone does not stop. The password policy still sets minimum length, complexity, history, and maximum age, but lockout is what defeats repeated live attempts.

Trap Answering 'require a longer password' to stop repeated failed logins; only lockout actually halts the automated guessing.

Multifactor authentication combines two or more factors from different categories: something you know (password, PIN), something you have (token, security key, authenticator app), and something you are (biometric). The categories matter, not the count, so two secrets of the same kind do not qualify. A leaked password alone cannot get in when a second category is required.

Trap Counting a password plus a PIN as MFA; both are 'something you know', so it stays single-factor.

Biometrics such as a fingerprint, facial recognition, or an iris scan are the 'something you are' factor, and Windows Hello uses them to sign in without a typed password. A biometric is hard to steal remotely but cannot be reissued if it is ever compromised, so it usually serves as one factor among several rather than the sole credential.

Both token types are the 'something you have' factor. A hardware token is a physical device: a key-fob showing a rotating one-time code, a smart card, or a FIDO2 security key on USB. A software token is an authenticator app on a phone that generates a time-based one-time code without dedicated hardware.

Single sign-on (SSO) authenticates a user once and then grants access to many systems without a fresh login at each, which is why one domain sign-in can open shares, mail, and apps. That convenience concentrates risk, because one captured SSO credential unlocks everything behind it, so SSO is meant to sit on top of MFA rather than replace it.

Trap Treating SSO as a security improvement on its own; without MFA, a single stolen credential reaches every linked system.

WPA3-Personal replaces WPA2's pre-shared-key four-way handshake with SAE (Simultaneous Authentication of Equals), so an attacker who captures the exchange cannot take it away and brute-force the passphrase offline, the attack that threatens WPA2 networks with weak passwords. SAE also provides forward secrecy, so cracking one session does not expose earlier traffic.

Trap Assuming a captured WPA3 handshake can be cracked offline the way a WPA2 handshake can; SAE is built to prevent that offline dictionary attack.

WPA2 introduced AES-based CCMP, the strong wireless cipher still in use, while TKIP was the interim WPA cipher and is now deprecated and weak. When a router offers both, select AES rather than TKIP or a mixed TKIP+AES mode. WPA3 likewise mandates AES-based encryption.

Trap Selecting WPA2 with TKIP (or a TKIP+AES mix) when AES-only is available; TKIP is the deprecated, weak option.

WEP (Wired Equivalent Privacy) uses the RC4 cipher with a weak initialization vector and can be cracked in minutes from captured traffic, so it is never an acceptable wireless setting. If a legacy device only supports WEP, isolate it on a separate network rather than dropping the whole network's security to WEP.

Trap Selecting WEP because an old device lists it as an option; WEP is trivially crackable, so segregate the legacy device instead.

Wi-Fi Protected Setup (WPS) lets a device join by pressing a button or entering an eight-digit PIN, and the PIN method is the flaw: the router validates it in two separate halves, shrinking the search space enough to brute-force it in hours. Turn WPS off regardless of which WPA version protects the network.

Trap Leaving WPS enabled because the network already uses WPA2 or WPA3; the WPS PIN is a separate weakness independent of the WPA version.

Personal mode shares one pre-shared key (PSK) across everyone on the network, so revoking one person means changing the passphrase for all. Enterprise mode uses 802.1X: the device authenticates through the access point to a RADIUS server that verifies each user individually, giving every user a revocable credential. Choose Enterprise when logins must be per-user and revocable.

Trap Using a shared pre-shared key when each employee needs an individually revocable Wi-Fi login; that requires Enterprise mode with RADIUS.

Windows built-in local groups grant a specific privilege without full administrator rights, which is the least-privilege choice: add a user to Backup Operators to let them back up and restore files, or to Remote Desktop Users to let them sign in over Remote Desktop. Membership is managed in Local Users and Groups (lusrmgr.msc).

Trap Putting the user in the Administrators group when a narrower built-in group already carries the one right they need.

A Data Recovery Agent (DRA) is an account whose certificate is designated, usually through Group Policy, to decrypt any user's EFS-encrypted files. It is how an administrator recovers encrypted data after an employee leaves or their profile and private key are lost. Without a preconfigured DRA, EFS files whose owning key is unavailable are unrecoverable.

Trap Reaching for an administrator password reset, which cannot decrypt another user's EFS files and can orphan them.

Windows records each failed sign-in as Security event ID 4625, so hundreds of 4625 entries in a short window, especially from one source address or against one account, signal an automated brute-force or password-guessing attack. A successful logon is the separate event ID 4624. Account lockout is the control that halts the guessing.

Trap Treating event ID 4624 (a successful logon) as the failure to hunt for.

By default Windows Defender Firewall blocks any inbound connection that does not match an allow rule while permitting outbound traffic, so keeping inbound blocked across all profiles is what limits malware from spreading laterally between machines. Blocking outbound instead is a deliberate hardening step to cut off command-and-control traffic, not the default behavior.

Trap Assuming the firewall blocks outbound traffic by default, when only unmatched inbound is blocked.

Windows Defender Firewall keeps separate rule sets for the Domain, Private, and Public profiles and switches between them automatically through Network Location Awareness. The Domain profile is applied only when the PC can authenticate to its domain controller; on untrusted networks such as coffee-shop Wi-Fi the Public profile with its most restrictive defaults applies, and a domain PC that cannot reach a controller also falls back to Public.

Trap Expecting a domain-joined laptop to keep the Domain profile on public Wi-Fi, when it can no longer reach a domain controller.

On a standalone Windows workstation, password and account-lockout rules are configured in Local Security Policy (secpol.msc) under Account Policies, in the Password Policy and Account Lockout Policy sections. Once the machine is domain-joined, a domain Group Policy Object overrides those local settings, which is why local password rules appear greyed out or stop taking effect after the join.

Trap Editing local secpol.msc on a domain-joined PC and expecting it to win over the domain policy.

Choose the mobile-device response by the scenario: a remote wipe erases all data on a device that is lost for good, a remote lock secures a device you expect to recover without destroying its data, and an enforced screen-lock PIN plus auto-erase after several failed passcode attempts protects an unattended or stolen device from passcode guessing. When someone shoulder-surfs a PIN, setting a new PIN restores that one credential.

Trap Reaching for a remote wipe on a device that is only temporarily misplaced, when a remote lock preserves the data.

When the Group Policy setting 'Passwords must meet complexity requirements' is enabled, a password must contain characters from at least three of four categories (uppercase, lowercase, digits, and symbols), be at least six characters long, and not contain the user's account name or full display name. It enforces these rules together, separate from the standalone minimum password length setting.

Trap Assuming complexity alone sets a long minimum, when minimum password length is its own separate policy.

CompTIA's A+ method is a six-step loop: identify the problem, establish a theory of probable cause, test the theory, establish a plan of action and implement it, verify full functionality and add preventive measures, then document. It is a job-role working habit rather than a numbered sequence the 220-1202 objectives publish, so learn it for the way it orders your thinking. What domain 3.0 states four times over is "Given a scenario, troubleshoot common ... issues", the symptom-to-cause-to-fix discipline this loop carries.

Trap Jumping straight to a plan of action before you have established and tested a theory; the tested theory has to come first.

Identifying the problem means questioning the user and pinning down what changed right before the symptom, because a newly installed update, driver, or app is the prime suspect. Reproducing the fault confirms you are chasing the real problem and not a one-off. This is why reversing the recent change is so often the actual fix.

Trap Taking a user's "nothing changed" at face value; a recent update, driver, or install is usually the trigger even when they do not recall making a change.

Backing up data before you alter the system is part of step one of the methodology, because a repair can fail or make matters worse. It is testable on its own: when the planned fix risks data, such as a reset, a disk repair, or a reimage, the correct first action is to back up first.

Trap Running a destructive repair like Reset this PC's Remove everything or a full reimage before backing up the user's files.

At the plan-of-action step, start with the least invasive action that could resolve the symptom and climb only when it fails: reboot or restart the service, then Safe Mode and rolling back a driver or update, then System Restore, then targeted repairs (sfc, DISM, chkdsk, Startup Repair), and finally Reset this PC or a reimage. Each rung up preserves less of the user's data and installed software, so stopping at the lowest rung that works is both faster and safer.

Trap Reaching for a reimage or Reset this PC early; it is the last resort after cheaper, data-preserving fixes fail, not the first move.

The Windows Recovery Environment (WinRE) loads automatically after two consecutive failed startup attempts, and you can launch it on demand by holding Shift while selecting Restart or by booting Windows installation media and choosing Repair your computer. WinRE is the single gateway to Startup Repair, Safe Mode, System Restore, a command prompt, and Reset this PC.

Trap Assuming a PC that will not reach the desktop needs a reinstall; WinRE reaches every offline repair tool even when Windows will not start.

Startup Repair (Automatic Repair) is the first WinRE tool to try when Windows will not boot: it automatically diagnoses and fixes common boot problems such as damaged boot configuration and logs its work to Srttrail.txt. Let it run before you hand-edit boot files, because it resolves many boot faults without any manual command.

Safe Mode starts Windows with a minimal set of drivers and services, which lets you work when a bad driver or startup app prevents a normal boot. From WinRE, Startup Settings offers Safe Mode on F4, Safe Mode with Networking on F5, and Safe Mode with Command Prompt on F6. Once in, roll back the driver in Device Manager or uninstall the update that preceded the symptom.

Trap Choosing plain Safe Mode (F4) when you need to download a driver or reach the network; that requires Safe Mode with Networking (F5).

System Restore returns Windows system files, settings, drivers, and installed programs to an earlier restore point while leaving the user's personal files untouched, so it undoes a bad change you cannot pin to a single driver or update. Restore points are created automatically before major changes like updates and driver installs, and you can also make one by hand. It runs from within Windows or from WinRE.

Trap Expecting System Restore to bring back deleted documents; it reverts system state, not user files, so it is not a data-recovery tool.

From the WinRE command prompt, bootrec repairs the boot path: bootrec /fixmbr rewrites the master boot record's boot code, /fixboot writes a new boot sector, /scanos finds installed Windows systems, and /rebuildbcd rebuilds the Boot Configuration Data (BCD) store. Reach for it when Startup Repair fails and the error names a missing or corrupt Bootmgr, boot sector, MBR, or BCD.

Trap Running Reset this PC for a "BCD is missing" error; bootrec /rebuildbcd repairs the boot store without removing apps or data.

Reliability Monitor (run perfmon /rel, or open it from Security and Maintenance) draws a day-by-day stability timeline and marks each app crash, driver failure, and Windows update against its date, which answers the "what changed?" question almost visually. A stability score that drops the day a driver installed points straight at that driver. Event Viewer holds the same events, but as raw timestamped logs rather than a chart.

A blue screen (BSOD) is a stop error, most often from a bad driver or a failing update and sometimes hardware. Record the stop code, boot Safe Mode, and roll back the driver or update that preceded it; the minidump and Event Viewer name the failing component. A repeating INACCESSIBLE_BOOT_DEVICE points at a storage driver or a bad update rather than a broken app.

Trap Reimaging on a single blue screen; most stop errors trace to one recent driver or update you can roll back.

When Windows reports you are signed in with a temporary profile, the local user profile is corrupt and any changes are discarded at sign-out. Repair or recreate the profile (create a fresh local profile) and copy the user's data into it. Because it is a per-user fault, other accounts on the same PC still sign in normally.

Trap Reinstalling applications to fix one user's broken profile; the profile itself is the fault, so recreate it and migrate the data.

A domain client whose clock drifts more than about five minutes from the domain controller fails Kerberos authentication, so domain logins and resource access break even though the password is correct. Resync the clock with w32tm /resync and confirm the Windows Time service is running. The symptom looks like an authentication problem, but the cause is the wrong time.

Trap Resetting the user's password when domain logins suddenly fail across a site; if the clock drifted past the Kerberos tolerance, correcting the time is the fix.

When an application will not launch or crashes, the cheapest fixes usually work: run it as administrator if it needs the elevated token to reach protected files or registry keys, and set compatibility mode (Properties, Compatibility tab) for a program written for an older Windows. A repair of the installation and applying updates come next, and a full uninstall and reinstall is the step after those, not the first move.

Trap Uninstalling and reinstalling an app the moment it fails to launch; run-as-admin, compatibility mode, and a repair are faster and often fix it.

Before retrying a failed install, confirm the machine meets the app's requirements (Windows edition and version, disk space, and any framework it needs), that you are installing with administrator rights since a standard user cannot write to Program Files, and that the installer itself is not corrupt (re-download one that failed a checksum). Remove a blocking older version from Programs and Features first.

Trap Blaming the app when a standard user cannot complete an install; writing to Program Files needs administrator rights.

If one account can run an app or open a file and another cannot, the difference is usually NTFS permissions on the program folder or the data file, not the application itself. Compare the effective permissions and check for a corrupt profile rather than reinstalling. The app binaries are shared, so a fault that is user-specific points to that user's rights or profile.

Trap Reinstalling the application to fix a one-user access problem; the app is fine, and NTFS permissions or a corrupt profile are the real cause.

A legacy application that will not run on the current Windows even in compatibility mode should run in a virtual machine or on a supported OS version, which is the plan of action rather than another reinstall. Compatibility mode only helps an app that expects an older Windows; it cannot rescue one the operating system genuinely cannot execute.

Steps five and six of the method are real, tested steps: confirm the original symptom is gone and nothing else broke, add a preventive measure where one applies, then record the symptom, cause, and fix in the ticket or knowledge base. Documentation is what lets the next technician skip the diagnosis you already did.

Trap Closing the ticket as soon as the fix appears to work; verifying full functionality and documenting the outcome are the required final steps.

When a symptom appears immediately after a Windows update or a driver install, the targeted fix is to reverse that one change: uninstall the update (from Settings, or Uninstall Updates in WinRE) or roll back the driver in Device Manager, rather than a broad repair. It is faster and less disruptive than System Restore because it touches only the suspect item; System Restore is the fallback when you cannot pin the change to one update or driver.

Trap Running sfc or reimaging after a bad update when simply uninstalling that update restores the machine.

Symptoms that signal malware, such as pop-ups, browser redirects, ransom notes, or a rogue antivirus, follow the malware-removal best-practice process, not a generic OS repair, and phone or tablet faults follow the mobile workflow. Recognizing which process a symptom belongs to is itself tested, because the recovery tools on this page will not remove an infection.

Trap Running Startup Repair or sfc to clear malware symptoms; malware removal follows its own quarantine-and-remediate sequence.

Change management replaces ad-hoc changes with a controlled process: every change is documented, risk-assessed, approved, and given a way back before it touches production. The goal is not bureaucracy but avoiding self-inflicted outages, so the exam frames it as choosing the controlled step over the fast one.

A rollback plan, also called a backout plan, is the pre-written path back to the last known-good state if a change fails. CompTIA uses both names for one concept, so an item offering both is not testing a difference between them.

Trap Treating the rollback plan and the backout plan as two separate documents; they are one plan under two names.

The backout plan has to exist before the change goes live, because once a change has failed in production there is no time to design a recovery. Having the way back ready is what turns a failed change into a quick restore instead of an incident.

Trap Implementing a change first and working out how to undo it only if it fails; the backout plan is a planning-stage deliverable.

Sandbox testing proves a change works in an isolated, non-production copy of the environment, so a bad change is caught off the live floor. The sandbox is walled off, so nothing done there touches real systems or data.

Trap Testing the change directly on production because it looks small; the point of the sandbox is to fail safely, away from users.

A single named person is accountable for the change from request to close, so there is never confusion about who drives it or who answers for the outcome. This is ownership by one person, distinct from the board that approves the change.

A change works through a natural order: submit the request, analyze risk, plan the change and its backout, get change-board approval, get end-user acceptance, implement, then verify and document.

Trap Jumping to implementation before the change has been risk-assessed and approved; risk analysis, planning, and approval come first.

The request form records why the change is needed (purpose), exactly what it touches and what it does not (scope), which systems and users are affected and the expected impact, and the date and time, ideally inside a maintenance window. This documented request is the starting point the rest of the process reviews.

Before approval you assess what could go wrong and how badly, then assign a risk level such as low, medium, or high. A higher risk level means a closer review and a firmer backout plan, so the level directly drives how much process the change needs.

A change board, often a change advisory board (CAB), reviews the request, risk, and plans and approves, defers, or rejects the change. For a normal change you do not implement without that approval, which exists so no single person pushes a risky change unchecked.

Trap Letting a technician implement a normal change on their own authority to save time; the change board's sign-off is required first.

The people who use the affected systems are notified what is changing, when, and how it affects them, and for user-facing changes they confirm it works afterward. Skipping acceptance is how a technically successful change still produces a wave of tickets.

After verifying the change worked and broke nothing else, you record what was done, when, by whom, the outcome, and whether the backout was used. That record closes the loop and feeds the knowledge base, so a 'the change is done, now what' question wants verify and document.

Trap Closing out a completed change without documenting it; the record is a graded step of the process.

A ticketing system tracks a support request from open to close, recording who reported it and on which device, a description of the problem, its category and severity for prioritization, the escalation level, and progress notes ending in the resolution. Category and severity are what drive how the queue is prioritized.

The written record is its own skill: a clear problem description, running progress notes, and a stated resolution let the next technician resume or find the ticket later without guessing. This record-keeping is separate from interpersonal communication, which is professionalism rather than documentation.

Asset management is the inventory of hardware and software, usually in a database once it grows, with each asset carrying an asset tag and unique ID, its assigned user, procurement details, and warranty and license status. When a question asks where a device's model, owner, or warranty lives, it is the inventory.

Trap Recording a device's owner, tag, or warranty in the ticket instead of the asset inventory; the ticket only references the device.

An asset moves through procurement, tagging and inventory, assignment to a user, maintenance (warranty and licenses), retirement, and disposal, with the inventory record tracking it the whole way. Disposal is not just discarding hardware: the device is wiped or destroyed so no data leaves with it.

A knowledge base is a searchable store of articles and known fixes, so a resolved issue becomes reusable instead of re-solved, and users can self-serve. Documenting resolved tickets is what feeds it, which is why a 'known fix already exists' scenario points here.

Trap Re-troubleshooting a recurring issue from scratch when a knowledge base article already documents the fix.

A network topology diagram shows how devices, segments, and links connect, so you read it before a change to see what will be touched and during a fault to trace the path. It is a map, not a procedure or a policy.

A standard operating procedure (SOP) gives step-by-step instructions so a repeatable task is done the same way every time, regardless of who performs it. The objectives name three: a custom software-install procedure, the new-user setup checklist for onboarding, and the end-user termination checklist for revoking a departing user's access.

Trap Skipping the end-user termination checklist so a departed employee's account stays active; the unrevoked account is an open door.

An acceptable use policy (AUP) states what users may and may not do with company systems, networks, and data, and users typically sign it. It is the document the organization points to when someone's use crosses the line.

A splash screen is a banner shown at logon or on a site that states terms, warnings, or required notices before a user proceeds, and it is one visible piece of meeting regulatory or compliance requirements. It differs from the acceptable use policy, which is the signed rules document rather than a displayed banner.

Trap Calling a logon warning banner an acceptable use policy; the banner is a splash screen, while the AUP is the signed policy document.

An incident report is a document type that records what happened during a security or safety incident, when, and how it was handled. It is distinct from the incident response process (first-responder duties, preserving evidence), which is a separate operational-procedures topic.

Trap Confusing the incident report you write with the incident-response process that governs handling; the report is the artifact, the response is the procedure.

Recording each ticket and incident with its symptoms, root cause, and resolution turns individual fixes into data you can analyze: it exposes a problem that keeps recurring across many users, feeds accurate help-desk metrics, and drives the continuous improvement of SOPs after a post-incident review. Resolving issues without logging them destroys that visibility, so the same root cause gets treated over and over instead of fixed once.

Trap Treating each repeat of the same issue as an isolated ticket instead of reading the pattern behind them.

An urgent fix such as a critical security patch or a production-down outage follows the emergency change process, which streamlines approval through a smaller authorized body, often an Emergency Change Advisory Board (ECAB), instead of waiting for the next scheduled CAB meeting. The steps are compressed, not dropped: documented justification, risk assessment, and a change record are still required so the change stays accountable.

Trap Treating an emergency as license to apply the change with no approval or record.

When a technician exhausts the standard troubleshooting or knowledge-base procedures, or a problem exceeds their access level or expertise, the correct next step is to escalate the ticket to the next support tier rather than keep guessing. Attach detailed notes of every step already taken so the higher tier does not repeat the work and can continue from where you stopped.

Trap Reaching for more trial-and-error fixes instead of escalating once the standard procedures are exhausted.

Knowledge base articles must be reviewed and updated whenever the underlying SOP, tool, or procedure changes, so technicians never follow outdated steps, and scheduling periodic reviews is how the repository stays reliable. A fixed article is saved with its revision date, while an article about a discontinued OS or tool is archived and labeled as legacy rather than left in active search results where it causes confusion.

Trap Deleting an outdated article outright instead of archiving it as legacy for anyone who still needs the history.