Chapter 7

Explain the Troubleshooting Methodology

This chapter explores CompTIA IT Fundamentals+ Objective 1.6: Explain the troubleshooting methodology. In this eight-part method, you learn to identify the problem (gather information, duplicate the problem, if possible, question users, identify symptoms, determine if anything has changed, approach multiple problems individually); research knowledge base/Internet, if applicable; establish a theory of probable cause (question the obvious, consider multiple approaches, divide and conquer); test the theory to determine the cause (once the theory is confirmed [confirmed root cause], determine the next steps to resolve the problem, if the theory is not confirmed, establish a new theory or escalate); establish a plan of action to resolve the problem and identify potential effects; implement the solution or escalate as necessary; verify full system functionality and, if applicable, implement preventive measures; and, finally, document findings/lessons learned, actions, and outcomes.

In brief, the eight-step troubleshooting method is as follows:

Step 1: Identify the problem.

Step 2: Research knowledge base/Internet.

Step 3: Establish a theory of probable cause.

Step 4: Test the theory.

Step 5: Establish a plan of action.

Step 6: Implement the solution or escalate.

Step 7: Verify full system functionality; implement preventive measures.

Step 8: Document findings/lessons learned, actions, and outcomes.

• Gather information.

• Duplicate the problem, if possible.

• Question users.

• Identify symptoms.

• Determine if anything has changed.

• Approach multiple problems individually.

As you begin the troubleshooting process, keep in mind that computers and computing devices are composed of subsystems. A subsystem is the combination of components designed to do a particular task, and it can include hardware, software, and firmware components.

Use Table 7-1 to identify the components in a subsystem and what to test or check.

You can see from Table 7-1 that virtually every subsystem in the computer has hardware, software, and firmware components and that some processes also save, edit, or manage data. A thorough troubleshooting process will take into account both the subsystem and all its components.

Before you make any changes, make sure you safeguard current settings:

• If possible, back up the entire system.

• On a Windows computer, back up the system Registry using Regedit.

• Print out or record current firmware/UEFI/BIOS, network, and software settings.

What’s the best way to decide whether a hardware, software, data file, or firmware problem is the most likely cause? Typically, hardware problems are intermittent, whereas software, data files, and firmware problems are consistent. Why? A hardware problem is often the result of a damaged or loose wire or connection; when the connection is closed, the component works, but when the connection opens, the component fails.

Other information sources include the following:

• Printer self-test to display amount of RAM and number of pages printed (laser); firmware version (laser or inkjet)

• Network logs

• Current BIOS/firmware settings

• Hardware information

• Windows Update history

Use Table 7-1 for additional suggestions.

Some users might be fearful of possible consequences if they were not using a device or network connection in an authorized manner and may be unwilling to be forthcoming about what they were doing.

Be compassionate and understanding, and work to help users understand that your questions are not designed to assign personal blame but are intended to help the device, system, or network to run properly.

Some of the ways you can help to develop a good relationship with your clients during the process include the following:

• Using proper language and avoiding jargon, acronyms, and slang, when applicable

• Maintaining a positive attitude and projecting confidence

• Actively listening (taking notes) and avoiding interrupting the customer

• Using your smartphone only for business-related matters after explaining what you’re doing and why (no social media, personal calls, or personal texts)

• Avoiding judging the customer

• Avoiding arguments with the customer

• Asking permission before touching, viewing, or moving printouts or other personal/business items

• Loud noise from inside the computer

• An unpleasant or unusual odor, which might or might not be accompanied by smoke or fumes

• An unexpected error message

• Flickering lights or other signs of a power fluctuation

• Slower-than-normal system response

• Inability to connect to network resources

• Blank screen

• Software not performing as expected

Table 7-2 lists some of the symptoms that can be caused by different parts of the computer.

Some of these symptoms might still exist when you are talking to users, but others are likely to no longer be evident. How you ask users about symptoms can help you discover the symptoms that took place before the reported problem occurred:

• “Did you hear anything different than usual?”

• “Do you usually print to a network printer?”

• “Do you remember what apps were open when the problem happened?”

• “Have you used the (printer, device, app) before, or was it just installed?”

Keep in mind that you should not limit the conversation to immediate issues. Anything out of the ordinary that occurred earlier on the same day, earlier in the week, or even the previous week could be significant.

Some of the ways to determine if anything has changed might include the following:

• Reviewing operating system and application update logs

• Comparing the default settings for the device to the current settings

• Reviewing device driver versions and when they were last updated

• Reviewing antivirus and anti-malware scan histories

• Reviewing network update logs

• Checking to see if any device or peripheral cables have been disconnected or connected to different ports than their assigned ports

• Checking IT department records of system hardware upgrades

• Checking BIOS/UEFI firmware revisions and updates

• Checking to see what apps/programs were installed recently

• Determining if new hardware was installed recently

• Checking to see what apps/programs were updated recently

• Determining if there were changes to the database recently (new tables, new data, new queries, old data removed, and so on)

If your organization has its own knowledge base, search that first. However, sooner or later, it’s going to be time to head to the Internet:

• Whether you suspect a hardware or software problem, try searching the Internet for the symptoms before going to a particular vendor’s website to search.

• Use keywords that describe the symptoms or problems.

• Be sure to include brand, model and operating system information in your search—for example, “HP LaserJet Pro 400,” “Windows,” “Epson ET-4750,” “macOS,” “Microsoft Office 2016 for macOS,” “Office 365 Home and Student for Windows,” “Adobe Photoshop CC 2018,” and so on.

• Pay attention to the dates of proposed solutions if multiple suggestions are given, as newer suggestions may work better than older suggestions.

• Note the operating system or app version listed. Sometimes the same solution will work with older or newer versions than the current one.

• For apps that have cloud or local/network versions, make sure you specify the correct version.

For example, a user reports a loud cooling fan inside a desktop computer. At the prompting of another user, the power to the cooling fan was disconnected. The fan no longer makes any noise, but a temperature alarm inside the case is now going off. Fortunately, the user called the help desk and was advised to shut down the computer before the system was damaged or data lost.

Another example: A user reports an error message being displayed and the system becoming unbearably slow whenever two apps were being run at the same time. The user decided to run only one app at a time. This made it difficult to get work done as both apps were needed. Fortunately, the user decided to call the help desk and it was determined that both apps needed updates. After the apps were updated, the error message no longer appeared.

If an internal component appears to have failed, such as a network adapter, consider using a USB adapter as a temporary replacement. A USB adapter can typically be plugged in and used with a driver installation, instead of shutting down the computer and sending it in for repairs.

If you suspect a network connection problem, try connecting to a different wireless network or a different physical network.

If a problem occurs at certain times of the day, but not others, look for potential interference issues. For example, wired security systems and elevators can interfere with wired networks that use unshielded twisted pair (UTP) cabling. A microwave oven can interfere with some wireless networks. Try to examine the environment where the problem takes place under similar circumstances to when the problem takes place. Because you’re not familiar with the location, you might notice issues that the occupants don’t.

If a problem occurs with software, check the documentation to see if there’s a way to start the misbehaving app in safe mode. An app’s safe mode (when available) turns off features that might cause problems. For example, to start Microsoft Office for Windows apps in safe mode, hold down the Ctrl key while the app starts, or use the Run command and add the /safe option to the command to start the app.

For example, suppose you can’t print to a local printer. The printing subsystem includes the printer, the USB cable between the printer and the computer, the USB port, the printer driver in the operating system, and the application. Each of these could cause the problem.

Start by checking the printer itself. Is it turned on? Online? Does is have ink or toner installed? If not, correct the problem and retry.

Next, check the USB cable. Is it connected to the printer and to a USB port on the computer? If not, correct the problem and retry.

Continue until you have checked each part of the subsystem. By using this “divide and conquer” method, you can find and fix problems in a systematic way.

If a problem appears complex, try looking for common features. For example, problems with printing, saving documents, and opening documents could have different causes if only local devices are being used, but if a network is used, all of these problems could be traced back to the network.

Here’s an example with software:

The system locks up when two specific programs are running at the same time. The application subsystem includes the operating system, the storage for the apps, the app files, and the data files created by each app. Each of these could cause the problem.

Start by running the first app and opening, editing, and saving some files. Note the app’s version and installed updates. Are there any problems with the app? If not, close it. If there are problems, resolve them.

Next, run the second app and open, edit, and save some files. Note this app’s version and installed updates. Are there any problems with the app? If not, close it. If there are problems, resolve them.

You have determined that the apps work properly when run separately. By using the “divide and conquer” method with apps, you now know the problem has to do with the combination of these apps running and not a problem with either app by itself.

• Update device drivers.

• Uninstall the device and let the operating system reinstall the device.

• Swap a cable.

• Move a USB device to a different port.

• Swap memory modules.

• Mute audio components.

• Install updates for the operating system.

• Install updates for apps.

• Test drives for errors.

• Test databases or data files for errors.

See Table 7-1 for additional suggestions. If you swap (replace) parts, be sure to use parts that are compatible and are known to work. A new, untested part could be defective.

After you make a single change in the system, retest it to see if the problem is solved. What do you do next? That depends on what you found out.

• Update device drivers. Continue to use the updated device drivers.

• Uninstall the device and let the operating system reinstall the device. If the device now operates properly, continue to use it.

• Swap a cable. If the replacement cable is not needed elsewhere, continue to use it.

• Move a USB device to a different port. If the USB device now works, you must decide if the USB port’s host device (card, motherboard, or hub) needs to be replaced.

• Swap memory modules. If the replacement memory modules are not needed elsewhere, continue to use them.

• Mute microphone or speakers. If muting either the microphone or speakers solves the problem, determine a permanent solution.

• Install updates for the operating system. If installing operating system updates solves the problem, plan to implement the solution on other affected systems.

• Install updates for apps. If installing app updates solves the problem, plan to implement the solution on other affected systems.

• Test drives for errors. The results of the test determine what the solution should be.

• Test databases or data files for errors. The results of the test help determine what the solution should be.

For example, if swapping in memory didn’t solve the problem, try the memory you removed from the problem system in a different, but similar, working system. If the other system continues to work, that suggests that the original computer’s memory sockets are dirty or have failed.

If you have checked everything in a particular subsystem, you can either look at another subsystem or escalate the problem to the next support tier.

A plan of action can be as simple as installing a replacement cable. Sometimes a plan of action might be more complex, as in dealing with a failing internal drive in a RAID 10 array, as follows:

Step 1: Back up data if data has not been backed up in ___ days (the exact amount of time depends upon how often the data changes; if data changes frequently, a backup might be needed daily).

Step 2: Shut down system and disconnect from power.

Step 3: Take ESD (electrostatic discharge) precautions and open system.

Step 4: Remove old drive.

Step 5: Check capacity.

Step 6: Install new drive of same capacity.

Step 7: Reconnect to power.

Step 8: Restart system.

Step 9: Prepare drive for use (partition, reformat) using RAID firmware.

Step 10: Rebuild RAID array.

Step 11: Test drive for proper operation using operating system or drive vendor diagnostics.

Step 12: Restart system and test functionality.

Here’s an example of a plan of action for dealing with a malware outbreak:

Step 1: Identify and research malware symptoms.

Step 2: Quarantine the infected systems.

Step 3: Disable System Restore (in Windows).

Step 4: Remediate the infected systems.

4a: Update the anti-malware software.

4b: Scan and use removal techniques (safe mode, pre-installation environment).

Step 5: Schedule scans and run updates.

Step 6: Enable System Restore and create a restore point (in Windows).

Step 7: Educate the end user.

What are potential effects? Potential effects for any solution can range from nothing (system works immediately, no downtime) to significant (system must be taken offline for repairs) as in the plans of action just described.

If you are responsible for implementing the plan of action, follow it carefully. Be sure to note any problems with the plan or any additional problems you observe.

If you are not responsible for implementing the plan of action, escalate it to the department that is responsible.

Here are some examples of testing full system functionality:

• Connect to a wired network and open a folder, then a file.

• Connect to a wireless network and open a folder, then a file.

• Connect to the Internet and view a web page that changes frequently, such as a news aggregator.

• Print to a local printer.

• Print to a network printer.

• Open a file from local or network storage, edit it, and save it under a different name.

• Scan a document or photograph.

• Copy a file to a USB drive.

• Burn an optical disc.

• Extend the desktop or mirror dual displays (depending on task requirements).

• Scroll through a document with a mouse or pointing device.

• Pinch zoom a web page with a touchscreen.

• Run a backup.

• Run the OS or app update process.

• Run an app and use it normally (open, edit, save data, close app).

What circumstances require the implementation of preventive measures? Here are some examples:

• Data loss due to a lack of backups: Set up a backup schedule and enable automatic backup in supported apps (Microsoft Office, and so on).

• Malware infection due to outdated malware protection: Update malware protection and set up an update schedule.

• Malware infection due to lack of real-time protection: Enable real-time protection.

• Malware infection due to infection from website: Set up real-time protection and enable browser anti-malware features.

• Malware infection due to phishing emails or social engineering: Set up training to help users distinguish legitimate emails from fakes and to avoid social engineering attempts in person or by phone.

• Drive failure: Enable S.M.A.R.T. drive self-monitoring, schedule operating system disk testing on a regular schedule, and make sure backups are scheduled.

• Any problem caused by user error or omission of needed tasks: If possible, automate tasks that should be done and set up user training.

What lessons did you and others in the organization learn? For example, did users learn how to detect phishing emails? When to check for malware? How to tell when a backup drive is becoming full? How to tell that the wireless network is not working? Be sure to record this as well.

Here’s an example that shows it might be necessary to make several attempts to solve a problem and that one “solution” can lead to another problem that needs to be solved:

Step 1: A user is unable to perform a video chat on a desktop computer. Symptoms included a blank screen during video chat and no video device available.

Step 2: Research indicated most likely reason was that webcam was not plugged in to a working USB port.

Step 3: Theory: Plug in webcam.

Step 4: Webcam was plugged in and video responded. However, speakers began to make loud howling and clicking noises. Return to Step 1 to solve newly discovered problem.

Return to Step 1: User recalled that webcam was disconnected because of sounds coming from speakers.

Step 2: Research indicated that feedback between the webcam and speakers was a possible cause of the problem.

Step 3: Theory: Mute microphone in webcam.

Step 4: Webcam’s microphone was muted and sound from speakers stopped. However, webcam’s microphone and speakers, rather than a headset, are needed for video chat. Return to Step 1 to look for a permanent solution.

Return to Step 1: Speakers are behind webcam and are at same height as webcam (which is attached to the top of a display).

Step 2: Further research indicated that moving the webcam (microphone) away from the speakers might reduce/eliminate feedback.

Step 3: Theory: Place webcam on desk below level of speakers.

Step 4: Webcam was moved, unmuted, and feedback stopped.

Step 5: Plan of action: Make sure webcams and speakers are not at same height for this user or other user in a similar situation.

Step 6: Webcam’s position was adjusted permanently.

Step 7: Tested webcam and speakers in video chat. Verified correct operation. Played music and audio with speakers. Verified correct operation. Showed user how to mute/unmute webcam microphone in case future changes in equipment setup would cause problems.

Step 8: Wrote up problem and solution. Made available in in-house support documents. Advised all users with similar situations.

Subsystem

hardware

software

firmware

log files

knowledge base

theory of probable cause

plan of action

full system functionality

preventive measures.

1. Establish a theory of probable cause

2. Identify the problem

3. Establish a plan of action to resolve the problem and identify potential effects

4. Implement the solution or escalate as necessary

2. Setting up staff training to avoid phishing and social engineering is an example of ____________.

1. establishing a plan of action

2. identifying the problem

3. testing the theory

4. preventive measures

3. Resetting the CMOS is not an example of troubleshooting which of the following components?

1. Power

2. RAM

3. Motherboard

4. CPU

4. Which of the following components uses TCP/IP configuration settings?

1. Network adapter

2. Display

3. Storage

4. RAM

5. How can you capture a BIOS/UEFI/firmware setup screen? (Choose the correct method.)

1. Press the PrintScreen key.

2. Use a screen snipping program.

3. Use your smartphone’s camera.

4. Use Alt+C keys.

6. The scanner driver is an example of which of the following?

1. Software

2. Hardware

3. Firmware

4. Subsystem

7. You are preparing to test an internal SATA hard drive. Which of the following is not part of the storage subsystem?

1. SATA cable

2. BIOS/firmware settings

3. Power connector

4. USB port

8. Identify symptoms” is part of which step?

1. Step 2: Research knowledge base/Internet

2. Step 4: Test the theory

3. Step 1: Identify the problem

4. Step 6: Implement the solution or escalate

9. Select the correct order for these steps: (a) Test the theory; (b) Research knowledge base/Internet; (c) Identify the problem; (d) Document findings.

1. a, b, c, d

2. c, b, a, d

3. d, a, c, b

4. d, c, b, a

10. A speed monitoring cable is used by which of the following subsystems?

1. Storage

2. Display

3. Power

4. Cooling

11. You have swapped a cable with a brand-new cable, and the device still does not work. Which of the following is the correct conclusion to draw?

1. Something else besides the cable is wrong.

2. The port is defective

3. The replacement cable is not known to be working.

4. The device is defective.

12. In the process of repairing a “dead” computer, you wind up swapping the power supply, the RAM, and the video card, in that order, keeping each of the replacement parts connected as you swapped the next one. The computer now works. Which of the following is a correct statement of what happened?

1. The power supply was the problem.

2. The RAM was the problem.

3. All of the replaced parts were defective.

4. We don’t know if the power supply and the RAM are defective.

13. If the theory is confirmed (confirmed root cause), you should determine the next steps to resolve the problem. What should you do if the theory is not confirmed?

1. Establish a new theory or escalate.

2. Question users.

3. Verify full system functionality and, if applicable, implement preventive measures.

4. Duplicate the problem, if possible.

14. You are applying the troubleshooting methodology steps in order to fix a user’s laser printer that won’t print. While establishing a theory of probable cause, what should you do first?

1. Duplicate the problem, if possible.

2. Question the obvious.

3. Change the toner cartridge.

4. Approach multiple problems individually.

15. What are the first and last steps of the troubleshooting methodology?

1. Establish a theory of probable cause and implement the solution or escalate as necessary.

2. Research knowledge base/Internet, if applicable, and verify full system functionality.

3. Test the theory to determine the cause and establish a plan of action.

4. Identify the problem and document findings/lessons learned, actions, and outcomes.

16. You are attempting to identify an operating system application-related problem for a user. Where would be a great place to gather information from?

1. The users Pictures folder

2. The network log

3. The operating system application log

4. A second-tier help desk support technician

17. The user is attempting to open a picture and sees an error message instead. When you have the user open another picture in the same folder, the picture opens normally. Which of the following is most likely the cause?

1. App failure

2. Hardware problem

3. Firmware problem

4. Picture file corrupted

18. You are helping a user with a website that doesn’t want to load. Which of the following troubleshooting actions should be tried first to determine if the website itself has a problem?

1. Open a different website.

2. Disconnect and reconnect the network cable or USB adapter.

3. Reinstall the web browser.

4. Contact the Internet service provider.

19. A user’s desktop computer won’t turn on. The user reports that a hard drive was just replaced at the user’s work area and the tech didn’t test the computer before leaving. Which of the following should you check first?

1. AC outlet used by computer

2. Switch on surge suppressor

3. Power supply switch and AC cord

4. Front-panel wire from case power switch to motherboard

20. You are sitting in an airport terminal awaiting a connecting flight. A fellow passenger is playing “Angry Birds” but can’t make a phone call. Which of the following should be checked first?

1. Power

2. Airplane mode

3. Bluetooth

4. Wireless