IT Support Interview Questions

"I was the person in my family and my friends' group who got called whenever a laptop stopped working, and I realised I liked it more than I let on. At college I took a part-time job at the campus help desk, mostly resetting passwords and fixing Wi-Fi on student laptops. What hooked me was the moment you find the real cause, like the time a whole lab couldn't print and it turned out to be one stuck job blocking the queue. I also like that the person usually leaves less stressed than they arrived. I want a proper service desk role now because I'd like to work on a wider range of problems, learn Active Directory and email admin properly, and grow into second-line work over time."

"I think the main job is keeping people able to do their work. Behind every ticket is someone who's stuck, so a fast, clear fix matters more than a perfect one delivered tomorrow. The desk is also the front door of IT. Most staff never meet the network or server teams, so how we answer the phone is how they judge IT as a whole. And the desk is an early warning system. If five people call about the same error in ten minutes, we're often the first to know there's an outage, and we're usually the first to hear about a suspicious email. A good desk notices those patterns, passes them on quickly, and writes things down so the same problem gets solved faster next time."

"Last year I set up a small lab on an old desktop with a free virtualisation tool. I built a Windows Server trial as a domain controller and joined a Windows client to it, then made users, groups and a couple of group policies. The part that taught me the most was when my client couldn't join the domain at all. After a while I found it was pointing at my home router for DNS instead of the domain controller, so it couldn't find the domain. Fixing that made DNS click for me in a way the course never did. I also rebuilt my parents' laptop when it got very slow, which taught me to back up first and ask what they actually use before wiping anything."

"I start by getting the facts instead of guessing. What exactly happens, is there an error message, when did it start, and did anything change, like an update, a new password or a move to another desk. Then I work out the scope. If it's one person it's probably their device or account, and if it's a whole team I'm looking at something shared like a server, the network or a service outage. After that I test the most likely and cheapest cause first and change one thing at a time, so I know what actually fixed it. Once it works I ask the user to confirm it on their side, not just take my word for it. Then I write up the cause and the fix in the ticket so the next person has a head start."

"First I'd ask what 'won't start' means, because users use it for three different problems. If there are no lights and no fans at all, it's power: I'd check the cable is seated, the wall socket works, the power strip is switched on, and try a known good cable. If the PC powers up but the screen stays black, I'd check the monitor is on, the cable is in the right port and the input is set correctly, which fixes more of these than you'd think. If it beeps or shows diagnostic lights, that usually points to memory or other hardware, so I'd escalate or swap the unit. If it gets past that but says no boot device, I'd check for a USB stick left in, then the boot order, and then the disk itself. If Windows starts loading and fails, I'd try the built-in startup repair or safe mode, and ask whether an update ran overnight."

"I'd first ask what's slow. If it's only one web app or the shared drive, that's likely the network or the server, not the laptop, and I'd check whether colleagues see the same. If everything is slow, I'd open Task Manager and see what's using the CPU, memory and disk. A process stuck at high usage usually tells the story. I'd check free disk space, because a nearly full drive slows everything down, and how long since the last restart, since some people never restart. Then I'd look at what changed this week: a new program, a big update half installed, a lot of new startup apps or browser extensions. I'd run a malware scan to rule that out. If it's an older laptop with little memory and a spinning disk, the honest answer might be an upgrade, and I'd raise that with the user's manager."

"Since the neighbours are fine, the network as a whole is working, so it's something about this machine or its connection. I'd check the basics first: is the cable in and the link light on, or is it on the right Wi-Fi network and not a guest one. Then I'd run ipconfig with the all switch. If the address starts with 169.254, the PC didn't get an address from DHCP, so I'd release and renew, and if that fails I'd try another cable or wall port. If it has a proper address, I'd ping the default gateway, then an outside IP address. If IPs work but websites don't, that's DNS, so I'd check the DNS servers it's using, flush the DNS cache and test with nslookup. I'd also check for a static IP someone typed in, proxy settings, or a VPN client stuck half connected."

"Because it's the whole floor, I can mostly rule out individual PCs, so I'd go to the printer or ask someone next to it what the screen says. A jam, an empty tray or a toner error explains a lot of these. If the printer looks healthy, I'd check it's on the network by pinging its IP address, and look at its network settings in case it picked up a new address. Then I'd check the print queue, either on the print server or on one user's PC if they print directly. A single stuck job at the top can block everything behind it, so I'd clear that job, and if the queue won't clear I'd restart the print spooler service. I'd also ask whether anything changed, like a driver update pushed overnight. Once it prints, I'd send a test page and let the floor know it's working again."

"With twenty minutes, I'd go for the fastest checks and a backup plan at the same time. First, can they open any normal website? If not, the VPN isn't the problem, it's their internet, and a phone hotspot often gets them going. If the internet works, I'd ask them to read me the exact VPN error. A very common one for remote staff is a password that expired while they were off the network, so I'd check their account for an expired password or a lockout while we're talking. Then I'd have them quit and restart the VPN client and try again. If we're still stuck with ten minutes to go, I'd switch to getting the presentation: if it's in cloud storage they can open it from a browser without the VPN. After the meeting, I'd book a proper session to fix the real cause."

"At my last company, a handful of users kept getting dropped from video calls, but only in one part of the building and only some afternoons. It looked random at first. I started logging each drop with the time, the user and where they sat, and after a week there was a clear pattern: every one was on the same wireless access point, and the drops lined up with a meeting room next to it filling up. I passed that evidence to the network team, and they found the access point was overloaded and on a busy channel. They adjusted it and added a second one. The drops stopped. What I took from it is that when something looks random, writing down every occurrence usually shows the pattern."

"At my last job a user working from home couldn't get her second monitor to show anything after a docking station swap. Before I connected, I confirmed who she was from the ticket, told her I'd need to see her screen and asked her to close her email and anything personal. Once connected, I talked through each step so she wasn't just watching a mouse move on its own. I found the display settings set to show only the laptop screen and an old display driver, so I asked before restarting, since she had a spreadsheet open, and let her save it first. After the restart, I had her drag a window across to the new screen herself. Then I disconnected, told her I'd gone, and wrote the driver fix in the ticket."

"When lockouts start the day after a password change, I assume the user is right and something else still has the old password. So I'd unlock the account and go through their devices with them. The usual one is email on their phone, which keeps trying the old password in the background. Next is the office Wi-Fi saved on a phone or tablet, if our Wi-Fi uses their work login. Then a second laptop, saved entries in Windows Credential Manager, or a mapped drive set up with saved credentials. We'd update or remove the old password on each one. If none of that explains it, I'd check the lockout event on the domain controllers, event 4740, which names the computer the bad attempts came from, or ask the systems team to. Then I'd check the account the next morning before closing the ticket."

"Active Directory is the company's central list of who and what is on the Windows network: user accounts, computers and groups. When someone signs in to a work PC, a domain controller checks their password against it. On the desk I'm in it all day. I search for the user, check whether the account is locked, disabled or expired, unlock it, and reset passwords with the option that makes them choose a new one at next sign-in. I also check group membership, because groups are how access is given, so if someone can't open a folder I compare their groups with a teammate's. OUs are like folders that organise accounts, and the desk usually only has rights over certain ones. Things like deleting accounts, admin accounts or group policy I leave to the system admins."

"I'd get the exact path and error first, because sometimes it's just a typo or a drive letter mapped to the wrong place. If it's a real access denied, I'd look at the folder's permissions to see which security group the team gets access through, and check whether the user is in it. Very often they're new or moved from another team and never got added. Before I add anyone, I'd check it's approved by the folder owner or their manager, depending on our process, and note that in the ticket, since access to data isn't something the desk should decide alone. Then I'd add them to the group, not to the folder directly. Group changes usually don't apply until the user signs out and back in, so I'd ask them to do that and test the folder with them."

"It starts with an approved request from HR or the hiring manager that gives me the name, role, team and start date. I'd create the account from a template for that role, not by copying another person's account, because copying drags along whatever extra access they've built up over the years. Then I'd add the groups for their team, assign an email licence and set a temporary password that must be changed on first sign-in. For the laptop, I'd make sure it's enrolled in our device management, encrypted, updated and has the standard apps, and I'd record the asset against their name. On the first morning, I'd sit with them for sign-in, help them set up MFA on their phone, check email, the shared drives and printing, and show them how to raise a ticket."

"First I'd check whether it's just them. If several people have it, I'd look at the service health page for a wider outage. If it's one user, I'd ask them to sign in to the web version of their mailbox. If that fails, it's the account: maybe the password expired, the account is locked, or there's a problem with their MFA sign-in, and I'd fix that. If the web version works, the account is fine and the issue is on the PC. Then I'd ask whether they changed their password recently, because Windows may still hold the old one, and I'd clear the saved Office entries in Credential Manager and sign in again. If that doesn't do it, I'd start Outlook in safe mode to rule out an add-in, make sure Office is up to date, and as a last step create a new Outlook profile."

"I'd look at the actual sender address, not just the name shown. These often come from a free mail account or a domain that's one letter off ours. Then the link. Hovering over it shows where it really goes, and it's usually some random site with a login page dressed up to look like ours. The message itself gives it away too: a vague greeting, a rush to act before your mailbox is closed, and a request to sign in, which our IT never asks for by email. I'd tell the user it's phishing, thank them for checking, and ask them to report it with the report button and then delete it. I'd also pass it to the security team so they can block the sender and pull it from anyone else who got it."

"I'd stay polite but I wouldn't reset it. Urgency plus seniority plus 'I can't verify' is exactly how a social engineering call sounds, and if I reset the wrong person's password I've handed over a senior account. So I'd explain that the check protects them, and then work hard to make verification fast. I could call them back on the number in the company directory, ask their assistant or manager to confirm, or walk them through self-service reset if they're enrolled. If they're genuinely who they say, one of those usually works in a couple of minutes. If they stay angry, I'd bring in my team lead rather than bend the rule myself. And I'd note the call in the ticket, because if it wasn't them, the security team will want to know someone tried."

"With five calls about one email, I'd treat it as a campaign, not five tickets. First I'd sort people by how exposed they are. Most only received it, so I'd thank them, ask them to report it with the report button and delete it. The person who clicked but typed nothing, I'd ask what happened after the click, and if anything downloaded, get the laptop checked and scanned. The one who typed their password is the priority. I'd follow our runbook: reset it, sign them out everywhere and check nobody added a new MFA method. At the same time I'd raise one incident to the security team with the original email and every caller's name, so they can block the link and pull it from other inboxes. I'd link every call to that parent ticket and, if our process allows, help get a short warning out to staff."

"I wouldn't install it right there, even with the manager's name mentioned, but I'd try hard not to just say no. I'd ask what they're trying to do, because often something we already have does the job, and I can set that up on the spot. If not, I'd explain in one line why there's a list: free tools sometimes aren't free for business use, some bundle unwanted extras, and anything we install we have to keep patched and supported. Then I'd raise a software request for them, ask the manager to approve it in the ticket, and tell them what happens next and roughly how long it takes. That way the user gets the tool if it's safe, and there's a record if anyone asks later why it's on the machine."

"I'd look at impact and urgency, not who's calling. The shared drive affects a whole team and stops their work, so it's the bigger incident. But a drive outage for many people is very likely a server or network problem that the desk can't fix alone, so the best thing I can do is spend two minutes confirming it and escalate it straight away to the server team, logging it as a major ticket. Once that's in someone's hands, I'd go to the meeting room, because that problem has a hard deadline and is usually a cable, input or display setting I can fix in minutes. I'd send the sales team lead a short message saying we know, who's working on it and when they'll hear next. If I had a colleague, I'd split the two instead."

"Forty minutes with no progress is usually past the point where I should have escalated. Most desks have a rough time limit, and I'd also escalate earlier if the fix needs access I don't have or if it turns out more users are affected. The important part is the handover. I'd write up the exact symptoms and error messages, what I've already tried and what happened each time, and attach screenshots or logs, so the second-line engineer doesn't repeat my first half hour. I'd tell the user plainly that I'm passing it to a specialist, who that is, and when they can expect to hear. Once it's solved, I'd read the resolution notes, because that's how I'd handle it myself next time."

"I'd let them get it all out first without interrupting, because arguing about whether it's been three days or two only makes it worse. Then I'd say I'm sorry they've waited that long, and I'd pull up the ticket right there with them. Often I'll see what happened, like it's waiting on a part, or it was assigned to someone who's off sick, or honestly it just fell through the cracks. I'd tell them plainly what I see, and then either fix it on the spot if I can, or give them a clear next step and a time I'll update them by. Then I'd make sure I actually hit that time. Afterwards I'd look at why the ticket sat untouched and mention it to my lead, so the same gap doesn't catch someone else."

"At my last job, an office manager kept having her laptop fill up and grind to a halt. The cause was that she saved everything to the desktop and never used the synced cloud folder, so her files lived only on a small, full disk. Instead of talking about storage and sync, I said her desktop was like a small drawer, and the cloud folder was a big filing cabinet that also keeps a copy safe if the laptop dies. I showed her once how to save to it, then had her do the next file herself while I watched. I checked in a week later and her disk was fine, and the next month she reminded her own team to do the same."

"Early on, I was cleaning up an old laptop before reusing it for another person and wiped it, assuming the previous user had moved their files to the cloud like everyone else. She hadn't, and a folder of drafts she needed was only on that disk. As soon as she asked, I told her straight away what I'd done, and then told my lead. We got most of it back from an older backup, but she lost about a week of changes, and I apologised to her properly. After that I started using a checklist before wiping any device: confirm with the user in writing that their files are saved, and check the disk myself for anything outside the synced folders. The team ended up adopting that checklist."

"A sales rep at my last company never restarted his laptop, so updates piled up and he'd call every couple of weeks about it being slow or apps crashing. Telling him to restart more often didn't work, because to him it meant losing all his open tabs and files. So I stopped telling him and asked what bothered him about restarting. Then I showed him that his browser could reopen his tabs and that his files autosaved to the cloud, so a restart cost him two minutes, not his whole setup. We agreed he'd restart on Friday afternoons. His tickets dropped off after that. If it had been a security issue, like refusing MFA, I wouldn't have negotiated; I'd have explained the policy and involved his manager."

"We kept getting calls about the new MFA app whenever someone changed phones, and each one took a while because people had to piece together the steps from memory. After the third one in a week, I wrote a short knowledge article. The title was what users actually said, 'I got a new phone and can't sign in', not the technical name. I wrote the steps in order with a screenshot for each, noted which parts only the desk could do, like clearing the old method, and added what to do if it still failed. The rest of the desk started linking it in tickets, and we also turned a cut-down version into a guide for users to read before they switched phones. Those calls got noticeably shorter."

"At my last job, I felt like I was reconnecting mapped drives for people every Monday. I searched our tickets and found it was dozens over a couple of months, nearly all from laptops that had been off the network over the weekend. I dug into one and found the login script that mapped the drives only ran at sign-in when the laptop could reach the domain, so anyone who signed in before their Wi-Fi came up got no drives. I wrote that up with the ticket list and took it to the systems team, who owned the script. They changed the setup so the drives reconnect once the laptop is back on the network. The Monday tickets for that almost disappeared, and I kept the ticket search as a way to spot the next pattern."

"I treat the routine ones as the ones most likely to go wrong, because that's when people skip steps. A password reset is a good example. It's easy to rush the identity check on the tenth call of the day, and that's exactly what someone trying to trick the desk hopes for. So I follow the same short checklist every time. I also try to remember that for the person calling, it's not routine, they're locked out and stressed. And I keep a note of which requests come up most, because the best way to deal with repetition is to remove it, for example by pushing self-service password reset or writing a quick guide so people can fix the simple things themselves."

"To me it starts with how you treat the queue. It's tempting to grab the quick password resets to make your numbers look good and leave the messy ones for someone else, and a team notices that fast. So I take tickets in order and pick up the awkward ones too. Second, I share what I find. If I work out a fix for a new error, I post it in the team chat and add it to the knowledge base, so five people don't each spend an hour on it. Third, I leave clean notes and a proper handover at the end of my shift, so nobody has to call a user back to ask what I already asked. And I ask for help early, because a stuck ticket I'm hiding helps nobody."