A+ Certification Prep

Two exams, nine domains, one certificate

On 25 March 2025 CompTIA released two exams numbered 220-1201 and 220-1202. Passed together, they earn the A+ certification, version 15, which CompTIA calls V15. Core 1 (220-1201) is mostly about things you can touch: computers, phones, printers, cables and networks, and what to do when they fail. Core 2 (220-1202) is mostly about software and people: operating systems, security, software faults and the procedures of a support job.

CompTIA's A+ page says you can take the two exams in any order. Its exam pages add a condition that matters more: both passes must come from the same version, with no mixing. If a version retires after your first exam but before your second, the first result no longer counts and you start again on the new version.

The previous version, V14 (220-1101 and 220-1102), was expected to retire in September 2025 according to CompTIA's A+ FAQ, and its exam pages now redirect to V15. CompTIA's page of exam objectives under development listed no new A+ version when this course was written. This course therefore follows V15, the version anyone starting now will sit. If a V16 draft appears on that page later, compare its objectives with the lesson list here before you book.

A word on names. CompTIA and A+ are trademarks of CompTIA, and CompTIA does not endorse or sponsor this course. The objectives are paraphrased here in our own words, and the official documents are linked in Sources. Nothing in this course can promise you a pass. What it can do is make sure that nothing on either objectives list is new to you on exam day.

Key idea: A+ is two exams from one version. Plan to sit both well inside that version's life, because a Core 1 pass does not carry over to a new version's Core 2.

How the domains divide your time

Each exam is split into domains, and CompTIA publishes the share of the exam each domain carries. On a full 90-question form, 28 percent is about 25 questions, so the weights translate directly into study hours.

Two patterns stand out. Troubleshooting is the largest domain in Core 1, and as Software Troubleshooting it is nearly a quarter of Core 2, so about one question in four asks you to fix something rather than define it. And Core 2 spreads its weight almost evenly, so it has no domain you can afford to skim.

This course takes the domains in the order its catalogue entry promises. Core 1 comes first: PC hardware, then laptops and mobile devices, networking, virtualization and cloud, and hardware and network troubleshooting. Core 2 follows: Windows, macOS and Linux, security, software troubleshooting and operational procedures. Two Core 2 objectives, 4.4 on safety and 4.5 on the environment, move forward to Lesson 2, because you should not open a computer before you know how to do it safely.

Reading an objectives document

Each exam has its own objectives PDF, both labelled Exam Objectives Document Version 4.0. Core 1 has 27 numbered objectives and Core 2 has 36, which makes 63 in all. Every objective opens with a verb, and the verb tells you what kind of question to expect.

More than half the objectives begin with "Given a scenario," which is why this course's practice questions are short scenarios rather than definitions. Under each objective sits a bulleted list of examples. The documents warn that these lists are not exhaustive, so a question may use a technology the list does not name. Each PDF also ends with an acronym list and a sample list of hardware and software for a training lab. Read the acronym lists early. They are long, and an unfamiliar abbreviation in a question can cost you a mark you could otherwise have earned.

One page of the Core 1 document surprises most readers. It prints CompTIA's troubleshooting methodology and then explains that the subject matter experts decided to leave the methodology itself out of the exam, while keeping the emphasis on troubleshooting in the context of the job. You will still use the method in every troubleshooting lesson here, because scenario questions reward the habits it builds. But no V15 question should ask you to recite its steps in order.

What the questions look like

Both exams mix three formats. Multiple-choice items have either one correct answer or several. Drag-and-drop items ask you to match or order things, such as connectors to their cables. Performance-based questions, or PBQs, put you in front of a small simulated tool and ask you to do something with it: set options on a router page, match ports to services, or choose the command that fixes a fault.

CompTIA's explainer on performance-based questions lists A+ among the certifications whose PBQs are simulations, as opposed to full virtual machines. For simulations it says three things worth knowing in advance. There is a reset button. You can skip a simulation and come back to it, with your work saved. And partial credit is possible. A PBQ is therefore not all or nothing. If one stalls you, record what you can, move on, and return with time in hand.

The rules around the exam

• Retakes. CompTIA's retake policy sets no waiting period between a first and a second attempt, but requires at least 14 calendar days before a third or any later attempt.
• Identification. The candidate ID policy asks for two original, unexpired IDs: a government-issued primary ID with your name and a recent photo, and a secondary ID with at least your name and a signature or photo. The names must match your registration exactly.
• Candidates aged 17 and under. Since 23 June 2026, the same policy requires parental consent through CompTIA Central before a minor registers for any CompTIA exam. A school ID is accepted as the single photo ID.
• Validity. CompTIA's A+ FAQ says the certification is valid for three years from the date you pass your second exam, and it can be renewed through continuing education rather than by sitting the exams again.
• Scoring. CompTIA describes its exams as criterion-referenced: your score is compared with an established cut score, not ranked against other candidates. It does not publish pass rates.
• Cost. This course does not quote a price. Check CompTIA's own store when you are ready to book.

A study plan built on retrieval

In 2013 John Dunlosky and four colleagues reviewed ten popular study techniques and rated only two as having high utility: practice testing, and distributed practice, meaning study spread out over time. Rereading and highlighting, two techniques many students rely on, rated low. For a two-exam certification the plan follows directly.

1. Take each lesson's ten questions a day after reading it, not straight away. A wrong answer is information: reread only the section it points to.
2. Keep a tracker with one row per objective, 63 rows in all. Record which lesson covers it and your confidence from 1 to 5.
3. Return to each module's questions a week later and again a month later, mixed with other modules, so you practise recognizing which topic a question is really about.
4. Book the first exam when no Core 1 row in your tracker sits below 3, and book the second while the first is still fresh.

Building your lab, step by step

A+ is a practical certification, and the cheapest practical lab is a virtual machine: a complete computer simulated in software, running inside your real one. The program that runs it is a hypervisor. Oracle VirtualBox is a free hypervisor for Windows, macOS (both Intel and Apple Silicon) and Linux hosts. Its download page says the base package is released under the GNU General Public License version 3, and it downloads without an account. An optional Extension Pack sits under a separate personal-use and educational licence; you do not need it for this course.

For the machine inside, the guest, use Ubuntu Desktop 26.04 LTS. It was released on 23 April 2026 and is supported until April 2031. Its release notes recommend a 2 GHz dual-core processor, at least 6 GB of memory and 25 GB of free storage for a comfortable experience. A virtual machine borrows those resources from your computer, so a host with 16 GB of memory runs it easily. On a host with 8 GB, try assigning 4 GB and closing other programs, and expect it to feel slow, because that is below Ubuntu's recommendation.

1. Check virtualization support. VirtualBox uses the processor's hardware-assisted virtualization, called VT-x on Intel processors and AMD-V on AMD. If a virtual machine refuses to start with an error naming either one, the feature is probably switched off in your computer's firmware. Microsoft's support article on enabling virtualization shows how to reach those settings from Windows, and Lesson 4 explains the firmware itself.
2. Install VirtualBox. Download the package for your host from virtualbox.org (version 7.2 when this was written) and install it with the default options.
3. Download Ubuntu and check it. For an Intel or AMD computer, download the 26.04 desktop image whose name ends in amd64.iso. For an Apple Silicon Mac, download the desktop image ending in arm64.iso from Canonical's cdimage server. From the same folder, download the file SHA256SUMS.
4. Compare the hash. On Windows, open PowerShell in your downloads folder and run Get-FileHash followed by the ISO's file name. Microsoft documents SHA-256 as the cmdlet's default algorithm. Compare the long result with the line for your file in SHA256SUMS: every character must match. On Linux, sha256sum -c SHA256SUMS does the comparison for you, as Ubuntu's verification tutorial shows. The same tutorial checks the signature on SHA256SUMS itself, which proves the list came from Canonical.
5. Create the VM. In VirtualBox choose New, give the machine a name, select the ISO, and assign at least 4 GB of memory (6 GB if your host can spare it), two processors and a 30 GB virtual disk.
6. Install Ubuntu by following the installer's prompts, then shut the VM down.
7. Take a snapshot. Select the VM and take a snapshot named clean install. The VirtualBox manual describes a snapshot as a preserved point in time. Restoring it returns the machine's settings and virtual disks to exactly that state and discards every change made since. Before any risky lab in this course, take one.
8. Leave networking on NAT. VirtualBox gives a new VM one network adapter in Network Address Translation mode by default. The guest reaches the internet through your computer, but other devices cannot reach services on the guest unless you deliberately make them visible. That is the right default for a practice machine.

Three hosts, three different results

The same steps go differently on different computers, and each difference is a small troubleshooting lesson.

• An Apple Silicon Mac. The VirtualBox manual lists the limits on Arm hosts: the guest must be an Arm operating system, and x86 guests are not supported. The amd64 image will fail and the arm64 image will work. Lesson 3 explains why, as the difference between x86-64 and ARM processors.
• A Windows computer already running another hypervisor. The VirtualBox manual warns that running virtual machines from competing hypervisors at the same time can crash the entire host, because each product tries to use the processor's virtualization features. Run one product's machines at a time.
• Windows 11 Pro, Enterprise or Education. These editions include Windows Sandbox, a disposable virtual machine built into Windows. Microsoft's documentation says closing it deletes all software, files and state, and each launch starts fresh, which makes it ideal for trying an unfamiliar program. Windows Home does not support it.

What about a Windows virtual machine? Microsoft offers a 90-day evaluation of Windows 11 Enterprise as an ISO, and no product key is needed. Its page asks you to register before downloading, and when read for this course it said you must sign in to the installed system with a Microsoft account. Microsoft's privacy statement says a child under 13, or a higher age where local rules require it, needs a parent's or guardian's consent to create one. Nothing in this course requires the evaluation. The Windows lessons use the Windows you already have, read-only wherever a change could do harm, and the Ubuntu VM takes everything risky. Lesson 26 explains how to study macOS with or without a Mac.

The method you will use all course

Troubleshooting runs through both exams, so here, once, is the method this course uses. The step names follow CompTIA's six-step methodology as the Core 1 document prints it. The notes under each step are working practice that later lessons develop.

1. Identify the problem. Ask the user what happened, what changed recently and what they see now. Reproduce the fault if you can, and protect any data at risk before you touch anything.
2. Establish a theory of probable cause, questioning the obvious. Is it plugged in, switched on, signed in? Search the vendor's knowledge base when the symptom is unfamiliar.
3. Test the theory to find the cause. Use the least invasive test that would prove or rule it out. If the theory fails, form another; if you run out, escalate.
4. Plan the fix and carry it out. Consider what the change will affect, and follow your organization's change procedure (Lesson 37) before making it.
5. Verify the whole system. Check that everything works, not only the part you fixed, and add preventive measures where they apply.
6. Document what you found, what you did and how it ended, in the ticket (Lesson 37).

Key idea: the method is a habit, not a quiz answer. It stops you from changing three things at once, and it leaves a record the next technician can use.

Common misconceptions

• "A+ is one exam." It is two, Core 1 and Core 2, and both passes must come from the same version.
• "675 means 75 percent." The result is reported on a 100 to 900 scale and compared with a cut score. CompTIA does not convert it to a percentage, so there is no reliable way to work out how many questions you can afford to miss.
• "A performance-based question is all or nothing." CompTIA's explainer says simulations can earn partial credit, and you can skip one and return to it.
• "Any ISO that finishes downloading is safe to use." A complete download can still be corrupted or altered. Only a matching hash, and a valid signature on the list of hashes, show that it is the file the publisher released.
• "A snapshot is a backup." A snapshot is stored with the virtual machine's own files on the same disk, so if that disk fails the snapshot goes with it. Backups, in Lesson 38, are copies kept somewhere else.

What to carry forward

• A+ V15 is two exams, 220-1201 and 220-1202, each with at most 90 questions in 90 minutes. The pass marks are 675 and 700 on a 100 to 900 scale, and both passes must come from the same version.
• Domain weights show where the questions are: troubleshooting is 28 percent of Core 1, and software troubleshooting 23 percent of Core 2.
• 36 of the 63 objectives begin "Given a scenario," so practise applying ideas, not just defining them.
• A+ PBQs are simulations: there is a reset button, you can skip and return, and partial credit is possible.
• No wait between attempts 1 and 2, 14 days before attempt 3; minors need parental consent through CompTIA Central; the certification lasts three years from the second pass.
• Your lab is VirtualBox, a hash-checked Ubuntu 26.04 VM on NAT, and a snapshot before every risky step.

Sources

1. CompTIA. (n.d.). CompTIA A+ [Certification overview]. Retrieved 27 October 2026. comptia.org
2. CompTIA. (n.d.). CompTIA A+ Core 1 and Core 2 (V15) [Exam details and FAQ]. Retrieved 27 October 2026. comptia.org
3. CompTIA. (2024). CompTIA A+ 220-1201 V15 certification exam objectives (Exam objectives document version 4.0). CompTIA (PDF)
4. CompTIA. (2024). CompTIA A+ Core 2 (220-1202) V15 certification exam objectives (Exam objectives document version 4.0). CompTIA (PDF)
5. CompTIA. (n.d.). Performance-based questions explained. comptia.org
6. CompTIA. (n.d.). CompTIA certification retake policy and Candidate ID policy. comptia.org (retakes); comptia.org (ID)
7. CompTIA. (n.d.). Exam development and CompTIA exam objectives under development. comptia.org (development); comptia.org (drafts)
8. Dunlosky, J., Rawson, K. A., Marsh, E. J., Nathan, M. J., and Willingham, D. T. (2013). Improving students' learning with effective learning techniques. Psychological Science in the Public Interest, 14(1), 4-58. doi.org
9. Oracle. (2026). Oracle VirtualBox user guide, release 7.2: Introduction; Installing Oracle VirtualBox (Arm host limitations); Working with virtual machines (snapshots, NAT). virtualbox.org (introduction); virtualbox.org (installation); virtualbox.org (working with VMs); virtualbox.org (downloads and licences)
10. Canonical. (2026). Ubuntu 26.04 LTS release notes; How to verify your Ubuntu download. documentation.ubuntu.com; ubuntu.com
11. Microsoft. (n.d.). Get-FileHash; Windows Sandbox; Enable virtualization on Windows; Windows 11 Enterprise evaluation; Microsoft privacy statement: Collection of data from children. learn.microsoft.com (Get-FileHash); learn.microsoft.com (Sandbox); support.microsoft.com; microsoft.com (evaluation); microsoft.com (privacy)

A laptop whose touchpad is rising

A three-year-old laptop arrives at the help desk with its touchpad bulging upward and its lid no longer closing flat. Under the touchpad sits a lithium-ion polymer battery, and it has swollen. What do you do first?

Dell's published guidance for this exact case makes a good model. Stop using the laptop. Disconnect the AC adapter and let the battery drain. Do not press on the battery, bend it or puncture it. If swelling has wedged it in place, do not pry it out, because puncturing, bending or crushing a battery can be dangerous. Never put a swollen battery back into service. Dell explains that swelling is a known risk of the chemistry, brought on by age, the number of charge cycles or exposure to high heat. It asks owners to contact support for a replacement and to return the old battery in an approved shipping container or take it to an approved recycling center.

The disposal step matters as much as the removal. The US Environmental Protection Agency says lithium-ion batteries, and devices that contain them, must not go in household garbage or recycling bins. A battery crushed in a collection truck or a sorting machine can start a fire, and even a used battery can hold enough energy to injure someone. The EPA asks you to put each battery in its own plastic bag or cover its terminals with non-conductive tape, then take it to a battery recycling or household hazardous waste collection point. For a damaged battery, its advice is to contact the battery or device manufacturer for handling instructions.

The point: almost every rule in this lesson is about stored energy: chemical energy in a battery, electrical energy in a power supply, static charge on your body, and the weight of a box held at arm's length. Work out where the energy is, and you can work out the rule.

Unplugged is the first step, not the last

Before you open a desktop, shut it down and pull the power cord from the wall or from the back of the power supply. Pressing the power button is not enough. Intel's ATX power supply design guide, the reference most desktop supplies are built to, defines a +5 V standby output that is active whenever AC power is present. It exists so the motherboard can respond to the power button or to a Wake on LAN signal. So while the cord is in, parts of the board are live even when the screen is dark. For a laptop, disconnect the adapter and follow the service manual's steps for disconnecting the internal battery before working near the board.

Unplugged does not always mean safe, either. The same Intel guide requires a supply to keep its outputs in regulation for at least 12 milliseconds after input power is lost, at full load. That energy has to be stored inside the supply, in its capacitors, and capacitors can hold a charge after the cord is out. OSHA's electrical safety rules require stored electric energy that might endanger personnel to be released, with capacitors discharged, before work begins. The working rule for a support technician, and the answer the exam expects, is that a failed power supply is replaced as a unit. You do not open it.

The third, round pin on a desktop's plug connects the equipment grounding conductor, which bonds the metal case to ground. If a fault inside makes the case live, the current has a low-resistance path to ground through that wire instead of through the person touching the case. OSHA forbids altering plugs or receptacles in any way that breaks that conductor's continuity, and forbids adapters that interrupt it. A plug with its ground pin snapped off belongs in the bin, not back in the wall.

Static: the damage you cannot feel

Electrostatic discharge, ESD, is the sudden flow of charge between two objects at different potentials, such as your fingertip and a memory module. The ESD Association's introduction to the subject publishes typical voltages that everyday activity generates, and the table shows why technicians care about the weather.

Now set that beside the components. The same source says many electronic devices are susceptible at less than 100 volts, and some disk drive components at less than 10. Even on a humid day, then, walking across a carpet can charge you to fifteen times the level that harms a sensitive part. Damage comes in two kinds. A catastrophic failure stops the device working at once, wholly or partly. A latent failure is worse for a technician: the part works when you install it and fails after a period of normal operation, and the ESD Association notes that such defects are hard to prove or detect once a device is assembled into a product.

The controls follow from the physics.

1. Disconnect power first, as above. ESD protection never replaces it.
2. Wear a wrist strap clipped to the chassis or to the workstation's common ground point. The ESD Association explains that it keeps the wearer at ground potential, and that its cord normally contains a one-megohm resistor.
3. Work on an ESD mat connected to the same common ground. It keeps the work surface at the same potential as everything else and drains charge from whatever you set down. Never rest a board on carpet or a plastic bag.
4. Handle parts by their edges, away from the contacts and chips, and touch as little of the circuitry as you can.
5. Store and carry parts in static-shielding bags. Inside a protected work area, low-charging packaging is enough; outside it, the ESD Association calls for packaging with discharge shielding. That is why a new memory module arrives in a metallic bag, and why a removed one should go back into one.

Lifting, cables, eyes and lungs

Printers, UPS units and servers are heavy, and backs are not replaceable parts. The revised NIOSH lifting equation, as summarized by the Canadian Centre for Occupational Health and Safety, starts from a load constant of 23 kg (about 51 lb) for an ideal lift and multiplies it by factors for every way the real lift is worse. Two factors show what good technique means. The horizontal multiplier is 1.00 when your hands are within 25 cm of your body and falls to 0.42 at 60 cm. The twisting multiplier is 1.00 with no twist and falls to 0.71 at a 90-degree turn.

Work one example. A 15 kg box held at arm's length, about 60 cm out, gives a recommended limit of no more than 23 x 0.42, about 9.7 kg, even if every other factor is perfect. The same box held against your body gets the full 23 kg starting point. So the rules write themselves: bring the load close before you lift, lift with your legs rather than bending over it, turn with your feet instead of twisting, and get a second person or a cart for anything you cannot hold close.

Other hazards are less dramatic and more common. OSHA's walking-working surfaces rule requires workplaces to be kept clean and orderly and floors free of hazards, and a power cord across a walkway is exactly the hazard it means: route cables along walls or under cable covers, and do not daisy-chain power strips. When you clean dust from equipment with compressed air, OSHA limits compressed air used for cleaning to less than 30 psi, and then only with effective chip guarding and personal protective equipment. In practice that means safety goggles against flying debris and an air filter mask against fine dust and toner.

When something catches fire

OSHA's fire protection definitions class fires by fuel. Class A is ordinary combustibles such as paper and wood, Class B is flammable liquids and gases, and Class C is a fire involving energized electrical equipment, where safety requires an extinguishing agent that does not conduct electricity. Water conducts, so it is never used on a Class C fire. If a power supply or printer starts burning, raise the alarm, cut the power at the plug or breaker if you can do so safely, and use only an extinguisher whose label includes the C rating. If the fire is more than small and contained, leave and let the building's emergency plan take over.

Reading a safety data sheet

The objectives still say MSDS, material safety data sheet, the old name. OSHA's Hazard Communication Standard now aligns with the United Nations Globally Harmonized System, and the documents are safety data sheets with a fixed 16-section format. Its text lists the headings in order, and six of them matter most in a support job.

OSHA also requires employers to keep a safety data sheet for each hazardous chemical in the workplace and make it readily accessible to employees during every shift. Electronic access is allowed as long as nothing stands between an employee and the sheet.

Here is the payoff. Suppose a toner cartridge splits inside a laser printer. Xerox's safety data sheet for toner used in its cartridges for HP LaserJet 2015X printers says the toner itself carries no significant hazard classification, but warns that, like any fine dust, it can present an explosion hazard if suspended in air in the right proportion, so any ignition sources should be removed until a dust cloud is dealt with. Its accidental release section says to vacuum up the excess and then wash with cold water, because hot water fuses toner and makes it harder to remove. Its disposal section names landfill as the recommended method for that product. Another product's sheet may say something different, and that is the lesson: for any chemical you handle, the sheet for that product is the authority.

Batteries, toner and old equipment

Disposal rules come from outside the building, and the objectives call this compliance with government regulations. In the United States, OSHA sets the workplace rules quoted in this lesson, and the EPA and state and local governments set the waste rules. Elsewhere, national and local law plays the same role, and your organization's procedures should reflect it. The pattern is consistent, though.

• Batteries: never in the household trash or recycling bin. Bag them separately or tape the terminals, then take them to a battery collection or household hazardous waste point.
• Toner and ink cartridges: follow the product's safety data sheet, and use the maker's or a retailer's return program where one exists.
• Computers, phones and monitors: the EPA recommends certified electronics recyclers and recognizes two accredited certification standards, R2 and e-Stewards. Before any device leaves your control, its data must be destroyed, which Lesson 33 covers.

The room: temperature, humidity, ventilation and dust

Every device's specification sheet states the environment it was designed for. Apple's MacBook Air specifications, for example, list an operating temperature of 10 to 35 degrees Celsius (50 to 95 degrees Fahrenheit) and relative humidity of 0 to 90 percent, noncondensing. Both ends of the humidity scale cause trouble. Dry air lets static build, as the ESD table shows. Humid air risks condensation, which is exactly what noncondensing rules out. A laptop carried from a freezing car into a warm, humid room can collect moisture inside, so let it reach room temperature before you switch it on.

Heat is removed by moving air, so placement is a cooling decision. Keep intake and exhaust vents clear, keep desktops off thick carpet and away from heaters and direct sun, and give closets that hold network equipment real ventilation. Dust blocks heat sinks and fans, so clean it out on a schedule: outdoors or with a vacuum to collect what you dislodge, with compressed air under the limits above, wearing goggles and a mask.

The power: surges, sags, brownouts and blackouts

NIST's guide Surges Happen! explains the disturbances in plain terms. A surge is a voltage spike lasting only a few millionths of a second, caused by lightning, short circuits or something as ordinary as a car knocking down a pole, and it can push the voltage to hundreds or even thousands of volts. A sag is the opposite, a short drop below normal voltage. It is unlikely to damage equipment but can crash a computer. A drop that lasts much longer is called a brownout. A blackout is the outage itself: no voltage at all. NIST stresses that the remedies differ, so match the protection to the problem.

The UPS vendor Vertiv describes three designs. An offline or standby UPS passes utility power straight through and switches to battery when power fails, with a break of about 6 to 8 milliseconds; it stops most spikes but does not correct minor sags and surges. A line-interactive UPS monitors the voltage and corrects both under- and over-voltage without using the battery, with a break of about 4 to 6 milliseconds when it does switch. An online, double-conversion UPS runs the load through its inverter all the time, so there is no break at all and the output is protected from virtually every disturbance. Now connect this to the power supply. A standby UPS's 6 to 8 millisecond gap is shorter than the 12 milliseconds of hold-up time Intel's guide requires, which is why a PC on a standby UPS normally rides through the switch without noticing it.

Two more points from NIST's guide. Every cable that enters a device is a path for a surge, so power, telephone, network and coaxial cable lines all need protecting, not just the power cord. And a surge protector's protective parts can wear out after a large surge: some designs then cut the power, while others keep the power on with no protection left. Indicator lights are not standardized, so read the instructions to know which yours does.

Common misconceptions

• "Leave the desktop plugged in so it stays grounded while you work." While it is plugged in, the standby rail is live. Unplug it, and control static with a wrist strap and mat, not with the mains cord.
• "A wrist strap protects me from electric shock." It protects the components from you. It does nothing about live circuits or charged capacitors, which is why disconnecting power comes first and power supplies stay closed.
• "If I did not feel a spark, nothing happened." Many components are damaged by less than 100 volts, and a latent failure may not show for weeks.
• "A surge protector keeps the computer running in a power cut." It only handles spikes. Keeping a machine running through a sag, brownout or blackout takes a UPS.
• "A dead battery is safe to throw away." The EPA warns that even used lithium-ion batteries can hold enough energy to injure someone or start a fire.

Recap

• Unplug before opening a case: the ATX standby rail is live whenever AC is present. Never open a power supply; its capacitors store energy.
• Keep the ground pin and grounding conductor intact; OSHA forbids breaking their continuity.
• ESD: a carpet walk can reach 35,000 V in dry air and damage starts below 100 V. Use a wrist strap with its one-megohm resistor, a grounded mat, edge handling and static-shielding bags.
• Lift with the load close: the NIOSH limit falls from 23 kg to about 9.7 kg when the load is 60 cm out. Use goggles and a mask with compressed air, under 30 psi at work.
• Electrical fires are Class C: non-conductive agents only, never water.
• The SDS has 16 sections: 6 for spills, 8 for protective equipment, 13 for disposal. Batteries and electronics go to proper collection, never the trash.
• Surge suppressors stop spikes; UPS units handle sags, brownouts and blackouts: standby (short break), line-interactive (corrects voltage), online (no break).

Sources

1. Dell Technologies. (n.d.). Handling swollen lithium-ion batteries. dell.com
2. US Environmental Protection Agency. (n.d.). Used lithium-ion batteries; Certified electronics recyclers. epa.gov (batteries); epa.gov (recyclers)
3. Intel Corporation. (2023). ATX version 3 multi rail desktop platform power supply design guide (Document 336521, revision 2.1a), sections 4.2.9 and 4.3.4. intel.com (PDF)
4. Occupational Safety and Health Administration. (n.d.). 29 CFR 1910.333 (stored electric energy), 1910.334 (grounding conductor continuity), 1910.155 (fire classes), 1910.242(b) (compressed air), 1910.22 (walking-working surfaces) and 1910.1200 (hazard communication). osha.gov (1910.333); osha.gov (1910.334); osha.gov (1910.155); osha.gov (1910.242); osha.gov (1910.22); osha.gov (1910.1200)
5. ESD Association. (n.d.). ESD fundamentals, part 1: An introduction to ESD and part 3: Basic ESD control procedures and materials. esda.org (part 1); esda.org (part 3)
6. Canadian Centre for Occupational Health and Safety. (n.d.). NIOSH lifting equation: Calculating the recommended weight limit. ccohs.ca
7. Xerox. (n.d.). Safety data sheet: Toner used in Xerox cartridges for HP LaserJet 2015X printers (Datasheet 3-1232). xerox.com (PDF)
8. Apple. (n.d.). MacBook Air: Technical specifications (operating requirements). apple.com
9. Martzloff, F. D. (2001). Surges happen! How to protect the appliances in your home (NIST Special Publication 960-6). National Institute of Standards and Technology. nist.gov (PDF)
10. Vertiv. (n.d.). What are the different types of UPS systems? vertiv.com

A board, a chip and a socket that must agree

Intel's Core Ultra 9 285K, launched in the fourth quarter of 2024, has 24 cores and runs 24 threads. AMD's Ryzen 9 9950X, launched on 15 August 2024, has 16 cores and runs 32 threads. Neither will fit the other's motherboard. Intel's specification page lists the 285K's socket as FCLGA1851, and AMD's lists the 9950X's as AM5. That one fact, that a processor and a motherboard must share a socket, settles more upgrade questions at a help desk than any benchmark.

This lesson compares the parts of the system unit side by side. It covers board sizes, sockets and processors, slots and connectors, the cards that use them, and the cooling that keeps it all working. Objective 3.5 in Core 1 lists every item, and its opening words, "Given a scenario, install and configure," tell you the questions will ask you to choose, not just to name.

Why this matters: nearly every hardware scenario on Core 1 is a compatibility check in disguise. Learn what must match what, and the answer usually eliminates itself.

Three board sizes and what each gives up

A motherboard's form factor fixes its size, the position of its mounting holes and its rear input/output panel, so it decides which case and how many expansion cards it can take. Intel's motherboard buying guide gives the sizes and typical layouts.

The trade-off is simple. A smaller board saves space and usually money, and gives up slots, memory sockets and room for airflow. Intel's guide adds a detail worth remembering. A board may have more slots than the processor and chipset have PCIe lanes to feed, so when every slot is full, some of them drop to a lower bandwidth. Read the board's manual before promising a user that a third card will run at full speed.

Sockets, chipsets and the compatibility check

The socket is the physical and electrical interface between processor and board. Intel's current desktop socket is a land grid array, LGA1851, named for its contact count; AMD's is AM5. A socket name narrows the choice, but it is not the whole check. The chipset on the board supports particular processor generations, and Intel's guide advises checking the processor's documentation to confirm the board supports it. In practice the decisive document is the motherboard maker's CPU support list, which also says which firmware version a newer processor needs.

Servers add a variation, the multisocket board, which holds two or more processors that share the system's memory and devices. AMD's EPYC 9005 page, for example, describes a two-processor (2P) reference system built on EPYC 9965 chips with 384 cores in total. You will not install one at a help desk. You should still recognize the term and know why a server needs it: more cores, memory channels and PCIe lanes than any single desktop processor offers.

Two instruction sets: x86-64 and ARM

A processor's architecture is the instruction set it understands, and software compiled for one architecture does not run natively on another.

• x86 and x64. The x86 family runs most Windows desktops and laptops. Plain x86 means the 32-bit instruction set; x64, also called x86-64, is its 64-bit extension, which almost every current PC uses. Intel and AMD processors are both x86-64, so the same Windows installation runs on either.
• ARM. ARM processors use a reduced instruction set computer (RISC) design and dominate phones and tablets. Apple's Mac processors and a growing number of Windows laptops use it too.

Microsoft's Windows on Arm documentation states the consequence directly: Arm apps run natively without emulation, while x86 and x64 apps run under emulation on Arm devices. So most Windows software still works on an Arm laptop, usually more slowly than native code, and some software, such as drivers for older hardware, may not work at all. You met the same rule in Lesson 1, where VirtualBox on an Apple Silicon Mac needed an Arm guest image.

Counting cores and threads

A core is a complete processing unit, and a multi-core processor runs one thread on each core at once. Two features complicate the count. Simultaneous multithreading (SMT; Intel's brand name is Hyper-Threading) lets one core run two threads by sharing its resources, which is why the 16-core Ryzen 9 9950X shows 32 logical processors. A hybrid design mixes two kinds of core. Intel describes its Performance-cores as larger cores built for raw speed and its Efficient-cores as built for performance per watt. A hardware feature, Thread Director, helps the operating system place each thread on the best core.

Read the table as a technician. The thread count shows how many tasks the chip can run at once, while per-core speed decides how fast a single task finishes. A user whose main program uses one thread gains little from more cores, and a user who renders video gains a lot. Both chips use the same memory type and channel count, a link to Lesson 5.

Slots, connectors and headers

Everything else on the board is a place to plug something in. Learn each by what connects to it.

Intel's PCIe explainer gives the numbers behind the first row. The per-lane rate doubled with each generation: PCIe 3.0 transfers 8 gigatransfers per second (GT/s), PCIe 4.0 16 GT/s and PCIe 5.0 32 GT/s. All generations are backward compatible, so a newer card works in an older slot at the older, slower rate. Lanes multiply the rate, which is why graphics cards use x16 and modern NVMe drives use x4.

M.2 needs care. Dell's guide to M.2 cards explains the label. In a size such as 2280, the first two digits are the width in millimeters and the rest the length, so a 2280 drive is 22 mm wide and 80 mm long. The key letter sets the interface. An M key carries PCIe x4 or SATA, and Dell notes that fast PCIe x4 SSDs use M keys because only the M key supports four lanes. A B key carries PCIe x2, USB or SATA. A and E keys serve Wi-Fi, Bluetooth and cellular modules. A drive can fit a socket physically and still not work if the socket supports only SATA and the drive is NVMe, or the reverse. Check the board's manual for what each M.2 socket supports.

Expansion cards: adding what the board lacks

Most boards now integrate graphics, audio and networking, so an expansion card is usually added for one of three reasons: more capability, a missing port, or a replacement for a failed built-in function.

• Video card (graphics card). A discrete GPU for gaming, design work or AI tasks, installed in the top x16 slot. Large cards need more power than the slot provides. Intel's ATX guide lists auxiliary connectors of 75 watts (2x3, six pins) and 150 watts (2x4, eight pins), and the newer 12V-2x6 connector rated for up to 600 watts.
• Sound card. Better audio converters or professional inputs and outputs than the onboard chip offers.
• Capture card. Records or streams video arriving from a camera or games console, usually over HDMI.
• Network interface card (NIC). Adds a faster or additional wired port, Wi-Fi, or a replacement when the onboard port fails.

The installation routine is the same for all of them. Power off and unplug, ground yourself (Lesson 2), and remove the slot cover. Seat the card firmly, secure the bracket screw, connect any auxiliary power, then install the vendor's driver.

Getting the heat out

Every watt a processor uses becomes heat, and the cooling path has to carry it away. Heat flows from the chip to its metal lid, through a thin layer of thermal interface material into a heat sink, and from the heat sink's fins into air moved by fans. Intel's support article on thermal interface material (TIM) explains its job as efficient heat exchange between the processor's heat spreader and the heat sink. It also gives the rules for applying it.

1. Check whether the cooler has TIM pre-applied. If it does, add no more.
2. When reinstalling a cooler, remove the old TIM completely with a soft dry cloth, or an anti-static wiper dampened with isopropyl alcohol, and let the surface dry.
3. Never add new TIM on top of used TIM; always replace it.
4. Apply new TIM to the center of the processor's heat spreader, and do not touch it, because oils from skin reduce the thermal contact.

Intel warns that missing or misapplied TIM can make the processor run inefficiently, overheat or shut down. Thermal pads are pre-formed solid sheets that do the same job where a gap is larger, such as on voltage regulators or under an M.2 drive's heat sink. Liquid cooling moves heat further: a pump circulates coolant through a block on the processor to a radiator, where fans release it, which suits high-power processors and small cases. Whatever the method, case fans should move air in one consistent direction, usually in at the front and out at the back and top.

Why this matters: overheating is one of the symptoms you will troubleshoot in Lesson 17, and a dry, reused or missing layer of thermal paste is one of its commonest causes after a repair.

Common misconceptions

• "Any processor fits any desktop motherboard." The socket must match, and the board's chipset and firmware must support that processor generation. Check the board's CPU support list.
• "A slot that looks like x16 always runs at x16." Physical size and wired lanes can differ, and slots can drop to fewer lanes when others are in use. The manual says which.
• "Every M.2 drive works in every M.2 slot." Key, length and interface must all match. An NVMe drive in a SATA-only socket will not be detected.
• "More thermal paste cools better, and old paste can be reused." Intel's instructions call for a single application to the center, and fresh TIM every time the cooler comes off.
• "Arm laptops cannot run Windows programs." Windows on Arm runs x86 and x64 apps under emulation; what most often fails is old hardware drivers.

What you now know

• ATX (12 x 9.6 in), microATX (9.6 x 9.6 in) and Mini-ITX (6.7 x 6.7 in) trade size for slots, memory sockets and airflow.
• Processor and board must share a socket (Intel LGA1851, AMD AM5 today), and the chipset and firmware must support the processor; servers may hold two or more sockets.
• x64 and ARM are different instruction sets; Windows on Arm emulates x86 and x64 apps.
• Threads equal cores unless SMT doubles them; hybrid chips mix Performance and Efficient cores.
• PCIe doubles its per-lane rate each generation (8, 16, 32 GT/s for 3.0 to 5.0) and stays backward compatible; GPUs use x16, NVMe SSDs x4; M.2 keys decide the interface.
• Expansion cards add video, sound, capture or networking; large GPUs need auxiliary power up to 600 W through 12V-2x6.
• Cooling runs chip, TIM, heat sink, fan; replace TIM whenever the cooler comes off.

Sources

1. Intel Corporation. (n.d.). Gaming motherboard buying guide. intel.com
2. Intel Corporation. (n.d.). Intel Core Ultra 9 processor 285K: Specifications. intel.com
3. Advanced Micro Devices. (n.d.). AMD Ryzen 9 9950X processor [Specifications]; AMD EPYC 9005 series processors. amd.com (Ryzen); amd.com (EPYC)
4. Intel Corporation. (n.d.). How hybrid design works. intel.com
5. Microsoft. (n.d.). Windows on Arm overview. learn.microsoft.com
6. Intel Corporation. (n.d.). What are PCIe 4.0 and 5.0? intel.com
7. Dell Technologies. (n.d.). Differences between M.2 cards, M.2 slots, keys, sizes and types (Knowledge base article 000144170). dell.com
8. Intel Corporation. (2023). ATX version 3 multi rail desktop platform power supply design guide (Document 336521, revision 2.1a), section 5.2.2.4 (PCIe add-in card connectors). intel.com (PDF)
9. Intel Corporation. (n.d.). How to apply or remove thermal interface material (TIM). intel.com

Before the button: the wall and the standby rail

Before anyone presses the power button, a desktop plugged into the wall is already awake in one small way. Intel's ATX power supply design guide, document 336521, requires a +5 V standby output, called +5VSB, that is active whenever AC power is present. It powers the circuits that must keep working while the main outputs are off: the soft power button, Wake on LAN and similar wake-up features. Follow the electricity from the wall socket to the operating system and every item in Core 1 objective 3.6, and the firmware half of objective 3.5, turns up on the way.

The journey starts with the mains supply, which differs by country: roughly 110 to 120 volts AC in North America and parts of Asia, roughly 220 to 240 volts in most of Europe, Africa and Asia. Intel's guide requires a desktop supply to deliver full power over two input ranges, 90 to 135 VAC and 180 to 265 VAC, at 47 to 63 Hz. It allows the right range to be chosen in either of two ways: auto-ranging, where the supply detects the voltage itself, or switch-selectable, where a small selector on the back must be set by hand. Laptop adapters are usually auto-ranging; Apple's MacBook Air specifications, for example, list a line voltage of 100 to 240 V AC. If a desktop supply has a selector, check it before the cord goes in whenever a machine moves between countries, because a supply set for the wrong range will not run correctly and can be damaged.

The button: three voltages and a power-good signal

Pressing the power button does not switch the supply directly. It tells the motherboard, which pulls a signal called PS_ON# low; the guide defines PS_ON# as an active-low control signal. The supply then starts its main outputs. A desktop supply converts AC into a few fixed DC voltages, and the wire colors on the 24-pin main connector are standardized in Intel's guide.

The main connector has 24 pins. Older boards used a 20-pin version, so many supplies ship a 20+4-pin plug whose last four pins detach: plug all 24 into a modern board, or only the 20 into an old one. Beyond the main plug, the processor gets its own 12 V feed through an 8-pin (2x4) connector, often called EPS12V. Graphics cards take 6-pin (75 W), 8-pin (150 W) or the newer 12V-2x6 connector rated for 600 W. Drives take SATA power connectors carrying 12 V and 5 V.

Next comes the most important signal you have never seen. Intel's guide defines PWR_OK as a power-good signal that the supply asserts only when the +12, +5 and +3.3 V outputs are within their regulation limits and enough energy is stored to keep running through a short loss of input. Until PWR_OK goes high, the motherboard holds the processor in reset. If it never arrives, the fans may spin while nothing else happens, which is a symptom you will meet in Lesson 17.

What matters here: three main voltages (12, 5 and 3.3 V), a live standby rail, and a power-good handshake. A machine that shows lights but never starts is often a machine that never received PWR_OK.

Choosing the supply: watts, efficiency, cables and redundancy

The wattage rating is the most DC power the supply can deliver continuously. Work an example. Take the 170 W Ryzen 9 9950X from Lesson 3, assume a graphics card whose maker lists 300 W, and allow about 100 W for the board, memory, drives and fans. That is roughly 570 W in steady use. Graphics cards also draw brief spikes well above their average. Intel's guide calls these power excursions, and requires a supply of more than 450 W with a 12V-2x6 connector to ride out bursts of 200 percent of its rating for 100 microseconds and 120 percent for 100 milliseconds. A 750 to 850 W supply built to the current ATX guide leaves room for both the steady load and the spikes; a 600 W supply would run near its limit.

Efficiency is the share of power drawn from the wall that reaches the components; the rest becomes heat in the supply. An 80 percent efficient supply delivering 500 W draws 625 W from the wall and wastes 125 W. At 90 percent it draws about 556 W and wastes about 56 W. Intel's guide sets minimums of 70, 72 and 65 percent at full, typical (50 percent) and light (20 percent) load. The voluntary 80 PLUS program, run by CLEAResult, certifies supplies that are at least 80 percent efficient at 10, 20, 50 and 100 percent of rated load, with a power factor of 0.9 or better. Its higher tiers, Bronze, Silver, Gold, Platinum, Titanium and Ruby, require progressively higher efficiency.

A modular power supply has detachable cables, so you connect only the ones the build needs. Intel's guide recommends modular designs because unused cables waste space inside the case, and fewer cables improve routing and airflow. A redundant power supply is a server feature. Dell's PowerEdge R740 manual describes two identical supplies that can run in a redundant 1+1 mode, so the server keeps running if one fails. The supplies are hot swappable, meaning a failed unit can be pulled and replaced with the server running. Dell adds that both units must have the same type of label and maximum output, and that mixing supplies from older server generations is not supported.

The firmware wakes up

With power good, the processor starts executing firmware stored on a chip on the motherboard. On older PCs that firmware was the BIOS (basic input/output system). On current PCs it is UEFI (Unified Extensible Firmware Interface), defined by the UEFI Forum, whose current specification, version 2.11, was released in December 2024. Technicians still say "BIOS" for both, and so do the exam objectives. The firmware runs the power-on self-test (POST), initializes the hardware, applies its saved settings, and looks for something to boot.

Its settings live in a setup program, opened by a key pressed during startup, usually Delete, F2 or F10, with a separate one-time boot menu on another key. Dell's OptiPlex 7020 owner's manual is a good map of a current business PC, and the table below matches its settings to the exam's list. Other makers use different names for the same switches.

Two rows need a closer look. Dell's knowledge base explains the passwords plainly: the system password prevents the computer from booting at all without it, while the admin (setup) password lets the computer boot normally and lets users view firmware settings, but not change them. A school lab that wants students to start PCs freely but never change the boot order needs only the admin password.

Temperature monitoring is the other. Enthusiast boards show far more than business PCs. The ASUS BIOS manual for its AMD 800 series boards (E25269, December 2024) describes a Monitor page that reads processor, motherboard, voltage regulator and chipset temperatures, fan speeds in revolutions per minute, and the 12, 5 and 3.3 V rails. It warns when a fan drops below a set speed and shows N/A when no fan is connected. Its fan settings use DC mode for 3-pin fans, which are controlled by varying voltage, and PWM mode for 4-pin fans, which are controlled by a pulse signal.

Secure Boot: a chain of signatures

Microsoft describes Secure Boot as an industry security standard that makes a PC boot only software trusted by its manufacturer. When the PC starts, the firmware checks the digital signature of each piece of boot software, including UEFI drivers on expansion cards (option ROMs), EFI applications and the operating system loader. If the signatures are valid, the firmware hands control to the operating system. The firmware keeps a database of allowed signers (db) and a database of revoked ones (dbx), and an item in both is treated as revoked.

That design explains a symptom: an old, unsigned boot utility that worked for years refuses to start once Secure Boot is on. It also explains a 2026 support task. Microsoft's Secure Boot documentation warns that the certificates it issued in 2011 for verifying boot software begin expiring in June 2026, and it asks organizations to update them in advance to avoid disruption.

Keys that never leave the chip: TPM and HSM

Microsoft's overview defines a Trusted Platform Module as a secure crypto-processor with physical protections against tampering. It generates and stores cryptographic keys and limits their use. During startup, the boot code, firmware and operating system components can be measured and recorded in the TPM, so a key can be released only if the machine booted the expected software. If someone guesses a key's authorization value wrongly too many times, the TPM's dictionary attack logic blocks further guesses. BitLocker uses the TPM to protect its drive encryption key, and Windows 11's published requirements include UEFI firmware that is Secure Boot capable and TPM version 2.0.

A hardware security module does the same kind of job at a different scale. NIST's glossary, drawing on SP 800-57, defines an HSM as a physical computing device that safeguards and manages cryptographic keys and provides cryptographic processing. In practice an HSM is a dedicated appliance or plug-in card serving many systems, for example signing transactions for a bank, where a TPM belongs to one computer.

Handing over to the boot loader

Microsoft's boot sequence for a Secure Boot PC ends the journey. The firmware verifies the signatures of every image up to and including the Windows Boot Manager. If the boot manager has a problem, the firmware tries a backup copy. If a driver or the kernel fails after that, Windows loads the Windows Recovery Environment so they can be repaired. Then Windows loads anti-malware software before other drivers. From the wall socket to this point, a healthy desktop takes a few seconds, and every stage you have followed is a place where Lesson 17's troubleshooting can begin.

Common misconceptions

• "A bigger wattage number means the supply uses more electricity." The rating is a maximum. A supply delivers what the components draw, and efficiency, not rating, decides how much is wasted.
• "Every desktop supply adjusts itself to any country's voltage." Intel's guide allows switch-selectable supplies. Check for a selector before plugging in abroad.
• "The BIOS password and the boot password are the same thing." One stops booting; the other stops setting changes. Dell documents them as separate passwords with separate effects.
• "Secure Boot encrypts the disk." It verifies signatures on boot software. Encryption is BitLocker's job, with keys protected by the TPM.
• "A TPM and an HSM are interchangeable." A TPM serves one machine; an HSM is a dedicated device that protects an organization's keys for many systems.

The short version

• Desktop supplies accept 90 to 135 or 180 to 265 VAC, by auto-ranging or a manual switch; +5VSB is live whenever AC is present.
• Outputs: +12 V (yellow) for CPU and GPU connectors, +5 V (red), +3.3 V (orange); PS_ON# (green) starts the supply and PWR_OK (gray) releases the processor from reset.
• Connectors: 20+4-pin main, 8-pin CPU, 6-pin, 8-pin and 12V-2x6 (600 W) for GPUs, SATA power.
• Size the wattage for steady load plus spikes; compare efficiency with 80 PLUS ratings; modular cables aid airflow; servers use identical, hot-swappable redundant supplies.
• UEFI firmware runs POST and holds the settings: boot order, USB ports and USB boot, fans and temperatures, virtualization, TPM, Secure Boot, and system versus admin passwords.
• Secure Boot checks signatures up to the boot manager; the TPM guards one machine's keys; an HSM guards an organization's.

Sources

1. Intel Corporation. (2023). ATX version 3 multi rail desktop platform power supply design guide (Document 336521, revision 2.1a): sections 3.1 (power excursions), 4.1 (AC input), 4.3 (PS_ON#, PWR_OK, +5VSB), 4.5.8 (efficiency) and 5.2 (connectors). intel.com (PDF)
2. CLEAResult. (n.d.). 80 PLUS program details. clearesult.com
3. Dell Technologies. (n.d.). Dell PowerEdge R740 installation and service manual: Power supply unit details. dell.com
4. Dell Technologies. (n.d.). OptiPlex Small Form Factor Plus 7020 owner's manual: System setup options; Understanding system password, admin password, and HDD password in BIOS (Knowledge base article 000132226). dell.com (setup options); dell.com (passwords)
5. ASUSTeK Computer. (2024). PRIME / ProArt / TUF GAMING AMD 800 series BIOS manual (E25269, first edition). asus.com (PDF)
6. UEFI Forum. (2024). UEFI specification version 2.11 [Specifications page]. uefi.org
7. Microsoft. (2026). Secure boot [Windows hardware design guidance]; Trusted Platform Module technology overview; Windows 11 specifications. learn.microsoft.com (Secure Boot); learn.microsoft.com (TPM); microsoft.com (Windows 11)
8. National Institute of Standards and Technology. (n.d.). Hardware security module (HSM) [Glossary entry, citing SP 800-57 Part 2 Rev. 1]. csrc.nist.gov
9. Apple. (n.d.). MacBook Air: Technical specifications (operating requirements). apple.com

Two upgrades on one ticket

A ticket asks for two jobs on the same office desktop: take its memory from 16 GB to 32 GB, and add storage for a shared project folder that must survive a drive failure. Both sound like shopping. Both are really procedures, with checks at each step that decide whether the part you buy will work. This lesson walks each procedure end to end, then changes one input and watches the answer flip. Along the way it covers Core 1 objectives 3.3 (memory) and 3.4 (storage).

Remember: memory (RAM) holds what the processor is working on now and forgets it when power goes off; storage keeps data when the power is off. Upgrading either one starts with the same question: what does this particular motherboard accept?

Memory in one table

DDR stands for double data rate. Each generation raised speed and changed the module. Samsung's DDR5 overview lists what changed from DDR4: a power management chip (PMIC) on the module itself rather than on the motherboard, on-die error correction that fixes single-bit errors inside each memory chip, a burst length of 16 instead of 8, and 32 banks instead of 16. Speeds are given in megatransfers per second (MT/s). Lesson 3's processors show the range on current desktops: Intel lists the Core Ultra 9 285K at up to DDR5-6400 on two channels, and AMD lists the Ryzen 9 9950X at up to DDR5-5600 with two modules, also on two channels.

Channels are the parallel paths between the memory controller and the modules. A dual-channel system moves data over two paths at once, but only if both channels have memory in them. Dell's guidance is to install modules in matched pairs, for example two 16 GB modules rather than one 32 GB module, to enable dual-channel operation. Mixing different speeds or capacities can make the system fall back to the slowest speed or the lowest capacity.

Procedure one: upgrading a desktop's memory

1. Read what is installed. Task Manager's Performance tab, under Memory, shows the total, the speed, the form factor and how many slots are used. Suppose it reports 16 GB as two 8 GB DDR5 DIMMs, with two of four slots used.
2. Read what the board accepts. The motherboard manual gives the DDR generation, the maximum capacity, the supported speeds and the slot order for two and four modules. Suppose it allows 128 GB of DDR5 and lists slots A2 and B2 for a pair.
3. Choose the parts. To reach 32 GB you can add a matched pair of 8 GB modules, or replace both with a matched pair of 16 GB modules. Buying the same speed as the existing pair avoids falling back to the slower module. A matched 2 x 16 GB kit in A2 and B2 is the cleanest answer, and it leaves two slots free for later.
4. Install safely. Shut down, unplug, ground yourself (Lesson 2). Open the slot latches, line up the notch, which only fits one way, and press the module straight down until the latches click.
5. Verify. On the first start, many boards spend a while training the new memory before anything appears on screen, so give it time. Then check that firmware and Task Manager both show 32 GB at the expected speed.

The same job on a slim laptop

Now change one input: the computer is a thin laptop. Dell's laptop memory guide makes the two differences plain. Laptops use SO-DIMMs, not full-size DIMMs. And not every laptop can be upgraded at all, because many slim models have memory soldered to the motherboard. The procedure therefore gains a new first step: check the service manual. If the memory is soldered, the honest answer to the ticket is that this laptop's memory cannot be increased, and the choices become working within it, moving data to faster storage, or replacing the machine. If there is a slot, the rest of the procedure is the same, with SO-DIMMs in place of DIMMs.

ECC: when a single flipped bit matters

Memory errors are not only caused by faults. Dell's white paper on server memory explains that transient soft errors can come from electrical disturbances or from high-energy particle strikes. ECC (error-correcting code) memory stores extra check bits with the data. The basic scheme, single error correction with double error detection (SEC-DED), reads 64 data bits plus 8 ECC bits on each access, so any one of the 72 bits can be wrong and the hardware corrects it. A database server running for months benefits; a home laptop rarely justifies the cost. ECC modules work only on platforms built to use them, so check the processor and board before ordering. Do not confuse module ECC with DDR5's on-die ECC, which corrects errors inside each chip and is present on ordinary DDR5 modules.

Storage devices compared

A hard disk drive (HDD) stores data on spinning magnetic platters, so its spindle speed sets how long the head waits for data to come around. On average the wait is half a revolution: 60 seconds divided by the speed in revolutions per minute, divided by two. Seagate's Exos X10 datasheet shows the result for a 7,200 RPM drive, an average latency of 4.16 ms.

Hard drives come in two form factors. The 3.5-inch drive belongs in desktops, servers and network storage; Seagate's Exos X10 is one, at 7,200 RPM with a SATA 6 Gb/s or 12 Gb/s SAS interface. The 2.5-inch drive suits laptops and external enclosures; Seagate's BarraCuda 2.5-inch line is mostly 5,400 RPM, with transfer rates up to about 140 MB/s.

A solid-state drive (SSD) has no moving parts, so there is no rotational wait, and the interface becomes the limit.

Two module names cause confusion. M.2 is a card and connector, not a speed: SATA-IO describes it as a small form factor that can carry Wi-Fi, cellular, USB, PCIe and SATA. An M.2 SSD may therefore be a SATA drive or an NVMe drive, and Lesson 3 showed how the key tells you which. mSATA is the older format it replaced. When SATA-IO announced it in 2009, it described a specification that maps SATA signals onto an existing small connector, for business-card-sized SSDs in notebooks and netbooks.

Procedure two: planning a RAID array

Back to the ticket's second job: a project folder that must survive a drive failure. RAID (redundant array of independent disks) combines drives so they act as one. Intel's support article on RAID volumes and Dell's RAID controller guide define the levels. Work them through with four 4 TB drives.

For a shared folder on four drives, RAID 5 gives the most space with protection against one failure, RAID 6 trades a second drive's capacity for surviving two, and RAID 10 gives the best write performance with protection. Intel notes that RAID 5's parity calculations slow writes, and Dell describes RAID 6 as protecting against double failures and against a second failure while a replaced drive is rebuilding, which is exactly when the remaining drives are working hardest.

Now change one input. The supplier delivers three 4 TB drives and one 2 TB drive. Intel's capacity rule for RAID 5 is the size of the smallest drive multiplied by one less than the number of drives: 2 TB x 3 = 6 TB, half of what four matched drives gave. Every larger drive is cut down to the size of the smallest, so build arrays from matched drives.

Remember: RAID keeps a system running through a drive failure. It is not a backup. Intel describes RAID 1 data as mirrored in real time, which means a mistaken deletion or a ransomware encryption is mirrored just as quickly. Backups are Lesson 38's subject.

Removable storage

• Flash drives plug into USB and carry files between machines. They are also the usual way to boot an operating system installer, which is why Lesson 4's firmware settings can block USB boot.
• Memory cards serve cameras, phones and drones. The SD Association defines four capacity classes and the file system each uses: SD up to 2 GB (FAT12 or FAT16), SDHC above 2 GB to 32 GB (FAT32), SDXC above 32 GB to 2 TB (exFAT) and SDUC above 2 TB to 128 TB (exFAT). An older device that supports only SDHC will not read a 64 GB SDXC card.
• Optical discs are read by a laser in an optical drive and survive mainly for archives and older software. Ecma's DVD standard, ECMA-267, gives the nominal capacities of a 120 mm DVD: 4.7 GB for one layer on one side, 8.5 GB for two layers on one side, 9.4 GB for one layer on each side, and 17 GB for two layers on each side.

Common misconceptions

• "RAID means I do not need backups." RAID survives drive failure only. Deletions, corruption and ransomware reach every drive in the array at once.
• "One large memory module is as good as two smaller ones." One module leaves a channel empty. Dell recommends matched pairs to enable dual-channel operation.
• "DDR5 is backward compatible with DDR4 slots." The notches and electrical requirements differ, so a DDR5 module will not fit a DDR4 slot.
• "M.2 means NVMe." M.2 is a form factor that can carry SATA or PCIe. An M.2 SATA SSD runs at SATA speed.
• "DDR5's on-die ECC makes any PC an ECC system." On-die ECC corrects errors inside each chip. End-to-end ECC between modules and the memory controller needs ECC modules and a platform that supports them.

Putting it together

• Desktops take DIMMs, laptops SO-DIMMs, and many slim laptops have soldered memory that cannot be upgraded.
• DDR generations are not interchangeable; DDR5 adds an on-module PMIC and on-die ECC.
• Install matched pairs in the manual's slots for dual-channel operation; mixed modules fall back to the slowest speed.
• ECC (SEC-DED: 64 data bits plus 8 check bits) corrects single-bit errors on servers and workstations that support it.
• HDD latency is half a revolution: about 5.6 ms at 5,400 RPM and 4.2 ms at 7,200 RPM. SSDs use SATA (6 Gb/s), SAS (12 Gb/s) or NVMe over PCIe; M.2 and mSATA are form factors.
• RAID 0 stripes with no protection; RAID 1 mirrors; RAID 5 loses one drive's capacity and survives one failure; RAID 6 loses two and survives two; RAID 10 halves capacity. Capacity is set by the smallest drive. RAID is not a backup.
• SD classes: SDHC up to 32 GB (FAT32), SDXC up to 2 TB (exFAT). A single-layer DVD holds 4.7 GB.

Sources

1. Dell Technologies. (n.d.). Desktop memory [Buying guide]; (2026, July 16). How to install RAM in a laptop: Step-by-step guide. dell.com (desktop memory); dell.com (laptop RAM)
2. Samsung Semiconductor. (n.d.). DDR5 [Product overview]. samsung.com
3. Dell EMC. (2020). Memory errors and Dell EMC PowerEdge YX4X server memory RAS features (Whitepaper, revision 1.1). dell.com (PDF)
4. Intel Corporation and Advanced Micro Devices. (n.d.). Processor specifications for the Core Ultra 9 285K and Ryzen 9 9950X (memory types and channels). intel.com; amd.com
5. Seagate Technology. (2017). Exos X10 data sheet; (2019). BarraCuda 2.5 HDD data sheet. seagate.com (Exos X10); seagate.com (BarraCuda 2.5)
6. NVM Express. (n.d.). Specifications. nvmexpress.org
7. SATA-IO. (n.d.). SATA M.2 card; (2009, September 22). SATA-IO develops specification for mini-SATA (mSATA) interface connector [Press release, reprinted by StorageNewsletter]. sata-io.org; storagenewsletter.com
8. Intel Corporation. (n.d.). Defining RAID volumes for Intel Rapid Storage Technology. intel.com
9. Dell Technologies. (n.d.). Dell PowerEdge RAID Controller 10 user's guide: Summary of RAID levels. dell.com
10. SD Association. (n.d.). Capacity (SD/SDHC/SDXC/SDUC); Ecma International. (2001). ECMA-267: 120 mm DVD, read-only disk (3rd ed.). sdcard.org; ecma-international.org

One desk, six kinds of cable

Pull a desk away from the wall in a small office and count what is behind it. There is a blue twisted-pair patch cable to the wall jack, an HDMI or DisplayPort lead to the monitor, and a USB-C cable from a docking station. There is a coaxial line to the cable modem, a telephone cord with a small RJ11 plug, and a power cord. Each one is a different standard with a different connector, and each fails in its own way. Core 1 objective 3.2 asks you to know all of them, and objective 2.8 asks you to know the tools that build and test network cabling. This lesson is a set of comparisons, because recognizing a cable is mostly a matter of knowing what it is not.

In short: for every cable, ask three questions. What signal does it carry (network, video, data, power)? How fast and how far? And which connector ends it? The tables below answer those questions in turn.

Copper network cable: categories, shielding and jackets

Ethernet over copper uses four twisted pairs, and the twists are what make it work. The Fiber Optic Association's guide to UTP cabling explains that each pair is twisted at a different rate to cut crosstalk between pairs. Higher categories are twisted more tightly and consistently. Categories set how much speed the cable supports at a distance. Intel's product brief for its E610 Ethernet adapters gives the figures that matter for a technician.

The Cat 8 row comes from Fluke Networks' account of the standards work, which describes it as shielded cable for 25 and 40 Gb/s over a two-connector channel of at least 30 m. Shielding is the other main choice. Unshielded twisted pair (UTP) relies on the twists alone and is what most offices use. Shielded twisted pair (STP) adds foil or braid around each pair, or around all of them, for extra protection from interference. The FOA notes that it is more common outside the US.

The jacket matters as much as the copper. A plenum, as the National Electrical Code defines it, is an air-handling space connected to the air distribution system, such as the space above a suspended ceiling used as a return-air path. EC&M's guide to the code explains that only cables marked for plenum use, such as CMP (communications plenum) and MPP, have the fire resistance to run there. Ordinary jackets give off smoke that the air system would carry through the building. Cable meant for outdoor underground runs, direct burial cable, is a separate product built to resist moisture and soil, and neither ordinary nor plenum cable should be buried.

Coaxial cable has a single center conductor inside a shield, and it carries cable television and cable internet. It ends in an F-type connector, which IEC 61169-24 describes as a screw-coupled coaxial connector for 75-ohm cable networks: you screw it onto the modem or wall plate.

T568A and T568B

An RJ45 plug has eight pins, and two wiring standards say which colored wire goes on which pin. The FOA's termination guide makes the key point: T568A and T568B differ only in that pairs 2 and 3, orange and green, swap places. Either works if both ends match.

A straight-through cable uses the same standard at both ends. A cable with T568A at one end and T568B at the other is a crossover, which the FOA notes was the easy way to connect two computers directly without a hub. Mixing standards by accident is a different matter: a tester reports it as crossed pairs. When you terminate, keep the twists right up to the connector. The FOA's rule is to untwist no more than about 13 mm (half an inch), or crosstalk rises.

Fiber: single-mode and multimode

Optical fiber carries light, so it ignores electrical noise and runs far longer than copper. The FOA's fiber reference describes the two kinds.

Three fiber connectors appear on the exam. The FOA's connector guide describes the ST (straight tip) as a bayonet-mount connector with a 2.5 mm ferrule, the most popular multimode connector until around 2005. The SC (subscriber connector) is a snap-in, push-pull connector, also with a 2.5 mm ferrule. The LC (Lucent connector) is a small form factor connector whose 1.25 mm ferrule is half the size of the SC's. The FOA calls it the one recent connector that has been a runaway success, in telephone networks and high-speed LANs alike.

Peripheral cables: USB, Thunderbolt and serial

USB names have changed often, which makes old cables confusing. Microsoft's USB documentation gives the original speeds. USB 1.x defined low speed (1.5 Mb/s) and full speed (12 Mb/s), and USB 2.0 added high speed at 480 Mb/s. USB 3.0 raised the maximum to 5 Gb/s, often marked with a blue port or the SuperSpeed logo. Plug a USB 3 device into a USB 2.0 port and it runs at USB 2.0's 480 Mb/s. The USB Implementers Forum now asks makers to label products by speed instead of version number: USB 5Gbps, 10Gbps, 20Gbps, 40Gbps and 80Gbps, the five rates defined across USB 3.2 and USB4.

Thunderbolt is Intel's high-speed interface, carried over the same USB-C connector. Intel lists Thunderbolt 4 at a minimum of 40 Gb/s and Thunderbolt 5 at up to 80 Gb/s in each direction, boosting to 120 Gb/s for heavy video. Both support daisy-chained accessories and work with USB4 devices. A Thunderbolt port therefore accepts USB-C devices, but a plain USB-C port does not necessarily provide Thunderbolt.

Video cables

Dell's guide to video cables lays out the differences that decide which one to use.

That last row explains a common ticket: a monitor stays dark on a laptop's USB-C port because that port carries data and power but not video. Adapters follow the same logic. Converting between two digital formats, such as DVI to HDMI, is mostly a matter of rearranging pins. VGA is analog, so going from HDMI or DisplayPort to VGA needs an active converter that changes the signal, not just a plug shape.

Drive cables, power plugs and the remaining connectors

• SATA uses a thin 7-pin data cable inside the case, plus a separate SATA power connector carrying 12 V and 5 V (Lesson 4). eSATA is the external version, with a shielded connector.
• Molex, properly the peripheral power connector, is the older 4-pin plug carrying 12 V and 5 V that Intel's ATX guide still specifies; you meet it on fans, older drives and adapters.
• RJ11 is the narrower telephone jack used for analog phone lines and DSL; an RJ45 network plug does not fit it.
• Punchdown blocks terminate many cables in a wiring closet. The FOA lists four kinds: 110, the most common for LAN connections and also found on the back of wall jacks; 66, the classic block for large telephone cables; and the proprietary Bix and Krone.

The tools that build and test cabling

Objective 2.8 lists eight tools. Each answers one question, so learn them by the question.

Two cautions. A toner sends its signal down copper, so Klein's manual says to use it only on wires that are not energized; check before you clip on. And a basic wiremap tester can pass a split pair, a wiring fault where wires from two different pairs are swapped at both ends. The FOA notes that it takes a more capable tester to find it, which matters because split pairs cause crosstalk that breaks fast links.

Common misconceptions

• "Cat 6 is a 10-gigabit cable." Only to 55 m. For 10 Gb/s over a full 100 m run, use Cat 6A.
• "T568B is right and T568A is wrong." Both are valid; the only rule is to use the same one at both ends unless you mean to build a crossover.
• "Every USB-C port can drive a monitor." Only ports with DisplayPort Alt Mode or Thunderbolt carry video.
• "A cable tester that shows a pass proves the cable will run at full speed." A wiremap pass checks continuity; split pairs and poor high-frequency performance need a more capable certifier or verifier.
• "Single-mode fiber is the cheaper, simpler kind." Single-mode has the tiny 9-micron core and needs laser sources; multimode, with its larger core, is the usual choice for short runs.

Where this leaves us

• Cat 5e for gigabit; Cat 6 for 10 Gb/s to 55 m; Cat 6A for 10 Gb/s to 100 m; Cat 8 for 25 or 40 Gb/s to about 30 m. UTP for offices, STP for noisy places, plenum-rated (CMP) jackets in air-handling spaces, direct burial cable underground.
• T568A and T568B swap pairs 2 and 3; mixing them makes a crossover.
• Multimode (50 or 62.5 micron core) for short runs, single-mode (9 micron) for long ones; ST bayonet, SC push-pull, LC half-size.
• USB 2.0 is 480 Mb/s, USB 3.0 5 Gb/s; today's labels run from USB 5Gbps to 80Gbps. Thunderbolt 4 is 40 Gb/s, Thunderbolt 5 up to 80 Gb/s, both on USB-C.
• VGA is analog; DVI, HDMI and DisplayPort are digital; HDMI and DisplayPort carry audio; USB-C carries video only with DisplayPort Alt Mode.
• Tools: stripper and crimper build plugs, punchdown tool terminates jacks and blocks, tester checks the wiremap, toner finds the cable, loopback tests the port, tap copies traffic, Wi-Fi analyzer surveys the air.

Sources

1. Fiber Optic Association. (n.d.). UTP cables; UTP terminations; Wiremap for UTP cabling; UTP cable testing. thefoa.org (cables); thefoa.org (terminations); thefoa.org (wiremap); thefoa.org (testing)
2. Fiber Optic Association. (n.d.). Optical fiber; Fiber optic connector identifier. thefoa.org (fiber); thefoa.org (connectors)
3. Intel Corporation. (n.d.). Intel Ethernet Network Adapter E610-XT2/XT4 for OCP 3.0 [Product brief]. intel.com (PDF)
4. Fluke Networks. (2016, April 28). TR-42.7 subcommittee work hand in hand with IEEE. flukenetworks.com
5. DeDad, J. (2003, April 1). Plenum datacom wiring: What you need to know. EC&M. ecmweb.com
6. International Electrotechnical Commission. (2019). IEC 61169-24:2019, Radio-frequency connectors, part 24: Sectional specification for screw-coupled coaxial connectors for 75 ohm cable networks (type F) [Webstore listing]. webstore.iec.ch
7. Microsoft. (n.d.). USB in Windows: FAQ; netsh wlan [Windows commands reference]. learn.microsoft.com (USB); learn.microsoft.com (netsh wlan)
8. USB Implementers Forum. (2024). USB data performance language usage guidelines; (n.d.). USB 2.0 specification [Document library]. usb.org (PDF); usb.org (USB 2.0)
9. Intel Corporation. (n.d.). Thunderbolt technology overview; Apple. (n.d.). Charge and connect with the USB-C connector on your iPhone. intel.com; support.apple.com
10. Dell Technologies. (n.d.). Understanding video cables: Which one do you need (Knowledge base article 000143545). dell.com
11. Cisco Systems. (n.d.). Understand cable requirements for console and AUX ports (Document 12223); Loopback tests for T1/56K lines (Document 5708). cisco.com (console); cisco.com (loopback)
12. Klein Tools. (2021). Tone and probe test and trace kit instructions (VDV500-705); Wireshark Foundation. (n.d.). Ethernet capture setup. kleintools.com (PDF); wiki.wireshark.org

The request that sounds right

A graphic designer files a ticket: the text on her 24-inch monitor, which runs at 1920 x 1080, looks soft. She asks for a 27-inch monitor at the same 1920 x 1080 resolution, "because a bigger screen will be sharper." The request sounds reasonable, the larger monitor costs little more, and it would make the problem worse. This lesson debugs that request and four others like it, and on the way covers every item in Core 1 objective 3.1: panel types, touch screens and inverters, and the four attributes on a monitor's box, pixel density, refresh rate, resolution and color gamut.

Bug one: bigger is not sharper

Sharpness depends on pixel density, measured in pixels per inch (PPI), not on screen size. Dell's monitor guide states the principle plainly: a larger display at the same resolution spreads the same number of pixels across more space. To compute it, find the number of pixels along the diagonal with Pythagoras, then divide by the diagonal in inches.

Check the method against a manufacturer's figure. Apple lists the 14.2-inch MacBook Pro display at 3024 x 1964 and 254 pixels per inch. The diagonal is the square root of 3024 squared plus 1964 squared, about 3,606 pixels, and 3,606 divided by 14.2 is 254. The designer's 27-inch 1080p monitor would drop from 92 to 82 PPI. The fix is a higher resolution, the number of pixels across and down: a 27-inch monitor at 2560 x 1440 gives her 109 PPI and more room on screen.

The upshot: resolution is the pixel count; pixel density is resolution divided by size. Compare monitors on density when the question is sharpness, and on resolution when it is workspace.

Bug two: "all LCDs are the same"

A liquid crystal display (LCD) does not make its own light. A backlight shines through a layer of liquid crystals that twist to let more or less light through each colored subpixel. How the crystals are arranged gives the three panel types, and Dell's monitor guides summarize their strengths.

Two of the terms need defining. Response time, in Dell's words, measures how quickly a pixel changes from one color to another; slow response leaves visible trails behind moving objects. Contrast is the ratio between the brightest white and the darkest black a panel can show at once. Dell adds a caution worth repeating to customers: panel behavior varies by implementation, so these are tendencies, not guarantees. A designer who sits at an angle to a second screen, or a team that gathers around one monitor, should get IPS.

Bug three: "an OLED is just a better LCD"

An OLED (organic light-emitting diode) panel has no backlight. Dell's description is that each pixel produces its own light, so a pixel can turn fully off and sit black beside a bright highlight. That gives OLED its striking contrast. It also gives it a weakness an LCD does not have. Dell warns that repeated, prolonged display of fixed elements can contribute to uneven wear or permanent image retention, often called burn-in. Built-in protections such as pixel shifting, screen dimming and maintenance cycles help manage the risk but do not eliminate it.

So the request "put an OLED in the lobby to show our logo and a clock all day" is a bug. For static content shown for hours, an LCD is the safer choice, and an OLED used for ordinary work should be allowed to run its care cycles and to sleep when nobody is using it.

Bug four: "Mini-LED is a kind of OLED"

Mini-LED is an LCD with a much better backlight. Apple's description of the Liquid Retina XDR display on iPad Pro explains the design. Older LCDs spread light from the edge of the panel across its back. This display instead uses more than 10,000 tiny LEDs spread across the whole back of the panel, grouped into more than 2,500 local dimming zones that can be dimmed separately. Dark parts of the picture get dark zones behind them, which is how it reaches a 1,000,000:1 contrast ratio while still being an LCD. Mini-LED narrows the contrast gap with OLED without OLED's burn-in risk, but a small bright object on a black background can still show a faint glow around it, because each zone is much larger than one pixel.

Bug five: reading the rest of the box

Refresh rate, measured in hertz, is how many times a display can update its image each second, as Dell defines it. Divide 1,000 by the rate to get the time per frame: 60 Hz gives a new image every 16.7 ms, 120 Hz every 8.3 ms, 144 Hz every 6.9 ms and 240 Hz every 4.2 ms. Dell's guidance is that 60 or 75 Hz is generally enough for documents, browsing and video calls, while fast games benefit from more. Apple's MacBook Pro lists adaptive refresh rates up to 120 Hz, called ProMotion, which lowers the rate when nothing on screen is moving.

Color gamut is the range of colors a display can reproduce, given as a share of a standard color space. VESA's DisplayHDR certification shows how gamut is specified in practice: every tier requires 99 percent coverage of ITU-R BT.709, the color space of HD video, and higher tiers add 90 or 95 percent coverage of DCI-P3, the wider space used in digital cinema. Apple lists its MacBook Pro display as P3 wide color. A photographer who prepares images for print or film needs the wide-gamut monitor; an accounts clerk does not.

Touch screens, digitizers and inverters

A touch screen adds a digitizer, the layer that turns a finger or pen on the glass into coordinates. Microsoft's hardware guidance requires touch and pen digitizers to present themselves to Windows as human interface devices reporting the position and whether the finger or pen tip is touching. The digitizer is separate from the image itself, which is why a cracked digitizer can stop touch from working while the picture stays perfect, or touches can register in the wrong place until the screen is recalibrated. Lesson 35 troubleshoots both.

The inverter belongs to older LCDs lit by a cold-cathode fluorescent lamp (CCFL), a thin fluorescent tube behind the panel. Dell's 2009 service manual for the Latitude E6500 laptop, sold with either a CCFL or an LED display, shows the CCFL panel's backlight cable plugging into a separate display inverter board, which drives the lamp. LED-backlit panels, the norm today, need no such board. You will still meet inverters in older laptops and monitors, and Lesson 19 covers what happens when a backlight or inverter fails.

Common misconceptions

• "A bigger screen at the same resolution is sharper." It is less sharp: the same pixels are spread over more area, so pixel density falls.
• "Response time and refresh rate are the same thing." Refresh rate is how often the image updates; response time is how quickly each pixel can change color. A fast refresh rate on a slow panel still smears.
• "Mini-LED is a type of OLED." Mini-LED is an LCD with thousands of small backlight LEDs in local dimming zones; OLED pixels make their own light.
• "OLED burn-in is a myth from old plasma TVs." Dell's own OLED guidance warns that prolonged fixed images can cause permanent image retention.

Pulling it together

• Pixel density (PPI) is diagonal pixels divided by diagonal inches; at the same resolution, a bigger screen is less sharp.
• IPS: consistent color at wide angles. VA: stronger contrast. TN: fastest response.
• OLED pixels emit their own light for true blacks, with a burn-in risk from static images; Mini-LED is an LCD with thousands of local dimming zones.
• Refresh rate is updates per second (60 Hz is 16.7 ms a frame); response time is pixel change speed.
• Color gamut is the share of a color space, such as BT.709 or the wider DCI-P3, that a display covers.
• The digitizer turns touch into coordinates; the inverter powers the CCFL backlight of older LCDs.

Sources

1. Dell Technologies. (n.d.). Standard monitors; Flat panel gaming monitors; OLED monitors [Buying guides with FAQs]. dell.com (standard); dell.com (gaming); dell.com (OLED)
2. Apple. (n.d.). MacBook Pro: Technical specifications (display); About the Liquid Retina XDR display on iPad Pro. apple.com (MacBook Pro); support.apple.com (XDR display)
3. VESA. (n.d.). DisplayHDR performance criteria. displayhdr.org
4. Microsoft. (n.d.). Windows pointer device overview [Windows hardware design guidance]. learn.microsoft.com
5. Dell Inc. (2009). Dell Latitude E6500 service manual (Rev. A02): Display inverter; Removing the CCFL display panel. dell.com (PDF)

A new device in a changed world

On 15 January 2026, Microsoft stopped publishing new third-party printer drivers to Windows Update for Windows 11 and Windows Server 2025, apart from case-by-case exceptions. Its published plan explains why. Since Windows 10 version 21H2, Windows has included the Microsoft IPP Class Driver, which works with any Mopria-compliant printer over the network or USB without a manufacturer's driver. From 1 July 2026 Windows prefers that built-in driver, and from 1 July 2027 third-party driver updates are limited to security fixes. Existing drivers keep installing and working; what changed is the default. Installing a printer is now less about hunting for drivers and more about the steps around them, and that is the procedure this lesson walks through, for a twelve-person office receiving a color laser multifunction device (MFD): a printer, scanner, copier and often fax in one.

Worth holding on to: Core 1 objective 3.7 is a deployment checklist and objective 3.8 is a maintenance checklist. Learn them as procedures and the exam's scenarios become a matter of finding the skipped step.

Procedure one: deploying the device

1. Unbox and choose the location. A laser MFD is heavy, so lift it with a second person (Lesson 2's NIOSH figures apply). Put it where its users can reach it and where confidential output is not on public view, on a surface that will bear its weight, with space around its vents and near both a power outlet and a network jack. Remove every strip of packing tape and shipping lock before powering on.
2. Connect it. HP's datasheet for its Color LaserJet Pro MFP 4303 lists the usual choices on one machine: Gigabit Ethernet, USB 2.0 for a single computer, dual-band Wi-Fi 5, and Wi-Fi Direct for phones connecting without the office network. Wired Ethernet is the reliable default for a shared device.
3. Update the firmware. A printer is a networked computer. Before putting it into service, install the maker's current firmware from its control panel or web interface. The same HP device checks the signature of its boot code before running it, and keeping that code current is what closes security flaws found since the device was built.
4. Choose the driver. On Windows 11, a Mopria-certified printer works with the built-in IPP class driver. Where you install a vendor driver instead, you often choose a page description language, the language the computer uses to describe a page to the printer. HP's Universal Print Driver, for example, comes as PCL 6 or PostScript. PCL (Printer Command Language) is HP's family of printer languages; the 4303's datasheet lists PCL 6, PCL 5e and PCL 5c. PostScript, which Adobe describes as the first device-independent page description language, released in 1984, describes a page the same way whatever the printer. Whichever you choose, the driver must be built for the computer's operating system and processor architecture; Microsoft's plan, for instance, treats native ARM64 printer drivers as a separate category.
5. Share it. There are three models, compared in the next section: share it from a PC, publish it from a print server, or register it with a cloud print service.
6. Set the defaults. Set duplex (two-sided) printing on by default to save paper, the default orientation and paper size, the tray settings that tell the printer which paper is in which tray (the 4303 has a 50-sheet multipurpose tray, a 250-sheet main tray and an optional 550-sheet tray), and a default quality setting that balances appearance against toner use.
7. Secure it and set up scanning, as described below, then print and scan a test page from a user's computer.

Sharing: from one PC, a server or the cloud

For twelve people, a printer share from a PC is fragile and a print server is more than they need; a printer that everyone adds directly by its network address, or a cloud service if the office already runs Microsoft 365, is the usual answer.

Securing a shared device

A multifunction device holds documents, address books and stored jobs, so the objectives treat it as a security device too. HP's datasheet for its enterprise Color LaserJet MFP 4801 lists the controls in one place.

• User authentication. Sign-in at the panel with PIN codes (up to 1,000 on that model), or with directory accounts through LDAP or Kerberos, so every job and scan has a name attached.
• Badging. A card or badge reader lets users sign in by tapping the same ID badge that opens the office doors. HP lists badge readers among the passwordless options it supports.
• Secured prints. The job waits in the device until its owner authenticates at the panel, so confidential pages never sit in the output tray. HP describes its PIN or pull printing as authenticating print jobs only when you are present.
• Audit logs. The device records who printed, copied and scanned what, and when. The 4801 can send device security events as syslog messages to an organization's security monitoring tools; Universal Print offers centralized reporting for all registered printers.

Scanning: where the pages go

An MFD scans from a flatbed, a glass plate for a single page, a book or a fragile original, or from an automatic document feeder (ADF), which pulls a stack of loose pages through by itself. The 4303's ADF holds 50 sheets and scans both sides in a single pass. Scans then go to one of three places, each needing its own setup.

Microsoft's driver plan notes that multifunction devices keep working over IPP: printing and faxing use IPP, while scanning uses the WS-Scan or eSCL protocols.

Procedure two: maintenance, by technology

Each printing technology wears out in its own places, so maintenance follows the technology.

Laser. HP's LaserJet Enterprise M604 to M606 user guide shows what each task involves. The printer warns when toner is low and very low; gently rocking the cartridge redistributes toner for a while, and the green imaging drum should not be exposed to light for more than a few minutes. The preventive maintenance kit contains replacement rollers for all trays, a replacement transfer roller and a replacement fuser, the heated assembly that melts toner onto the paper; the guide warns that the fuser is very hot. A cleaning page, printed from the Calibration/Cleaning menu, clears the toner and dust that cause specks, smears and streaks. On color lasers, HP's M554 and M555 guide describes calibration as a function that optimizes print quality and fixes misaligned color, colored shadows and blurry graphics.

Inkjet. Epson's user's guide for its ET-2800 printers gives the order of work. Print a nozzle check pattern; if lines are missing or faint, clean the print head. If there is no improvement after three cleanings, turn the printer off and wait at least 12 hours before trying again, and use the heavier Power Cleaning only if necessary, because it consumes a lot of ink. Align the print head when output is grainy or blurry or shows dark or light horizontal bands. If ink appears on the back of pages, clean the paper guide rollers.

Thermal. Zebra's documentation defines direct thermal printing: the printhead presses directly against the media, heating elements discolor its heat-sensitive coating, and no ribbon is used. That is why these printers need special thermal paper. Its user guide for the GK888t printer says to clean the printhead after every roll of media when printing direct thermal, using a cleaning pen, and to let the printhead cool for a minute first.

Impact. Epson's guide for its LQ-590II dot matrix printer covers the remaining tasks. Replacing the ribbon cartridge means moving the print head by hand, and the guide warns that the print head may be hot right after printing. Impact printers survive because they print multipart forms: carbonless sets of an original and copies, up to six parts on that model, which a laser or inkjet cannot mark through.

Same symptom, four different fixes

Change one input, the technology, and the same complaint, "the prints are faded," leads somewhere different. On a laser, it usually means low toner. On an inkjet, it means clogged nozzles, so start with a nozzle check. On a direct thermal printer, look for a dirty printhead or paper without the heat-sensitive coating. On an impact printer, it usually means a worn ribbon. Lesson 19 builds this into full troubleshooting.

Common misconceptions

• "Every printer needs the manufacturer's driver." Mopria-certified printers work with Windows' built-in IPP class driver, which Windows now prefers.
• "Secure printing means encrypting the job." In the exam's sense it means holding the job until its owner authenticates at the device, so nothing sits unattended in the tray.
• "Keep running head cleaning until the print improves." Epson's guidance is three cleanings, then a 12-hour rest; repeated cleaning wastes ink.
• "A maintenance kit is just a new toner cartridge." HP's kit replaces the fuser, the transfer roller and the tray rollers, the parts that wear with page count.
• "Thermal printers use ink." Direct thermal printers darken heat-sensitive paper and use no ink, toner or ribbon.

Summing up

• Deploy in order: location, connection, firmware, driver, sharing, defaults, security, scanning, test.
• Windows 11 prefers the built-in IPP class driver for Mopria printers; vendor drivers offer PCL (HP's printer languages) or PostScript (Adobe's device-independent language).
• Share from a PC (host must stay on), a print server (central queues and drivers) or a cloud service such as Universal Print (no servers or drivers).
• Secure with authentication, badges, secured (pull) printing and audit logs; scan to email (SMTP), network folders (SMB) or cloud storage, from the flatbed or the ADF.
• Laser: toner, maintenance kit (fuser, transfer roller, rollers), calibration, cleaning. Inkjet: cartridges, head cleaning (three tries, then wait), alignment, rollers. Thermal: heat-sensitive paper, printhead cleaning. Impact: ribbon, printhead, multipart forms.

Sources

1. Microsoft. (2025). End of servicing plan for third-party printer drivers on Windows; (2024). Discover Universal Print; (n.d.). Share a printer as a network printer. learn.microsoft.com (driver plan); learn.microsoft.com (Universal Print); support.microsoft.com (sharing)
2. HP Inc. (n.d.). HP Color LaserJet Pro MFP 4303 series data sheet; HP Color LaserJet Enterprise MFP 4801 series data sheet. hp.com (4303, PDF); hp.com (4801, PDF)
3. Adobe. (n.d.). PostScript [Product page]. adobe.com
4. HP Development Company. (2017). LaserJet Enterprise M604, M605, M606 user guide; (n.d.). HP Color LaserJet Enterprise M554, M555 user guide. hp.com (M604, PDF); hp.com (M554, PDF)
5. Seiko Epson. (n.d.). ET-2800/ET-2803 user's guide; LQ-590II/LQ-2090II user's guide (NPD5799-02). epson.com (ET-2800, PDF); epson.com (LQ-590II, PDF)
6. Zebra Technologies. (n.d.). Direct thermal [ZD200 series user guide glossary]; Cleaning [GK888t user guide]. docs.zebra.com (glossary); docs.zebra.com (cleaning)

One laptop, five complaints

A sales manager brings in her Dell Latitude 5450, a 14-inch business laptop, with a list. It slows to a crawl with forty browser tabs open. Wi-Fi drops in the far corner of the office. She wants a camera she can physically cover. She wants to plug in at her desk with one cable and get two monitors, a wired network and charging. And on the road she wants her phone to get the laptop online. Following this one machine through the bench covers almost all of Core 1 objectives 1.1 and 1.2, because each complaint leads to a different part or connection.

The first move is not a screwdriver. It is Dell's owner's manual for that exact model, because laptops differ far more than desktops. The Latitude 5450 manual divides its parts into two lists.

The names say who is expected to do the work: CRUs are parts an owner may replace, FRUs are parts a trained technician replaces, usually under a service contract. Notice two surprises on this model. The battery is a field-replaceable unit, and so is the keyboard, which comes as part of the palm-rest assembly. Never assume a part is easy to replace because it was easy on another laptop.

So what?: on a laptop, the service manual decides the procedure, the parts and even whether you should be the one doing it. Read it before the base cover comes off.

Before the cover comes off

Lesson 2's rules apply, with one laptop-specific step. Dell's procedure for this model is to enter its Service Mode, which cuts the battery off from the system, or, if that fails, to disconnect the battery cable and drain residual power by holding the power button. Only then remove the base cover. The 5450's battery is a three-cell lithium-ion pack of 42 or 54 watt-hours at 11.4 V, and Lesson 2's warnings about swollen packs apply to it in full.

Complaint one: more memory and storage

Lesson 5 showed that many slim laptops have soldered memory. This one does not. Its specifications list two SODIMM slots for DDR5 memory at 5200 or 5600 MT/s, depending on the processor, from 8 GB up to 64 GB. If it has 8 GB as two 4 GB modules, the fix for forty tabs is a matched pair of 16 GB DDR5 SODIMMs, keeping dual-channel operation. The solid-state drive is also a customer-replaceable unit. When you replace a boot drive, plan the data move first: clone the old drive or back it up, because the new drive arrives empty.

Complaint two: the Wi-Fi in the far corner

The 5450's wireless card is offered as either a Realtek card supporting Wi-Fi 6 on 2.4 and 5 GHz or an Intel AX211 supporting Wi-Fi 6E, which adds the 6 GHz band; both include Bluetooth 5.3. A newer card can help, but the card does not contain the antennas. Two thin coaxial cables run from connectors on the card, marked Main and Aux, to antennas elsewhere in the chassis. Dell's instructions for this model say to connect the white cable to the Main connector and the black cable to the Aux connector. Dell's procedure for removing the display assembly begins by removing the wireless card and freeing the antenna cables from their routing guides, which tells you the cables run up into the lid.

That routing explains a classic ticket: Wi-Fi is weak or gone after a screen repair. The likely cause is an antenna cable left unplugged, swapped, or pinched in the hinge, not a failed card. The same logic applies to the optional WWAN card, which puts a cellular modem and a nano-SIM inside the laptop, with its own pair of antenna cables.

Complaint three: the camera, the microphone and the sign-in

The camera module sits in the display lid with the panel, and on the 5450 it is a field-replaceable unit. For privacy, the model has a physical privacy shutter: Dell's manual says to slide it right to cover the lens and left to uncover it. A shutter blocks the lens, not the microphones, so a user who also wants the microphones off needs to mute them or disable them in software or firmware.

The objectives group three more parts under physical privacy and security components.

• Fingerprint reader. The 5450's optional reader is a capacitive sensor at 500 dpi. Microsoft's Windows Hello documentation describes capacitive fingerprint sensors as one of its biometric sign-in methods.
• Infrared camera. Windows Hello facial recognition does not use the ordinary webcam. Microsoft's support page says it needs an infrared camera, built in or external, and its business documentation explains that special IR cameras help guard against spoofing with a photo.
• Near-field scanner. The optional Dell ControlVault 3 Plus contactless smart-card reader with NFC reads cards such as ISO 14443 Type A and B and FeliCa badges, and works as an NFC reader, writer and peer-to-peer device. It does not read older 125 kHz proximity cards, so check which badges an office uses before promising tap-to-sign-in.

Phones and tablets: fewer parts, same thinking

Phones and tablets are more tightly built still, and their batteries and screens are usually replaced by the maker or its partners rather than at a help desk. Apple's iPhone battery service page, for example, sends customers to an Apple Store, an Apple Authorized Service Provider or a mail-in repair. The connectors are what a support technician meets most. Older Android phones and accessories used micro-USB, older cameras mini-USB, and iPhones before the iPhone 15 used Apple's own Lightning connector. Apple's support page says iPhone 15 and later models have a USB-C connector, with a USB-C to Lightning adapter for older accessories. USB-C is now the common connector on phones, tablets and laptops alike.

Complaint four: online on the road

Three wireless connection methods appear in the objectives, each built for a different distance.

Tethering is sharing a phone's cellular connection with one device, often over a USB cable; a hotspot shares it over Wi-Fi with several. A laptop can play either role. Microsoft's support page shows Windows sharing a Wi-Fi, Ethernet or cellular connection as a mobile hotspot, and warns that sharing a cellular connection uses data from the data plan. The sales manager's phone can therefore get the laptop online, and every gigabyte comes out of her phone's allowance, a point Lesson 10 returns to.

Complaint five: one cable at the desk

Her ports decide what is possible. Dell lists the 5450's external ports: an RJ45 Ethernet port, two USB 3.2 Gen 1 ports (one with PowerShare charging), two Thunderbolt 4 ports with DisplayPort Alt Mode, USB4 and Power Delivery, an HDMI 2.1 port, a universal audio jack, an optional nano-SIM slot and a wedge-shaped security-cable slot. The Thunderbolt ports also take the power adapter, so one of them can do everything a dock needs.

Dell's guide to docking stations explains the choice. A docking station connects the laptop through one cable to everything on the desk: monitors, keyboard, mouse, speakers and wired network. Thunderbolt docks can drive several high-resolution monitors and charge the laptop over the same cable; USB-C docks rely on DisplayPort Alt Mode; universal USB docks use DisplayLink technology to work with laptops of any brand. A port replicator is the older, simpler idea. The accessory maker Targus notes that docks were formerly called port replicators, but distinguishes a dock, a device with its own hardware for video, USB and Ethernet, from a port replicator that simply passes the laptop's own connections through to a desk unit. For two monitors, Ethernet and charging on one cable, she needs a Thunderbolt dock.

The remaining accessories plug into the same ports or pair over Bluetooth: a stylus (Microsoft's pointer device guidance defines a pen as an active stylus input that supports hovering, which needs a pen-capable digitizer), a drawing pad for artists, an external trackpad, the track point pointing stick in the middle of some keyboards, and headsets, speakers and webcams over USB, Bluetooth or the audio jack.

Common misconceptions

• "If it has screws, the customer can replace it." The service manual's CRU and FRU lists decide; on the Latitude 5450 even the battery and keyboard are technician parts.
• "Weak Wi-Fi after a repair means the wireless card died." The antenna cables run into the display; check that Main and Aux are connected and not pinched before replacing the card.
• "Any webcam can do Windows Hello face sign-in." It needs an infrared camera.
• "A camera shutter stops the laptop listening." It covers the lens only; the microphones need muting or disabling separately.
• "A hotspot is free internet." It shares the phone's cellular data plan, and every byte counts against it.

Looking back

• Read the model's service manual first: CRUs for the owner, FRUs for trained technicians.
• Enter service mode or disconnect the battery and drain residual power before working inside.
• Memory may be SODIMM slots or soldered; storage and wireless cards are often M.2 modules.
• Wireless antennas live in the lid: white cable to Main, black to Aux on Dell's 5450; check them after any display work.
• Privacy and security hardware: shutter (lens only), capacitive fingerprint reader, IR camera for face sign-in, contactless NFC card reader.
• Connectors: USB-C everywhere now, micro-USB and mini-USB on older devices, Lightning on iPhones before the 15.
• NFC is centimeters at 13.56 MHz; Bluetooth pairs discoverable devices; hotspots and tethering share cellular data.
• A dock adds hardware (displays, Ethernet, charging over one cable); a port replicator only passes the laptop's ports through.

Sources

1. Dell Technologies. (n.d.). Latitude 5450 owner's manual: contents (CRUs and FRUs), Battery, Memory, Wireless module, External ports and slots, Fingerprint reader, Contactless smart-card reader, Using the privacy shutter, Removing the display assembly. dell.com (manual); dell.com (ports); dell.com (contactless reader)
2. Dell Technologies. (n.d.). How to replace wireless card on Latitude 5450 and/or Precision 3490 [Service video and steps]. dell.com
3. Microsoft. (n.d.). Configure Windows Hello; Windows Hello for Business; Windows pointer device overview. support.microsoft.com (Hello); learn.microsoft.com (Hello for Business); learn.microsoft.com (pointer devices)
4. NFC Forum. (n.d.). NFC technology: Technical overview. nfc-forum.org
5. Microsoft. (n.d.). Pair a Bluetooth device in Windows; Use your Windows device as a mobile hotspot. support.microsoft.com (Bluetooth); support.microsoft.com (hotspot)
6. Apple. (n.d.). Connect to the Personal Hotspot of an iPhone or iPad; Charge and connect with the USB-C connector on your iPhone; iPhone battery replacement. support.apple.com (hotspot); support.apple.com (USB-C); support.apple.com (battery service)
7. Dell Technologies. (n.d.). Guide to Dell docking stations (Knowledge base article 000124295); Quinn, K. (2018, June 5). Targus docking station dictionary. Targus. dell.com; targus.com

Six tickets from one Monday

Verizon's prepaid support page announced that it would finish decommissioning its 3G and non-VoLTE 4G CDMA network by 31 December 2022. It warned that devices still using that network afterwards would be unable to make calls, including to 911, send texts or use the internet. Its business page later confirmed that the network was gone as of 3 January 2023. Any phone or tablet that could use only that network went silent, whatever its settings. Problems like that are the substance of Core 1 objective 1.3, which is about getting mobile devices connected and keeping them connected and managed. This lesson works through six tickets of the kind a help desk sees on any Monday, then pulls out the rules they share.

Ticket one: "The field tablet has no data"

A delivery company's tablet shows full Wi-Fi bars in the depot but no data on the road. Start with the switches: check that cellular data is turned on, including for the app in question, and that airplane mode is off. Then check the generation. Each generation of mobile network, 3G, 4G (LTE) and 5G, needs a device that supports it. When a carrier retires a generation, as Verizon did with 3G CDMA, devices that cannot use a newer one lose service no matter how they are configured. The fix for an old 3G-only tablet is a new device, not a setting.

A tablet with no cellular radio at all can still go online through a phone's hotspot, sharing the phone's cellular data over Wi-Fi, as Lesson 9 showed. That is a sound stopgap, but every byte comes from the phone's plan.

Ticket two: "The new phone has no SIM tray"

A SIM (subscriber identity module) identifies a device to its carrier. Traditionally it is a small removable card, now usually nano-SIM size. An eSIM does the same job without a card. Apple describes eSIM as an industry-standard digital SIM built into the iPhone, eliminating the need for a physical card. It needs an iPhone XS, XR or later and a carrier that supports eSIM. Some iPhone models are eSIM-only. Activation happens in software: the carrier provides the plan, often through a QR code or the carrier's app, during or after setup. For a technician, the practical difference is that moving a number to a new phone means transferring the eSIM, not moving a card. A carrier that does not support eSIM cannot serve an eSIM-only phone.

Ticket three: "My earbuds won't connect"

Bluetooth pairing follows the same five steps on every platform, and the objectives list them in order.

1. Enable Bluetooth on the phone or laptop.
2. Enable pairing on the accessory. Apple's instructions say to put the accessory in discovery mode, and Microsoft's say to make it discoverable; how is device-specific, so check its manual.
3. Find the device in the phone's or computer's Bluetooth settings and select it.
4. Enter the PIN if asked. Apple notes that you might need to enter a PIN or passcode and points to the accessory's documentation for it.
5. Test connectivity: play audio, make a test call, or type with the keyboard.

If an accessory that used to work will not reconnect, Apple's troubleshooting advice is to unpair it, put it back in discovery mode and pair it again.

Ticket four: "The map puts me in the wrong building"

Location services come from more than one source. Apple explains that, with the user's permission, Location Services uses information from cellular, Wi-Fi, GPS and Bluetooth to determine location. GPS is satellite positioning. Apple notes that its accuracy depends on how many satellites the device can see, and that finding them all can take several minutes, with accuracy improving over time. Cellular location uses information from the mobile network, and with Wi-Fi it lets a phone that cannot see the sky still show an approximate position. A courier's app that starts indoors therefore begins with a rough position and sharpens it once GPS has the satellites in view.

Location is also a privacy setting. Apple lets the user grant or revoke location access app by app, and to turn Location Services off entirely. A support technician's first questions are whether location is on, whether this app has permission, and whether the device can see the sky.

Ticket five: "I want work email on my own phone"

This is where mobile device management (MDM) comes in, and the answer depends on who owns the phone. Microsoft's description of its Intune service draws the line clearly.

Apple builds the same split into its own platform. Its User Enrollment is designed for BYOD, where the user, not the organization, owns the device. IT can manage only the organization's accounts, settings and information, and the user can see what is managed. Organizations needing more control use device enrollment instead.

The objectives list what management is for. Device configurations push settings such as Wi-Fi, email accounts and VPN to enrolled devices. Policy enforcement requires things like a screen lock or a minimum OS version before a device may reach company data. Corporate applications are deployed to managed devices, while on unenrolled BYOD phones users install them from the app store themselves. Microsoft's app protection policies show how MAM protects BYOD data. They can require a PIN or fingerprint to open corporate email, prevent copying and pasting of corporate data into personal apps, and block managed apps on jailbroken or rooted devices. When someone leaves, a selective wipe removes only the company's data.

The core of it: corporate device, manage the device; personal device, manage the apps and data. The test of a good BYOD policy is that the company can remove its own data without touching the employee's photos.

Ticket six: "My calendar is out of date and my data ran out"

Synchronization keeps the same mail, calendar, contacts and files on every device. In Microsoft environments, many phones use Exchange ActiveSync. Microsoft describes it as a synchronization protocol optimized for high-latency, low-bandwidth networks, which lets phones reach email, calendar, contacts and tasks and keep working with them offline. Business apps such as cloud storage sync files the same way. When a calendar is stale, check that sync is on for that account and data type, that the device has a connection, and that the account's password has not changed.

Sync also uses data, which matters on capped plans. Apple's Low Data Mode shows what a phone can do about it. It stops apps using network data when they are not in use and turns off Background App Refresh. It also lowers streaming quality, turns off automatic downloads and backups, and pauses iCloud Photos updates. A traveler who syncs a large shared folder over cellular can exhaust a data cap in an afternoon; the fix is to sync large files on Wi-Fi only and turn on low-data settings.

Common misconceptions

• "If a device has signal bars, its settings are the problem." A device that supports only a retired network generation cannot be fixed by settings; it must be replaced.
• "An eSIM phone can use any carrier." The carrier must support eSIM, and Apple lists that as a requirement.
• "Location services means GPS." Phones combine GPS with cellular, Wi-Fi and Bluetooth information; GPS alone can take minutes and struggles indoors.
• "BYOD means the company can wipe my phone." With app-level management or Apple's User Enrollment, the organization manages only its own apps, accounts and data, and can wipe only those.

What to remember

• Check the switches first (cellular data, per-app data, airplane mode), then the network generation; retired 3G networks strand old devices.
• An eSIM is a built-in digital SIM; it needs a supporting carrier and moves by transfer, not by card.
• Bluetooth: enable, put the accessory in pairing mode, find it, enter a PIN if asked, test.
• Location combines GPS, cellular, Wi-Fi and Bluetooth, under per-app permission.
• MDM manages corporate devices whole; MAM and User Enrollment protect only work apps and data on BYOD devices, with selective wipe.
• Exchange ActiveSync syncs mail, calendar, contacts and tasks; watch data caps and use low-data settings on cellular.

Sources

1. Verizon. (n.d.). CDMA network update [Prepaid support]; 3G CDMA network retirement [Business support]. verizon.com (prepaid); verizon.com (business)
2. Apple. (n.d.). Set up eSIM on iPhone; About privacy and Location Services in iOS, iPadOS, and watchOS; Use Low Data Mode on your iPhone and iPad; Connect a third-party Bluetooth accessory to your iPhone or iPad. support.apple.com (eSIM); support.apple.com (location); support.apple.com (Low Data Mode); support.apple.com (Bluetooth)
3. Microsoft. (n.d.). Pair a Bluetooth device in Windows. support.microsoft.com
4. Microsoft. (2026). What is Microsoft Intune?; App protection policies overview. learn.microsoft.com (Intune); learn.microsoft.com (app protection)
5. Apple. (n.d.). User Enrollment and device management [Apple Platform Deployment]. support.apple.com
6. Microsoft. (n.d.). Exchange ActiveSync [Exchange Server documentation]. learn.microsoft.com

The number on every request

When a user in a Windows office opens a mapped drive, the request leaves the PC addressed to TCP port 445. The Internet Assigned Numbers Authority (IANA) lists that port in its registry under the name microsoft-ds. When a technician takes over that user's screen with Remote Desktop, the traffic goes to port 3389. When the user opens a web page, it goes to 443. Every network service waits on a numbered port, and a firewall that blocks the wrong number breaks the service without breaking anything else. That is why Core 1 objective 2.1 is a list of numbers. The exam asks you to read a symptom and name the port, or read a port and name the service.

An IP address gets traffic to the right computer; the port number gets it to the right program on that computer. IANA's registry divides the range into System Ports (0 to 1023), User Ports (1024 to 49151) and Dynamic or Private Ports (49152 to 65535). Servers listen on the well-known numbers in the first range, and the client side of each connection usually uses a temporary port from the top range.

Two ways to carry the data: TCP and UDP

RFC 768 itself says applications needing ordered, reliable delivery should use TCP. UDP is not "worse." It is the right tool when a resent voice packet would arrive too late to matter, or when a request and its answer each fit in one message.

Bottom line: choose by what the application needs. If every byte must arrive in order, TCP; if speed and small messages matter more than guaranteed delivery, UDP.

The port table, grouped by job

IANA registers most of these numbers for both TCP and UDP; the transport column shows what the service normally uses.

Several rows need a sentence of explanation. DNS is often described as UDP-only. RFC 7766, however, says all general-purpose DNS implementations must support both UDP and TCP, so that large responses are not limited to what fits in one UDP packet. DHCP's two numbers are a pair: RFC 2131 says client messages go to the server port, 67, and server replies go to the client port, 68. HTTPS traditionally runs over TCP, but HTTP/3 runs over QUIC, and RFC 9000 says QUIC packets are carried in UDP datagrams. A firewall that allows only TCP 443 therefore pushes browsers back to older HTTP versions. Microsoft's port reference lists Remote Desktop on both TCP and UDP 3389. It puts the NetBIOS name and datagram services on UDP 137 and 138, the session service on TCP 139, and SMB on TCP 445. Microsoft also notes that CIFS is a dialect of SMB, which is why the objectives list them together.

The mail trio: SMTP, POP3 and IMAP

Mail uses one protocol to send and one of two to read. SMTP on port 25 moves messages between mail servers. For reading, RFC 1939 says POP3 is not meant for extensive manipulation of mail on the server: normally mail is downloaded and then deleted. RFC 9051 describes IMAP as letting a client access and manipulate messages on the server, with mailboxes that work like local folders and the ability to resynchronize after working offline. That difference decides real tickets. A user who reads mail on a phone, a laptop and a tablet wants IMAP. A message read or filed on one device then shows as read and filed on the others. POP3 suits a single computer that should keep its own copy.

Clear text and its secure replacements

CISA's guidance on securing network infrastructure tells administrators to disable unencrypted remote administration protocols such as Telnet and FTP. Legacy, unencrypted protocols, it warns, make it easy for attackers to harvest credentials. RFC 4251 describes SSH as a protocol for secure remote login and other secure network services over an insecure network. The secure alternatives line up neatly:

Reading symptoms through port numbers

Because each service has its own door, a single blocked or misdirected port produces a very particular symptom, and the symptom points back to the port.

• Websites load but mapped drives fail: suspect TCP 445 between the PC and the file server.
• Websites fail by name but work by IP address: DNS on port 53 is not answering.
• A PC comes up with no address after being moved: DHCP on UDP 67 and 68 is not reaching it.
• Mail arrives but cannot be sent: the sending path, SMTP or submission, is blocked or misconfigured.
• Remote Desktop to a server times out while ping works: port 3389 is blocked by a firewall.

Network+ Certification Prep (CS 215) teaches the full port table and packet-level troubleshooting; for A+, the list above, learned by job rather than by number, is the target.

Common misconceptions

• "DNS uses only UDP." RFC 7766 requires DNS implementations to support TCP as well, for large responses and zone transfers.
• "HTTPS is a completely different protocol from HTTP." It is HTTP carried over TLS encryption, on port 443 instead of 80.
• "UDP is unreliable, so it is a poor choice." It is the deliberate choice for DNS, DHCP, voice and HTTP/3, where speed or simplicity matters more than retransmission.
• "POP3 and IMAP do the same job." POP3 normally downloads and deletes; IMAP keeps mail on the server so several devices stay in step.
• "Port 445 is NetBIOS." NetBIOS uses 137 to 139; SMB runs directly over TCP 445.

The takeaway

• TCP: reliable, ordered, connection set up by handshake. UDP: minimal, no delivery guarantee, fast.
• File transfer 20/21; SSH 22; Telnet 23; SMTP 25; DNS 53; DHCP 67/68; HTTP 80; POP3 110; NetBIOS 137 to 139; IMAP 143; LDAP 389; HTTPS 443; SMB/CIFS 445; RDP 3389.
• DNS uses UDP and TCP; DHCP uses UDP; HTTP/3 uses UDP 443 through QUIC.
• Replace clear text: SSH for Telnet, SFTP or FTPS for FTP, HTTPS for HTTP, 993 and 995 for IMAP and POP3.
• Learn each port by the symptom its loss would cause.

Sources

1. Internet Assigned Numbers Authority. (2026). Service name and transport protocol port number registry. iana.org
2. Postel, J. (1980). User Datagram Protocol (RFC 768); Eddy, W. (Ed.). (2022). Transmission Control Protocol (TCP) (RFC 9293). RFC Editor. rfc-editor.org (RFC 768); rfc-editor.org (RFC 9293)
3. Droms, R. (1997). Dynamic Host Configuration Protocol (RFC 2131); Dickinson, J., Dickinson, S., Bellis, R., Mankin, A., and Wessels, D. (2016). DNS transport over TCP: Implementation requirements (RFC 7766). rfc-editor.org (RFC 2131); rfc-editor.org (RFC 7766)
4. Bishop, M. (Ed.). (2022). HTTP/3 (RFC 9114); Iyengar, J., and Thomson, M. (Eds.). (2021). QUIC: A UDP-based multiplexed and secure transport (RFC 9000). rfc-editor.org (RFC 9114); rfc-editor.org (RFC 9000)
5. Myers, J., and Rose, M. (1996). Post Office Protocol, version 3 (RFC 1939); Melnikov, A., and Leiba, B. (2021). Internet Message Access Protocol (IMAP), version 4rev2 (RFC 9051). rfc-editor.org (RFC 1939); rfc-editor.org (RFC 9051)
6. Ylonen, T., and Lonvick, C. (Eds.). (2006). The Secure Shell (SSH) protocol architecture (RFC 4251). rfc-editor.org
7. Microsoft. (n.d.). Service overview and network port requirements for Windows; Microsoft SMB protocol and CIFS protocol overview. learn.microsoft.com (ports); learn.microsoft.com (SMB and CIFS)
8. Cybersecurity and Infrastructure Security Agency. (n.d.). Securing network infrastructure devices. cisa.gov

A studio that needs to get online

A six-person architecture studio is moving into a converted warehouse on the edge of a small town. It needs internet for large drawing files and video calls, Wi-Fi throughout, desk phones that run over the network, two security cameras, and a printer. Follow the network from the street to the desks and you meet every item in Core 1 objectives 2.7 and 2.5. They cover the kinds of internet connection, the names for networks of different sizes, and the boxes that join it all together.

Choosing the link from the street

The first decision is what the provider can bring to the building. The BroadbandUSA glossary from the US National Telecommunications and Information Administration (NTIA) and a broadband reference guide it publishes from the Public Service Commission of Wisconsin describe the main options.

The studio's town has cable and DSL, and fiber stops two streets away. DSL is out at once: the building is well beyond 18,000 feet from the exchange. Cable will do today, and the owner asks the fiber provider about extending its line.

Why satellite distance matters: a worked example

The European Space Agency describes geostationary orbit (GEO) as an altitude of 35,786 km, where a satellite keeps pace with the Earth's rotation and appears fixed in the sky. That is why a fixed dish can point at it. A request from the studio would travel up 35,786 km and down 35,786 km to the provider's ground station. At the speed of light, about 300,000 km per second, those 71,572 km take roughly 0.24 seconds. The reply makes the same trip back, so a round trip costs about half a second before any processing. That delay is what the Wisconsin guide calls a noticeable time lag, and it is why video calls and voice over IP suffer on geostationary service.

ESA places low Earth orbit (LEO) under 2,000 km. Repeat the sum for a satellite at 550 km and the up-and-down trip is about 1,100 km, roughly 4 milliseconds each way. Distance adds only a few milliseconds to a low-orbit connection, against about a quarter of a second each way for geostationary service.

Key idea: choose a connection by what reaches the building, then by speed in each direction and by latency. Distance kills DSL beyond about 18,000 feet, and distance to the satellite gives geostationary service its half-second round trip.

Networks named by their reach

Inside the building: the boxes and what each does

From the cable modem inward, each device has one job, even when a single plastic box combines several of them.

• Modem or ONT. Converts the provider's signal, coaxial, telephone line or fiber, into Ethernet. It marks the edge of the provider's network.
• Router. Forwards traffic between networks, here between the studio's LAN and the internet, and usually performs address translation for the private addresses of Lesson 13.
• Firewall. Permits or blocks traffic according to rules. In a small office it is usually part of the router; NIST's firewall guidelines, SP 800-41, describe the stateful filtering that lets replies return without opening the network to everyone.
• Switch. Connects wired devices within the LAN. Cisco's guide to switch types says unmanaged switches need no configuration and provide basic connectivity, smart switches add some management, quality of service and security, and managed switches give the most control, with options for VLANs, port security, authentication, traffic prioritization and a web interface for monitoring.
• Access point. Bridges wireless devices onto the wired LAN, and is the subject of Lesson 14.
• Network interface card (NIC). The port, built in or added, that connects a device to the network. Each has a MAC address, a 48-bit hardware address. IEEE's guidelines explain that a 24-bit Organizationally Unique Identifier assigned to a manufacturer forms the first half, so the first six hexadecimal digits identify the maker. Windows' getmac command lists the MAC address of every network card in a computer.

The studio's desk phones, cameras and access points add one more requirement: power. Power over Ethernet (PoE) sends electrical power down the same twisted-pair cable as the data, so a camera on a ceiling needs one cable instead of two. Cisco's PoE configuration guide gives the standards. IEEE 802.3af supplies up to 15.4 W per port and 802.3at (PoE+) raises that to 30 W; 802.3bt reaches 60 W for Type 3 devices and 90 W at its highest class. Power comes from a PoE switch, which powers devices on its ports, or from a PoE injector. An injector is a small box that adds power to one cable between an ordinary switch and the device. Check the device's power class against the switch's budget: an access point that needs 25 W will not run on an 802.3af port.

Finally, the cables. Every run from a desk or ceiling ends in the telecom room. The FOA's guide to premises cabling explains that patch panels give the most flexibility there. Each incoming cable is punched down on the back of the panel, and short patch cables plug into its front jacks to connect each run to a switch port. Moving a person to a new desk then means moving a patch cable, not re-running a cable through the ceiling.

The studio's network, finished

Cable arrives at a cable modem in the telecom room. The modem connects to a small router with a built-in firewall. The router feeds a managed PoE+ switch. The phones can have their own VLAN later, and the switch powers the phones, the two cameras and three ceiling access points. Desk and ceiling cables run back to a 24-port patch panel beside the switch. The printer and the workstations plug in through wall jacks, each with its own NIC and MAC address, and the staff's phones and headsets form their own small PANs. One building, five kinds of device, three kinds of network.

Common misconceptions

• "The modem and the router are the same thing." They are often in one box, but the modem converts the provider's signal and the router forwards traffic between networks.
• "Satellite internet is always half a second behind." That figure comes from geostationary distance; low Earth orbit satellites under 2,000 km have far shorter paths.
• "Any switch can do VLANs." Cisco's guide reserves VLAN options for managed (and to a degree smart) switches; unmanaged switches have no configuration at all.
• "Any Ethernet port can power a camera." Power must come from a PoE switch or injector, and its standard must meet the device's class.

Recap

• Fiber ends at an ONT, cable at a cable modem, DSL at a DSL modem over the phone line; cellular and fixed wireless use radio; satellite uses a dish.
• DSL is limited to about 18,000 feet from the central office; geostationary satellite (35,786 km) adds about half a second of round-trip delay; LEO is under 2,000 km.
• PAN around a person, LAN and WLAN around a building, MAN around a town, WAN beyond, SAN for storage in a data center.
• Router between networks, firewall by rule, switch within the LAN (unmanaged, smart or managed), access point to the wired LAN, NIC with a 48-bit MAC address.
• PoE: 802.3af 15.4 W, 802.3at 30 W, 802.3bt 60 to 90 W, delivered by a PoE switch or an injector.
• Patch panels terminate building cables so connections change by patch cable.

Sources

1. National Telecommunications and Information Administration. (2016). BroadbandUSA glossary. ntia.gov (PDF)
2. Center for Community Technology Solutions, UW-Extension, and Public Service Commission of Wisconsin. (2014). Broadband reference guide. Hosted by NTIA. ntia.gov (PDF)
3. CableLabs. (n.d.). DOCSIS 3.1. cablelabs.com
4. International Telecommunication Union. (2008). G.984.1: Gigabit-capable passive optical networks (GPON): General characteristics; (n.d.). IMT-2020 (a.k.a. 5G). itu.int (G.984.1); itu.int (IMT-2020)
5. European Space Agency. (n.d.). Types of orbits. esa.int
6. IEEE 802 LAN/MAN Standards Committee. (n.d.). Working groups; IEEE Registration Authority. (n.d.). Guidelines for use of EUI, OUI, and CID. ieee802.org; ieee.org (PDF)
7. Cisco Systems. (n.d.). Cisco unmanaged, smart, and managed switches; Configuring Power over Ethernet (Catalyst 9300, IOS XE 17.11). cisco.com (switch types); cisco.com (PoE)
8. Scarfone, K., and Hoffman, P. (2009). Guidelines on firewalls and firewall policy (NIST SP 800-41 Rev. 1). csrc.nist.gov
9. Fiber Optic Association. (n.d.). UTP terminations (patch panels). Microsoft. (n.d.). getmac. thefoa.org; learn.microsoft.com

The diagnosis that sounds right

A user calls the help desk: her laptop shows "No internet." The technician asks her to run ipconfig, and she reads out an IPv4 address of 169.254.112.40, a subnet mask of 255.255.0.0, and an empty default gateway. Her conclusion is that "the internet is down." It is a reasonable guess, and it is wrong. This lesson debugs that diagnosis and five others like it. Each wrong answer teaches one part of Core 1 objective 2.6: public and private IPv4 addresses, APIPA, static and dynamic addressing, the subnet mask, the gateway, and IPv6.

An IPv4 address is 32 bits, written as four decimal numbers from 0 to 255 separated by dots. Every device on a network needs one, along with a subnet mask, a default gateway and the address of a DNS server. A device gets these either by being typed in, a static configuration, or by asking a DHCP server, a dynamic one.

Bug one: "169.254 means the internet is down"

The 169.254 address is the clue. RFC 3927 reserves the 169.254/16 block for IPv4 link-local addresses that a device gives itself when no other configuration mechanism is available. The RFC is explicit that these addresses work only with devices on the same physical or logical link, not beyond it. Microsoft calls the feature Automatic Private IP Addressing (APIPA), and its ipconfig documentation lists APIPA alongside DHCP as a source of an adapter's settings.

So the laptop did not reach a DHCP server. The internet may be fine; this computer never got an address that could reach it. Work back along the path: is the cable plugged in or the Wi-Fi actually associated, is the switch port live, is the DHCP server (usually the router in a small office) running? Then ask for a new address with ipconfig /release followed by ipconfig /renew, two switches Microsoft's documentation describes for adapters configured to obtain an address automatically.

The point: an address starting 169.254 is not a network failure report. It is the computer telling you it could not find DHCP, and only devices on the same link can reach it.

Bug two: "My address is how websites see me"

The studio's laptops show addresses like 192.168.1.20, yet a website sees something completely different. RFC 1918 sets aside three blocks of private addresses for use inside organizations:

Private addresses are reused in millions of networks, so they cannot be used on the internet itself. Everything else that is not reserved for a special purpose is a public address, unique on the internet and assigned through the provider. The router bridges the two worlds with network address translation. RFC 3022 describes Network Address Port Translation (NAPT), in which many internal addresses share one external address, distinguished by port number. The website sees the router's single public address. Note the trap in the middle block: 172.16 to 172.31 is private, but 172.32.0.1 is not.

Bug three: "Same office, so same network"

The studio adds a plotter with the address 192.168.2.15. A laptop at 192.168.1.20 with the mask 255.255.255.0 cannot reach it directly, though both sit in the same room. The subnet mask decides which part of an address names the network and which part names the host. RFC 1122 requires a host to use the mask to decide whether a destination is on a connected network; if it is, the packet goes straight to it, and if not, it goes to a gateway.

Work it through. A mask of 255.255.255.0, written /24 because its first 24 bits are ones, says the first three numbers are the network. The laptop's network is 192.168.1; the plotter's is 192.168.2. They differ, so the laptop sends the plotter's traffic to its gateway, which may not route between them at all. The fix is to put the plotter on 192.168.1, or to change the mask on every device if a bigger network is truly intended. A /24 leaves 8 bits for hosts: 2 to the power 8 is 256 combinations, minus the all-zeros network address and the all-ones broadcast address, which leaves 254 usable host addresses. Network+ Certification Prep (CS 215) takes subnetting much further; A+ asks you to recognize a mismatch like this one.

Bug four: "Local works, so the network is fine"

A desktop with a static address can print to the plotter and open files on the local server, but no website loads. Local traffic never needs the default gateway; everything bound for another network does, as RFC 1122 describes. Check the gateway first. If it was typed as 192.168.1.254 when the router is 192.168.1.1, every packet for the internet goes to an address where nothing answers. Local success with remote failure points at the gateway, and remote success with local failure, which is rarer, points at the mask.

Bug five: "Static addresses for everything"

A technician tired of DHCP problems decides to type a fixed address into every computer. This trades one problem for several: every move or replacement needs manual work, typing errors create the mask and gateway faults above, and two devices given the same address conflict with each other. The usual rule is the reverse.

• Dynamic (DHCP) for computers, phones and tablets, which come and go.
• Static, or a DHCP reservation (Lesson 15), for devices others must find at a known address: the router, printers, servers, access points and cameras. Keep static addresses outside the range DHCP hands out, and record them.

Bug six: "IPv6 is just a longer IPv4"

IPv6 addresses are 128 bits instead of 32, and they look and behave differently. RFC 4291 sets the rules.

• Format. Eight groups of one to four hexadecimal digits, separated by colons, such as 2001:DB8:0:0:8:800:200C:417A. Leading zeros in a group may be dropped.
• Compression. A double colon, ::, stands for one or more groups of zeros, and may appear only once in an address. So 2001:0db8:0000:0000:0000:ff00:0042:8329 becomes 2001:db8::ff00:42:8329.
• Link-local addresses start with fe80::/10. Every IPv6 interface has one, the IPv6 cousin of an APIPA address, usable only on its own link.
• Loopback is ::1, a node's address for sending packets to itself, which RFC 4291 says must never be assigned to a physical interface.
• Unique local addresses, in fc00::/7 under RFC 4193, are for private use inside a site, rather like the RFC 1918 blocks.
• Global unicast addresses are the publicly routable ones.

IPv6 also changes how devices get addresses. Under stateless address autoconfiguration, SLAAC, RFC 4862 describes routers advertising the prefix for the network while each host generates its own interface identifier, so a host can build its own global address without a DHCP server. Microsoft's documentation notes that ipconfig with no parameters displays both IPv4 and IPv6 addresses for every adapter, because Windows runs the two side by side.

Special addresses at a glance

Common misconceptions

• "A 169.254 address means the internet is down." It means the device did not reach a DHCP server; start at the cable, the Wi-Fi association and the DHCP server.
• "All 172 addresses are private." Only 172.16.0.0 to 172.31.255.255 is.
• "If I can reach the local server, the gateway must be right." Local traffic never uses the gateway; only remote traffic exposes a wrong one.
• "The :: shortcut can be used anywhere there are zeros." RFC 4291 allows it only once per address, or the address would be ambiguous.
• "IPv6 always needs DHCP." With SLAAC, hosts build their own addresses from prefixes the router advertises.

What to carry forward

• 169.254.x.x is APIPA (RFC 3927): DHCP was not reached; check the link, then ipconfig /release and /renew.
• Private IPv4: 10/8, 172.16/12, 192.168/16 (RFC 1918); NAT with port translation lets many share one public address (RFC 3022).
• The mask splits network from host; different networks mean traffic goes to the gateway (RFC 1122). A /24 holds 254 hosts.
• Local works but internet fails: check the default gateway.
• DHCP for clients; static addresses or reservations for routers, printers, servers and access points, outside the DHCP range.
• IPv6: 128-bit hex, :: once, fe80:: link-local, ::1 loopback, fc00::/7 unique local, SLAAC from router advertisements.

Sources

1. Cheshire, S., Aboba, B., and Guttman, E. (2005). Dynamic configuration of IPv4 link-local addresses (RFC 3927). RFC Editor. rfc-editor.org
2. Rekhter, Y., Moskowitz, B., Karrenberg, D., de Groot, G. J., and Lear, E. (1996). Address allocation for private internets (RFC 1918); Srisuresh, P., and Egevang, K. (2001). Traditional IP network address translator (Traditional NAT) (RFC 3022). rfc-editor.org (RFC 1918); rfc-editor.org (RFC 3022)
3. Braden, R. (Ed.). (1989). Requirements for Internet hosts: Communication layers (RFC 1122), section 3.3.1. rfc-editor.org
4. Hinden, R., and Deering, S. (2006). IP version 6 addressing architecture (RFC 4291); Hinden, R., and Haberman, B. (2005). Unique local IPv6 unicast addresses (RFC 4193). rfc-editor.org (RFC 4291); rfc-editor.org (RFC 4193)
5. Thomson, S., Narten, T., and Jinmei, T. (2007). IPv6 stateless address autoconfiguration (RFC 4862). rfc-editor.org
6. Internet Assigned Numbers Authority. (n.d.). IANA IPv4 special-purpose address registry. iana.org
7. Microsoft. (n.d.). ipconfig [Windows commands reference]. learn.microsoft.com

A new band for Wi-Fi

On 23 April 2020 the US Federal Communications Commission opened 1,200 megahertz of spectrum in the 6 GHz band, from 5.925 to 7.125 GHz, for unlicensed use. The FCC said the new rules would usher in Wi-Fi 6, the next generation of Wi-Fi. Until then, Wi-Fi had lived in two crowded neighborhoods, 2.4 GHz and 5 GHz. Core 1 objective 2.2 asks you to compare all three bands, their channels and the rules that govern them. It also covers the 802.11 standards and three shorter-range radios: Bluetooth, NFC and RFID. Each comparison below is a decision a technician actually makes, usually when Wi-Fi is slow and someone asks why.

Three bands compared

Cisco Meraki's channel planning guide explains the 2.4 GHz problem plainly. Because most of the channels overlap, 2.4 GHz is not the best choice for high-density deployments. Access points whose coverage overlaps should not share a channel, and in 2.4 GHz there are only three to share out.

Why this matters: most "slow Wi-Fi" tickets in busy buildings are channel problems, not internet problems. Moving capable devices to 5 or 6 GHz and planning channels so neighboring access points differ fixes more than any speed upgrade.

Channels: width, selection and regulation

A channel's width sets its capacity. Meraki's high-density guide gives figures for 802.11ac with one spatial stream. It lists about 87 Mb/s on a 20 MHz channel, 200 Mb/s on 40 MHz and 433 Mb/s on 80 MHz. Wider is faster for one access point, but each wide channel uses up several narrow ones, leaving fewer non-overlapping channels for neighbors. That is why the same guide calls 20 MHz a common recommendation in high-density spaces. A lecture hall full of access points is better served by many narrow channels than by a few wide ones.

Channel selection follows from the same idea: give neighboring access points different channels. Many access points choose automatically, scanning for the least busy channel; in 2.4 GHz, Meraki's automatic selection uses only channels 1, 6 and 11.

Regulations set the outer limits. Each country's regulator decides which channels and frequencies are allowed, so a device sold for one country may not use every channel in another. In parts of the 5 GHz band, Meraki explains, access points must use Dynamic Frequency Selection (DFS). If an access point detects radar there, it must immediately stop using that channel and move to another. Regulators also limit transmit power and antenna gain, which is why Meraki warns that third-party antennas above certain gains may violate regulations in some countries.

The 802.11 standards and their Wi-Fi names

The IEEE 802.11 working group writes the standards; its timeline gives each amendment's year. In October 2018 the Wi-Fi Alliance introduced generation numbers to make them easier to follow: Wi-Fi 6 for devices supporting 802.11ax, Wi-Fi 5 for 802.11ac and Wi-Fi 4 for 802.11n.

The Wi-Fi Alliance gives each generation the year it was introduced: Wi-Fi 4 in 2009, Wi-Fi 5 in 2014, Wi-Fi 6 in 2018 and Wi-Fi 7 in 2024. Wi-Fi 7 brought 320 MHz channels in the 6 GHz band and multi-link operation, which spreads traffic across several links at once. The Dell laptop in Lesson 9 shows these names in a real specification. One wireless card option was Wi-Fi 6 on 2.4 and 5 GHz; the other was Wi-Fi 6E, which adds the 6 GHz band. Network+ Certification Prep (CS 215) covers wireless design and security in depth, and Lesson 33 here covers Wi-Fi security settings.

The short-range radios: Bluetooth, NFC and RFID

The Bluetooth SIG's technical overview places both Bluetooth radios in the 2.4 GHz industrial, scientific and medical (ISM) band. That is the band 2.4 GHz Wi-Fi uses too, so a crowded 2.4 GHz environment can affect both. GS1 manages the EPC Gen2 standard for passive UHF RFID. It describes the standard as defining interrogators (readers) and passive tags operating from 860 to 930 MHz. A passive tag carries no battery; the reader's radio signal powers it. NFC works at 13.56 MHz with a deliberately tiny range, and the NFC Forum notes that one NFC device can power the other in the same way. Recall from Lesson 9 that the Dell laptop's contactless reader handled 13.56 MHz cards but not 125 kHz proximity cards. The one word RFID covers badges that work only with their own kind of reader.

Common misconceptions

• "There are eleven channels in 2.4 GHz, so eleven access points can share a floor." Most overlap; only three (1, 6 and 11 in the US) do not.
• "Wider channels are always faster." One access point gets more throughput, but neighbors run out of separate channels; dense spaces often use 20 MHz.
• "An access point changing 5 GHz channels on its own is a fault." With DFS, detecting radar requires it to leave the channel.
• "Wi-Fi 6E is a different standard from Wi-Fi 6." Both are 802.11ax; 6E means the device can also use the 6 GHz band.
• "NFC and Bluetooth are interchangeable short-range radios." NFC works within centimeters at 13.56 MHz; Bluetooth works across a room at 2.4 GHz.

What you now know

• 2.4 GHz: universal but crowded, three non-overlapping channels (1, 6, 11 in the US). 5 GHz: many more channels, DFS on some. 6 GHz: 1,200 MHz opened by the FCC in 2020, for Wi-Fi 6E and 7.
• Wider channels raise one access point's throughput but cut the number of separate channels; regulators set channels, power and DFS rules by country.
• 802.11a and b (1999), g (2003), n (2009, Wi-Fi 4), ac (2013, Wi-Fi 5), ax (2021, Wi-Fi 6 and 6E), be (2024, Wi-Fi 7).
• Bluetooth Classic and LE share the 2.4 GHz ISM band; NFC is 13.56 MHz at centimeters; RFID ranges from 125 kHz badges to 860 to 930 MHz passive UHF tags.

Sources

1. Federal Communications Commission. (2020, April 23). FCC adopts new rules for the 6 GHz band, unleashing 1,200 megahertz of spectrum for unlicensed use [News release]. fcc.gov (PDF)
2. Cisco Meraki. (n.d.). Channel planning best practices; High density Wi-Fi deployments; Dynamic Frequency Selection (DFS). meraki.com (channel planning); meraki.com (high density); meraki.com (DFS)
3. IEEE 802.11 Working Group. (n.d.). Official IEEE 802.11 working group project timelines. ieee802.org
4. Wi-Fi Alliance. (2018, October 3). Wi-Fi Alliance introduces Wi-Fi 6; (2024, January 8). Wi-Fi Alliance introduces Wi-Fi CERTIFIED 7; (n.d.). Wi-Fi (MAC/PHY) technologies. wi-fi.org (Wi-Fi 6); wi-fi.org (Wi-Fi 7); wi-fi.org (generations)
5. Bluetooth SIG. (n.d.). Bluetooth technology overview. bluetooth.com
6. NFC Forum. (n.d.). NFC technology: Technical overview; GS1. (n.d.). EPC/RFID UHF air interface protocol. nfc-forum.org; gs1.org

Four tickets in one week

Consider a twelve-person accounting firm that moved its email to a new cloud provider on a Monday. By Friday the help desk has four tickets. Invoices sent from the firm's domain are landing in clients' spam folders. Staff cannot print to the office copier, and its settings page no longer opens at the address everyone bookmarked. A bookkeeper who works from home cannot open the file share. And a visitor on the guest Wi-Fi reports that he could see the accounting server's shared folders.

Nothing in this office is broken in the hardware sense. Each ticket is about a service the network provides: name records and mail authentication, address assignment, remote access and separation. Core 1 objective 2.3 asks you to summarize the services that networked hosts provide. Objective 2.4 asks you to explain the configuration behind them. This lesson teaches both, then returns to close the four tickets.

Server roles: one job per service

A server role is a job a computer does for others on the network. One machine can hold several roles, and in a small office the router often holds a few, such as handing out DHCP addresses (Lesson 13). The port numbers come from Lesson 11.

Four roles need more than a table row. Syslog, defined in RFC 5424, carries event notification messages. Each message has a severity from 0 (Emergency: system is unusable) to 7 (Debug), and RFC 5426 says syslog receivers must accept messages on UDP port 514. Sending every device's events to one syslog server lets a technician read a whole incident in one place instead of logging in to each box.

AAA splits access into three questions: who are you (authentication), what may you do (authorization) and what did you do (accounting). RFC 2865 describes RADIUS as carrying authentication, authorization and configuration information between a network access server and a shared authentication server. The access server might be a VPN gateway or a Wi-Fi controller, so that every sign-in is checked in one place. RFC 8907 says TACACS+ is now used mainly for device administration: authenticating access to network devices, authorizing operations centrally and auditing them.

A database server is the program behind most business applications. The PostgreSQL documentation describes the model: a server process manages the database files, accepts connections from client applications and performs database actions on their behalf. The client might be a desktop application or a web server building pages. Databases & SQL (CS 340) teaches what happens inside.

NTP, the Network Time Protocol, is described in RFC 5905 as widely used to synchronize computer clocks in the Internet. Time matters more than it seems. Kerberos, the sign-in protocol of a Windows domain, uses time stamps to prevent replay attacks. Microsoft advises a maximum clock difference of 5 minutes between a client and the domain controller. Time stamps from a client outside that tolerance are not treated as authentic, so its sign-ins fail. Logs from devices whose clocks disagree also cannot be lined up when you investigate a problem.

Appliances at the internet edge

Some services come as dedicated boxes, or virtual appliances, placed where the office network meets the internet.

• Spam gateway. It receives inbound mail before the mail server does and filters it. NIST's email security guide (SP 800-177 Rev. 1) describes the filtering as a pipeline with the cheap checks first. Lists of approved and blocked senders come first, then domain-based authentication (SPF, DKIM and DMARC, below), then analysis of the content and links. No single check catches everything, so NIST recommends layering them.
• Unified threat management (UTM). NIST's firewall guide (SP 800-41 Rev. 1) describes a typical UTM system as a firewall combined with malware detection and removal and the sensing and blocking of suspicious network probes. One box is simpler to manage than several. The trade-off, NIST notes, is that the box must have every feature the organization needs, and enough processor and memory to run them all at once.
• Load balancer. It spreads incoming requests across several servers that do the same job. Amazon's documentation for its Elastic Load Balancing service explains the key feature. The load balancer monitors the health of its targets and routes traffic only to healthy ones, resuming when a failed target recovers.
• Proxy server. RFC 9110 defines a proxy as a message-forwarding agent chosen by the client. It notes that organizations often route their HTTP requests through one for security services or shared caching. A reverse proxy sits in front of servers instead. RFC 9110 says such gateways are used for caching and for spreading or load balancing services across several machines.

Systems you cannot simply patch: SCADA, embedded and IoT devices

SCADA (supervisory control and data acquisition) systems run water, gas and electric networks, pipelines and rail. NIST's guide to operational technology security (SP 800-82 Rev. 3) explains what they do. They collect information from the field, send it to a control center and display it, so an operator can monitor or control a whole system from one place in near real time.

Such systems are often legacy or embedded. NIST notes that an operational technology system can stay in service for more than 20 years. Many contain hardware and software the vendor no longer supports and that cannot be patched. When a normal control, such as anti-malware software, cannot run on the device, NIST advises a compensating control. Its example is a firewall in front of the device that inspects traffic and blocks threats. Network segmentation and isolation head its list of security tools.

Internet of Things (IoT) devices bring the same problem into an ordinary office: cameras, smart thermostats, door controllers and sensors. NIST's report on IoT risk (NISTIR 8228) says many IoT devices cannot be accessed, managed or monitored in the same ways as conventional IT devices. They may also arrive without passing through the normal inventory process. Its mitigations begin with a current, accurate inventory of every IoT device. It also aims to stop a compromised device from attacking others on the same network segment.

What matters here: when a device cannot protect itself, the network has to protect it. Keep a list of what you have, separate it from everything else, and restrict what can reach it.

DNS records: what the name server holds

A DNS server answers from resource records. Each record has a name, a type, a value and a TTL (time to live). RFC 1035 defines the TTL as how long a record may be cached before the source should be asked again. The examples below use example.com and the address blocks set aside for documentation.

Three rules from the RFCs explain common tickets. MX preference: RFC 1035 says lower values are preferred. A sender tries the MX record with preference 10 before the one with 20, which acts as a backup. CNAME stands alone: RFC 1034 says that if a CNAME is present at a name, no other data should be present there. A name that needs MX or TXT records cannot also be an alias. TTL and patience: a changed record is not seen everywhere at once, because resolvers may keep the old answer until its TTL runs out. Microsoft's instructions for connecting a domain to Microsoft 365 use a TTL of 3600 seconds, one hour.

Proving that mail is really yours: SPF, DKIM and DMARC

Email was designed so that any sending host can use any domain name. RFC 7208 calls this a major obstacle to reducing spam, and it is how a criminal sends mail that claims to come from your bank. Three DNS records let a domain owner prove which mail is genuine, and large receivers now expect them. Google's sender guidelines, in force since 1 February 2024, require everyone who sends to Gmail accounts to set up SPF or DKIM. Senders of 5,000 or more messages a day must set up SPF, DKIM and DMARC.

Each has details that cause tickets. Microsoft's SPF value for Microsoft 365 is v=spf1 include:spf.protection.outlook.com -all. The ending is a rule for every other host: in RFC 7208, a minus sign means fail and a tilde (~all) means soft fail. A domain must have only one SPF record. RFC 7208 says that if a check finds more than one, the result is a permanent error. That is why Microsoft's setup instructions say not to create a second SPF record when you change providers. Add the new provider to the existing record instead. For DKIM, Microsoft 365 asks for two CNAME records, selector1._domainkey and selector2._domainkey, which point to key records that Microsoft hosts.

DMARC has a new standard. In May 2026 the IETF published it as a Standards Track RFC, RFC 9989, replacing the informational RFC 7489 of 2015. A DMARC record names a policy for mail that fails. With p=none the owner expresses no preference, p=quarantine asks receivers to treat such mail as suspicious, and p=reject marks every failure as illegitimate use of the domain. The rua tag asks receivers to send aggregate reports. A starting record looks like v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. NIST's guide describes the three policies as a way to tighten gradually. An organization not yet confident in its SPF and DKIM setup can publish p=none with reports, read them, and move to quarantine and then reject.

What matters here: SPF says which servers may send for the domain, DKIM proves the domain signed the message, and DMARC ties both to the From address people actually see.

DHCP: scope, exclusions, reservations and leases

Lesson 13 showed what a client does when DHCP fails. Here is what the server is configured with. Microsoft's DHCP deployment guide for Windows Server lists the parts of a scope. They are a range of addresses the server may lease, a subnet mask, a name, a lease duration, and scope options such as the default gateway and DNS servers.

• Exclusions. Microsoft defines an exclusion range as a contiguous range of addresses inside the scope that the server is not allowed to use. Its purpose is to protect addresses you assign by hand. If static devices sit inside the scope with no exclusion, the guide warns, the server can lease the same address again and cause a conflict.
• Reservations. A reservation ensures that a particular client always receives the same address. Microsoft's reservation command identifies the client by an ID, and for Windows clients that ID is the MAC address. The device still uses DHCP, so it still learns the current gateway and DNS settings.
• Leases. RFC 2131 calls the normal method dynamic allocation: an address is assigned for a limited period, or until the client gives it up. By default a client asks its own server to renew after half the lease (the T1 timer). If that fails, after seven eighths of the lease (T2) it broadcasts the request to any server.

Microsoft's example scope shows the pattern. It leases 10.0.0.1 to 10.0.0.254 with mask 255.255.255.0, excludes 10.0.0.1 to 10.0.0.15 for static devices, and sets the default gateway option to 10.0.0.1.

Separating and extending the network: VLANs and VPNs

A VLAN (virtual LAN) divides one set of switches into separate networks. Cisco Meraki's guide to VLAN tagging says VLANs keep traffic from different networks apart as it crosses shared links and devices. That limits broadcast traffic and secures network segments. Its terms are worth learning exactly:

• An access (untagged) port accepts a single VLAN; it usually connects an end device such as a PC or printer.
• A trunk (tagged) port carries several VLANs, using IEEE 802.1Q tags to mark which VLAN each frame belongs to; trunks usually link switches.
• The native VLAN is the one associated with untagged traffic on a trunk.
• Best practice is a single subnet per VLAN.

Traffic between VLANs can cross only through a device that routes at layer 3, such as a router or firewall. Meraki stresses that even two VLANs on the same device stay separated unless a routing device joins them. That router or firewall is where rules decide what may cross. Lesson 12 noted that VLAN support is a feature of managed switches.

A VPN (virtual private network) extends a private network across one that is not trusted, usually the internet. NIST's guide to IPsec VPNs (SP 800-77 Rev. 1) defines a VPN as a virtual network built on top of existing physical networks. It provides a secure communications mechanism for data and control information. The guide describes the two arrangements a technician meets most:

• Gateway-to-gateway (site-to-site) joins two networks, such as a main office and a branch office.
• Remote access (host-to-gateway) lets individual computers on untrusted networks, such as traveling employees and people working from home, reach internal services.

Closing the four tickets

1. Invoices in spam. Look up the domain's TXT records. Either only the old provider's SPF record exists, or there are now two. Merge them into one record that includes the new provider, then publish the new provider's DKIM records. Add a DMARC record with p=none and a rua address, and tighten to quarantine and then reject once the reports show all genuine mail passing. Check, too, that the MX record points at the new provider.
2. The wandering copier. Its lease ran out and it came back with a different address, so print queues and bookmarks point at an address it no longer has. Create a DHCP reservation for its MAC address and update the queues once.
3. The remote bookkeeper. Forwarding the file server's SMB port from the internet is the wrong fix. Microsoft's guidance is to block TCP 445 inbound from the internet at the firewall. Give her a remote access VPN instead, with her sign-in checked centrally, so the share is reached only through the encrypted tunnel.
4. The guest who could see the server. Guests and staff shared one flat network. Put the guest Wi-Fi on its own VLAN and let the router or firewall pass guest traffic to the internet only. Move the cameras and other IoT devices to a VLAN of their own for the same reason.

Common misconceptions

• "An exclusion and a reservation do the same job." An exclusion keeps addresses away from DHCP for devices you configure by hand; a reservation gives one DHCP client the same address every time.
• "Add a second SPF record for the new provider." Two SPF records produce a permanent error. Merge them into one.
• "SPF stops anyone from faking our From address." SPF checks the envelope sender. DMARC is what ties authentication to the From address people see.
• "A DMARC record with p=none protects the domain." It expresses no preference about failing mail. It is a reporting stage on the way to quarantine or reject.
• "A guest Wi-Fi name is enough separation." A network name is only as separate as the VLAN and firewall rules behind it.
• "Clock accuracy is cosmetic." Kerberos sign-in and log investigation both depend on synchronized time.

The short version

• Server roles: DNS (53), DHCP (67 and 68), file share (445), print, mail (SMTP, IMAP, POP3), syslog (UDP 514), web (80, 443), AAA (RADIUS, TACACS+), database and NTP (123).
• Appliances: a spam gateway filters mail in layers; a UTM puts firewall, malware and probe defenses in one box; a load balancer spreads requests and skips unhealthy servers; a proxy forwards for clients, a reverse proxy for servers.
• SCADA, legacy, embedded and IoT devices often cannot be patched or managed like PCs: inventory them, isolate them and guard them with compensating controls.
• DNS: A (IPv4), AAAA (IPv6), CNAME (an alias, alone at its name), MX (mail, lowest preference first), TXT (text, including SPF, DKIM and DMARC).
• SPF lists permitted senders in one record, DKIM signs, and DMARC (RFC 9989) aligns them with the From address and sets none, quarantine or reject.
• DHCP: a scope with options; exclusions for static devices; reservations by MAC address; leases renewed from half-time.
• VLANs separate traffic on shared switches and cross only through a router or firewall; VPNs connect sites or remote users securely.

Sources

1. Mockapetris, P. (1987). Domain names: Concepts and facilities (RFC 1034); Domain names: Implementation and specification (RFC 1035); Thomson, S., Huitema, C., Ksinant, V., and Souissi, M. (2003). DNS extensions to support IP version 6 (RFC 3596). RFC Editor. rfc-editor.org (RFC 1034); rfc-editor.org (RFC 1035); rfc-editor.org (RFC 3596)
2. Kitterman, S. (2014). Sender Policy Framework (SPF) for authorizing use of domains in email, version 1 (RFC 7208); Crocker, D., Hansen, T., and Kucherawy, M. (Eds.). (2011). DomainKeys Identified Mail (DKIM) signatures (RFC 6376); Herr, T., and Levine, J. (Eds.). (2026). Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 9989). rfc-editor.org (RFC 7208); rfc-editor.org (RFC 6376); rfc-editor.org (RFC 9989)
3. Rose, S., Nightingale, J. S., Garfinkel, S. L., and Chandramouli, R. (2019). Trustworthy email (NIST SP 800-177 Rev. 1); Google. (n.d.). Email sender guidelines. nist.gov (PDF); support.google.com
4. Microsoft. (n.d.). Add DNS records to connect your domain; Deploy DHCP using Windows PowerShell; Add-DhcpServerv4Reservation; Maximum tolerance for computer clock synchronization; Secure SMB traffic in Windows Server. Microsoft Learn. learn.microsoft.com (DNS records); learn.microsoft.com (DHCP); learn.microsoft.com (reservations); learn.microsoft.com (clock tolerance); learn.microsoft.com (SMB)
5. Droms, R. (1997). Dynamic Host Configuration Protocol (RFC 2131); Gerhards, R. (2009). The syslog protocol (RFC 5424); Okmianski, A. (2009). Transmission of syslog messages over UDP (RFC 5426); Mills, D., Martin, J., Burbank, J., and Kasch, W. (2010). Network Time Protocol version 4: Protocol and algorithms specification (RFC 5905). rfc-editor.org (RFC 2131); rfc-editor.org (RFC 5424); rfc-editor.org (RFC 5426); rfc-editor.org (RFC 5905)
6. Rigney, C., Willens, S., Rubens, A., and Simpson, W. (2000). Remote Authentication Dial In User Service (RADIUS) (RFC 2865); Dahm, T., Ota, A., Medway Gash, D. C., Carrel, D., and Grant, L. (2020). The Terminal Access Controller Access-Control System Plus (TACACS+) protocol (RFC 8907); Fielding, R., Nottingham, M., and Reschke, J. (Eds.). (2022). HTTP semantics (RFC 9110). rfc-editor.org (RFC 2865); rfc-editor.org (RFC 8907); rfc-editor.org (RFC 9110)
7. Scarfone, K., and Hoffman, P. (2009). Guidelines on firewalls and firewall policy (NIST SP 800-41 Rev. 1); Barker, E., Dang, Q., Frankel, S., Scarfone, K., and Wouters, P. (2020). Guide to IPsec VPNs (NIST SP 800-77 Rev. 1). csrc.nist.gov (SP 800-41); nist.gov (SP 800-77, PDF)
8. Stouffer, K., Pease, M., Tang, C., Zimmerman, T., Pillitteri, V., Lightman, S., Hahn, A., Saravia, S., Sherule, A., and Thompson, M. (2023). Guide to operational technology (OT) security (NIST SP 800-82 Rev. 3); Boeckl, K., Fagan, M., Fisher, W., Lefkovitz, N., Megas, K. N., Nadeau, E., Gabel O'Rourke, D., Piccarreta, B., and Scarfone, K. (2019). Considerations for managing Internet of Things (IoT) cybersecurity and privacy risks (NISTIR 8228). nist.gov (SP 800-82, PDF); nist.gov (NISTIR 8228, PDF)
9. Cisco Meraki. (n.d.). Fundamentals of 802.1Q VLAN tagging; Amazon Web Services. (n.d.). How Elastic Load Balancing works; PostgreSQL Global Development Group. (n.d.). Architectural fundamentals. meraki.com; docs.aws.amazon.com; postgresql.org

Two plans for one old server

Picture a ten-person architecture practice whose only server, six years old, sits in a closet. It holds 4 TB of drawings on a file share. It also runs a licensed archive program that works only on an older version of Windows Server, which no longer receives updates. The server must be replaced this year, and the two technicians who support the practice disagree about what should replace it.

The first says: move it all to the cloud. There will be no hardware to buy or replace, capacity can grow on demand, and a large provider keeps systems available better than a closet can. The second says: buy one new server and virtualize. The old program needs its old operating system, which a virtual machine can provide on site. Drawings opened all day from the cloud would add charges, and the office's single internet line would become something nobody can work without.

Both positions are credible, and both are argued in the vocabulary of Core 1 objectives 4.1 and 4.2. This lesson builds that vocabulary, weighs the evidence on each side, and ends with what would settle the question.

What a virtual machine is, and what it is for

NIST's guide to virtualization security (SP 800-125) defines virtualization as the simulation of the software or hardware that other software runs on. The simulated environment is a virtual machine (VM). A hypervisor controls the flow of instructions between each guest operating system and the physical processor, memory, storage and network cards. It can partition the system's resources and isolate the guests, so that each has access only to its own. The A+ objectives list these purposes:

Microsoft lists Windows Sandbox for the Pro, Enterprise and Education editions of Windows and notes that the Home edition does not support it. Desktop virtualization takes the idea further. In a virtual desktop infrastructure (VDI), users' desktops run as VMs on servers, and each user connects over the network from whatever device is at hand. Microsoft describes Azure Virtual Desktop as a desktop and app virtualization service that runs on Azure. It can give each user a single-session desktop or let many users share a multi-session one, and it can deliver full desktops or individual apps.

Two kinds of hypervisor

Remember: ask what sits directly on the hardware. If the hypervisor does, it is Type 1. If an ordinary operating system does and the hypervisor runs as a program on it, it is Type 2.

What a VM needs: security, network and storage

A VM still needs real resources. The host's processor must have its virtualization extensions switched on in firmware (Lesson 4), and the host needs enough memory for itself and for every guest running at once (Lesson 1). The objectives name three more requirements.

Security. NIST SP 800-125 warns that virtualization adds layers of technology that need their own controls. Combining many systems on one computer also means a larger impact if that computer is compromised. Features that make it easy to share information between host and guests can become an attack vector if they are not carefully controlled. NIST's first recommendation is to secure every element and keep it secure: hypervisor, host OS, each guest OS, applications and storage. That means patches, secure configuration baselines, and firewalls or antivirus in each guest, just as on a physical PC. NIST adds that even a bare metal host needs physical security, because someone who can reboot it may be able to alter the hypervisor's settings.

Network. Each VM gets a virtual network card, and the hypervisor decides what that card connects to. VirtualBox's modes show the usual choices:

Storage. A VM's hard disk is a file on the host, and VirtualBox offers two kinds. A fixed-size image is created at roughly its full capacity, so a 10 GB disk is a 10 GB file. A dynamically allocated image starts very small and grows each time a sector is written for the first time, up to the capacity chosen. Snapshots need space too. When one is taken, VirtualBox freezes the disk image and sends every later write to a second, differencing image. A host can therefore run out of disk space long after its VMs were created.

Containers: sharing the kernel

A container isolates an application without giving it a whole operating system. NIST's container security guide (SP 800-190) draws the line clearly. A VM gets hardware-level isolation from a hypervisor and includes a complete guest OS. With containers, multiple apps share the same OS kernel instance but are kept apart from each other. Each container starts from an image, a package that contains all the files required to run it. NIST's example is a web server image: the server program, its libraries and its configuration files, with every other OS function supplied by the host's kernel.

Three consequences follow. First, containers are OS-family specific: a Linux host can run only Linux containers, and a Windows host only Windows containers. Second, NIST concludes that container runtimes do not isolate as strongly as hypervisors, because the shared kernel is a larger attack surface. Third, containers are usually replaced rather than repaired. NIST explains that a container needing an update is destroyed and replaced by a new one built with the update, while traditional VMs are reconfigured and upgraded throughout their lives. NIST's diagrams also show containers running inside VMs, which combines the two.

Remember: a VM virtualizes the hardware and brings its own operating system. A container shares the host's kernel and brings only the application and what it needs.

Cloud models: who owns it and who runs what

The A+ cloud terms match those in NIST's definition of cloud computing (SP 800-145). That definition separates cloud computing from virtualization. NIST reserves the word cloud for services with five essential characteristics: on-demand self-service, broad network access, resource pooling, rapid elasticity and measured service. A few VMs on one office server are virtualization. They become a private cloud only when users can provision what they need themselves, from pooled capacity that is measured.

In all three, the provider manages the underlying cloud infrastructure. The higher the model, the more the provider manages on your behalf.

Cloud characteristics, with the numbers

• Shared resources and multitenancy. NIST's resource pooling means the provider's resources serve many consumers through a multi-tenant model, assigned and reassigned as demand changes. Customers generally cannot see or control exactly where their resources are, though they may choose a country, state or data center.
• Dedicated resources. Some workloads must not share hardware. Amazon's EC2 Dedicated Instances run on hardware dedicated to a single AWS account, physically isolated at the host level from other accounts' instances.
• Metered utilization. NIST's measured service means usage is metered, monitored and reported, typically for pay-per-use billing. Data transfer is metered by direction. Azure's bandwidth pricing makes inbound data transfer (ingress) free and charges for outbound transfer (egress). AWS gives each customer 100 GB of data out to the internet free each month, across all its services and regions except China and GovCloud, and bills per gigabyte beyond that.
• Elasticity. In NIST's words, capabilities can be provisioned and released, in some cases automatically, to scale outward and inward with demand.
• Availability. Providers state availability in a service level agreement (SLA). Amazon's compute SLA promises a single EC2 instance 99.5% monthly uptime. It promises 99.99% for a region when instances run across two or more availability zones, which AWS describes as isolated locations within a region. If AWS misses either figure, the remedy is a service credit on the bill.
• File synchronization. Sync clients keep a copy of cloud files on each device. Microsoft's OneDrive Files On-Demand shows every file in File Explorer without downloading it; online-only files take no space until opened.

The availability numbers repay a worked example. A 30-day month has 43,200 minutes. At 99.5%, up to 0.5% of them, 216 minutes or 3.6 hours, can pass with the server unavailable before a credit is owed. At 99.99%, the figure is about 4.3 minutes. An SLA does not promise that an outage will not happen; it promises a credit if one runs long.

Weighing the two plans

The case for the cloud rests on real characteristics. Elasticity means paying only for what is used when demand changes. Spreading servers across availability zones earns an SLA no closet can match, and file sync gives staff their drawings at home. There is also no hardware to replace in six years.

The case for virtualizing on site rests on facts just as real. The archive program needs its old operating system, and a Type 1 hypervisor on a new server can run it in an isolated VM. The drawings are large and opened constantly; from a public cloud, every download is metered egress beyond the free allowance. The office's one internet line would carry every file. And the practice's load is steady, so elasticity buys little.

Notice the common ground. The old program needs a VM either way, on site or as IaaS in a cloud. Either way its unsupported operating system must be isolated, as Lesson 15 explained for systems that cannot be patched. What would settle the rest is measurement, not opinion:

1. How much data would leave the cloud each month, and what would that egress cost?
2. Is demand steady, or does it spike, as at a deadline?
3. What does an hour of downtime cost the practice, and which option's availability covers it?
4. Does the archive program's vendor support and license it in a VM, and in a public cloud?
5. Do clients' contracts or regulations limit where the drawings may be stored?

Many small offices end with a mix: SaaS for email and file sync, and a small on-site hypervisor for the legacy program and the heaviest files.

Common misconceptions

• "Virtualization and cloud computing are the same thing." NIST defines cloud by five characteristics. VMs on one server are virtualization until self-service, pooling and metering are added.
• "A container is just a small VM." It shares the host's kernel, so a Linux container needs a Linux kernel, and its isolation is weaker than a hypervisor's.
• "Windows Sandbox keeps what I install for next time." Everything in it is discarded when it closes.
• "Downloading from the cloud costs the same as uploading." Ingress is free at Azure; egress is metered, with AWS giving only the first 100 GB a month free.
• "A 99.99% SLA means the service never goes down." It promises credits when missed, and AWS's 99.99% applies only across two or more availability zones; one instance gets 99.5%.
• "A private cloud has to be in our own building." NIST allows a private cloud to be run by a third party, on or off premises.

Putting it together

• VMs serve as sandboxes (Windows Sandbox discards everything), test beds (snapshots), homes for legacy software and OSs, and cross-platform tools (WSL 2, VirtualBox); VDI delivers whole desktops from servers.
• Type 1 hypervisors run directly on the hardware (Hyper-V); Type 2 run on a host OS (VirtualBox).
• VM requirements: virtualization extensions on and enough memory; every layer secured; the right network mode (NAT, bridged, internal, host-only); disk space planned for growing images and snapshots.
• Containers share the host's kernel: OS-family specific, replaced rather than patched, and less isolated than VMs.
• Deployment models: private, community, public, hybrid. Service models: IaaS (you run the OS), PaaS (you run the application), SaaS (you use the application).
• Characteristics: shared or dedicated resources, multitenancy, metered use with free ingress and billed egress, elasticity, availability set by SLAs and zones, and file synchronization.

Sources

1. Mell, P., and Grance, T. (2011). The NIST definition of cloud computing (NIST SP 800-145). National Institute of Standards and Technology. csrc.nist.gov
2. Scarfone, K., Souppaya, M., and Hoffman, P. (2011). Guide to security for full virtualization technologies (NIST SP 800-125); Souppaya, M., Morello, J., and Scarfone, K. (2017). Application container security guide (NIST SP 800-190). csrc.nist.gov (SP 800-125); csrc.nist.gov (SP 800-190)
3. Oracle. (2026). Oracle VirtualBox user guide: Introduction; Virtual networking; Virtual storage. virtualbox.org (introduction); virtualbox.org (networking); virtualbox.org (storage)
4. Microsoft. (n.d.). Hyper-V architecture; Windows Sandbox; What is the Windows Subsystem for Linux?; What is Azure Virtual Desktop? Microsoft Learn. learn.microsoft.com (Hyper-V); learn.microsoft.com (Sandbox); learn.microsoft.com (WSL); learn.microsoft.com (Azure Virtual Desktop)
5. Microsoft. (n.d.). Bandwidth pricing; Save disk space with OneDrive Files On-Demand for Windows. azure.microsoft.com; support.microsoft.com
6. Amazon Web Services. (n.d.). Amazon EC2 Dedicated Instances; Regions and Zones; Amazon Compute Service Level Agreement; Amazon EC2 On-Demand pricing. docs.aws.amazon.com (Dedicated Instances); docs.aws.amazon.com (zones); aws.amazon.com (SLA); aws.amazon.com (pricing)
7. Canonical. (n.d.). Docker for system admins. Ubuntu Server documentation. ubuntu.com

Tuesday, 2:15 pm: the front-desk PC switches off again

For the third afternoon in a row, the computer at the front desk of a small dental practice has switched itself off without warning. The receptionist lost a half-finished appointment schedule each time. Dana, the practice's part-time technician, has heard this kind of ticket called "the PC is acting up," and she knows that phrase is where troubleshooting starts, not where it ends.

CompTIA prints a six-step troubleshooting method alongside the Core 1 and Core 2 objectives. The objectives document is frank that the method itself is not tested on the V15 exams, but that troubleshooting in the context of the job very much is. Every scenario question in this module rewards the habit, so this lesson follows Dana through one ticket, step by step, and then reads the rest of objective 5.1's symptom list. In our words, the six steps are:

1. Identify the problem.
2. Form a theory of probable cause, starting with the obvious, and research where it helps.
3. Test the theory to find the cause.
4. Plan the fix, then carry it out.
5. Verify that the whole system works, and prevent a repeat where you can.
6. Document what you found, what you did and how it turned out.

Identifying the problem: the user, the timing and the logs

Dana starts with the person, not the PC. When does it happen? Always after lunch, the receptionist says, usually while the practice's X-ray viewing software is open. What does she see? The screen goes black and the fans stop; there is no error message. Does it come back? Yes, if she presses the power button a minute later. Has anything changed? Only that the office turned the heating up for winter. Dana writes the answers down word for word.

Then she reads the PC's own account. In Event Viewer, under Windows Logs and System, she finds three critical events from the source Kernel-Power, Event ID 41: "The system has rebooted without cleanly shutting down first." Each one has a BugcheckCode of 0. Microsoft's guide to this event explains what that zero means. If no stop error code was recorded, Windows probably had no chance to write one, which can indicate a power supply problem. The causes it lists include a drained laptop battery, a power outage or unplugged cord, and a power supply that is underpowered or faulty. The same guide tells administrators to check for overheating.

In short: by the end of step 1, Dana knows the symptom (a sudden power-off with no crash screen), the pattern (afternoons, under load) and one change (a warmer room). She has not yet touched a screwdriver.

Forming a theory: question the obvious, then research

The obvious causes come first because they are cheap to rule out. Is the power cord seated at both ends? Is the PC on a power strip that someone's foot can switch off? Is a space heater on the same circuit? Dana checks: the cord is tight, the strip is a surge protector mounted out of reach, and the heater is across the room.

Research narrows the rest. Intel's guide to overheating in its boxed processors lists the symptoms: the system boots but shuts down automatically after a short time; the processor runs at a lower frequency than expected, or shows evidence of throttling; the system is generally slow; and the fan is excessively noisy. The receptionist had mentioned that the PC "gets loud and slow" before it dies. Dana's theory: the processor is overheating under the afternoon load, and its thermal protection is switching the PC off.

Testing the theory: speed, temperature and dust

A theory is only useful if a test could prove it wrong. Dana opens the X-ray software and watches Task Manager's Performance tab. Within fifteen minutes the processor's reported speed falls well below its base speed, while the fan rises to a roar. In firmware setup, the hardware monitor (Lesson 4) shows the CPU temperature climbing fast even at idle.

Then she shuts the PC down, unplugs it, grounds herself as Lesson 2 describes, and removes the side panel. The tower sits on carpet under the desk, its front vents a few inches from a box of printer paper. The heatsink's fins are matted with dust, and the CPU fan spins slowly and unevenly when she nudges it. The theory is confirmed. Had it not been, she would have gone back to step 2 with a new theory. If she ran out of theories, or the fix needed authority she did not have, she would escalate to a senior technician or the vendor, with her notes.

Planning and carrying out the fix

A plan names the work, the parts, the time and the people it affects. Dana orders a matching CPU fan, books the work for after the last patient, and tells the office manager the front-desk PC will be down for an hour. She also confirms that the appointment system stores its data on the server, not on this PC.

That evening she follows Intel's troubleshooting list. She blows the dust out of the heatsink with compressed air, away from the other desks. She replaces the worn fan and makes sure its power cable is firmly connected and clear of the blades. The thermal paste between processor and heatsink has dried to a crust, so she cleans both surfaces and applies fresh paste, taking care, as Intel advises, to use the right amount. She checks that the cooler is mounted evenly and that cables do not block the airflow.

Verifying, preventing and documenting

Replacing a part is not the same as fixing the problem. The next morning Dana runs the X-ray software for an hour and watches the results. The processor holds its full speed, the fan stays quiet and no new Event ID 41 appears. Then she makes a repeat less likely. The tower moves off the carpet onto a small stand with clear space in front of the vents. A six-month dust check goes on the office maintenance list, and she inspects the two other PCs bought the same year.

Finally she documents the ticket so that the next technician, or Dana herself in a year, does not start from zero:

• Symptom: sudden power-offs in the afternoon under load; no crash screen; Event ID 41 with BugcheckCode 0, three times in three days.
• Cause: CPU overheating: dust-clogged heatsink, failing fan, dried thermal paste, blocked intake.
• Action: cleaned heatsink, replaced fan, renewed thermal paste, moved tower off the carpet.
• Result: one hour under load at full speed, no shutdowns. Six-month cleaning scheduled; two similar PCs checked.

In short: the method protects you from your first guess. Dana's first instinct, a failing power supply, matched the log but not the noise, the slowdown or the dust.

The rest of objective 5.1: reading the symptoms

Objective 5.1 lists the symptoms of motherboard, memory, processor and power faults. Each points to a short list of causes and a first check.

Beeps, lights and crash screens

Before a PC can show anything on screen, its firmware runs the power-on self-test (POST). When that test fails early, the only way to report it is a sound or a light. Dell's laptop table shows how specific the codes are: 2 beeps mean no memory detected, 4 a memory failure, 5 a real-time clock power failure (the CMOS battery), 6 a video failure and 7 a processor failure. Many desktop boards use lights instead. ASUS boards with Q-LEDs have four, for CPU, DRAM, VGA and BOOT; a light that stays on points to a missing or faulty part. For a DRAM light, ASUS's steps are to reseat the memory, clean the contacts, use modules from the board's supported list, and try one module at a time. Codes differ between makers and models, so always look them up for the exact machine.

Once the operating system is running, a fatal error produces a proprietary crash screen. Windows shows "Your device ran into a problem and needs to restart," with a stop code such as MEMORY_MANAGEMENT. Microsoft's support page still calls this a Blue Screen error, or a Black Screen error, because the screen's color and wording vary with the Windows 11 version. Microsoft says the cause might be a hardware device, its driver or software. Its first steps are to remove any newly added hardware, check Device Manager for flagged devices, keep 10 to 15% of the drive free and install updates. A Mac that restarts with a message that it restarted because of a problem has had a kernel panic. Apple says the most likely cause is faulty software, but damaged or incompatible hardware, including external devices, can also cause one.

Symptoms that mean stop now

Two symptoms change the order of the method, because safety comes before diagnosis. A burning smell means a component may be failing electrically: shut the PC down, unplug it and do not power it on again until you have found the source. If the source is the power supply, it is replaced, never opened (Lesson 2). Capacitor swelling is the other. In 2003 IEEE Spectrum reported that capacitors made with a faulty electrolyte had been breaking open in desktop PCs throughout 2002. These were the aluminum electrolytic capacitors that smooth the power supplied to chips, and the bad formula generated hydrogen gas until they burst and leaked onto the board. A bulging or leaking capacitor means the board or power supply will fail. For a support technician the fix is a replacement part, with the data backed up first, not a soldering iron.

The clock is the gentlest symptom. Lenovo's documentation explains that a coin-cell battery keeps the date, time and firmware settings while the computer is off, and that when it fails, the date and time are lost and an error appears at startup. A clock that is wrong only after the PC has been unplugged points to that battery. A clock that drifts while the PC runs points instead to time synchronization (Lesson 15).

Common misconceptions

• "The method is on the exam as a list to memorize." CompTIA states that the method is not tested on V15, but scenario questions reward its order: gather facts, test before fixing, verify, document.
• "It restarted fine, so the ticket is closed." Repeated Event ID 41 entries say otherwise. Verify under the conditions that caused the fault.
• "A crash screen always means bad hardware." Microsoft names drivers and software as causes too, and Apple calls faulty software the most likely cause of a kernel panic.
• "Beep codes mean the same on every PC." They vary by maker and model. Look them up for the exact machine.
• "Swapping parts until it works is troubleshooting." Change one thing at a time, so that you know which change fixed the fault.

Where this leaves us

• Six steps: identify the problem, form a theory (obvious first, then research), test it, plan and fix, verify and prevent, document. CompTIA does not test the list, but its scenario questions reward the habit.
• Event ID 41 with a zero bug check code suggests power or overheating; Intel's overheating signs are shutdowns, low clock speed, throttling, slowness and fan noise.
• POST beeps and Q-LEDs report faults before video works; codes are maker-specific.
• Windows stop codes and Mac kernel panics come from drivers and software as well as hardware; undo the latest change first.
• A burning smell or swollen capacitors mean stop and replace; a clock lost while unplugged means the coin-cell battery.

Sources

1. CompTIA. (2024). CompTIA A+ 220-1201 V15 certification exam objectives (Exam objectives document version 4.0), Troubleshooting methodology knowledge and objective 5.1. comptia.org (PDF)
2. Microsoft. (n.d.). Advanced troubleshooting for Event ID 41: "The system has rebooted without cleanly shutting down first"; Troubleshooting Windows unexpected restarts and stop code errors. learn.microsoft.com; support.microsoft.com
3. Intel Corporation. (n.d.). Overheating symptoms and troubleshooting for Intel boxed processors (Support article 000005791). intel.com
4. Dell Technologies. (n.d.). Dell laptop beep codes and LED diagnostic codes (Knowledge base article 000132041); ASUSTeK Computer. (2026). ASUS motherboard troubleshooting via Q-LED indicators (FAQ 1042678). dell.com; asus.com
5. Apple. (n.d.). If your Mac restarts and a message appears. Mac User Guide. support.apple.com
6. Lenovo. (n.d.). Coin-cell battery [Desktop user guide topic]. lenovo.com
7. Moore, S. K., and Chiu, Y.-T. (2003, February 1). Leaking capacitors muck up motherboards. IEEE Spectrum. spectrum.ieee.org

A beeping storage box and a confident plan

At 7:50 on a Monday, the network storage box (NAS) in a small law office is beeping. It holds four drives in RAID 5, and one drive bay's status light is flashing amber. The office manager has a plan, and it sounds reasonable. "RAID 5 survives one failed drive, so our files are safe. Mute the beeping, pull out the drive with the orange light so it stops complaining, and we'll order a new drive this week."

Every clause of that plan contains a mistake that has cost real offices their data. This lesson is built the way a technician debugs: take the plausible answer, find exactly where its reasoning breaks, and fix that step. Then it applies the same habit to every other symptom in Core 1 objective 5.2. Lesson 5 explained the RAID levels; here they go wrong.

Bug 1: "Our files are safe"

Half true, which makes it dangerous. Dell's guide to its PERC RAID controllers defines the state precisely: a redundant virtual disk is degraded when one or more of its physical disks have failed or are inaccessible. Synology's documentation adds that a degraded storage pool remains accessible because no data loss has occurred. Notice the word yet, which neither says out loud. A degraded RAID 5 array has spent its only margin. One more failed drive, and the array is gone.

And RAID was never a backup (Lesson 5). It protects against a drive failing, not against deletion, ransomware or a second failure. So the first action on a degraded array is the one the plan left out: copy the important data somewhere else now, while every file can still be read.

Bug 2: "Mute it and order a drive this week"

Muting is fine; waiting is not. Synology's article on a beeping NAS sends the technician to the reason first: its Beep Control setting shows the reason for the current beep. The reasons include a degraded volume, a crashed volume, an abnormal SSD cache and a failing cooling fan. Only then does it explain how to mute. Silence removes the warning, not the fault. Every day the array runs degraded is another day in which a second failure ends it.

This is also where a hot spare earns its keep. Synology notes that drives assigned as hot spares repair a degraded pool automatically. Dell describes the same behavior: when a disk fails, an assigned hot spare is put to work and rebuilding begins until the array is back to optimal. An office with a hot spare would have been rebuilding before anyone heard the beep.

Bug 3: "Pull the drive with the orange light"

Which light, exactly? In a dim closet, the bays look alike, and a technician who pulls the wrong one removes a healthy member from an array that has no margin left. Synology's own instructions say to confirm which drive is defective on the NAS's drive page before removing anything. Dell's drive carriers have an identify mode for the same purpose: the status light flashes green twice per second when a drive is being identified or prepared for removal.

What happens if the wrong drive comes out? Synology's article on crashed volumes lists accidental removal of a drive as one of the causes. Its first instruction is to insert the removed drive back immediately, so the system can reassemble the pool. A volume that crashed from drive errors, it warns, cannot be repaired at all.

Status lights also say more than "broken." Dell's table for its server drive carriers shows how much one light can carry:

Other makers use other patterns, so read the code table for the exact device before acting.

Bug 4: "Any new drive will do"

Synology's repair instructions set the rules. For RAID 1, 5, 6 and 10, the replacement must be at least as large as the smallest drive in the pool. Any data already on the replacement is erased. If the unit cannot hot-swap, power it off before changing drives. Then start the repair. Dell's guide states the goal: once the rebuild completes, the virtual disk's state changes from degraded back to optimal.

The rebuild itself is a risky time in the array's life. The remaining drives work their hardest to re-create the missing data, and they are usually as old as the one that failed. That is why the backup in bug 1 comes first, and why Lesson 5 recommended RAID 6 for arrays that must survive a second failure during a rebuild.

The upshot: treat a degraded array as a countdown. Back up, read the reason, identify the right drive, replace it with a large enough one, rebuild, and only then relax.

The same mistake, symptom by symptom

Each symptom in objective 5.2 has a tempting move that makes things worse. The better move protects the data first.

On Windows, the first two checks need no extra tools. In PowerShell, Get-PhysicalDisk lists every physical disk with its health status. Microsoft documents Get-StorageReliabilityCounter as reporting each disk's temperature, errors, wear and hours in use.

Why a fast drive can be slow: IOPS

IOPS (input/output operations per second) counts how many separate reads or writes a drive completes each second. It matters most for small, scattered requests, such as a database looking up records. Throughput, in megabytes per second, matters most for large files read from start to finish. A hard drive is good at the second and poor at the first, because each scattered request waits for the heads to move and the platter to turn.

Seagate's data sheet for its Exos X10 enterprise hard drive shows the gap. The drive is rated to sustain 249 MB/s on large transfers, yet only 170 random 4K reads per second, with an average latency of 4.16 ms. Small random requests on a busy hard drive therefore pile up, and Task Manager shows the disk at 100% active while copies of large files still run quickly. A solid state drive, with no moving parts, handles that workload far better. That is why "the server got slow" on an aging hard drive is often an IOPS problem, not a network one. A failing drive retrying its reads, or an array busy rebuilding, can produce the same symptom.

Common misconceptions

• "A degraded array is safe." It is readable, but it has lost its protection. Back up and replace now.
• "Amber means the drive is dead." On Dell carriers, green-amber-off means a predicted failure, and fast amber means failed. Read the code.
• "Initialize the disk and the files will appear." Initializing and formatting are for empty disks. On a disk with data, they are the last step of data loss.
• "A foreign configuration is junk to clear." It is the array's own description. Import it when all members are present.
• "Every clicking drive is failing." Seagate notes that soft clicking can be normal; hard, metal-on-metal clicking is the warning.

Pulling it together

• Degraded means one failure from loss: back up, read the reason, identify the right drive, replace it with one at least as large as the smallest member, rebuild.
• Hot spares start the rebuild automatically; RAID 6 survives a second failure during a rebuild.
• Status lights, S.M.A.R.T. warnings and audible alarms are early warnings: act on them before the array or drive fails.
• Bootable device not found: check that firmware sees the drive and the boot mode (UEFI) before replacing anything.
• Missing or Not Initialized disks and missing arrays: never initialize, format or clear a disk or configuration that holds data.
• Low IOPS on hard drives explains slow databases that still copy large files quickly.

Sources

1. Dell EMC. (n.d.). Dell EMC PowerEdge RAID Controller (PERC) 10 user's guide: Degraded state of virtual disks; SMART errors; Foreign configuration found; Disk carrier LED indicators; Hot spares. dell.com (PDF)
2. Synology. (n.d.). Repair a storage pool; (2023). My Synology NAS keeps beeping. What can I do?; (2026). What can I do if one of my volumes crashed? Synology Knowledge Center. synology.com (repair); synology.com (beeping); synology.com (crashed volume)
3. Microsoft. (n.d.). Troubleshoot Disk Management; chkdsk; Get-PhysicalDisk; Get-StorageReliabilityCounter. Microsoft Learn. learn.microsoft.com (Disk Management); learn.microsoft.com (chkdsk); learn.microsoft.com (Get-PhysicalDisk); learn.microsoft.com (reliability counters)
4. Seagate Technology. (n.d.). The drive is making "clicking" sounds (LaCie knowledge base 006281); (2017). Exos X10 data sheet. seagate.com (clicking); seagate.com (Exos X10)
5. Dell Technologies. (n.d.). Resolve No Bootable Device Found error in Legacy mode on Dell computers (Knowledge base article 000128655). dell.com

Twenty minutes before the board meeting

It is 8:40, and the board meets at 9:00 in the conference room. The projector says "No Signal." Once a picture does appear, it is fuzzy, stretched and wider at the top than the bottom. Down the hall, the multifunction printer has produced fifty copies of the agenda with a dark line down every page. Twelve more jobs sit in the queue and will not move. Nothing here needs a new part yet. Each symptom has a short list of causes, and the order you check them in is the whole skill.

Core 1 objective 5.3 lists video, projector and display symptoms, and objective 5.6 lists printer symptoms. This lesson works through the conference room first, then the monitors on people's desks, then the printer. Each step uses the maker's own troubleshooting guide, because that is where a technician looks.

"No Signal": input source and cabling

A projector or monitor showing "No Signal" is usually healthy and simply looking at the wrong input, or at an input with nothing on it. Epson's user's guide for its BrightLink Pro 1420Wi and 1430Wi projectors gives the order. Press Source Search and wait a few seconds. Make sure the computer or video source is on. Check the connection from the projector to the source. If the source is a laptop, make sure it is set to display on an external monitor (Windows logo key + P on a Windows laptop). Only then turn the projector and the source off and on again.

Physical cabling faults show up as no picture, an intermittent picture or wrong colors. Epson's advice for incorrect colors includes making sure every cable is securely connected and, if long cables are in use, trying shorter ones. Lesson 6 covers which cables carry what. Remember that a USB-C port carries video only if it supports DisplayPort Alternate Mode.

Fuzzy, distorted and wrongly sized images

A fuzzy image from a projector usually needs focusing, but Epson lists less obvious causes. One is condensation on the lens after the projector comes in from the cold, so let it warm to room temperature. Others are a projector placed too far from the screen, or at so steep an angle that keystone correction distorts the image. If the source is a computer, Epson suggests the Auto button and, failing that, a lower resolution.

A distorted image, wider at one end like a trapezoid, comes from projecting at an angle. Epson's fix is to place the projector squarely in front of the center of the screen if possible. If the feet have tilted it, use the keystone adjustment to square the image.

Sizing issues are usually a resolution mismatch. Microsoft advises keeping the display resolution marked Recommended, the panel's native resolution (Lesson 7). It explains that a lower resolution makes text less sharp, and can leave the picture small, centered on the screen, edged with black, or stretched. On a projector, Epson adds the Aspect button and checking that the computer's resolution is within the projector's limits.

Dim images, lamps and shutdowns

Projector lamps fade with use. Epson's guide notes that an image that has been getting progressively darker may mean the lamp needs replacing soon. Before blaming the lamp, check whether an ECO power setting is dimming it, and try a brighter color mode. A burnt-out bulb announces itself on the status lights. On the BrightLink, an orange Lamp light means the lamp has a problem: check whether it is burned out, broken or installed incorrectly, then reseat or replace it. A flashing orange Lamp light means replace the lamp soon, and Epson says not to keep using the projector.

An intermittent shutdown is usually heat. When the BrightLink's Temp light turns orange, the projector has overheated and turned itself off. Epson's steps are to leave it off to cool for about five minutes, then make sure the vents and air filter are not clogged with dust or blocked, and clean or replace the filter. At high altitude, turn on High Altitude Mode. A projector that turns its lamp off after a period of inactivity, with no warning lights, has simply gone to standby.

Audio issues follow the same path as the picture. Epson's list starts with the projector's volume and the A/V Mute button, then the input source. Next comes the computer's own audio output, which must be set to the projector. For HDMI sources, it suggests setting the connected device to PCM output.

Worth holding on to: read the status lights before opening anything. The maker has already done half the diagnosis for you.

Monitor faults: pixels, burn-in, flashing and color

Dell's display pixel guidelines define the two pixel faults. A bright pixel, also called a stuck pixel, has all three subpixels permanently on. A dark pixel, a dead pixel, has all three permanently off and shows as a black dot on a white background. Dell says not to try fixing them yourself, warning against pixel-fixing software and pressing on the screen, which can damage the display. Whether a pixel fault earns a replacement depends on the maker's policy. Dell counts only faults visible at normal viewing distance, about 35 to 50 cm for a desk monitor. On eligible models, its Premium Panel Exchange replaces a display for even one bright pixel during the warranty.

Burn-in is the permanent ghost of an image left on screen for too long, the risk Lesson 7 described for OLED panels showing fixed elements such as taskbars. The fix is prevention: screen savers, dimming, hiding fixed elements, and the panel's own maintenance cycles.

A flashing screen has a neat test from Microsoft. Open Task Manager. If Task Manager flickers along with everything else, the display driver is probably the cause; update, roll back or reinstall it. If Task Manager stays steady while the rest flickers, an app is the cause. Microsoft also suggests Windows logo key + Ctrl + Shift + B to reset the graphics driver. A loose or damaged cable can also make the picture flash, so reseat the cable first.

Incorrect color display on a monitor starts with the same cable checks. Then check the display's color mode or picture preset, and any color profile or input-signal setting that has been changed. Epson's projector advice applies to any display: try the color modes, check the input signal setting, and look at brightness, contrast and color controls before replacing anything.

The printer: reading the page

A printed page is evidence. HP's guides for its LaserJet Enterprise printers start every image defect the same way. Reprint the document, because some defects are intermittent. Check the cartridge's remaining life. Make sure the driver and tray settings match the paper loaded, and that the room is within the printer's temperature and humidity range. Then read the defect itself.

HP also says to inspect the cartridge's imaging drum without touching it, and to replace the cartridge if the drum is scratched or marked. A fingerprint on the drum is itself a print defect.

The printer: paper, finishing and trays

• Paper jams. HP's list for frequent jams is mostly about the paper and the tray. Use paper that meets the specifications and is not wrinkled, folded, damaged or previously printed. Do not overfill the tray, adjust the guides to touch the stack without bending it, and push the tray fully in. Check that the tray is configured for the paper's type and size.
• Paper not feeding. Remove any jammed sheet, load the correct size, set the size and type on the control panel, adjust the guides, and check whether the printer is waiting for a manual-feed prompt. HP adds that the rollers above the tray may be dirty and can be cleaned with a lint-free cloth dampened with warm water.
• Multipage misfeed. When several sheets feed at once, HP says to remove the stack, flex it, rotate it 180 degrees and flip it over. It also says not to fan the paper. Use undamaged paper that meets specifications, and do not overfill the tray.
• Finishing issues. For staple jams, HP's stapler/stacker has a removable staple cartridge with a cover that opens to free the jammed staple. After clearing a jam, the first few documents may not be stapled while the stapler reloads. Jobs still print if the stapler is jammed or empty. A hole punch that misbehaves is checked the same way: the finisher's messages, the job's settings and the paper's orientation.
• Incorrect page orientation. Orientation is set in the driver; HP's drivers put it on the Finishing tab. Paper with a printed letterhead must also be loaded the way the tray's orientation table shows.
• Tray not recognized. First check that the tray is fully inserted and configured in the printer's Trays menu. If the printer sees the tray but the computer's print dialog does not offer it, the driver does not know it is installed. Set the installed options in the printer's properties on the computer.
• Grinding noise. A grinding sound is mechanical. Turn the printer off, open its doors and look for a foreign object, such as a paper clip, in the paper path. If the noise continues, the gears or rollers need a service technician.

The queue and the network

Multiple prints pending in the queue and a frozen print queue are usually the Windows print spooler, not the printer. Microsoft's steps are to stop the Print Spooler service in Services and delete the files in the folder %WINDIR%\system32\spool\PRINTERS. Then start the service again, with its startup type set to Automatic. Do this on the computer that hosts the queue; on a shared print server, every user's waiting jobs go too.

Connectivity issues follow HP's network checklist, which a technician can run in a few minutes. Print a configuration page to learn the printer's IP address. Check that the cable is secure and the port's link light is lit. Then check that the computer's printer port uses that address, and ping the address from the computer. HP points out that if the printer's address changes, a port configured with the old address stops working. That is a strong reason to give printers a DHCP reservation (Lesson 15).

Back in the conference room

At 8:41 the technician pressed Source Search: the projector had been set to a different HDMI input. The laptop was set to duplicate its display, and its resolution was set to one within the projector's limits, which cured the stretching. Keystone correction squared the image, and the focus ring sharpened it. At the printer, the dark line survived a reprint but disappeared after a cleaning page. The frozen queue cleared once the spooler on the print server was restarted, after a warning to the other users. Every fix came from the maker's own list, checked in order, cheapest first.

Common misconceptions

• "No Signal means the projector is broken." It usually means the wrong input, a source that is off, or a laptop not sending video to an external display.
• "Massage a dead pixel back to life." Dell warns that pressure and pixel-fixing software can damage the display; check the warranty policy instead.
• "Fan the paper to stop double feeds." HP says to flex, rotate and flip the stack, and not to fan it.
• "A stuck queue means a broken printer." Clearing and restarting the Windows print spooler usually frees it.
• "A projector that shuts itself off needs a new lamp." An orange Temp light means overheating: clean the filter and vents first.

Summing up

• Displays: input source and cabling first; focus, keystone, aspect and native resolution for fuzzy, distorted or wrongly sized images.
• Projectors: progressive dimming or a Lamp light means the lamp; a Temp light means heat, so clean the filter and vents.
• Monitors: stuck and dead pixels follow the maker's policy; burn-in is prevented, not fixed; the Task Manager test separates driver flicker from app flicker.
• Print defects: lines, fading and specks are toner, drum or cleaning issues on lasers, and nozzles on inkjets; echo images are fusing; garbled print is the driver.
• Paper handling: paper condition, guides and tray capacity explain most jams and misfeeds; flex, rotate and flip, never fan.
• Queues and connectivity: reset the spooler; check the printer's address, link and ping.

Sources

1. Seiko Epson. (n.d.). BrightLink Pro 1420Wi/1430Wi user's guide: Solving problems (projector light status; "No Signal"; image not rectangular; fuzzy or blurry image; brightness and colors; sound; partial image; power and shut-off). epson.com (user's guide); epson.com (light status)
2. Microsoft. (n.d.). Troubleshoot screen flickering in Windows; Change your screen resolution and layout in Windows; Fix printer connection and printing problems in Windows. Microsoft Support. support.microsoft.com (flickering); support.microsoft.com (resolution); support.microsoft.com (printing)
3. Dell Technologies. (n.d.). Dell display pixel guidelines (Knowledge base article 000126004). dell.com
4. HP Development Company. (2017). LaserJet Enterprise M604, M605, M606 user guide: Solve problems; (n.d.). HP Color LaserJet Enterprise M554, M555 user guide: Troubleshoot image defects; Solve wired network problems. hp.com (M604, PDF); hp.com (M554, PDF)
5. Seiko Epson. (n.d.). ET-2800/ET-2803 user's guide: Print head nozzle check. epson.com (PDF)

"People sound like robots"

The ticket from a twelve-person accountancy reads: "Teams calls from the back office keep breaking up. People sound like robots." Network complaints arrive in words like these, and the technician's job is to turn them into numbers. Microsoft's own guidance for Teams makes the link: calls with static, calls that cut out and voices that sound like robots could be jitter or packet loss.

Core 1 objective 5.5 lists the network symptoms a support technician meets. This lesson works one ticket end to end as a procedure. Then it changes one input and shows how the same complaint leads somewhere else entirely. It closes with the rest of the symptom list. The physical tools, from cable testers to Wi-Fi analyzers, are Lesson 6's; the addressing is Lesson 13's.

The three numbers that decide call quality

• Latency is delay: how long a packet takes to arrive. Ping reports it as round-trip time.
• Jitter is the variation in that delay from packet to packet. Voice is sent as a steady stream, so uneven arrival breaks it up even when the average delay is fine.
• Packet loss is the share of packets that never arrive. Voice uses UDP (Lesson 11) and cannot wait for a resend.

Microsoft publishes targets for Teams media over the complete path from a client to its network edge, including Wi-Fi, the office network and the internet connection:

Two built-in Windows commands do most of the measuring. ping sends echo requests and reports each reply's time; Microsoft documents ping /t as continuing until interrupted. pathping, Microsoft explains, sends echo requests to each router between source and destination over a period of time. It then shows the packet loss at each router or link, so you can see where along the path the problem lives.

Procedure one: a choppy call on Wi-Fi

1. Scope it. Who is affected, where and when? Only the four people in the back office, on laptops, worst around lunch. The front office, also on Teams, is fine. The pattern already points inside the building.
2. Measure from an affected laptop. Run ping -n 100 to the default gateway, then to a public address. The gateway replies swing between 3 ms and 190 ms, with 4 packets lost out of 100. A wired PC in the front office pings the same gateway at 1 ms with no loss.
3. Compare with the targets. Delay swinging by more than 150 ms means jitter far above 30 ms, and 4% loss is four times the 1% limit. The trouble is on the laptop's first hop, the wireless link, before any internet provider is involved.
4. Find the cause. netsh wlan show interfaces shows the laptops on the 2.4 GHz band, channel 6, with middling signal. The break room's microwave oven sits against the back office wall. Cisco Meraki's list of common interference sources begins with microwave ovens, followed by cordless phones and Bluetooth devices. A Wi-Fi analyzer shows two neighbors' networks on channel 6 as well.
5. Fix it. Microsoft's advice for Teams over Wi-Fi is that the 2.4 GHz band is often affected by other consumer devices, while 5 GHz is better suited to real-time media. It also recommends quality of service, or Wi-Fi Multimedia (WMM), to prioritize media. The technician moves the laptops to the office's 5 GHz network and turns on WMM.
6. Verify. The same 100 pings to the gateway now range from 2 to 9 ms with no loss, and a test call at lunchtime stays clear. The ticket notes record the before-and-after numbers.

So what?: measuring the first hop separately from the internet split the problem in half at once. Without the numbers, the obvious culprit, the internet provider, would have taken the blame.

Procedure two: the same complaint, a different cause

Now change one input. The robotic calls come from a desk phone plugged into the wall, not a laptop on Wi-Fi.

1. Scope it. One phone, all day, worse at random moments.
2. Measure. The phone has no ping, so the technician reads the switch. Its log shows the port for that desk losing link and regaining it every few minutes. This is port flapping. The port's error counters also show CRC errors climbing.
3. Find the cause. Cisco's guide to switch port problems explains that a port that constantly flaps, losing and regaining link, can be caused by a marginal cable. It says such a cable can be just good enough to connect while corrupting packets. The same guide lists a faulty network card and a duplex mismatch among the causes. In a duplex mismatch, one end is set by hand while the other auto-negotiates, and Cisco warns of extremely slow performance, intermittent connectivity and loss of connection. Late collisions on a port usually indicate a duplex mismatch.
4. Fix it. A cable tester (Lesson 6) shows a split pair in the patch cable. A new cable goes in, and the technician confirms that both ends auto-negotiate, as Cisco recommends: auto on both sides, or the same manual setting on both.
5. Verify. A day later the switch log shows no further link changes and the error counters have stopped rising.

So what?: the user's words were identical in both tickets. The measurement, Wi-Fi delay in one and switch-port events in the other, decided the fix.

The rest of objective 5.5

Two of these deserve a sentence more. For authentication failures on Wi-Fi after a password change, Microsoft's first steps are to forget the network in Settings under Manage known networks, then reconnect with the new password. For staff whose calls lag only on a VPN, Microsoft notes that VPNs are typically not designed for real-time media. A VPN can add a layer of encryption and route traffic to a more distant point, adding latency and jitter. Its recommendation is split tunneling, so that Teams media bypasses the VPN.

Restarting the modem and router, which Microsoft also lists, disconnects everyone briefly. It is a reasonable step at home, but in an office it needs a warning first.

Common misconceptions

• "Slow calls mean a slow internet plan." Jitter and loss on the first Wi-Fi hop break calls on any plan. Measure the gateway before blaming the provider.
• "Average latency is all that matters for voice." A steady 70 ms works; a link swinging between 3 and 190 ms does not. Jitter matters.
• "Setting the adapter to a fixed speed makes it faster." One manual end against one auto-negotiating end causes a duplex mismatch. Use auto on both, or the same manual setting on both.
• "A port that keeps reconnecting is a switch fault." Cisco names the marginal cable first.
• "Restarting the router fixes everything." It may hide the cause and disconnects every user; measure first.

Looking back

• Latency is delay, jitter is its variation, loss is packets that never arrive. Microsoft's complete-path targets for Teams: under 100 ms round trip, under 30 ms jitter, under 1% loss.
• ping (and ping /t) measures one path; pathping shows loss at each hop; ping the gateway first to split local faults from provider faults.
• 2.4 GHz suffers interference from microwave ovens, cordless phones, Bluetooth and neighbors; 5 GHz suits real-time media.
• Port flapping and CRC errors point to cables, network cards or duplex mismatches.
• Limited connectivity with a 169.254 address means DHCP was not reached; Wi-Fi authentication failures after a password change mean forget and reconnect.
• Prioritize voice with quality of service, and keep real-time media out of VPN tunnels.

Sources

1. Microsoft. (n.d.). Understand Teams network requirements [Training module unit]; Prepare your organization's network for Microsoft Teams. Microsoft Learn. learn.microsoft.com (requirements); learn.microsoft.com (prepare network)
2. Microsoft. (n.d.). ping; pathping [Windows commands reference]. Microsoft Learn. learn.microsoft.com (ping); learn.microsoft.com (pathping)
3. Microsoft. (n.d.). Fix Wi-Fi connection issues in Windows. Microsoft Support. support.microsoft.com
4. Cisco Systems. (n.d.). Troubleshoot switch port and interface problems (Document 12027). cisco.com
5. Cisco Meraki. (n.d.). Common sources of wireless interference. meraki.com

One flash drive, three computers

A video editor finishes a 6 GB clip on her Mac and needs it on a Windows PC and on a Linux workstation in the next room. She copies it to a brand-new flash drive and gets an error: the file is too large. The drive has plenty of free space. The problem is its file system, the way the drive organizes files, and the fix depends on which operating systems must read it.

Core 2 objective 1.1 asks you to compare operating systems, file systems, and the vendor life cycles that decide how long each keeps receiving updates. These are comparison questions, so this lesson is built around tables. Read each table, then read what it means for a real ticket.

Workstation and mobile operating systems

The split that matters most for support is not desktop versus phone. It is who controls the updates: one maker for its own hardware (Apple, Google's Pixel and Chromebook programs), or a chain of makers, as with most Android phones and many Linux systems.

File systems compared

Microsoft's own feature table puts the key differences side by side. Only NTFS of the Windows-readable formats keeps a journal and tracks file owners and access control lists. FAT32's maximum file size is 4 GiB, while NTFS and exFAT reach 2^64 minus 1 bytes. That single number explains the video editor's error.

The core of it: internal Windows drives use NTFS; drives that move between computers use exFAT, or FAT32 when an old device demands it; Linux uses ext4 or XFS; Macs use APFS.

Compatibility between operating systems

Apple's Disk Utility guide makes the cross-platform rule explicit. It describes MS-DOS (FAT) and ExFAT as the file systems compatible with Windows. It recommends MS-DOS (FAT) for Windows volumes of 32 GB or less and ExFAT for Windows volumes over 32 GB. The editor's fix is to back up anything on the flash drive, reformat it as exFAT, and copy the clip again. Every one of her three computers can then read and write it.

The same thinking applies beyond drives. Applications are built for one operating system and often one processor architecture (Lesson 3). A program written for Windows does not run on ChromeOS, and a Linux container cannot run a Windows program (Lesson 16). When a user moves between systems, check three things before promising anything: the file formats, the applications and the peripherals' drivers.

Life cycles: when updates stop

Every operating system version reaches end of life (EOL), after which its maker stops releasing fixes, including security fixes. A computer past EOL keeps working, but every newly discovered vulnerability stays open on it forever.

• Windows 10. Microsoft ended support on 14 October 2025. Organizations can buy Extended Security Updates (ESU), a paid annual subscription for critical and important security updates, for up to three years. Microsoft's consumer ESU page now runs the home program until 12 October 2027. Enrollment is free with settings sync turned on, or uses Microsoft Rewards points or a one-time purchase. ESU provides security fixes only: no new features.
• ChromeOS. Google's Auto Update policy gives ChromeOS devices 10 years of updates from the platform's release date. The date counts from when the platform was released, not from when the school bought the laptop.
• Android on Pixel phones. Google promises Pixel 8 and later phones 7 years of OS and security updates. The clock starts when each model first went on sale on the Google Store in the US, not on the purchase date. Other Android makers set their own periods.

Update limitations come in two kinds. Some are dates, like those above. Others are hardware: a newer version may require features older hardware lacks. Windows 11's requirements for a TPM and UEFI firmware (Lesson 22) left many working Windows 10 PCs unable to upgrade. That made the Windows 10 end of support a hardware budgeting question as much as a software one.

The core of it: know the EOL date of every system you support. Plan replacements or ESU before that date, not after a vulnerability appears.

Common misconceptions

• "The drive says 'file too large', so it must be full." On FAT32, any single file over 4 GiB fails, however much space is free.
• "ReFS is just a newer NTFS for every drive." Microsoft's comparison shows ReFS is not bootable and not supported on removable media.
• "A PC past end of support stops working." It keeps running; it just stops receiving fixes, which is the danger.
• "A Chromebook gets updates for 10 years after I buy it." The 10 years count from the platform's release date.
• "exFAT is as safe as NTFS for an internal drive." exFAT has no journal and no permissions; it is for removable media.

What to remember

• Workstations: Windows, macOS, Linux, ChromeOS. Mobile: iOS, iPadOS, Android. Who controls updates matters most.
• NTFS: Windows internal drives, journal, permissions, BitLocker. ReFS: resilient server storage, not bootable. FAT32: universal, 4 GiB file limit. exFAT: removable drives without that limit.
• ext4 and XFS for Linux (XFS is RHEL's default); APFS for macOS 10.13 and later.
• Windows 10 support ended 14 October 2025; ESU gives security fixes only, for a limited time.
• ChromeOS: 10 years from platform release. Pixel 8 and later: 7 years from US launch. Others vary by maker.

Sources

1. Microsoft. (n.d.). File system functionality comparison; NTFS overview; Resilient File System (ReFS) overview. Microsoft Learn. learn.microsoft.com (comparison); learn.microsoft.com (NTFS); learn.microsoft.com (ReFS)
2. Apple. (n.d.). File system formats available in Disk Utility on Mac. Disk Utility User Guide. support.apple.com
3. Red Hat. (n.d.). Overview of available file systems. Red Hat Enterprise Linux 9: Managing file systems. docs.redhat.com
4. Microsoft. (n.d.). Extended Security Updates (ESU) program for Windows 10; Windows 10 Extended Security Updates [Consumer page]. Retrieved 2 November 2026. learn.microsoft.com; microsoft.com
5. Google. (n.d.). Auto Update policy [ChromeOS]; Learn when you'll get software updates on Google Pixel phones. support.google.com (ChromeOS); support.google.com (Pixel)

Two machines on the bench

Two computers arrive on the same morning. The first is a brand-new desktop for a small accounting office, with an empty SSD and a box of parts. The second is a five-year-old laptop running Windows 10 Home, full of a user's files and favorite programs. Both are supposed to end the day on Windows 11. The procedure for the first is a clean installation; for the second, an upgrade, if the hardware allows it. Core 2 objectives 1.2 and 1.3 cover both, and this lesson works them in order.

Step one: choose the edition

Editions differ in features a business notices on day one. Microsoft's documentation supplies the facts:

Two more names appear on the exam. N editions, sold in some markets, include the same functionality as the other editions except Windows Media Player and related media technologies. Microsoft's Media Feature Pack restores them. Enterprise editions add management and security features for large organizations and are licensed through volume agreements. Windows 10 also had a Pro for Workstations edition, which Windows 11 keeps, for high-end hardware with up to 6 TB of memory. The desktop style differs too: Windows 11 moved the Start menu and taskbar icons to the center and reorganized Settings, so users upgrading from Windows 10 need a minute of orientation.

The accounting office needs domain join for central sign-in, BitLocker for laptops that leave the building, and Remote Desktop for its part-time bookkeeper. Every requirement points to Windows 11 Pro.

Bottom line: a business that needs directory join, BitLocker or Remote Desktop hosting needs Pro or higher; Home is for personal computers.

Step two: check the hardware

Microsoft's Windows 11 requirements are specific: a compatible 64-bit processor of 1 GHz or faster with two or more cores; 4 GB of memory; 64 GB of storage; UEFI firmware that is Secure Boot capable; TPM version 2.0; DirectX 12 compatible graphics with a WDDM 2.0 driver; and a 720p display of 9 inches or more. Home edition also requires an internet connection and a Microsoft account to finish setup. Lesson 4 showed where to find TPM and Secure Boot settings in firmware. The new desktop passes every line.

Step three: boot the installer and partition the drive

An installer can start from several boot methods: a USB flash drive (the usual choice), a network boot from a deployment server, an external or hot-swappable drive, an internet-based recovery, or a partition on an internal drive. A PC can also be set up to multiboot, choosing between installed operating systems at startup. The technician boots the desktop from a USB installer made with Microsoft's download tools and chooses a clean install.

Partitioning comes next. Microsoft states that when Windows is deployed to a UEFI-based device, the drive holding the Windows partition must use a GUID partition table (GPT). Windows allows up to 128 partitions on a GPT drive. The older master boot record (MBR) scheme supports only four partition table entries, and needs an extended partition with logical drives to go beyond that. On a GPT drive, Windows Setup creates an EFI System Partition, which the device boots from, a small Microsoft reserved partition, the Windows partition, formatted NTFS (Lesson 21), and a recovery partition holding the tools Windows uses to repair itself.

If Setup shows no drives at all, the storage controller needs a third-party driver. Setup's Load driver option accepts the controller maker's driver from a USB drive, after which the SSD appears.

Step four: finish, join and verify

After Setup completes, the technician signs in, installs updates, joins the PC to the office directory, turns on BitLocker and enables Remote Desktop for the bookkeeper's account. Verification is a checklist: Settings, System, About shows Windows 11 Pro and the correct name; BitLocker reports the drive encrypted; a test Remote Desktop connection works; Windows Update shows no pending updates. The ticket records the edition, the Windows version and the recovery key's storage location.

The second machine: when the input changes

Now the five-year-old laptop. Its owner wants to keep her files, settings and programs, so the right path is an in-place upgrade, not a clean install. Microsoft's requirements for upgrading directly add two conditions. The laptop must run Windows 10 version 2004 or later, with the September 14, 2021 security update or later installed. The upgrade keeps the edition: Windows 10 Home becomes Windows 11 Home.

Upgrade considerations come before the button is pressed:

• Back up files and user preferences, even though an upgrade keeps them, in case it fails.
• Check application and driver support: older programs and devices may need updated versions, or may not work at all.
• Check hardware compatibility against the requirements above.

Here the input changes the result. The laptop's firmware offers only TPM 1.2. It fails the Windows 11 requirement for TPM 2.0, so it cannot be upgraded at all. The choices become the ones Lesson 21 described: enroll it in Windows 10 Extended Security Updates while a replacement is budgeted, or replace it now. Changing one fact flipped the plan from "upgrade today" to "plan a replacement."

Bottom line: a clean install suits new or wiped drives; an in-place upgrade keeps files and apps but only on hardware that meets the new version's requirements.

Installing at scale, and repairing in place

Feature updates and the product life cycle

Windows 11 receives one feature update a year, in the second half of the calendar year, plus monthly security updates on the second Tuesday. Each feature update is supported for 24 months on Home, Pro, Pro for Workstations and Pro Education, and 36 months on Enterprise and Education. Microsoft's release information table shows what that means in practice. Version 24H2 is past its end of updates for Home and Pro, so a Pro PC still on it in November 2026 gets no fixes. Version 25H2 is supported on those editions until 12 October 2027, and 26H2, released on 29 September 2026, until 10 October 2028. Keeping PCs on a supported feature update is part of every technician's routine.

Common misconceptions

• "Home can join a domain if you find the right setting." Microsoft lists every edition except Home for directory and hybrid domain join; the fix is an edition upgrade.
• "Remote Desktop needs Pro on both ends." Only the PC being connected to needs Pro.
• "An N edition is missing security features." It lacks only Windows Media Player and related media technologies, which the Media Feature Pack restores.
• "MBR and GPT are interchangeable for Windows 11." A UEFI install needs GPT for the Windows drive.
• "Once installed, Windows 11 is supported forever." Each feature update has a fixed support period: 24 or 36 months, depending on edition.

The takeaway

• Pro or higher for directory join, BitLocker, Remote Desktop hosting and gpedit.msc; Home tops out at 128 GB of RAM, Pro at 2 TB.
• Windows 11 needs TPM 2.0, UEFI with Secure Boot capability, 4 GB RAM, 64 GB storage and a compatible 64-bit processor.
• Clean installs boot from USB, network or other media; UEFI installs use GPT; Setup's Load driver option handles unseen storage.
• In-place upgrades keep files and apps: back up, check compatibility, and confirm the hardware first.
• At scale: imaging, network installs, Autopilot. On one PC: recovery partition, Reinstall Windows, reset.
• Feature updates: yearly, with 24 months of support (36 for Enterprise and Education).

Sources

1. Microsoft. (n.d.). Windows 11 requirements; Memory limits for Windows and Windows Server releases. Microsoft Learn. learn.microsoft.com (requirements); learn.microsoft.com (memory limits)
2. Microsoft. (n.d.). BitLocker overview; Microsoft Entra joined devices; Microsoft Entra hybrid joined devices. Microsoft Learn. learn.microsoft.com (BitLocker); learn.microsoft.com (Entra join); learn.microsoft.com (hybrid join)
3. Microsoft. (n.d.). How to use Remote Desktop; Media Feature Pack for Windows N; Recovery options in Windows. Microsoft Support. support.microsoft.com (Remote Desktop); support.microsoft.com (N editions); support.microsoft.com (recovery)
4. Microsoft. (n.d.). UEFI/GPT-based hard drive partitions; Windows and GPT FAQ. Microsoft Learn. learn.microsoft.com (UEFI/GPT); learn.microsoft.com (GPT FAQ)
5. Microsoft. (n.d.). Overview of Windows Autopilot; Windows 11 release information. Microsoft Learn. Retrieved 2 November 2026. learn.microsoft.com (Autopilot); learn.microsoft.com (release information)

"It has been slow since Tuesday"

An architect's PC has been slow since Tuesday. It takes three minutes after sign-in before anything responds, it freezes for a few seconds every so often, and the plotter has stopped printing. On Tuesday, she installed a new plotter driver and a "PDF helper" a colleague recommended. Windows ships with a tool for every part of this ticket. Core 2 objective 1.4 expects you to know them by name, and by the file name you type to open each one. This lesson follows the ticket from tool to tool, then lists the rest.

Task Manager: what is running right now

Task Manager (Ctrl + Shift + Esc) is the first stop. Its views answer different questions:

• Processes lists every running app and background process with its use of CPU, memory, disk and network. Sort by a column to find the heaviest. End task stops one that has hung.
• Performance graphs CPU, memory, disk, network and GPU use over time, and shows details such as the processor's speed, installed memory and disk type.
• Startup apps lists programs that launch at sign-in, with their measured impact.
• Users shows who is signed in and what each person is running, useful on shared PCs.
• Services lists background services and whether each is running, with a link to the full Services console.

Microsoft defines the startup impact ratings precisely. High impact means the app used more than 1 second of CPU time or more than 3 MB of disk activity at startup. Low impact means under 300 milliseconds of CPU and under 292 KB of disk. Selecting an app and choosing Disable stops it from starting automatically. On the architect's PC, the PDF helper shows High impact. Disabling it cuts the wait after sign-in to under a minute.

Key idea: Task Manager shows the present. For the past, use Event Viewer; for the long view, Performance Monitor.

Going deeper: Resource Monitor and Performance Monitor

The freezes remain. Resource Monitor (resmon.exe) breaks activity down further than Task Manager. It shows which files each process is reading and writing, and which network addresses each one is talking to. During a freeze, it shows the PDF helper's background service writing heavily to the disk.

Performance Monitor (perfmon.msc) records instead of showing. Microsoft's guide to slow computers describes it as an inbox tool that tracks performance counters built into Windows, such as CPU and memory use. Its data collector sets record those counters for hours or days, which catches problems that happen only overnight or under load. The data narrows down which resource is the bottleneck.

Event Viewer and Device Manager: what went wrong, and which driver

Event Viewer (eventvwr.msc) holds the logs that Windows and applications write. Under Windows Logs, System records drivers, services and hardware, Application records programs, and Security records sign-ins and audited actions. Lesson 17 used it to read Event ID 41. Here, the System log shows errors from the plotter's print driver each time a job is sent.

Device Manager (devmgmt.msc) lists every hardware device and its driver, with a warning symbol on any device that has a problem. Microsoft's advice for a problem that appeared after an update is to reinstall the previous driver. Open the device's Properties, select the Driver tab and choose Roll Back Driver, signed in with administrator permissions. The plotter prints again on the previous driver, and the technician notes to retry the new one when the maker releases a fix.

System Configuration: a clean boot to find a conflict

When a problem looks like a clash between programs but the culprit is unknown, Microsoft recommends a clean boot, which starts Windows with only essential drivers and startup programs. Open System Configuration (msconfig.exe). On the Services tab, select Hide all Microsoft services, then Disable all, and apply. On the Startup tab, open Task Manager and disable each enabled startup app, noting which ones you disabled. Restart and test. Then re-enable items in halves until the problem returns, which identifies the one responsible. Microsoft warns that System Configuration's advanced boot options should be changed only with guidance, because a mistake there can make the computer unusable.

Keeping a PC healthy: Disk Cleanup, Optimize Drives and Task Scheduler

• Disk Cleanup (cleanmgr.exe) deletes temporary files and, if you choose, system files that are no longer needed. Microsoft points to Storage Sense in Settings as the newer automatic equivalent.
• Disk Defragment, now called Optimize Drives (dfrgui.exe), runs the defragmenter. Microsoft's defrag reference describes it as locating and consolidating fragmented files to improve performance. It performs the proper optimization for each type of media. For SSDs that means retrim, which tells the drive which blocks are no longer in use, rather than moving files around.
• Task Scheduler (taskschd.msc) runs tasks automatically. Microsoft describes it as monitoring criteria you choose, called triggers, and executing tasks when they are met. Use it for a weekly script, and check it when something runs at startup that appears nowhere else.

The administrator's consoles

Many of these tools are Microsoft Management Console (MMC) snap-ins. Microsoft describes MMC as hosting administrative tools, called consoles, that manage the hardware, software and network components of Windows. That is why their file names end in .msc, and why several can be combined into one custom console.

• Disk Management (diskmgmt.msc): disks, partitions and volumes (Lessons 18 and 22).
• Local Users and Groups (lusrmgr.msc): the device's local accounts and groups, such as the built-in Administrator and the Administrators group. Microsoft notes they also appear under Computer Management.
• Certificate Manager: Microsoft's instructions use certmgr.msc for the current user's certificates and certlm.msc for the local computer's. Check here when a site, VPN or Wi-Fi connection rejects a certificate.
• Group Policy Editor (gpedit.msc): local policies on Pro and higher editions (Lesson 22). In a domain, policies usually come from the server instead.
• Registry Editor (regedit.exe): the database of Windows and application settings. Microsoft's warning is blunt: serious problems might occur if you modify the registry incorrectly, possibly requiring a reinstall of Windows. Before editing, export the keys you plan to change, or back up the whole registry.
• System Information (msinfo32.exe): Microsoft describes it as a comprehensive view of the hardware, system components and software environment. Lessons 3, 4 and 18 used it for motherboard, firmware and boot-mode details.

Key idea: match the question to the tool. Present, past, long-term, hardware, conflicts and settings each have their own console.

Common misconceptions

• "End task fixes a slow PC." It stops one process now. If the program starts at sign-in, disable it in Startup apps, or it returns.
• "A clean boot means disabling every service." Microsoft's procedure hides all Microsoft services first, so only third-party services are disabled.
• "Defragment the SSD to speed it up." Optimize Drives retrims SSDs instead; consolidation is for hard drives.
• "Registry edits are harmless if you're careful." Microsoft warns they can require reinstalling Windows. Export the key first.
• "certmgr.msc shows every certificate on the PC." It shows the current user's; certlm.msc shows the local computer's.

Recap

• Task Manager: Processes, Performance, Startup apps (High impact means over 1 s of CPU or 3 MB of disk), Users, Services.
• Resource Monitor for per-process detail; Performance Monitor to record counters over time; Event Viewer for what happened.
• Device Manager: driver status, Roll Back Driver after a bad update.
• Clean boot with System Configuration: hide Microsoft services, disable the rest, disable startup apps, then halve.
• Disk Cleanup, Optimize Drives (defragment HDDs, retrim SSDs), Task Scheduler.
• MMC snap-ins (.msc): diskmgmt, lusrmgr, certmgr and certlm, gpedit, perfmon, taskschd, eventvwr, devmgmt. Back up before using regedit. msinfo32 for a full inventory.

Sources

1. Microsoft. (n.d.). Configure startup applications in Windows; How to perform a clean boot in Windows; Update drivers through Device Manager in Windows; Free up drive space in Windows. Microsoft Support. support.microsoft.com (startup apps); support.microsoft.com (clean boot); support.microsoft.com (drivers); support.microsoft.com (drive space)
2. Microsoft. (n.d.). Troubleshoot performance problems in Windows; What is Microsoft Management Console?; Windows registry information for advanced users. Microsoft Learn. learn.microsoft.com (performance); learn.microsoft.com (MMC); learn.microsoft.com (registry)
3. Microsoft. (n.d.). defrag; msinfo32 [Windows commands reference]; Task Scheduler; Local accounts. Microsoft Learn. learn.microsoft.com (defrag); learn.microsoft.com (msinfo32); learn.microsoft.com (Task Scheduler); learn.microsoft.com (local accounts)
4. Microsoft. (n.d.). How to: View certificates with the MMC snap-in. Microsoft Learn. learn.microsoft.com

Why technicians still type

Settings and consoles cover most jobs, but the command line wins in three situations. It is faster when you know the command. It works over a remote session where a graphical tool is clumsy. And a command can go into a script and run the same way a hundred times. Core 2 objective 1.5 lists the commands an A+ technician should know. This lesson uses them in two procedures, the second a variation of the first, then gathers them into one table.

Two habits apply to every command. Some need an elevated prompt: right-click Command Prompt or Terminal and choose Run as administrator. Microsoft notes, for example, that formatting a hard drive requires membership in the Administrators group. And every command explains itself: Microsoft's reference lists /? as displaying help at the command prompt, so robocopy /? prints all of robocopy's options.

Procedure one: moving a user's files to a new PC

1. Confirm who and where you are. whoami shows the current domain and user name; Microsoft adds that it can list the account's groups and privileges too. hostname displays the computer's name. winver opens a window showing the exact Windows version and build. All three belong in the ticket.
2. Find the files. cd displays or changes the current directory, and dir lists a directory's files and subdirectories. Type cd C:\Users\dana\Documents, then dir, to see what will be moved.
3. Make a destination. md creates a directory, and Microsoft notes it can create intermediate directories in one command: md D:\Migration\dana\Documents.
4. Copy with robocopy. Microsoft describes robocopy as copying file data from one location to another, and its options make it the right tool for a migration:

   robocopy C:\Users\dana\Documents \\fs01\migration\dana\Documents /E /R:2 /W:5 /LOG:C:\Temp\dana.log

   /E copies subdirectories, including empty ones. /R:2 and /W:5 limit retries to two, five seconds apart. Without them, Microsoft's defaults are one million retries with a 30-second wait, so one locked file can stall the job for days. /LOG writes the results to a file for the ticket. Be careful with /MIR. Microsoft defines it as mirroring a directory tree, the same as /E plus /PURGE, which deletes destination files that are not in the source.
5. Map the shared drive on the new PC. net use connects a computer to a shared resource: net use S: \\fs01\shared /persistent:yes maps it as drive S: and remembers it after restarts.
6. Apply and check policy. gpupdate updates Group Policy settings; with /force it reapplies all of them rather than only changed ones. gpresult /r displays a summary of the Resultant Set of Policy, the policies that actually applied, to confirm the drive-mapping policy reached the user.
7. Clean up. rmdir deletes a directory; Microsoft notes that /s deletes the whole tree, files included, and /q skips the confirmation. Use both only on a path you have checked twice.

The point: a migration done by command is repeatable and leaves a log. The same seven lines work for the next user with one name changed.

Procedure two: the same move, but the server cannot be reached

Change one input. On the next user's PC, robocopy reports that the network path to \\fs01 cannot be found. The commands change from file tools to network tools, used in order from the PC outward:

1. ipconfig /all: Microsoft describes ipconfig as displaying all current TCP/IP configuration values. Check the address, mask, gateway and, above all, the DNS servers (Lesson 13).
2. ping: ping 10.0.0.5, the server's address, replies. ping fs01 fails with a name error. The network path works; the name does not.
3. nslookup: Microsoft describes it as displaying information used to diagnose DNS. nslookup fs01 answers that the name cannot be found by the DNS server listed in step 1. That server turns out to be a home router's address left over from a manual setting.
4. Fix and flush. Set the adapter back to obtain DNS automatically. Then ipconfig /flushdns clears any cached wrong answer, and robocopy runs.

For a server in another building, two more commands find where the path breaks. tracert sends messages with steadily increasing time-to-live values. Each router along the path must reduce that value by one and report back when it reaches zero, so tracert lists every hop in turn. pathping adds packet loss at each hop over time (Lesson 20). And netstat shows the PC's own side: active TCP connections and listening ports. Its -a option shows all connections and listening ports, -n shows numbers instead of names, and -b shows the program behind each one.

The point: the procedure stayed the same, but one failed step sent the technician from file commands to network commands, in order from the PC outward.

Disks, accounts and system files

• chkdsk checks a volume's file system; /f fixes errors and /r also locates bad sectors (Lesson 18).
• format prepares a drive for Windows files: format E: /FS:NTFS /Q quick-formats E: as NTFS, deleting its file table without a sector-by-sector scan. Everything on the drive is lost.
• diskpart is an interpreter for managing disks, partitions and volumes. Microsoft explains that you must first list and then select an object to give it focus; every later command acts on that focus. Check twice which disk is selected before running anything destructive.
• net user adds, modifies or deletes user accounts and displays account details, on the local computer or a domain.
• sfc /scannow scans the integrity of all protected system files and repairs damaged ones when possible. Microsoft notes that sfc retrieves correct versions of overwritten protected files from its own store.

Common misconceptions

• "robocopy /MIR is just a thorough copy." It also purges destination files that are not in the source. Use /E unless you mean to mirror.
• "gpupdate shows which policies applied." gpupdate applies policy; gpresult reports it.
• "If ping by name fails, the server is down." Ping it by address. If that works, the problem is name resolution; check it with nslookup.
• "A quick format securely erases a drive." /Q deletes the file table without scanning sectors; the data is not overwritten.
• "net use and net user are the same tool." net use connects to shared resources; net user manages accounts.

What to carry forward

• Run as administrator when a command changes the system; use /? for any command's options.
• cd and dir to navigate; md, rmdir /s and robocopy (/E, /R, /W, /LOG; beware /MIR) to manage files.
• Network, from the PC outward: ipconfig /all, ping by address then by name, nslookup, tracert or pathping; netstat for the PC's own connections; net use to map shares.
• chkdsk, format and diskpart change disks; check the target twice.
• whoami, hostname, winver and net user identify the account, PC, version and users.
• gpupdate /force applies policy; gpresult /r reports it; sfc /scannow repairs system files.

Sources

1. Microsoft. (n.d.). Windows commands [Reference]: cd; dir; md; rmdir; robocopy; format; diskpart; whoami; hostname; net user. Microsoft Learn. learn.microsoft.com (index); learn.microsoft.com (robocopy); learn.microsoft.com (diskpart); learn.microsoft.com (format)
2. Microsoft. (n.d.). ipconfig; nslookup; tracert; netstat [Windows commands reference]; (2016). Net use. Microsoft Learn. learn.microsoft.com (ipconfig); learn.microsoft.com (nslookup); learn.microsoft.com (tracert); learn.microsoft.com (netstat); learn.microsoft.com (net use)
3. Microsoft. (n.d.). gpupdate; gpresult; sfc [Windows commands reference]. Microsoft Learn. learn.microsoft.com (gpupdate); learn.microsoft.com (gpresult); learn.microsoft.com (sfc)

Priya's first day

Priya starts as a marketing coordinator on Monday, and Sam, the office's technician, has her new laptop for the morning. By lunch it must sign her in, reach the file server, print, connect from home, and behave sensibly on her train's Wi-Fi. Sam's morning touches nearly every item in Core 2 objectives 1.6 and 1.7, the Windows settings and client networking a technician configures every week. Follow it in order.

Who she is: accounts, domains and workgroups

Sam's first decision is the account. Priya's office runs a domain, so the laptop joins it (Lesson 22), and she signs in with her work account. Microsoft describes Active Directory Domain Services as a directory that stores information about objects on the network, such as user accounts with their names and passwords. It makes that information available to authorized users and administrators. One account then works on every domain computer, and the domain's Group Policy configures them all.

The alternative is a workgroup, the default for home and very small offices. There, Microsoft explains, local accounts are defined on each device, the device is its own security authority, and the accounts have rights and permissions only on that device. Sharing still works in a workgroup: shared printers, file servers and mapped drives. But each PC keeps its own list of users, so an account created on one PC means nothing on the next.

Why this matters: "my password doesn't work on the other PC" is a workgroup ticket. In a domain, one account follows the user everywhere.

Settings: the everyday controls

Sam works through the Settings app's categories:

• Accounts: Priya's work account, sign-in options and Windows Hello.
• Time and Language: the correct time zone. Kerberos sign-in fails if a clock drifts too far (Lesson 15), so time matters for more than meetings.
• Windows Update, called Update and Security in Windows 10: updates before she starts work.
• Privacy: which apps may use the camera, microphone and location.
• Apps: default apps, and removing the trial software the laptop arrived with.
• System, Devices and Personalization: display scaling for her docked monitor (Lesson 19), Bluetooth for her headset, and her background.
• Network and Internet, which gets its own section below, and Gaming, which a work laptop rarely needs.

Control Panel: the older controls that still matter

Control Panel remains, and the exam lists its applets by name. Programs and Features uninstalls desktop programs and turns Windows features on or off. Devices and Printers shows the printer Sam adds. Sound sets her headset as the default device. Mail manages Outlook profiles. Indexing Options chooses which locations Windows Search indexes. User Accounts, System, Device Manager, Administrative Tools, Windows Defender Firewall, Network and Sharing Center and Internet Options (proxy and security settings for older applications) round out the list, along with Ease of Access for accessibility.

Two File Explorer Options are worth changing on every PC Sam sets up. On the View tab, he clears Hide extensions for known file types. With extensions hidden, a file named invoice.pdf.exe appears as invoice.pdf, a disguise attackers rely on (Lesson 31). Show hidden files, folders and drives he turns on only when troubleshooting, for example to reach an application's settings in the AppData folder. The General tab sets how folders open and what Quick access shows.

Power options: sleep, hibernate and fast startup

Microsoft's description of system power states separates the two ways to pause. In sleep (states S1 to S3) the system appears off, but memory is kept refreshed, so work resumes in seconds while a little power is used. In hibernate (S4), Windows saves the contents of memory to a hibernation file and power use drops to the lowest level. That suits a laptop left in a drawer for days. Many newer laptops use Modern Standby, which, Microsoft notes, replaces S1 to S3. A power plan sets when the screen turns off and when the PC sleeps or hibernates. Its lid setting, Choose what closing the lid does, lets Sam set "do nothing" on power so Priya can close the lid while docked.

Fast startup, on by default, explains a classic ticket. Microsoft describes it as combining a cold start with wake from hibernation. At shut down, Windows closes applications and signs users out, then saves the kernel and its loaded drivers to the hibernation file. "Shut down" therefore does not fully reload Windows, while "Restart" does. When a driver problem survives every shutdown, try Restart, or turn fast startup off.

USB selective suspend, in a power plan's advanced settings, lets Windows suspend an individual idle USB port without affecting the others. Microsoft notes it saves battery on portable computers. If a USB device keeps disconnecting, this setting is worth checking.

Network and Internet: addressing, profiles and paths

Priya's laptop gets its address from DHCP, which Microsoft recommends. Settings are filled in automatically by the router or another access point, and nothing needs changing when the laptop moves. The office's label printer server, however, needs a static address. In Settings, Sam opens the adapter, selects Edit next to IP assignment, and chooses Manual for IPv4. He then enters the IP address, the subnet mask (as a prefix length, such as 24 for 255.255.255.0), the gateway and the preferred and alternate DNS servers. Lesson 13 explained each value; a typing error in any one of them is the usual cause of "connected, but nothing works."

Every network Windows joins gets a profile. Microsoft's current guidance sets new networks to Public by default and recommends it in most cases: the PC is hidden from other devices, and file and printer sharing are off. Private makes the PC discoverable and allows sharing, and should be chosen only for networks whose people and devices you know and trust. Priya's train Wi-Fi stays Public.

The file server is reached by a network path in File Explorer. Microsoft's description of universal naming convention (UNC) paths gives the format: a server name prefaced by two backslashes, then a share name and folders, such as \\fs01\marketing\campaigns. Typing that into File Explorer's address bar opens the share. Map network drive turns it into a drive letter, as net use does at the command line (Lesson 24).

Connecting from anywhere: Wi-Fi, cellular, VPN and proxy

• Wired and wireless connections appear in Network and Internet; Wi-Fi networks are joined once and remembered under Manage known networks.
• Cellular (WWAN): Priya's laptop has a cellular modem. Microsoft notes that cellular connections are metered by default. On a metered connection, Windows limits background data use, and some updates are not installed automatically. Sam also marks her phone's hotspot as metered.
• VPN: under Network and Internet, VPN, Add VPN, Sam chooses Windows (built-in) as the provider. He enters a connection name, the server's name or address, the VPN type the office uses, and the sign-in method. From home, she connects before opening the file server's path (Lesson 15).
• Proxy: the office's web filter needs a proxy. Microsoft's Proxy settings offer automatic detection, a setup script at a given address, or a manual proxy server and port, with an exceptions list for sites that should bypass it. The office uses a setup script.

The firewall: letting one app in

Priya's video tool needs incoming connections. Microsoft's guidance on Windows Defender Firewall names two ways to allow it, and calls both risky. Adding the app to the list of allowed apps is less risky, because an allowed app opens the ports it needs only when it needs them. Opening a port is more risky, because it stays open until someone closes it. Sam allows the app, for the Private and Domain profiles only, and notes it on the ticket.

Why this matters: each setting Sam chose has a ticket attached when it is wrong: a Public profile that blocks sharing, a static address with a wrong gateway, a hidden extension that disguises malware, a lid that sleeps a docked laptop.

Common misconceptions

• "Private is the safe profile because it sounds secure." Private makes the PC discoverable for sharing; Public hides it. Microsoft recommends Public in most cases.
• "Shut down is a full restart." With fast startup on, Shut down saves the kernel session to the hibernation file; Restart reloads Windows fully.
• "Opening a port and allowing an app are the same." Microsoft calls opening a port the riskier of the two, because it stays open.
• "A workgroup account works on every PC in the office." Local accounts have rights only on their own device.
• "Metered connections block Windows Update entirely." They limit background data and hold back some automatic updates; they do not switch updating off.

What you now know

• Domain: central accounts and policy. Workgroup: each PC is its own security authority; share printers, files and mapped drives explicitly.
• Settings covers accounts, time and language, updates, privacy, apps, system, devices, personalization, network and gaming; Control Panel still holds Programs and Features, Devices and Printers, Sound, Mail, Indexing Options, Internet Options and more.
• Show file name extensions on every PC; show hidden files only when needed.
• Sleep keeps memory powered; hibernate saves it to disk; fast startup hibernates the kernel at shutdown; USB selective suspend idles individual ports.
• DHCP for clients; static IP, mask, gateway and DNS for fixed devices; Public profile unless sharing on a trusted network.
• Cellular is metered by default; VPN, proxy (automatic, script or manual) and allowed apps in the firewall complete the setup; reach shares by \\server\share paths.

Sources

1. Microsoft. (n.d.). Essential network settings and tasks in Windows; Metered connections in Windows; Connect to a VPN in Windows; Use a proxy server in Windows; Risks of allowing apps through Windows Firewall. Microsoft Support. support.microsoft.com (network settings); support.microsoft.com (metered); support.microsoft.com (VPN); support.microsoft.com (proxy); support.microsoft.com (firewall)
2. Microsoft. (n.d.). Active Directory Domain Services overview; Local accounts. Microsoft Learn. learn.microsoft.com (AD DS); learn.microsoft.com (local accounts)
3. Microsoft. (n.d.). System power states; Distinguishing fast startup from wake-from-hibernation; USB selective suspend. Microsoft Learn. learn.microsoft.com (power states); learn.microsoft.com (fast startup); learn.microsoft.com (USB selective suspend)
4. Microsoft. (n.d.). File path formats on Windows systems (UNC paths). Microsoft Learn. learn.microsoft.com

A Windows technician meets a Mac

A design studio has taken you on as its support technician. Its staff use Macs, and the first ticket asks for three things: install a font utility, set up backups, and explain why an app keeps freezing. Every one of those jobs has a Windows equivalent you already know. The quickest way to learn macOS for Core 2 objective 1.8 is to put the two side by side. If you have a Mac, try each item; if not, Apple's user guides, linked below, show the screens. macOS cannot legally run in a virtual machine on non-Apple hardware, so this lesson has no VM lab.

The same jobs, different names

Macs lean heavily on trackpad gestures, such as swiping between full-screen apps and spaces, and on multiple desktops, called spaces, which Mission Control lets you create and move between. Continuity features connect a Mac to the user's other Apple devices. Apple's examples include Handoff, for starting an email on an iPhone and finishing it on the Mac, plus Universal Clipboard, Sidecar and Instant Hotspot. Apple notes that most of these need each device signed in to the same Apple Account, while a few, such as AirDrop, do not.

What matters here: a Mac ticket is usually a Windows ticket in different words. Translate the job, then find the Mac tool.

Installing and removing apps

Mac apps arrive in three forms. An .app is the application itself, a bundle that appears as one file. A .dmg is a disk image, which opens like a small drive, usually holding the .app to drag into the Applications folder. A .pkg is an installer package, which Apple's guide says looks like an open box and runs an installer. Apple's instructions are to double-click the disk image or package in Downloads and follow the onscreen instructions. If macOS warns about an app from an unidentified developer, that is Gatekeeper at work, and the user should be sure of the source before overriding it. The App Store is the fourth route, and the safest, because Apple reviews its apps.

Removing an app is simpler than on Windows. Apple says to look first for an Uninstaller in the app's folder and run it if there is one. Otherwise, drag the app from Applications to the Trash; it is gone for good when the Trash is emptied. Apps that macOS itself requires, such as Mail, Music and Notes, cannot be removed.

System folders

Apple's file system guide explains the folders a technician meets most:

• /Applications holds apps for every user of the Mac; the App Store installs apps here automatically.
• /Users holds each user's home folder, with Desktop, Documents, Downloads and their own Library.
• /Users/name/Library holds that user's app settings and support files. Apple notes it has been hidden since macOS 10.7, which is why "reset this app's settings" often means finding it.
• /Library holds resources shared by all users of the computer; administrators can change it.
• /System holds the system software Apple installs. Apple says users cannot add, remove or alter items there.

Apple Accounts in an organization

Each user signs in to an Apple Account (the objectives use its older name, Apple ID) for iCloud, the App Store and Continuity. Organizations use Managed Apple Accounts instead. Apple describes them as designed for, owned and managed by an organization, which controls access to iCloud services and buys and distributes apps for its users. Managed accounts carry corporate restrictions. Apple notes they don't store Health data and limit the Wallet app. Find My isn't available on them; instead, the organization uses its device management service to locate or lock a lost device. That management is the MDM of Lesson 10.

Best practices: backups, malware, updates, encryption

• Backups. Apple's guide says that when Time Machine is on, it automatically backs up the Mac with hourly, daily and weekly backups, and also keeps local snapshots for recovering earlier versions of files. It needs an external drive or network destination.
• Antivirus. Apple's platform security guide states that macOS includes built-in antivirus technology called XProtect, for signature-based detection and removal of malware. Apple updates it automatically. Gatekeeper and Notarization help prevent malware from launching in the first place.
• Updates and patches. Software Update installs macOS updates. The objectives name Rapid Security Response (RSR), Apple's way to ship urgent security fixes between full updates. Apple's support article now calls the current form Background Security Improvements. These are lightweight security releases for components such as Safari and WebKit, starting with macOS 26.1, installed when Automatically Install is on.
• FileVault. Apple explains that on a Mac with Apple silicon or a T2 security chip, data is encrypted automatically. Turning on FileVault adds a layer that keeps anyone from decrypting or getting to the data without the login password. On older Macs, FileVault is what encrypts the data at all. Setting it up requires an administrator.

What matters here: the Mac best-practice list matches Windows': back up automatically, keep the built-in protections and updates on, encrypt the disk, and manage work accounts centrally.

Common misconceptions

• "Macs don't need antivirus at all." They have it built in: XProtect, updated by Apple, with Gatekeeper and Notarization.
• "Removing the Dock icon uninstalls an app." It only removes the shortcut. Uninstall by dragging the app from Applications to the Trash, or with its Uninstaller.
• "Apple silicon Macs don't need FileVault because they are encrypted anyway." FileVault adds the requirement for a login password before the data can be decrypted.
• "A Managed Apple Account is a personal account with a company email." The organization owns and manages it, and some services, such as Find My, are not available.
• "System Preferences is missing on a new Mac." It was renamed System Settings.

The short version

• System Settings, Finder, Spotlight (Command-Space), Dock, Mission Control and spaces, Force Quit (Option-Command-Esc), Disk Utility, Terminal.
• .app is the app, .dmg a disk image, .pkg an installer package; the App Store is the reviewed route. Uninstall with the Uninstaller or by dragging to the Trash.
• /Applications for all users' apps, /Users for homes, ~/Library for one user's settings (hidden), /Library for shared resources, /System for Apple's system software.
• Managed Apple Accounts are owned by the organization and restricted; personal Apple Accounts drive iCloud and Continuity.
• Time Machine for backups, XProtect for malware, Software Update plus Background Security Improvements (RSR in the objectives) for patches, FileVault for encryption.

Sources

1. Apple. (n.d.). Mac User Guide: Install and uninstall apps from the internet or a disc on Mac; Back up your files with Time Machine on Mac; Protect data on your Mac with FileVault; View open windows and spaces in Mission Control on Mac; Find what you need with Spotlight on Mac. support.apple.com (apps); support.apple.com (Time Machine); support.apple.com (FileVault); support.apple.com (Mission Control); support.apple.com (Spotlight)
2. Apple. (n.d.). How to force an app to quit on Mac; About Background Security Improvements for iOS, iPadOS, and macOS; What is Keychain Access on Mac?; Disk Utility User Guide. support.apple.com (Force Quit); support.apple.com (security improvements); support.apple.com (Keychain Access); support.apple.com (Disk Utility)
3. Apple. (n.d.). Apple Platform Security: Protecting against malware in macOS; Apple Platform Support: Intro to Managed Apple Accounts; iCloud; Continuity feature support. support.apple.com (malware); support.apple.com (Managed Apple Accounts); support.apple.com (iCloud); support.apple.com (Continuity)
4. Apple. (n.d.). File System Programming Guide: File system basics (domains and standard directories). Apple Developer Documentation Archive. developer.apple.com

The lab VM goes to work

A small web agency runs Linux on its developers' workstations. Your ticket: set up a project folder for a new developer, give the right people access, install a tool, point a test name at a test server, and check the network. You will do it in the Ubuntu VM from Lesson 1, which makes this the most hands-on lesson in the course. Then the same job changes one input, and a few commands change with it. Core 2 objective 1.9 lists every command used here.

One rule before typing: almost everything in Linux is case-sensitive, and nothing goes to a recycle bin. A deleted file is gone.

Procedure one: a project folder on Ubuntu

1. Find your place. pwd prints the working directory; ls -l lists files with their permissions, owner, size and date. man ls opens the manual for any command. The manual pages are the reference this lesson cites.
2. Build and arrange. mkdir -p ~/projects/site creates the folder (the ~ means your home folder). cp index.html ~/projects/site/ copies a file, mv draft.html about.html moves or renames one, and rm old.html deletes one. rm -r deletes a folder and everything in it, so read the path twice.
3. Search. find searches a directory tree for files: find ~/projects -name '*.css' lists every stylesheet. grep prints lines that match a pattern: grep -r 'TODO' ~/projects finds every unfinished note.
4. Set permissions. ls -l shows permissions as three sets of r (read), w (write) and x (execute): for the owner, the group and everyone else. chmod changes them. Its manual explains numeric modes: read counts 4, write 2 and execute 1, added together for each set. chmod 750 deploy.sh gives the owner everything (7), the group read and execute (5) and others nothing (0).
5. Set ownership. chown changes a file's owner and group: sudo chown alice:web ~/projects/site/index.html.
6. Install a tool. Ubuntu's documentation recommends the Advanced Packaging Tool, used through the apt command. sudo apt update refreshes the package index, a database of available packages, and sudo apt install tree installs one. sudo apt upgrade updates everything installed.
7. Edit a configuration file. sudo nano /etc/hosts opens nano, a simple text editor. Add the line 192.168.1.50 devserver, save with Ctrl+O and exit with Ctrl+X. Then ping -c 4 devserver reaches the test server by name on this PC only.
8. Check the machine. df -h reports free space on each file system, and du -sh ~/projects estimates the space a folder uses. top shows processes live, and ps aux takes a snapshot of them. cat prints a file to the screen.
9. Check the network. ip addr shows the interfaces and addresses; the ip manual describes it as showing and changing routing, devices and interfaces. ping tests reachability, curl -I https://ubuntu.com fetches a web server's headers, dig ubuntu.com queries DNS, and traceroute ubuntu.com lists the routers on the path.

Remember: pwd, ls, cd, cp, mv and rm move you and your files; find and grep search; chmod and chown control access; apt installs; nano edits; df, du, top, ps and cat inform.

sudo, su and the root account

The root account is Linux's all-powerful administrator. Ubuntu's documentation explains that its developers disable the root account by default. It is not deleted, but it is given a password hash that matches no possible value, so it cannot log in directly. Instead, sudo lets an authorized user temporarily elevate privileges with their own password. That gives accountability for every action, and lets the administrator control what each user may do. From Ubuntu 25.10 onward, sudo is provided by sudo-rs, a Rust implementation. su runs a command, or a whole shell, as another user. It needs that user's password, which is why su - to root fails on a default Ubuntu system.

Procedure two: the same job on Fedora, and a drive that will not behave

Change one input: the next developer runs Fedora, a Red Hat family distribution. Every file and network command above works the same, but software comes from a different package manager. The dnf manual describes it as a package manager for RPM-based Linux distributions: sudo dnf install tree, and sudo dnf upgrade for everything. Ubuntu packages (.deb) and Fedora packages (.rpm) are not interchangeable.

The same developer's USB drive will not mount and reports errors. Two commands handle file systems. mount attaches one to a folder, for example sudo mount /dev/sdb1 /mnt/usb, and umount detaches it. fsck checks and repairs a Linux file system. The ext4 checker's manual is emphatic: it is not safe to run on mounted file systems. If it asks whether to check a mounted file system, the only correct answer is "no." So unmount first, then check: sudo umount /dev/sdb1, then sudo fsck /dev/sdb1.

Configuration files and the parts of the system

Three components make up the running system. The bootloader (GRUB on most Linux PCs) starts first and loads the kernel, the core that manages the hardware, memory and processes. The kernel then starts systemd. Its manual describes it as a system and service manager that runs as the first process at boot and brings up and maintains the services. systemctl status ssh shows whether a service is running; sudo systemctl restart ssh restarts it.

Remember: passwd lists accounts, shadow protects their passwords, hosts maps names locally, fstab lists file systems, resolv.conf names DNS servers.

Common misconceptions

• "/etc/passwd contains the passwords." It lists accounts; the password hashes live in /etc/shadow, which regular users cannot read.
• "Run fsck to fix the drive while it's in use." The manual says checking a mounted file system is unsafe; unmount it first.
• "apt and dnf are interchangeable." apt manages Debian-family packages such as Ubuntu's; dnf manages RPM-based distributions such as Fedora.
• "chmod 777 fixes permission problems." It gives everyone write access. Grant only what each class needs, such as 750 or 640.
• "Ubuntu has no root account." It has one, locked by default; administrators use sudo with their own password.

Putting it together

• Files: pwd, ls, cd, cp, mv, rm (no recycle bin); search with find (by name) and grep (by content).
• Access: chmod numeric modes add read 4, write 2, execute 1 for owner, group and others; chown sets owner and group.
• Software: apt on Ubuntu and Debian, dnf on Fedora and Red Hat; sudo elevates with your own password; su switches user.
• Information: man, cat, top, ps, du, df. Network: ip, ping, curl, dig, traceroute.
• File systems: mount and umount; fsck only on unmounted file systems.
• Config files: /etc/passwd, /etc/shadow, /etc/hosts, /etc/fstab, /etc/resolv.conf. Components: bootloader, kernel, systemd.

Sources

1. Ubuntu manpage repository. (n.d.). chmod(1); chown(1); grep(1); find(1); df(1); du(1); top(1); ip(8); dig(1). Canonical. manpages.ubuntu.com (chmod); manpages.ubuntu.com (find); manpages.ubuntu.com (ip)
2. Ubuntu manpage repository. (n.d.). passwd(5); shadow(5); hosts(5); fstab(5); resolv.conf(5); systemd(1). Canonical. manpages.ubuntu.com (passwd); manpages.ubuntu.com (shadow); manpages.ubuntu.com (fstab); manpages.ubuntu.com (systemd)
3. Ubuntu manpage repository. (n.d.). apt(8); dnf(8); sudo(8); su(1); fsck(8); e2fsck(8). Canonical. manpages.ubuntu.com (dnf); manpages.ubuntu.com (e2fsck); manpages.ubuntu.com (su)
4. Canonical. (n.d.). User management; Package management. Ubuntu Server documentation. ubuntu.com (users); ubuntu.com (packages)

Five licenses and one rollout

An architecture firm has bought five licenses for a 3D rendering application, and it is moving the whole office to Microsoft 365 the same month. The vendor's requirements sheet asks for 64-bit Windows 11, a recent multi-core processor, 32 GB of memory, a dedicated graphics card with 8 GB of video memory, 50 GB of free storage, and a USB license key that must stay plugged in. The download is a 12 GB disk image. Before anyone clicks Install, Core 2 objective 1.10 expects you to check each requirement against each PC. Objective 1.11 covers the cloud move that follows.

Requirement by requirement

Three rows need more explanation. On 32-bit versus 64-bit, Microsoft's FAQ is blunt. Moving from 32-bit to 64-bit Windows requires reformatting the drive, installing 64-bit Windows and reinstalling everything, and Windows 11 has no 32-bit version at all. In the other direction, 64-bit Windows runs most 32-bit programs through a compatibility layer Microsoft calls WOW64. It does not run 16-bit Windows programs at all, which is when the legacy VM of Lesson 16 earns its place.

On graphics, Intel explains the difference precisely. Integrated graphics don't use a separate memory bank; the GPU uses system memory shared with the CPU. Discrete graphics have their own dedicated memory that is not shared. A laptop with 16 GB of RAM and integrated graphics therefore does not meet a requirement for 8 GB of dedicated video memory. One of the firm's five machines, a thin laptop, fails here.

On compatibility, Microsoft's advice for an older app that misbehaves on Windows 11 is to look for an updated version from the publisher first. Failing that, run the Program Compatibility Troubleshooter, found under Settings, System, Troubleshoot, Other troubleshooters.

In short: read the requirements sheet line by line against each PC before installing. The one that fails, here a graphics chip, is cheaper to find on paper than after a failed install.

Getting the software onto the PCs

• Physical media versus a mountable ISO. Software once came on discs; now it often comes as an ISO disk image. There is no need to burn it. Microsoft's Mount-DiskImage command mounts an ISO so it appears as a normal disk, and File Explorer's Mount option does the same. Run the installer from the new drive letter.
• Downloadable package. An installer downloaded from the vendor, usually an .exe or .msi file on Windows. Download it from the vendor's own site and confirm its publisher, or its hash when the vendor publishes one (Lesson 1).
• Image deployment. For many identical PCs, include the app in the deployment image instead (Lesson 22).

Weighing the impact before installing

The objectives name four kinds of impact to consider before any new application goes in:

• Device: will it slow the PC, fill its drive or conflict with existing software? Test on one PC first.
• Network: a 12 GB download to five PCs at once can saturate a small office's internet link (Lesson 20). Stagger downloads, or install from one local copy.
• Operation: who will support it, who needs training, and how does the work change? Changes like this go through change management (Lesson 37).
• Business: license terms and cost, compliance, and the downtime the installation causes. Install after hours if work would otherwise stop.

The cloud move: what a productivity suite includes

Microsoft 365, like its main rival Google Workspace, bundles the tools objective 1.11 lists:

Sync and folder settings decide whether people's files are actually protected. Microsoft recommends that enterprises move the Windows known folders to OneDrive: Desktop, Documents, Pictures, Screenshots and Camera Roll. Users keep working in the folders they know, while their files are backed up to the cloud and available from any device.

Identities and licenses

The firm already has an on-premises Active Directory, and no one wants a second password. Identity synchronization solves that. Microsoft Entra Connect is an on-premises application for hybrid identity. Its features include password hash synchronization, which copies a hash of each user's on-premises password to Microsoft Entra ID so the same password works in the cloud. Microsoft now steers new deployments toward Microsoft Entra Cloud Sync, which it calls the future of synchronization and the replacement for Connect.

Then each user needs a license. In the Microsoft 365 admin center, licenses can be assigned to individual users, from the Active users or Licenses page. With group-based licensing, a license is assigned to a security group or Microsoft 365 group, and every member receives it, including people added later. Microsoft adds one prerequisite: before a license can be assigned, the user's location must be set, because some services are not available in every country.

In short: synchronize identities so one account works everywhere, and license by group so new hires are covered the moment they join it.

How the rollout ended

Four PCs met every requirement and received the rendering app from a mounted ISO, after hours, one at a time. The thin laptop with integrated graphics was swapped for a workstation with a dedicated card. Accounts synchronized from Active Directory, a "Designers" group carried the Microsoft 365 licenses, and known folder move protected everyone's desktops on day one.

Common misconceptions

• "64-bit Windows runs every old program." It runs most 32-bit programs through WOW64, but not 16-bit programs.
• "16 GB of RAM covers an 8 GB video memory requirement." Integrated graphics share system memory; the requirement is for a card with its own dedicated memory.
• "An ISO file has to be burned to a disc." Windows mounts it as a drive.
• "Cloud storage means files are synced automatically." Only folders inside OneDrive sync; known folder move brings Desktop and Documents in.
• "Licenses must be assigned one user at a time." Group-based licensing assigns them to everyone in a group, including future members.

Where this leaves us

• Check 64-bit versus 32-bit, CPU, RAM, dedicated graphics and VRAM, storage, hardware tokens and OS compatibility before installing.
• Moving 32-bit Windows to 64-bit needs a reformat and reinstall; 64-bit Windows runs 32-bit apps (WOW64) but not 16-bit ones.
• Distribute by mounted ISO, downloadable package or image; weigh device, network, operational and business impact.
• Cloud suites bundle email, storage, documents, spreadsheets, presentations, videoconferencing and messaging.
• Known folder move protects Desktop and Documents; Entra Connect or Cloud Sync synchronizes identities; group-based licensing assigns licenses, after each user's location is set.

Sources

1. Microsoft. (n.d.). 32-bit and 64-bit Windows: Frequently asked questions; Make older apps or programs compatible with the latest version of Windows. Microsoft Support. support.microsoft.com (32-bit and 64-bit); support.microsoft.com (compatibility)
2. Microsoft. (n.d.). Running 32-bit applications (WOW64); Mount-DiskImage. Microsoft Learn. learn.microsoft.com (WOW64); learn.microsoft.com (Mount-DiskImage)
3. Intel Corporation. (n.d.). What is the difference between integrated graphics and discrete graphics? (Support article 000057824). intel.com
4. Microsoft. (n.d.). Redirect and move Windows known folders to OneDrive; What is Microsoft Entra Connect?; Assign or unassign licenses for users in the Microsoft 365 admin center; Assign or unassign licenses to a group in the Microsoft 365 admin center. Microsoft Learn. learn.microsoft.com (known folders); learn.microsoft.com (Entra Connect); learn.microsoft.com (licenses); learn.microsoft.com (group licenses)

From the parking lot to the admin console

Ana is a support technician at a regional health insurer, and her walk to work passes through more security than she notices. Each layer exists because something got past the layer before it somewhere else. Core 2 objective 2.1 names these measures in two groups: physical security, which keeps the wrong people away from the equipment, and logical security, which keeps the wrong people out of the systems. Follow Ana's morning and the list stops being a list.

The perimeter

The parking lot has a fence, bright lighting after dark, and a row of short concrete posts in front of the glass entrance. Those posts are bollards. CISA's guide to vehicle barriers calls bollards a common type of passive barrier where continuous walls are not acceptable, able to blend in with architecture and landscaping. It adds an honest limit: typical bollards stop automobiles only at modest speeds, so higher-risk sites need stronger designs. Lighting and fences do quieter work, deterring intruders and making them visible to the video surveillance cameras along the building.

The door

At the entrance, a security guard watches a badge reader. Ana holds up a key fob, a small radio token. Some colleagues use a smart card with a chip that can also sign them in to their PCs, and some a mobile digital key, a credential stored on their phone. A few old doors still use plain keys. NIST's security controls catalog lists keys, locks, combinations, biometric readers and card readers as physical access devices. It requires them to be secured and inventoried, with keys and combinations changed when they are lost or when the people holding them leave.

Past the reader is an access control vestibule: a small space between two doors, the second of which will not open until the first has closed. It stops tailgating, someone following an authorized person through a door. NIST's controls also require visitors to be escorted, which is why the lobby keeps a visitor log.

Inside: watching, alarms and the server room

NIST lists guards, video surveillance cameras and sensor devices as examples of monitoring physical access. At night, motion sensors feed an alarm system. The server room adds two more checks. A magnetometer, a walk-through metal detector, screens anyone entering the data center. And a biometric reader at the door works alongside the badge. Biometric readers come in several kinds: fingerprint, palm print, retina, facial recognition technology and voice recognition. The racks have door locks, and every laptop on a desk has an equipment lock: a cable through the security slot that Lesson 9 found on the Dell laptop.

The upshot: physical security works in layers, perimeter, door, interior, room and device, so one failure does not hand over the equipment.

Signing in: factors and methods

At her desk, Ana proves who she is with multifactor authentication (MFA): at least two different kinds of factor, something you know (a password or PIN), something you have (a phone or token) and something you are (a biometric). The objectives list the common "something you have" methods:

A TOTP is the six-digit code that changes as you watch. RFC 6238 defines it as a one-time password derived from the current time, in time steps with a default length of 30 seconds. NIST's authentication guidelines (SP 800-63B-4, July 2025) draw the line that matters. Authenticators that involve manually entering an output, such as OTP and out-of-band codes, are not phishing-resistant, because an impostor site can relay the code to the real one. Phishing resistance requires cryptographic authentication, such as a security key or a passkey. NIST also restricts the use of the phone network (SMS or voice) for sending codes. And it allows biometrics only as part of MFA with a physical authenticator, never alone.

Ana signs in once in the morning. Single sign-on (SSO) then carries her into the claims system, email and a travel booking site run by a partner company. The partner step uses SAML. OASIS describes the Security Assertion Markup Language as an XML-based framework for exchanging security information between online partners, in assertions that applications in other security domains can trust. It calls web single sign-on across domains its most important use.

What she may do once inside

• Directory services and identity and access management (IAM): her account, groups and roles live in a directory such as Active Directory or Microsoft Entra ID (Lessons 22 and 25). IAM is the discipline of granting, reviewing and removing that access.
• Principle of least privilege: NIST's control AC-6 allows only the access users need to accomplish their assigned tasks. Ana's account can reset passwords, but cannot read claims.
• Access control lists (ACLs): the lists on files, folders and network devices that say which accounts may do what (Lesson 21).
• Just-in-time access and privileged access management (PAM): when Ana needs administrator rights, she requests them. Microsoft's Privileged Identity Management, for example, provides just-in-time privileged access, time-bound assignments, approval to activate a role, and MFA to activate it.
• Zero Trust model: NIST SP 800-207 describes zero trust as assuming no implicit trust based on network location or on who owns the device. Authentication and authorization happen before each session with a resource. Ana's laptop gets no extra trust for being on the office network.
• Mobile device management (MDM): her phone's work profile is managed and can be wiped of company data (Lesson 10).
• Data loss prevention (DLP): Microsoft describes DLP policies as identifying, monitoring and automatically protecting sensitive information. One example is blocking an email that contains customers' card numbers before it leaves the company.

The upshot: logical security asks three questions in order. Who are you (MFA, SSO)? What may you do (least privilege, ACLs, just-in-time access)? What is leaving (DLP, MDM)?

Common misconceptions

• "Any MFA stops phishing." NIST says manually entered codes, from apps, SMS or tokens, can be relayed by an impostor site; only cryptographic authenticators are phishing-resistant.
• "A fingerprint alone is the strongest login." NIST allows biometrics only as part of MFA with a physical authenticator.
• "Badges stop tailgating." A badge opens a door for whoever follows. A vestibule, or a guard, stops the follower.
• "Zero Trust means trusting no one inside the company." It means trust is never granted because of location or device ownership; every request is authenticated and authorized.
• "Admins should keep admin rights permanently for convenience." Just-in-time access grants them for a limited time, with approval and MFA.

Pulling it together

• Perimeter: fences, lighting, bollards (passive barriers against vehicles), cameras.
• Entry: guards, badge readers, key fobs, smart cards, mobile digital keys, keys; access control vestibules stop tailgating; visitors are escorted.
• Inside: motion sensors and alarms, magnetometers, biometric readers (fingerprint, palm, retina, face, voice), door and equipment locks.
• MFA methods: hardware tokens and passkeys (phishing-resistant), authenticator apps and TOTP (30-second steps), OTP, SMS and voice (restricted), email.
• SSO with SAML assertions between organizations; directory services and IAM manage identities.
• Least privilege, ACLs, just-in-time and privileged access management, Zero Trust, MDM and DLP control what happens after sign-in.

Sources

1. Temoshok, D., Fenton, J. L., Choong, Y.-Y., Lefkovitz, N., Regenscheid, A., Galluzzo, R., and Richer, J. P. (2025). Digital identity guidelines: Authentication and authenticator management (NIST SP 800-63B-4). National Institute of Standards and Technology. nist.gov (PDF)
2. Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5): AC-6 Least privilege; PE-3 Physical access control; PE-6 Monitoring physical access. csrc.nist.gov
3. Rose, S., Borchert, O., Mitchell, S., and Connelly, S. (2020). Zero trust architecture (NIST SP 800-207). csrc.nist.gov
4. M'Raihi, D., Machani, S., Pei, M., and Rydell, J. (2011). TOTP: Time-based one-time password algorithm (RFC 6238); OASIS. (2008). Security Assertion Markup Language (SAML) V2.0 technical overview. rfc-editor.org; oasis-open.org
5. Cybersecurity and Infrastructure Security Agency. (2020). Dams sector active and passive vehicle barriers guide. cisa.gov (PDF)
6. Microsoft. (n.d.). What is Microsoft Entra Privileged Identity Management?; Learn about data loss prevention. Microsoft Learn. learn.microsoft.com (PIM); learn.microsoft.com (DLP)

Procedure one: securing a new accountant's laptop

Malik starts in accounting on Monday, and his Windows 11 Pro laptop is already joined to the domain (Lesson 22). The technician's job is to make it secure without making it hard to use. Core 2 objective 2.2 lists the settings involved. This lesson applies them in order, then follows one access problem that reveals how permissions combine.

Step 1: the right kind of account

Malik signs in with his domain account, and it is a standard account, not an administrator. Windows offers several account types:

• Standard user: everyday work, with no rights to change the system. This is the least-privilege default (Lesson 29).
• Administrator: full control. Technicians use a separate administrator account for admin work, never for email and browsing.
• Guest: Microsoft notes the built-in Guest account is disabled by default and can provide anonymous access. It calls it a security risk and recommends leaving it disabled unless its use is necessary.
• Power user: Microsoft's reference describes Power Users as a built-in group, empty by default, whose members can create local users and groups, install programs, manage local printers and create file shares. Those rights are far more than "a little extra," so add no one without a reason.
• Local versus Microsoft account: a local account exists only on the PC (Lesson 25). A Microsoft account signs in with an online identity that can sync settings and connect OneDrive. A work PC like Malik's uses a domain or Microsoft Entra account instead.

Step 2: sign-in options

The sign-in options are the username and password, a PIN, a fingerprint and facial recognition. Malik sets up Windows Hello with a PIN and his fingerprint. Microsoft explains that Windows Hello for Business combines a device-specific credential with a biometric or PIN gesture. It adds that a PIN doesn't compromise security, because Windows Hello has built-in brute-force protection and the PIN never leaves the device. A stolen PIN is useless on any other computer, which is why passwordless sign-in with Windows Hello beats typing a password. After signing in, single sign-on carries Malik into his work apps (Lesson 29).

Step 3: User Account Control and Run as administrator

User Account Control (UAC) keeps even administrators from running everything with full rights. Microsoft explains that when an administrator signs in, Windows creates two access tokens. The standard user token, with administrative privileges removed, runs the desktop and ordinary apps. The administrator token is used only when a task needs it. Elevation then depends on the account:

• An administrator in Admin Approval Mode sees a consent prompt and simply approves.
• A standard user sees a credential prompt and must enter an administrator's credentials.

Run as administrator, from a program's right-click menu, requests that elevation for one program. That is how Lesson 24's commands get an elevated prompt.

Worth holding on to: daily work runs as a standard user, and elevation is a deliberate, prompted act for one task.

Step 4: Defender Antivirus and the firewall

In the Windows Security app, under Virus and threat protection, the technician confirms that Microsoft Defender Antivirus is active and runs Protection updates to fetch the latest security intelligence, the definitions. Microsoft describes real-time protection as continuously monitoring the device, scanning files and programs as they are accessed or run. Sometimes a technician must deactivate it to install difficult software. Microsoft explains the toggle is temporary: real-time protection turns back on automatically after a short while. While it is off, files you open or download are not scanned, and scheduled scans keep running. Never leave it off.

The Windows Defender Firewall stays activated on every profile. Lesson 25 covered application security, allowing an app through the firewall, and port security, opening a port, which Microsoft calls the riskier of the two.

Step 5: encryption

• BitLocker encrypts the whole drive, unlocked by the TPM and optionally a startup PIN (Lesson 4). On a domain- or Entra-joined PC, Microsoft notes the recovery key is backed up to Active Directory or Microsoft Entra ID. Confirm it is there before you need it.
• BitLocker To Go, Microsoft explains, is BitLocker on removable data drives: USB flash drives, SD cards and external hard disks formatted NTFS, FAT16, FAT32 or exFAT.
• Encrypting File System (EFS) encrypts individual files and folders on NTFS volumes with a public-key system tied to the user. Microsoft notes that compressed files and system files cannot be encrypted with it.

Step 6: Active Directory does the rest

Much of Malik's setup comes from the domain, not the laptop:

• Joining the domain happened before delivery (Lesson 22).
• Moving objects within organizational units: the laptop's computer object moves into the Accounting Laptops OU. Microsoft explains that OUs are created for purposes such as delegating administration and applying Group Policy.
• Selecting security groups: Malik joins the Accounting group, which carries his access to the department's files.
• Applying Group Policy: the policies linked to his OU and groups configure the laptop. gpupdate /force applies them now, and gpresult /r shows which ones arrived (Lesson 24).
• Assigning a logon script and home folder: on the Profile tab of his user account, a logon script maps the department drive at sign-in, and a home folder gives him a private network folder.
• Configuring folder redirection: Microsoft describes Folder Redirection as redirecting the path of a known folder, such as Documents, to a new location, often a file share. Users work with it as if it were still on the local drive, and the files are on the server, where they are backed up.

Procedure two: "I can open the folder, but I can't save"

On day two, Malik can open the accounting folder on the file server but cannot save changes. The input that changed is the path: he reaches the files through a share, not on his own disk. Folders have two sets of permissions. NTFS permissions apply to the files themselves, wherever they are opened from. Share permissions apply only to access over the network. Dell's guide to Windows permissions gives the rule. Locally, only NTFS permissions are used. Through a share, both NTFS and share permissions apply, and the most restrictive wins. The Accounting group has NTFS Modify, but the share grants only Read, so Read is all Malik gets. Raising the share permission to Change fixes it. Many administrators then manage access through NTFS alone.

Two more details complete the picture. Dell notes that, by default, permissions are inherited from a folder by the files and subfolders beneath it. Inheritance can be turned off, and explicit permissions on an item override inherited ones. That is why one subfolder can behave differently from its parent. And file and folder attributes, such as read-only, can block saving on their own, so check a file's Properties before rebuilding permissions.

Worth holding on to: over the network, the effective permission is the more restrictive of share and NTFS; on the PC itself, only NTFS counts.

Common misconceptions

• "Power Users is a safe middle step." Microsoft's list shows it can install programs and create shares and users.
• "Turning off real-time protection keeps it off." Microsoft says it turns back on automatically after a short while.
• "A PIN is weaker than a password." A Windows Hello PIN never leaves the device and is protected against brute-force guessing.
• "NTFS Modify means the user can modify over the network." Not if the share grants less; the most restrictive applies.
• "EFS and BitLocker are the same thing." BitLocker encrypts whole drives; EFS encrypts individual files for a user.

Summing up

• Standard accounts for daily work; separate admin accounts; Guest disabled; Power Users empty unless justified.
• Windows Hello PIN, fingerprint or face for passwordless sign-in; the PIN never leaves the device.
• UAC: consent prompts for admins, credential prompts for standard users; Run as administrator elevates one program.
• Defender Antivirus active and updated; real-time protection turns itself back on; firewall on, apps allowed rather than ports opened.
• BitLocker for drives (recovery key in AD or Entra), BitLocker To Go for removable drives, EFS for individual files.
• AD: OUs for policy and delegation, security groups for access, Group Policy, logon scripts, home folders, folder redirection.
• Share plus NTFS: the most restrictive applies over the network; inheritance flows down unless broken; check attributes.

Sources

1. Microsoft. (n.d.). Virus and threat protection in the Windows Security app. Microsoft Support. support.microsoft.com
2. Microsoft. (n.d.). Windows Hello for Business; How User Account Control works; Local accounts; Understand security identifiers. Microsoft Learn. learn.microsoft.com (Windows Hello); learn.microsoft.com (UAC); learn.microsoft.com (local accounts); learn.microsoft.com (security identifiers)
3. Microsoft. (n.d.). BitLocker overview; BitLocker FAQ; File encryption (EFS). Microsoft Learn. learn.microsoft.com (BitLocker); learn.microsoft.com (BitLocker To Go); learn.microsoft.com (EFS)
4. Microsoft. (n.d.). Reviewing OU design concepts; Folder Redirection, Offline Files, and Roaming User Profiles overview. Microsoft Learn. learn.microsoft.com (OUs); learn.microsoft.com (folder redirection)
5. Dell Technologies. (n.d.). PowerEdge: NTFS file, folder and share permissions in Windows (Knowledge base article 000137238). dell.com

Three ways in

Attacks on a small business usually arrive by one of three routes. They come through people, by persuading someone to help. They come through systems, by exploiting a weakness. Or they leave software behind that does the damage. Core 2 objectives 2.5 and 2.4 list the names on each route, and the exam asks you to tell neighbors apart: smishing from vishing, a virus from a Trojan, EDR from MDR. Comparison tables are the fastest way to learn them.

Social engineering: attacks on people

CISA defines a social engineering attack as one in which an attacker uses human interaction, social skills, to obtain or compromise information about an organization or its systems. The attacker may pose as a new employee, a repair person or a researcher.

So what?: every one of these works by creating trust or urgency. The defense is the same habit each time: verify through a channel the attacker does not control, such as calling a known number back.

Threats: attacks on systems

The money explains the attention. The FBI's IC3 reported 305,033 BEC incidents worldwide between October 2013 and December 2023, with an exposed dollar loss of about $55.5 billion. Most began with nothing more technical than an email that looked right.

Vulnerabilities: what attackers exploit

• Unpatched systems: a known flaw with a fix that was never installed.
• Unprotected systems: missing antivirus or a disabled firewall (Lesson 30).
• End-of-life (EOL) systems: no fixes will ever come (Lesson 21).
• Non-compliant systems: devices that don't meet the organization's security policy, such as missing encryption.
• Bring your own device (BYOD): personal devices the organization does not fully control (Lesson 10).

Malware compared

NIST's guide to malware incident prevention (SP 800-83 Rev. 1) defines the classic types, and later names fill out the list.

Tools and methods: detect, remove, prevent

For ransomware, CISA's guide puts preparation first. It calls for offline, encrypted backups of critical data, regularly tested, because many ransomware variants hunt for backups they can reach and delete or encrypt them. Lesson 36 follows the malware removal procedure step by step.

So what?: no single tool covers all three routes. Training protects people, patching protects systems, and layered detection catches the software that gets through.

Common misconceptions

• "A Trojan spreads itself like a virus." NIST defines Trojans as nonreplicating; they rely on someone running them.
• "MFA makes vishing harmless." A caller who talks a user into reading out a code defeats any code-based MFA.
• "Zero-day means the attack happened today." It means the vulnerability was unknown, so no patch existed.
• "Adware is harmless." Microsoft notes potentially unwanted apps can install other unwanted software; remove them.
• "Backups on a mapped drive protect against ransomware." CISA stresses offline backups, because ransomware seeks out reachable copies.

Looking back

• Social engineering: phishing (email), spear phishing (targeted), whaling (executives), vishing (voice), smishing (SMS), QR code phishing, shoulder surfing, tailgating, impersonation, dumpster diving.
• Threats: DoS and DDoS, evil twin, zero-day, spoofing, on-path, brute-force and dictionary attacks, insider threat, SQL injection, XSS, BEC, supply chain.
• Vulnerabilities: unpatched, unprotected, EOL and non-compliant systems, and BYOD.
• Malware: virus, boot sector virus, Trojan, rootkit, keylogger, spyware, stalkerware, ransomware, cryptominer, fileless, adware and PUPs.
• Tools: antivirus and anti-malware, EDR, XDR, MDR, email security gateway, software firewall, recovery console, OS reinstallation, user education; offline, tested backups for ransomware.

Sources

1. Souppaya, M., and Scarfone, K. (2013). Guide to malware incident prevention and handling for desktops and laptops (NIST SP 800-83 Rev. 1). National Institute of Standards and Technology. csrc.nist.gov
2. Cybersecurity and Infrastructure Security Agency. (n.d.). Avoiding social engineering and phishing attacks; Understanding denial-of-service attacks; #StopRansomware guide; (2021). Defending against software supply chain attacks. cisa.gov (social engineering); cisa.gov (DoS); cisa.gov (ransomware); cisa.gov (supply chain, PDF)
3. National Institute of Standards and Technology. (n.d.). Computer Security Resource Center glossary: zero day attack; man-in-the-middle attack; brute force password attack; spoofing; insider threat. csrc.nist.gov (zero day); csrc.nist.gov (on-path); csrc.nist.gov (spoofing)
4. OWASP Foundation. (n.d.). SQL injection; Cross site scripting (XSS). owasp.org (SQL injection); owasp.org (XSS)
5. Federal Bureau of Investigation, Internet Crime Complaint Center. (2024, September 11). Business email compromise: The $55 billion scam (Alert I-091124-PSA). ic3.gov
6. Microsoft. (n.d.). Fileless threats; Detect and block potentially unwanted applications; Overview of endpoint detection and response capabilities; What is Microsoft Defender XDR?; Microsoft Defender Experts; Windows Recovery Environment (Windows RE). Microsoft Learn. learn.microsoft.com (fileless); learn.microsoft.com (PUA); learn.microsoft.com (EDR); learn.microsoft.com (XDR); learn.microsoft.com (MDR); learn.microsoft.com (WinRE)

The password policy argument

A dental practice's office manager hands the new technician the practice's password policy. Passwords must be 8 characters, with an uppercase letter, a number and a symbol, and must change every 90 days. The technician wants to replace it with long passphrases, no forced changes, and a password manager. The manager is unconvinced. Both positions have evidence behind them, and Core 2 objective 2.7 lists every factor they argue about: length, character types, uniqueness, complexity and expiration.

The case for complexity and expiration

The office manager's policy is not superstition. Expiration limits how long a stolen password stays useful, and the A+ objectives themselves list expiration and complexity among password considerations. Some rules still require it. The PCI Security Standards Council, whose standard covers businesses that take card payments, explains that PCI DSS requirement 8.3.9 applies when passwords are the only factor. In that case passwords must be changed at least every 90 days, or the security posture of accounts must be analyzed dynamically.

The case for length, no forced changes and a manager

NIST's authentication guidelines (SP 800-63B-4, 2025) take the other side, firmly:

• A password used as the only factor must be at least 15 characters; one used only as part of MFA may be shorter, but at least 8.
• Verifiers shall not impose other composition rules, such as requiring mixtures of character types.
• Verifiers shall not require periodic password changes, but shall force a change if there is evidence of compromise.
• New passwords must be checked against a blocklist of commonly used, expected or compromised values.
• Verifiers shall allow password managers and autofill.

Microsoft's password guidance explains why. Research shows that almost every rule imposed on users weakens password quality, because length, character and change requirements all push people toward predictable patterns that attackers guess easily. Microsoft recommends that cloud-only accounts' passwords never expire.

What settles it

Two facts settle the argument for most offices. First, does a rule apply? If the practice takes cards, PCI DSS may. Second, is MFA in place? The PCI Council's FAQ says requirement 8.3.9 does not apply to system components where MFA is used. So the resolution is to turn on MFA everywhere, then follow NIST. Require long passphrases, drop composition rules, check passwords against a blocklist, stop routine forced changes, and force a change immediately when there is evidence of compromise. Each password should be unique, which is only practical with a password manager. Where a rule still demands expiration for password-only accounts, keep it there and nowhere else.

The core of it: length, uniqueness and MFA beat complexity and rotation. Expire a password when it is compromised, or when a rule you must follow requires it.

Hardening the workstation

• Data-at-rest encryption: BitLocker on Windows and FileVault on Macs (Lessons 26 and 30).
• BIOS/UEFI passwords: a supervisor password stops anyone from changing boot order or Secure Boot (Lesson 4).
• Screen locks and logging off: Microsoft's policy setting Interactive logon: Machine inactivity limit locks the session through the screen saver once the PC is idle for longer than the limit. Users should also lock or log off whenever they walk away.
• Protecting hardware and data: cable locks on laptops (Lesson 29); no passwords or PII on sticky notes or in unprotected files; a password manager for every credential.
• Account management: restrict user permissions to what each job needs (Lesson 29). Microsoft's net user command can restrict sign-in times with /times, giving the days and times a user may sign in, and set an account expiration date with /expires, ideal for contractors. Keep the Guest account disabled (Lesson 30).
• Failed attempts lockout: Microsoft's Account lockout threshold policy sets how many failed sign-ins lock an account, from 1 to 999. Zero means never lock. Lockout slows brute-force guessing (Lesson 31).
• The default administrator account: Microsoft notes that Windows Setup disables the built-in Administrator and creates another administrator account, and that keeping the built-in one disabled is best practice. Renaming it helps less than people think, because the account keeps the same well-known security identifier. On routers and other devices, always change the default administrator password (Lesson 33).
• Disable AutoRun (AutoPlay in Settings), so that inserting a drive or disc cannot launch a program by itself.
• Disable unused services: every running service is something an attacker could exploit, so turn off those the PC does not need.

Hardening the browser

The browser is where most attacks meet the user, so objective 2.11 gives it its own list:

• Installation from trusted sources: download browsers only from the maker, and check the published hash where one is offered (Lesson 1). Untrusted download sites bundle adware.
• Patching: browsers update themselves, but the update takes effect only after a restart.
• Extensions and plug-ins: install only from the official store, only what is needed, and remove the rest. An extension can read every page you visit.
• Password managers: the browser's own manager or a dedicated one, which NIST says sites must allow.
• Secure connections and valid certificates: a certificate warning means stop, not click through.
• Settings: the pop-up blocker stays on. Clearing browsing data and the cache fixes stale pages and protects privacy on shared PCs. Sign-in and data synchronization carries bookmarks and passwords between devices, so protect the account with MFA. Ad blockers cut malicious advertising. The proxy setting follows the system's (Lesson 25).
• Private browsing: Google explains that Incognito limits what is saved on the device but doesn't make you invisible. Websites, and organizations that manage the network, such as a school, employer or internet provider, may still observe the activity.
• Secure DNS: Chrome encrypts DNS lookups, by default in an automatic mode that falls back to unencrypted lookups if needed. With a custom provider chosen, Chrome won't fall back. Google notes the feature is unavailable on managed devices or with parental controls on.
• Browser feature management: organizations enable or disable plug-ins, extensions and features centrally, by policy.

Hardening mobile devices

• Device encryption: Apple explains that setting a passcode also turns on data protection, which encrypts iPhone data with 256-bit AES. Android devices use file-based encryption, which Android's documentation recommends for new devices.
• Screen locks: facial recognition, fingerprint, PIN, pattern or swipe. Google's guidance is blunt: swipe gives no protection, a 6-digit PIN is recommended, and a strong password is the most secure option.
• Configuration profiles: settings packages, usually pushed by MDM, that enforce passcodes, Wi-Fi and VPN (Lesson 10).
• Patch management: install OS updates and app updates promptly.
• Endpoint security software: antivirus and anti-malware where the platform supports it, and content filtering for managed devices.
• Locator apps and remote wipes: Find My on Apple devices, and Google's Find Hub, which lets an owner find, secure or erase a lost Android device remotely.
• Remote backup apps: iCloud or Google backups make a remote wipe affordable.
• Failed login attempt restrictions: an iPhone can be set to erase all data after 10 failed passcode attempts, with the Erase Data setting.
• Policies and procedures: MDM, the difference between BYOD and corporate-owned devices, and profile security requirements, such as a minimum passcode, are covered in Lesson 10.

Common misconceptions

• "Complex passwords that change every 90 days are best practice." NIST forbids composition rules and routine forced changes; long, unique passwords with MFA are stronger.
• "Renaming the Administrator account hides it." Microsoft notes it keeps the same well-known security identifier; disable it instead.
• "Incognito hides browsing from the network." Google says employers, schools and internet providers may still see it.
• "Swipe to unlock is a lock." Google says it gives no protection.
• "Remote wipe is a last resort with no downside." Without a backup, it destroys the user's data too; set up backups first.

What to remember

• Passwords: 15 characters or more for single-factor use, no composition rules, no routine forced changes, a blocklist, password managers, MFA; PCI's 90-day rule applies only where MFA is not used.
• Workstations: encryption, firmware passwords, inactivity screen locks, least privilege, sign-in time limits and expiration dates, lockout thresholds, a disabled built-in Administrator and Guest, AutoRun off, unused services off.
• Browsers: trusted sources and stores, prompt patching, valid certificates, pop-up blocker, private browsing's limits, secure DNS, centrally managed features.
• Mobile: passcode-based encryption, real screen locks (not swipe), configuration profiles, updates, endpoint software, Find My or Find Hub, remote backup, erase after failed attempts, MDM policy.

Sources

1. Temoshok, D., Fenton, J. L., Choong, Y.-Y., Lefkovitz, N., Regenscheid, A., Galluzzo, R., and Richer, J. P. (2025). Digital identity guidelines: Authentication and authenticator management (NIST SP 800-63B-4), section 3.1.1.2. nist.gov (PDF)
2. PCI Security Standards Council. (2025). Do PCI DSS requirements 8.3.9 and 8.3.10.1 apply to all system components? (FAQ 1590); Microsoft. (n.d.). Password policy recommendations for Microsoft 365 passwords. pcisecuritystandards.org; learn.microsoft.com
3. Microsoft. (n.d.). Interactive logon: Machine inactivity limit; Account lockout threshold; Local accounts; net user. Microsoft Learn. learn.microsoft.com (inactivity); learn.microsoft.com (lockout); learn.microsoft.com (local accounts); learn.microsoft.com (net user)
4. Google. (n.d.). Browse in Incognito mode; Use secure DNS [Chrome Help]; Set screen lock on an Android device; Find, secure, or erase a lost Android device [Android Help]. support.google.com (Incognito); support.google.com (secure DNS); support.google.com (screen lock); support.google.com (Find Hub)
5. Apple. (n.d.). Set a passcode on iPhone. iPhone User Guide; Android Open Source Project. (n.d.). Encryption. support.apple.com; source.android.com

Procedure one: a new router for a law office

A ten-person law office has bought a new router with built-in Wi-Fi, and the technician has one afternoon to set it up properly. Core 2 objectives 2.10 and 2.3 list what "properly" means. Work through them in order. A router left on factory settings is a gift to attackers.

1. Place it securely. The router goes in the locked communications closet, not on the reception desk where a visitor could press its reset button or plug into a spare port.
2. Change the default passwords. CISA warns that most network devices come with default administrator passwords. Those credentials may be published online or even printed on the device, and leaving them unchanged lets attackers in. Set a long, unique administrator password and, if the router allows it, a new administrator username.
3. Update the firmware. CISA calls regular software updates one of the most effective steps for home and small-office networks, because they include critical security fixes. Install the latest firmware now, and turn on automatic updates if the router offers them.
4. Configure secure management access. Allow the administration page only from the office network, over HTTPS, and turn off remote administration from the internet.
5. Turn off UPnP. Universal Plug and Play lets any device on the network ask the router to open ports on its own. That is convenient for a game console, and just as convenient for malware. Turn it off unless a specific device truly needs it.
6. Set firewall rules. Block unsolicited inbound traffic, and disable ports and services the office does not use. Use port forwarding (port mapping) only for a named service that must be reachable from outside. Never forward file sharing; remote staff use the VPN (Lesson 15). IP filtering allows or blocks specific addresses, and content filtering blocks categories of websites and known malicious sites.
7. Use a screened subnet for public servers. The office's client portal runs on a server in the closet. NIST's firewall guide describes a DMZ, now often called a screened subnet, as a firewall interface where organizations commonly put public-facing servers. Traffic from those servers to the internal network still passes through the firewall, so a compromised web server does not sit next to the file server.

Bottom line: new credentials, current firmware, management locked to the inside, UPnP off, and only the ports the business needs.

The wireless settings

The other wireless settings follow. Change the SSID from the factory name, which advertises the router's make, and avoid the firm's name if you would rather not announce it. Disabling SSID broadcast hides the name from casual lists, but devices still send the name when they connect, so it is not a security control; encryption is. Configure guest access on a separate network, isolated from the office (Lesson 15's VLANs), so clients' phones never see the file server.

Authentication: who may join, and who may manage

A shared passphrase suits a small office. A larger one uses WPA3-Enterprise, where each person signs in with their own account, checked by a RADIUS server (Lesson 15). Leaving staff then means disabling one account, not changing everyone's passphrase. TACACS+ serves a different job, authenticating and authorizing the administrators of network devices and logging their commands. Kerberos is the authentication protocol Microsoft describes as verifying the identity of a user or host. Windows domains use version 5: a user signs in once and receives tickets that grant access to file servers and other services without re-entering a password. Its timestamps are why clocks must agree (Lesson 15). Multifactor authentication belongs on the router's administration account and the VPN as much as on email (Lesson 29).

Procedure two: retiring the old PCs

The same office is retiring eight PCs. The input that changes the procedure is where each drive is going, and what kind of drive it is. NIST's guidelines for media sanitization (SP 800-88 Rev. 2, September 2025) define three methods:

• Clear: logical techniques that overwrite all user-addressable storage, protecting against simple, non-invasive recovery through the normal interface.
• Purge: techniques that make recovery infeasible even with state-of-the-art laboratory techniques, while leaving the device reusable. They include overwriting, block erase and cryptographic erase. NIST says to use purge instead of clear when possible.
• Destroy: techniques that make recovery infeasible and the device unusable.

Applied to the eight PCs:

Three details trip people up. Degaussing erases magnetic media with a strong magnetic field, but NIST says it should not be used on non-magnetic media such as SSDs. Many older degaussers are too weak for modern high-coercivity hard drives anyway. Drilling a hole through a drive feels final, but NIST warns that drilling, bending or cutting may only partly damage it, leaving portions recoverable in a lab. Standard formatting on its own is not sanitization unless it overwrites every sector. What tools call low-level formatting on modern drives is in practice an overwrite, since the true low-level format is done at the factory.

Outsourcing to a third-party vendor is common for destruction. Get a certificate of destruction, or of recycling, listing each drive's serial number and the method. NIST's guidelines include a sample Certificate of Sanitization form. For the rest of the hardware, the EPA encourages using certified electronics recyclers. It names two accredited certification standards, R2 and e-Stewards, both audited by independent third parties.

Regulatory and environmental requirements drive all of this. Laws and contracts covering health, financial and personal data require documented disposal, and environmental rules keep electronics out of landfill. The certificate is the proof for both.

Bottom line: pick the method by the drive's destination and type, purge before anything leaves the building, destroy what cannot be purged, and keep the certificate.

Common misconceptions

• "Hiding the SSID secures Wi-Fi." The name still travels when devices connect; WPA3 or WPA2 with AES is the protection.
• "WPA2 with TKIP is fine." TKIP was an interim fix for WEP; use AES.
• "Degaussing erases any drive." NIST says not to use it on SSDs and other non-magnetic media.
• "A drilled drive is destroyed." NIST warns drilling may leave portions of the data recoverable.
• "A quick format wipes a drive." It deletes the file table; the data remains until overwritten.

The takeaway

• Router: secure placement, new default credentials, current firmware, LAN-only HTTPS management, UPnP off, unused ports disabled, forwarding only when needed, IP and content filtering, a screened subnet for public servers.
• Wireless: WPA3 (or WPA2 with AES, never TKIP), a renamed SSID, isolated guest access; hiding the SSID is not security.
• Authentication: RADIUS for network sign-in, TACACS+ for device administration, Kerberos tickets in Windows domains, MFA everywhere it is offered.
• Sanitization: clear, purge or destroy by destination and drive type; no degaussing SSDs; drilling is not reliable destruction; quick formats are not wipes.
• Outsource with certificates of destruction; recycle through R2 or e-Stewards certified recyclers; meet regulatory and environmental duties.

Sources

1. Cybersecurity and Infrastructure Security Agency. (n.d.). Home network security. cisa.gov
2. Wi-Fi Alliance. (n.d.). Wi-Fi security (WPA3, Wi-Fi Enhanced Open, Protected Management Frames); Frankel, S., Eydt, B., Owens, L., and Scarfone, K. (2007). Establishing wireless robust security networks: A guide to IEEE 802.11i (NIST SP 800-97, withdrawn). wi-fi.org; nist.gov (PDF)
3. Scarfone, K., and Hoffman, P. (2009). Guidelines on firewalls and firewall policy (NIST SP 800-41 Rev. 1), section 3 (DMZ). csrc.nist.gov
4. Microsoft. (n.d.). Kerberos authentication overview; format [Windows commands reference]. Microsoft Learn. learn.microsoft.com (Kerberos); learn.microsoft.com (format)
5. Chandramouli, R., and Hibbard, E. A. (2025). Guidelines for media sanitization (NIST SP 800-88 Rev. 2). National Institute of Standards and Technology. csrc.nist.gov
6. U.S. Environmental Protection Agency. (n.d.). Certified electronics recyclers; Electronics donation and recycling. epa.gov (certified recyclers); epa.gov (donation and recycling)

The tempting fix

"Just reinstall Windows" ends many tickets, and it ends them badly. It takes hours, loses settings and sometimes data, and often brings the problem straight back, because the cause was a driver, a disk, a setting or a piece of hardware all along. This lesson takes each Windows symptom in Core 2 objective 3.1, starts from the tempting wrong answer, and traces where that reasoning fails. The method is Lesson 17's. Here it meets Windows itself.

Stop errors and an unstable system

The tempting fix: a PC shows a blue screen of death (BSOD) twice in a morning, so reinstall. Where it fails: the stop screen is evidence, and reinstalling discards it. Microsoft notes that the stop code at the bottom of the screen, such as MEMORY_MANAGEMENT, helps determine the cause, and that a hardware device, its driver or software can be responsible. Its first steps are to remove newly added hardware, check Device Manager, keep 10 to 15% of the drive free and install updates (Lesson 17). If the crashes began after a driver update, roll that driver back (Lesson 23). If they began after a Windows update, uninstall that update from the recovery options.

System instability without a clear stop code calls for checking Windows' own files. sfc /scannow scans and repairs protected system files (Lesson 24). When sfc cannot repair everything, Microsoft points to a more extensive check that can repair the component store itself: DISM /Online /Cleanup-Image /RestoreHealth. Then run sfc again. If both pass and the PC is still unstable, test the memory and check temperatures (Lesson 17); hardware is next in line.

Key idea: the last change is the first suspect. A driver, an update or new hardware explains most sudden instability, and each can be undone without a reinstall.

Boot issues and "No OS found"

The tempting fix: the PC says no operating system was found, so the drive has died. Where it fails: Microsoft divides startup into four phases, each with a different cause:

Finding the phase finds the fix. For a PreBoot failure, check firmware first: is the drive listed, and is the boot mode UEFI? For the later phases, Microsoft's tools run from the Windows Recovery Environment (Lesson 31). Startup Repair diagnoses and fixes many common startup issues automatically. Windows starts it by itself when it detects a startup problem. From the recovery command prompt, bootrec /fixmbr repairs the master boot code and bootrec /fixboot the boot sector. For BCD errors, bootrec /scanos looks for installations, and bootrec /rebuildbcd rebuilds the store after the old one is exported and renamed.

Slowness, shutdowns, services and crashing apps

• Degraded performance. Tempting fix: buy more memory. Where it fails: slowness has many causes, and Task Manager shows which one this is (Lesson 23). Check startup apps with High impact, a disk at 100% or nearly full, a process eating CPU, and malware (Lesson 36). Upgrade hardware only when the measurements say so.
• Frequent shutdowns. Tempting fix: a Windows bug. Where it fails: a sudden power-off with Kernel-Power Event ID 41 and no stop code points to power or heat (Lesson 17), not software.
• Services not starting. Tempting fix: set the service to Manual and move on. Where it fails: something that depends on it will break later. Event Viewer's System log records why the service failed. In the Services console, the service's Dependencies tab shows what it needs running first, and its Log On tab shows which account it runs as. A changed or expired password on that account is a classic cause.
• Applications crashing. Tempting fix: reinstall Windows. Where it fails: one crashing program is that program's problem. Read its entries in Event Viewer's Application log, install the vendor's update or use its repair option, check its compatibility (Lesson 28), and reinstall only the app.

Low memory warnings and USB controller resources

Low memory warnings. Tempting fix: delete the page file to free disk space. Where it fails: Microsoft explains that the system commit limit, the most memory Windows can promise to programs, is physical memory plus all page files. Removing the page file shrinks that limit, so the warnings get worse and a crash dump cannot be written. Leave the page file system-managed. Then find the program using the memory in Task Manager, often one that leaks, and add RAM only if the legitimate peak exceeds it.

USB controller resource warnings. Tempting fix: the new device is faulty. Where it fails: the message "Not enough USB controller resources" is about the controller, not the device. Plugable, a maker of docks and hubs, explains that each USB controller has a limited number of endpoints, and each device uses several, up to 32. A laptop's built-in camera, Bluetooth and card reader may already have used most of them. Move some devices to a port on a different controller, and the "faulty" device works.

Slow profile loads and time drift

Slow profile load. Tempting fix: delete and rebuild the user's profile. Where it fails: rebuilding loses settings and fixes nothing if the cause is size. With roaming profiles, Microsoft explains, the user's profile is copied from a file share to the local computer and merged at each sign-in. A profile full of large files therefore takes minutes to arrive. Redirecting folders such as Documents to the server (Lesson 30) keeps the profile small. Also check logon scripts and drive mappings that wait on slow network paths.

Time drift. Tempting fix: set the clock by hand. Where it fails: the drift returns, and in a domain, Kerberos sign-ins depend on clocks that agree; Microsoft advises a maximum difference of 5 minutes (Lesson 15). Microsoft's w32tm tool shows and fixes the Windows Time service. w32tm /query /status shows the time source and last synchronization, and w32tm /resync tells the computer to resynchronize as soon as possible. The time client uses UDP port 123, so a firewall blocking it causes drift too. A clock that is wrong only after the PC has been unplugged points to the coin-cell battery (Lesson 17).

Key idea: every one of these has a cheaper, more certain fix than a reinstall. Keep the reinstall for when the evidence says the installation itself is beyond repair, and back up first.

Common misconceptions

• "A BSOD means Windows is corrupt." Microsoft lists hardware devices, drivers and software as causes; read the stop code and undo the last change.
• "No OS found means the drive is dead." It is a PreBoot-phase message; check the firmware's drive list, boot order and boot mode first.
• "Disabling the page file speeds Windows up." It lowers the commit limit, causing low memory errors and preventing crash dumps.
• "sfc fixes everything." When sfc cannot repair files, DISM /RestoreHealth repairs the component store it draws on.
• "A slow sign-in needs a new profile." Large roaming profiles and slow logon scripts are more common causes.

Recap

• BSOD: read the stop code, remove new hardware, roll back drivers or updates; instability: sfc, then DISM /RestoreHealth, then hardware tests.
• Boot: identify the phase (PreBoot, Boot Manager, OS Loader, Kernel); Startup Repair; bootrec /fixmbr, /fixboot, /scanos and /rebuildbcd.
• Performance, shutdowns, services and app crashes: Task Manager, Event ID 41, the System and Application logs, dependencies and service accounts.
• Low memory: commit limit equals RAM plus page files, so keep the page file. USB resources: spread devices across controllers.
• Slow profiles: large roaming profiles and logon scripts; redirect folders. Time drift: w32tm /query /status and /resync, UDP 123, the coin-cell battery.

Sources

1. Microsoft. (n.d.). Advanced troubleshooting for Windows boot problems; How to determine the appropriate page file size for 64-bit versions of Windows. Microsoft Learn. learn.microsoft.com (boot); learn.microsoft.com (page file)
2. Microsoft. (n.d.). Repair a Windows image (DISM); Windows Time service tools and settings (w32tm). Microsoft Learn. learn.microsoft.com (DISM); learn.microsoft.com (w32tm)
3. Microsoft. (n.d.). Troubleshooting Windows unexpected restarts and stop code errors. Microsoft Support; Folder Redirection, Offline Files, and Roaming User Profiles overview. Microsoft Learn. support.microsoft.com (stop codes); learn.microsoft.com (roaming profiles)
4. Plugable Technologies. (n.d.). Not enough USB controller resources error [Knowledge base]. plugable.com

The problem: one phone, five complaints

A sales manager hands over her company phone with a list. The battery is empty by lunchtime. The phone feels hot in her pocket. A data warning arrived halfway through the month. Ads now appear outside the browser. And tap-to-pay stopped working at the coffee shop. Is that one fault or five? Is it hardware, the operating system, an app or malware?

This lesson covers three objectives that meet in that one phone: mobile hardware symptoms (Core 1 objective 5.4), mobile OS and app problems (Core 2 objective 3.2) and mobile security problems (Core 2 objective 3.3). The method is Lesson 17's, with an order that saves time and data. Check the physical device first, then the software, then the security questions. And back up before any step that erases data.

Start with the hardware

Look before you tap. Remove the case, then check the screen, the ports and the shape of the device. Most hardware symptoms announce themselves to a careful eye.

A phone that is hot while sitting idle is worth a second look. Normal heat follows work: Apple lists setup, restoring a backup, big updates, wireless charging and games. Heat with no work points to something running that the user did not start, which is the security section's question.

Then the operating system and the apps

An app fails to launch, crashes or will not close. Apple and Google give nearly the same ladder, cheapest step first:

1. Force the app to close, then reopen it.
2. Restart the device. On most Android phones, holding the power button for about 30 seconds forces a restart.
3. Update the app from its store, and update the operating system.
4. On Android, force stop the app and clear its cache. Google calls this a short-term fix, because cached data builds up again.
5. Clear the app's data on Android, or delete and redownload it on an iPhone. Both can erase data stored in the app.
6. Still failing? Apple and Google both say to contact the app's developer.

An app or the OS fails to install or update. Apple lists what an update needs: a compatible device, an internet connection and enough storage. Its reasons for failure follow from that. The device may not support the new version, storage may be short, the download may be slow, or the update server may be out of reach. For storage, Apple suggests Offload Unused Apps, which frees space without deleting personal information. The same causes explain most app install failures too, along with an app that needs a newer OS than the device can run (Lesson 28).

Slow to respond, random reboots and short battery life. Google's guide for a phone that restarts or crashes starts with updates and storage: a phone can start having issues when less than 10% of its storage is free. Next comes safe mode, which temporarily turns off all downloaded apps. If the problem stops in safe mode, an app is the likely cause. Remove recently downloaded apps one at a time, restarting after each. Google also suggests removing cases and external battery packs. A factory reset comes last, after a backup. On an iPhone, Apple explains that unexpected shutdowns are more likely with a low charge, an aged battery or cold temperatures. Check Battery Health before blaming iOS.

Connectivity: Wi-Fi, Bluetooth and NFC.

• Wi-Fi. Apple's order: Wi-Fi on, Airplane Mode off, then a test without any VPN or security app installed. Reset network settings only if everything else fails. That removes all Wi-Fi networks and passwords, cellular settings, and VPN and APN settings, so on a school or business phone, ask IT first.
• Bluetooth. Bluetooth on and the accessory charged and in pairing mode. Then forget the device and pair it again (Lesson 10).
• NFC. For tap-to-pay, Google's checklist: NFC on, Google Wallet as the default payment app, a screen lock set and the phone unlocked before paying. The antenna may sit near the top or middle of the phone, and a thick case can interrupt the signal.

Screen does not autorotate. On an iPhone, check that Portrait Orientation Lock in Control Center is off. Then test in an app that rotates, such as Calculator or Safari, because some apps do not support rotation at all. Apple also suggests the Measure app's level to check whether the phone detects orientation changes. On Android, the switch is Auto-rotate screen, under Settings, Display and touch on Google's phones. Menu names vary by maker.

The point: most mobile app and OS problems yield to the same ladder. Close, restart, update, isolate with safe mode, and erase only after a backup.

Last, the security questions

Back to the sales manager's phone. The heat, the battery drain, the early data warning and the ads fit one cause better than four: an app doing work she did not ask for. Core 2 objective 3.3 lists the concerns that let such apps in.

The symptoms in the objective map to causes like this:

• High network traffic and a data-usage limit notification. Android lets the user set a data warning, which sends a notification, and a limit, which turns mobile data off. A warning that arrives early with no change in habits is a clue. The App data usage list shows how much data each app uses.
• Degraded response time. Background work by an unwanted app competes with the user's own. Check battery and data use by app, then test in safe mode.
• Limited or no internet connectivity. A rogue VPN or security app can route or block traffic. Apple's Wi-Fi steps test by uninstalling such software.
• A high number of ads. Google lists pop-up ads that will not go away as a sign of malware.
• Fake security warnings. A pop-up claims the phone is infected and offers a cleaner app or a phone number. The FTC says real security pop-up warnings will never ask you to call a phone number.
• Unexpected application behavior. Apps opening or settings changing by themselves. Google adds contacts receiving messages you did not send.
• Leaked personal files or data. Treat it as an incident. Change passwords, turn on multifactor authentication and report it under the organization's policy (Lesson 39).

Google's malware steps for Android make a good model on either platform. Turn on Play Protect, install system and security updates, remove apps you do not trust, and run the Google account's Security Checkup. If the phone is still compromised, back up the data and factory reset. Google warns that reinstalling the app that caused a problem can bring it back.

Common misconceptions

• "Put a wet phone in rice." Apple says not to: rice particles can damage the phone. Moving air and time do the job.
• "A phone that stops charging at 80 percent is faulty." Optimized Battery Charging, a charge limit or heat can all hold it there on purpose.
• "Clearing an app's cache erases my data." Clearing cache removes temporary files; clearing data, or deleting the app, is what can erase data stored in it.
• "Jailbreaking only adds features." Apple lists security holes, instability, battery drain and failed future updates.
• "A virus warning in the browser proves the phone is infected." It is often a scam page. Close it, never call the number, and check the phone with its built-in protection.

What to carry forward

• Order: hardware, then OS and apps, then security. Back up before anything that erases data.
• Hardware: Battery Health and charge cycles, swelling (stop), ports and debris, liquid (air and time, no rice), heat limits, the digitizer drag test, calibration and stylus pairing.
• Apps: close, restart, update, clear cache, then data or reinstall, then the developer. OS updates need a compatible device, a connection and storage.
• Reboots and slowness: storage under 10%, safe mode to find the app, factory reset last. Connectivity: Wi-Fi, Bluetooth and NFC checklists; reset network settings last.
• Security: unofficial stores, developer mode, root and jailbreak, spoofed apps. Symptoms: data spikes, slowness, lost connectivity, ads, fake warnings, odd behavior and leaks.

Sources

1. Apple. (n.d.). iPhone battery and performance; If your iPhone or iPod touch won't charge; If you see a liquid-detection alert on your iPhone; If your iPhone or iPad gets too hot or too cold. Apple Support. support.apple.com (battery); support.apple.com (charging); support.apple.com (liquid); support.apple.com (temperature)
2. Apple. (n.d.). If an app on your iPhone or iPad stops responding, closes unexpectedly, or won't open; If your iPhone or iPad won't update; If you can't connect to Wi-Fi on your iPhone or iPad; Rotate the screen on your iPhone or iPod touch; If you can't pair Apple Pencil with your iPad. Apple Support. support.apple.com (apps); support.apple.com (updates); support.apple.com (Wi-Fi); support.apple.com (rotation); support.apple.com (Apple Pencil)
3. Apple. (n.d.). Unauthorized modification of iOS [iPhone User Guide]; Enabling Developer Mode on a device [Developer documentation]. support.apple.com (jailbreaking); developer.apple.com
4. Google. (n.d.). Fix an installed Android app that isn't working; Find problem apps by rebooting to safe mode on Android; Fix an Android device that's restarting or crashing; Fix a screen that isn't working right on Android. Android Help. support.google.com (apps); support.google.com (safe mode); support.google.com (restarts); support.google.com (screen)
5. Google. (n.d.). Remove malware or unsafe software; Use Google Play Protect to help keep your apps safe and your data private; Fix problems with tap to pay transactions; Reduce and manage mobile data usage; How to make your screen rotate all by itself. Google Help Centers. support.google.com (malware); support.google.com (Play Protect); support.google.com (tap to pay); support.google.com (data usage); support.google.com (auto-rotate)
6. Federal Trade Commission. (n.d.). How to spot, avoid, and report tech support scams. Consumer Advice. consumer.ftc.gov

Thursday, 8:05 am: the alerts start

Ray manages a three-person accounting office, and his Windows 11 Home desktop has started talking back. A box in the corner of the screen says his antivirus subscription has expired and offers a renewal by phone. The office has never bought that product; it uses the Microsoft Defender built into Windows. Chrome now opens to a home page he did not choose. His searches pass through an unfamiliar search engine, and pop-ups cover the pages he reads. He calls the office's part-time technician, and the clock starts.

This lesson follows her morning. It covers the symptoms of a compromised PC (Core 2 objective 3.4) and the ten-step malware removal procedure for a small office or home office (Core 2 objective 2.6). The steps are CompTIA's. The evidence behind each one comes from Microsoft, NIST, CISA, the FTC and Google.

8:20 am: reading the symptoms

The FTC's list of malware signs makes a good first screen. It names a computer that slows down, freezes or crashes; a changed home page or redirects; new toolbars or add-ons; lots of pop-up ads; repeated operating system errors; disabled tools such as Task Manager; and messages the user did not send. The objective's symptoms map onto that list. Several also have innocent explanations, and step 1 of the procedure is about telling them apart.

Two rows change the plan at once. If files are being renamed or encrypted, this is ransomware: isolate the PC and escalate it as an incident (Lesson 39). And if a managed PC has lost its network by itself, check before you "fix" it. Microsoft Defender for Endpoint, for example, can isolate a compromised device. Isolation cuts it off from the network while keeping its link to the security service. That is containment working, not a fault.

Ray's PC shows no renamed files and still reaches the network. In Settings, Apps, Installed apps, two programs stand out, both installed yesterday afternoon: a free "PDF converter" and the security product from the pop-up. Chrome has a new extension. Windows Security's protection history is empty, which fits the FTC's warning that malware can go undetected even with security software running. Symptoms verified.

8:35 am: steps 1 to 3, stopping the spread

1. Investigate and verify malware symptoms. Done above. Verifying first avoids wiping a PC whose real problem was a wrong clock or a full disk.
2. Quarantine the infected system. She unplugs the Ethernet cable and turns off Wi-Fi. Nobody plugs a USB drive from this PC into another one. CISA's ransomware guide gives the same order of preference: unplug affected devices or remove them from Wi-Fi. Power them down only if they cannot be disconnected, because that destroys evidence held in memory.
3. Disable System Restore (Windows Home). Microsoft describes restore points as snapshots of system files, installed applications, the registry and settings. A snapshot taken after the infection may hold the malware, and rolling back to it later would bring the malware back. VAIO's support article notes that disabling System Restore deletes all restore points, which is the goal here. Step 9 turns it back on.

Why this matters: the first three steps stop the damage from growing before any cleaning begins. A technician who scans for an hour while the PC stays on the network gives the malware that hour to spread.

9:00 am: steps 4 to 6, cleaning

4. Remediate the infected system. Google's advice for unwanted ads and pop-ups is to check for unwanted programs before resetting the browser. She uninstalls the two programs in Settings, Apps, Installed apps. Then she removes the extension, resets Chrome's settings and takes notification permission away from the sites that had it.
5. Update the anti-malware software. The FTC's removal steps put the update before the scan. Microsoft explains that security intelligence, also called definitions, describes the latest threats and is used in every scan. Windows downloads it through Windows Update, and Protection updates, Check for updates fetches it on demand.
6. Scan and removal techniques. A full scan comes first. For malware that defends itself, Microsoft offers the Microsoft Defender Offline scan. It restarts the PC and scans from the Windows Recovery Environment without loading Windows, so persistent malware has a harder time hiding. WinRE is built on the Windows Preinstallation Environment (Windows PE), the objective's "preinstallation environment." Safe mode, which starts Windows with a limited set of files and drivers, is the other classic way to keep malware from loading while you remove it.

9:50 am: step 7, clean or rebuild?

The scans remove the programs' leftovers and find nothing else. Is the PC clean enough to trust? NIST's malware guide gives the test. Rebuild when the malware cannot be removed. Rebuild, too, when the host has had several infections, has been infected for an extended or unknown time, or has had backdoors, rootkits or other attacker tools installed. In those cases, NIST says, rebuilding is the most reliable way to restore the host's integrity. Sometimes it is also faster than proving the PC clean.

Reimage or reinstall can mean three things on a small office PC. Restore a standard image, as managed networks do. Use Reset this PC, which Microsoft says reinstalls Windows from scratch and can keep personal files or remove everything. Or reinstall from installation media. After an infection, the safer pattern follows NIST: remove everything, then restore data from a known good backup. Ray's PC had one recent, well-understood infection with no rootkit, and every scan now passes, so she keeps it. A PC with a rootkit alert or an unknown history would be rebuilt.

10:30 am: steps 8 to 10, closing the loop

8. Schedule scans and run updates. She runs Windows Update until nothing is left, which also brings the latest security intelligence. Microsoft recommends a quick scan for scheduled scans. A quick scan checks the places where malware registers to start with Windows, such as registry keys and startup folders.
9. Enable System Restore and create a restore point. Microsoft notes that System Protection is not on by default but recommends it. She turns it on for drive C: and creates a restore point named for the date: the first clean snapshot.
10. Educate the end user. Ray learns where the infection came from: a free PDF converter from an online ad. She shows him how the scareware box differs from a real Windows Security notice. Microsoft's rule is simple: real error messages from Microsoft and other big tech companies never include phone numbers to call. If the screen fills with scary pop-ups, close the browser, with Alt+F4 if needed. Because the PC was compromised, Ray also changes his passwords and turns on two-factor authentication, as the FTC advises.

Why this matters: the last three steps decide whether the PC stays clean. Updates and scheduled scans close the gap the malware used. A fresh restore point gives the next fix a clean starting place. And a user who knows the trick is far less likely to fall for it twice.

Common misconceptions

• "Scan first, then disconnect." Quarantine is step 2, before any cleaning; CISA says to unplug or remove the PC from Wi-Fi at once.
• "A clean scan proves a clean PC." The FTC notes that malware can go undetected, and NIST prefers rebuilding after rootkits or an infection of unknown length.
• "Restore points are a safe way back after malware." A point taken after the infection can hold it. That is why the procedure disables System Restore, then turns it back on once the PC is clean.
• "Every certificate warning means an attack." Chrome lists a sign-in portal, a wrong clock, antivirus HTTPS scanning and work proxies as common causes; rule those out first.
• "Pulling the power is the best quarantine." CISA prefers disconnecting from the network; powering down loses the evidence held in memory.

What you now know

• Symptoms: false antivirus and desktop alerts, unwanted OS notifications, pop-ups, redirection, slow browsers, certificate warnings, lost network access, altered or locked files and failed OS updates. Rule out innocent causes first.
• Renamed or encrypted files mean ransomware: isolate and escalate as an incident.
• The ten steps: verify; quarantine; disable System Restore (Home); remediate; update anti-malware; scan (full scan, Defender Offline in WinRE, safe mode); reimage or reinstall if needed; schedule scans and update; re-enable System Restore with a new restore point; educate the user.
• Rebuild, per NIST, after rootkits or backdoors, repeated infections or an infection of unknown length, and restore data from a known good backup.

Sources

1. Federal Trade Commission. (n.d.). Malware: How to protect against, detect, and remove it. Consumer Advice. consumer.ftc.gov
2. Souppaya, M., and Scarfone, K. (2013). Guide to malware incident prevention and handling for desktops and laptops (NIST SP 800-83 Rev. 1). National Institute of Standards and Technology. csrc.nist.gov
3. Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware guide. cisa.gov
4. Microsoft. (n.d.). Virus and threat protection in the Windows Security app; Windows startup settings; System Protection; Recovery options in Windows; Protect yourself from online scams and attacks. Microsoft Support. support.microsoft.com (Windows Security); support.microsoft.com (safe mode); support.microsoft.com (System Protection); support.microsoft.com (recovery); support.microsoft.com (scams)
5. Microsoft. (n.d.). Windows Recovery Environment (Windows RE); Take response actions on a device; About regular quick and full scans with Microsoft Defender Antivirus. Microsoft Learn. learn.microsoft.com (WinRE); learn.microsoft.com (isolation); learn.microsoft.com (scheduled scans)
6. Google. (n.d.). Remove unwanted ads, pop-ups and malware; Get help with common error messages in Chrome; Use notifications to get alerts. Google Chrome Help. support.google.com (malware); support.google.com (errors); support.google.com (notifications)
7. VAIO Corporation. (2016). [Windows 10] How to enable/disable system recovery [Knowledge base]. support.us.vaio.com

Why the paperwork is part of the repair

A technician fixes a laptop on Monday. On Thursday it fails again, and a colleague takes the call. If Monday's ticket says "fixed it," Thursday starts from zero. If it says what failed, what was replaced and how it was tested, Thursday starts from Monday's evidence. Core 2 objectives 4.1 and 4.2 are about that evidence: tickets, asset records, the documents a support team works from, and a way to change systems without surprising anyone. This lesson works through them as four procedures.

Procedure 1: write a ticket someone else can act on

1. Capture the user and the device. User information: name, contact details, department and location. Device information: asset tag, hostname, model and operating system. Take them from the asset records where you can, not from memory.
2. Describe the issue. One issue per ticket. Record the symptom in the user's words, the exact error text, when it started and what changed just before (Lesson 17).
3. Categorize and set severity. A category (hardware, software, network, account access, security) routes the ticket and shows patterns over time. Severity reflects impact and urgency. One user's sticky mouse is low; a whole office unable to bill clients is high.
4. Escalate by level when needed. Tier 1, the help desk, handles known fixes and knowledge base articles. Tier 2 brings deeper specialists, and tier 3 the engineers or the vendor. Escalate with your notes, so the next level does not repeat your tests.
5. Write progress notes as you go. Dated, factual and short, so a stranger could pick up the job.
6. Close with the resolution. What fixed it, the cause if known, how it was tested and the user's confirmation. If the fix will be needed again, write or link a knowledge base article.

NIST's configuration management guide expects the help desk to be part of the change process too, with procedures for how change requests that start at the help desk are recorded, submitted and tracked. A ticket is often where a change begins.

What matters here: a ticket is written for the next person, who may be you in six months. Facts, times and tests beat adjectives.

Procedure 2: track an asset from purchase to disposal

Asset management answers plain questions fast: what do we own, where is it, who has it, and is it still under warranty? The procurement life cycle gives the order:

1. Request and approve. A documented need and a budget holder's approval.
2. Purchase and receive. Check the delivery against the order.
3. Tag and record. Fix an asset tag to the device and enter it in the inventory. NIST's inventory control (CM-8) lists details worth recording: date of receipt, cost, model, serial number, manufacturer, supplier, component type and physical location. It adds software license information and network names and addresses, and calls for a unique identifier for each component, which is what an asset tag and ID provide.
4. Assign and deploy. Record the assigned user. That field is what makes off-boarding possible.
5. Maintain. Track warranty end dates and licenses. A warranty that ends next month changes a repair decision, and installed copies must not outnumber licenses (Lesson 39).
6. Retire and dispose. Sanitize or destroy the storage, keep the certificate (Lesson 33) and mark the asset retired.

An inventory list says what exists. A configuration management database (CMDB) adds how things connect. Atlassian describes a CMDB as a structured repository of configuration items and their relationships, such as applications, servers, services and dependencies. It is what shows a technician, before a change, that the "spare" switch actually feeds the reception printers.

Procedure 3: work from the right document

• Incident reports record an event that went wrong, such as a security incident, an injury or a major outage. They cover what happened, when, who was involved, what was done and the outcome. Lesson 39 covers incident response.
• Standard operating procedures (SOPs) are step-by-step instructions for a repeated task, so it is done the same way every time. The objectives name a custom installation procedure for a software package (this office's version, settings and license location), a new user onboarding checklist and a user off-boarding checklist.
• Onboarding follows NIST's account management control (AC-2): approval for requests to create accounts, and access based on a valid authorization and the intended use. In practice that means an approved request, an account in the right groups, a tagged device assigned in the inventory and a first sign-in with MFA set up.
• Off-boarding follows NIST's personnel termination control (PS-4). Disable system access within a set time. Revoke authenticators and credentials. Hold an exit interview. Retrieve organizational property such as tokens, keys, ID cards and building passes. And keep access to the information the person controlled.
• Service-level agreements (SLAs) put the service in writing. NIST describes an SLA as a commitment between a provider and its customers. It covers responsibilities, the type of service, expected performance such as reliability and response times, and reporting, resolution and termination. An internal SLA is IT's promise to the departments it serves; an external or third-party SLA is a vendor's promise to the organization.
• Knowledge base articles turn one technician's fix into everyone's: the symptom, the cause, the fix and how to confirm it, linked from the tickets that used it.

Procedure 4: make a change without surprising anyone

NIST's configuration change control (CM-3) states the core. Decide which kinds of change are controlled. Review each one and approve or reject it with its security impact in mind. Document the decisions, implement only approved changes and keep the records. A companion control (CM-4) asks for the impact analysis before the change, not after. In a small office the steps look like this:

1. Submit a request form. State the purpose (why), the scope (exactly what will and will not change) and the affected systems and impact (who loses what, and for how long).
2. Classify the change type. A standard change is low-risk, repeated and pre-approved, such as adding memory in Atlassian's examples. NIST's guide lists security patches, antivirus signature updates and replacing a defective peripheral or drive as typical preapproved changes, which are still tested and documented. A normal change has no pre-approved process and needs assessment and approval, from a change advisory board if it is high-risk. An emergency change answers an unexpected error or threat and cannot wait. NIST SP 800-128 calls for expedited review, then retroactive analysis and approval.
3. Analyze the risk and assign a risk level: what could fail, how likely that is and how bad it would be.
4. Prepare the documented business processes. A backup plan (take a backup first). A rollback plan, which NIST SP 800-128 requires, for undoing the change if problems occur. Sandbox testing in an environment isolated from production. And the responsible staff members who will implement, approve and verify. NIST's CM-3 enhancement asks for changes to be tested, validated and documented before implementation is finalized.
5. Schedule it. Set a date and time inside a maintenance window, an agreed low-impact period. Keep it outside any change freeze, a period when only emergency changes are allowed, such as an accounting firm's quarter-end close.
6. Get change board approval. The NIST glossary describes a configuration control board, also called a change control board, as a group of qualified people responsible for controlling and approving changes.
7. Implement, with peer review. A second technician checks the configuration or script before and after it goes live.
8. Confirm end-user acceptance, then close. The people who use the system confirm it works for their tasks. Then record the outcome and keep the records.

What matters here: change management is not paperwork for its own sake. Each step answers a question someone will ask if the change goes wrong: why was it done, who agreed, what was tested, and how do we get back?

Common misconceptions

• "Small changes do not need a record." Standard changes skip the board, not the record. NIST notes that preapproved changes are still tested and documented.
• "Emergency changes skip the process." They take a faster path, and NIST SP 800-128 expects them to be analyzed and approved afterward.
• "An inventory and a CMDB are the same thing." An inventory lists assets; a CMDB also maps how configuration items depend on each other.
• "Escalating means giving up." Escalation with good notes is the fastest route to a fix. Repeating the same failed steps is not.
• "Off-boarding is HR's job." Disabling access, revoking credentials and collecting property are IT tasks on the checklist, as NIST's PS-4 control shows.

The short version

• Tickets: user and device information, issue description, category, severity, escalation level, progress notes and resolution, in clear, concise writing.
• Assets: procure, tag and record (unique ID, serial number, warranty, license, location), assign, maintain, retire and dispose. A CMDB adds relationships.
• Documents: incident reports, SOPs (custom installs, onboarding and off-boarding checklists), internal and third-party SLAs, and knowledge base articles.
• Change: request (purpose, scope, impact), type (standard, normal, emergency), risk level, backup and rollback plans, sandbox test, responsible staff, window or freeze, board approval, peer review, end-user acceptance and records.

Sources

1. Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5), controls AC-2, CM-3, CM-4, CM-8 and PS-4. National Institute of Standards and Technology. csrc.nist.gov
2. Johnson, A., Dempsey, K., Ross, R., Gupta, S., and Bailey, D. (2011, updated 2019). Guide for security-focused configuration management of information systems (NIST SP 800-128). National Institute of Standards and Technology. csrc.nist.gov
3. National Institute of Standards and Technology. (n.d.). Service level agreement; Configuration control board [Glossary]. Computer Security Resource Center. csrc.nist.gov (SLA); csrc.nist.gov (CCB)
4. Atlassian. (n.d.). Types of changes in change management; What is a configuration management database (CMDB)? atlassian.com (change types); atlassian.com (CMDB)

Five setups that look fine until the day they are needed

Backups fail quietly. Nobody notices until the morning a drive dies or ransomware strikes. Then the gap between "we have backups" and "we can restore" becomes the whole story. This lesson covers Core 2 objective 4.3 by taking five common setups, finding where each one breaks, and fixing it with the backup types, recovery methods, testing and rotation schemes the objective names.

1. "The backup drive is always plugged in"

The setup: a small office backs up its file server every night to a USB drive that never leaves the server. Where it fails: anything that can reach the server can reach that drive. CISA warns that many ransomware variants look for accessible backups and delete or encrypt them, and its guide calls for offline, encrypted backups of critical data. A fire, flood or theft takes the drive along with the server.

The fix: the 3-2-1 rule, from a US-CERT paper that CISA still publishes:

• 3 copies of any important file: the original and two backups.
• 2 different media types, to protect against different hazards.
• 1 copy offsite, outside the home or business.

Onsite backups restore fast because they are close at hand. Offsite backups, in the cloud or in another building, survive what happens to this one. The paper suggests that larger organizations keep one copy onsite and another offsite. And a copy that is offline, disconnected between backups, is one that ransomware cannot reach.

Remember: a backup that ransomware or a fire can reach at the same moment as the original is a copy, not a backup.

2. "A full backup every night, to be safe"

The setup: every night, the whole server is copied in full. Where it fails: NIST's contingency planning guide notes that full backups take a long time, and that repeating them for files that rarely change wastes storage. As the data grows, the job runs into the working day. NIST describes the alternatives:

NIST gives a common combination: a full backup at the weekend and a differential each evening. The synthetic full comes from backup vendors. Veeam, for example, explains that its synthetic full does not read data from the production source. It consolidates the previous full and the incrementals already in the backup repository into a new full file.

3. "Restore it over the original"

The setup: a user wants yesterday's version of a spreadsheet, so the technician restores it to its usual folder. Where it fails: the restore replaces today's file, and the morning's work with it. Microsoft's File History page warns that a restored file replaces the current version and that the replacement can't be undone. Recovery has two modes:

• In-place (overwrite). The backup goes back where it came from, replacing what is there. This is right when the original is gone or damaged, such as after a failed disk is replaced.
• Alternative location. The backup goes somewhere else, so both versions survive. File History offers this as Restore to. Windows Server Backup's wbadmin start recovery command has a -recoveryTarget parameter for it. Its -overwrite option chooses Overwrite, CreateCopy or Skip for files that already exist.

4. "The software says every job succeeded"

The setup: the backup software has reported success every night for a year. Where it fails: a success message proves that a job ran, not that the data can be restored. Media fail, jobs skip files, and the password for an encrypted backup gets lost. CISA's guide says to test backup procedures regularly and to test the availability and integrity of backups in a disaster recovery scenario.

The fix: backup testing on a schedule. Restore sample files to an alternative location and open them. Now and then, restore a whole system to spare hardware or a virtual machine, and time it. Set the frequency the way NIST advises for backups themselves: by how critical the data is and how often new information arrives. An accounting system that changes hourly needs more frequent backups, and more frequent tests, than a policy folder that changes once a year.

Remember: the only proof that a backup works is a restore.

5. "Keep last night's backup; that's the one we need"

The setup: each night's backup replaces the one before. Where it fails: problems are often found late. If a file was corrupted three weeks ago, every backup since holds the corrupted copy. A backup rotation scheme keeps older copies on purpose. The classic one is grandfather-father-son (GFS). Arcserve's documentation describes it as daily (son), weekly (father) and monthly (grandfather) backup sets. Each tier is kept longer than the one below it, so a few sets cover months. Modern tools apply the same idea to disk and cloud backups; Veeam, for example, gives the names to weekly, monthly and yearly full backups. NIST adds that a backup policy should set the media rotation schedule and how data is taken offsite.

Common misconceptions

• "RAID is a backup." RAID keeps a server running through a disk failure (Lesson 18), but it copies deletions, corruption and encrypted files at once.
• "Incremental and differential are the same." Incremental copies changes since the last backup of any kind; differential copies changes since the last full.
• "A synthetic full reads everything from the server again." It is built from backups already stored, which is why it spares the server.
• "Restoring in place is always fine." It overwrites the current version. Restore to an alternative location when anything current might matter.
• "A sync folder is an offsite backup." A sync service mirrors changes, including deletions. Count it as a backup only if it keeps older versions you can restore.

Putting it together

• Placement: the 3-2-1 rule (3 copies, 2 media types, 1 offsite). Onsite copies for fast restores; offsite and offline copies for disasters and ransomware.
• Types: full; incremental (since the last backup); differential (since the last full); synthetic full (built from stored backups).
• Recovery: in-place overwrites the current version; an alternative location keeps both.
• Testing: restore on a schedule, with frequency set by how critical the data is and how fast it changes.
• Rotation: grandfather-father-son keeps daily, weekly and monthly sets for different lengths of time.

Sources

1. Ruggiero, P., and Heckathorn, M. A. (2012). Data backup options. US-CERT; published by the Cybersecurity and Infrastructure Security Agency. cisa.gov (PDF)
2. Cybersecurity and Infrastructure Security Agency. (2023). #StopRansomware guide. cisa.gov
3. Swanson, M., Bowen, P., Phillips, A. W., Gallup, D., and Lynes, D. (2010). Contingency planning guide for federal information systems (NIST SP 800-34 Rev. 1). National Institute of Standards and Technology. csrc.nist.gov
4. Microsoft. (n.d.). Backup and restore with File History. Microsoft Support; wbadmin start recovery. Microsoft Learn. support.microsoft.com; learn.microsoft.com
5. Veeam Software. (n.d.). Synthetic full backup; Long-term retention policy (GFS). Veeam Backup and Replication User Guide. helpcenter.veeam.com (synthetic full); helpcenter.veeam.com (GFS)
6. Arcserve. (2022). Grandfather-Father-Son rotation. Arcserve Backup 19.0 Administration Guide. documentation.arcserve.com

The argument at the help desk

A help desk lead has a proposal. Technicians write tickets in shorthand, and customers complain that the emails they get back are full of jargon. Why not paste each ticket into a free public AI chatbot and let it draft the reply? A senior technician objects at once. Both have a point, and their argument runs through all three objectives in this lesson: how technicians communicate (Core 2 objective 4.7), how they treat data, licenses and evidence (4.6), and how they use AI (4.10).

The case for the chatbot

The lead's goal is a good one. Customers deserve replies they can understand. The US government's plain language guidance defines plain language as content that is clear and easy to understand, and the Plain Writing Act of 2010 requires it for federal content written for the public. A language model can turn "renewed DHCP lease, flushed DNS cache" into "your computer had lost its network address; it is fixed now." It can also summarize a long ticket thread, translate a reply and keep the tone consistent.

AI is also arriving whether or not anyone plans for it. This is application integration: AI built into tools staff already use. Microsoft's support pages, for example, note that Microsoft 365 plans for home and business now include Copilot in apps such as Word, PowerPoint and Excel.

The case against

The senior technician's objections come straight from NIST's Generative AI Profile (NIST AI 600-1), which lists the risks:

• Data privacy. Tickets hold names, addresses, and sometimes health or payment details. NIST lists the leakage and unauthorized use or disclosure of personal or sensitive data as a risk. A free public chatbot runs under its provider's terms, not the organization's, so whatever is pasted in has left the organization's control.
• Hallucinations. NIST calls them confabulation: confidently stated but erroneous or false content. A confident wrong fix in a customer email is worse than no email.
• Bias. NIST warns of harmful bias and performance gaps between groups or languages, which can mean worse answers for some customers.
• Accuracy and plagiarism. Output must be checked against the facts. NIST also lists the replication of copyrighted or licensed content, and plagiarism, as risks.

What settles it: a policy

The argument ends once the question changes from "AI or no AI?" to "which tool, which data, and who checks?" That is what an AI policy answers:

• Private versus public. A private tool, run or licensed by the organization, keeps data security and data privacy under the organization's contract and controls, and its data source, what it draws on, is known. A public tool is open to anyone, on terms the organization does not set.
• Appropriate use. Name the approved tools and the tasks they may do. Ban regulated data, passwords and client secrets from public tools.
• Human review. A technician checks every AI answer before it reaches a customer. Any suggested command or script is tested in a sandbox first (Lesson 37).
• Plagiarism. Say when AI-drafted work must be disclosed, and never present someone else's work as your own.

In short: AI is a tool under policy: approved tools, permitted data and a person who checks the result.

Communicating like a professional

Whatever drafts the words, the technician owns them, on the phone and in person. Core 2 objective 4.7 lists the habits:

Regulated data, policies and licenses

Some data carries legal duties wherever it sits, including in a ticket or a chatbot window:

• Personally identifiable information (PII). NIST defines PII as information that can distinguish or trace an individual's identity, such as a name, Social Security number or biometric records, alone or combined with other linked information. Government-issued information, such as Social Security, passport and driver's license numbers, is among the most sensitive.
• Healthcare data. HHS explains that the HIPAA Privacy Rule protects individually identifiable health information held by covered entities and their business associates, in any form: electronic, paper or oral. It calls this protected health information (PHI).
• Credit card payment information. The PCI Security Standards Council says card verification codes may not be kept once the purchase they were collected for has been authorized. A technician who finds them in a spreadsheet has found a problem.
• Data retention requirements. Rules also set how long records must be kept. The IRS, for example, says to keep tax records for 3 years in most cases, 7 years in some, and employment tax records for at least 4 years. Deleting too early can break a rule; keeping data too long adds risk.

Policies turn these duties into rules people sign. An acceptable use policy (AUP) says what users may and may not do on the organization's systems. A non-disclosure agreement (NDA) binds one party to secrecy; a mutual NDA (MNDA) binds both, as when a contractor and a client share confidential details. Splash screens, or sign-in banners, meet compliance requirements at the door. NIST's control AC-8, written for US government systems, calls for a notice before access stating that use may be monitored and that unauthorized use is prohibited. The notice stays on screen until the user acknowledges it.

Licenses decide what software may be used, where and by whom:

• EULA and valid licenses. The end-user license agreement is the contract accepted at installation. Every installed copy needs a valid license, tracked in the asset records (Lesson 37).
• Perpetual license. Paid once and kept. Microsoft sells Office 2024 as a one-time purchase for one computer; there is no upgrade path, so the next major release is bought at full price. A subscription, such as Microsoft 365, is paid for as long as it is used.
• Personal-use versus corporate-use licenses. The course's own lab software shows the difference. Oracle licenses the VirtualBox Extension Pack free for personal use, which it defines as noncommercial use by the person who downloaded it on a single host, and for educational use by teachers and students. A business needs a different license.
• Open-source licenses. The VirtualBox base package itself is under the GNU GPL version 3. The Open Source Initiative's definition requires free redistribution and access to source code, among other terms.
• Digital rights management (DRM). Technology that controls access to content. US law, 17 U.S.C. 1201, says that no person shall circumvent a technological measure that effectively controls access to a protected work. The Copyright Office reviews exemptions every three years.

When the job turns up prohibited content

Sooner or later a technician fixing one thing finds another: files that appear to show illegal material, fraud or a policy violation. The objective calls this prohibited content or activity, and the first response is short:

1. Stop. Do not keep browsing, copying, deleting or "investigating." Every action can alter evidence.
2. Report it through the channel your policy names. Management decides, with legal advisors, whether to inform law enforcement. NIST's forensics guide says that decision, about collecting evidence for possible legal or disciplinary use, follows the organization's policies and legal advice.
3. Preserve and document. Secure the device and write down what you saw, when and where. Incident documentation starts with your first note.

From there, trained responders take over, and their methods appear on the exam:

• Chain of custody. NIST defines it as a process that tracks evidence by documenting each person who handled it, when it was collected or transferred, and why. RFC 3227 lists what to record: where, when and by whom evidence was found, collected and examined; who held it and how it was stored; and every transfer.
• Copy of the drive. NIST SP 800-86 describes a bit-for-bit image, including free and slack space, made through a write-blocker so the original is not altered. Integrity is shown by computing a message digest (a hash) of the original and the copy and confirming they match. Analysis is done on the copy.
• Order of volatility. RFC 3227 says to collect from the most volatile to the least: registers and cache; then routing table, ARP cache, process table and memory; temporary file systems; disk; remote logs; physical configuration; and archival media. It also warns: don't shut down until evidence collection is complete.

In short: at that moment the technician's job is to stop, report and preserve. The investigation belongs to others.

Common misconceptions

• "Deleting the chat makes a public AI tool safe." The data was sent to a provider on its terms; NIST lists leakage and unauthorized disclosure as risks.
• "A confident AI answer is probably right." NIST's term for confidently stated false content is confabulation. Check every answer.
• "A one-time purchase covers every PC in the office." Microsoft's one-time purchase of Office 2024 is for one computer.
• "Free for personal use means free at work." The VirtualBox Extension Pack's free license covers personal and educational use, not commercial use.
• "Turning the PC off protects the evidence." RFC 3227 warns against shutting down before evidence is collected; follow policy and leave collection to the responders.

Where this leaves us

• Communication: dress for the setting, use plain language, listen actively, avoid distractions, stay calm with difficult customers, set expectations, document the work and follow up. Leave confidential material alone.
• Regulated data: PII, government-issued numbers, PHI and card data need special handling, and retention rules set how long records stay. AUPs, NDAs and splash screens put the rules in writing.
• Licensing: valid licenses for every copy; perpetual versus subscription; personal versus corporate use; open source; DRM and section 1201.
• Prohibited content: stop, report, preserve. Responders use chain of custody, hashed bit-for-bit copies and the order of volatility.
• AI: integrated tools under a policy of appropriate use, with human review for bias, hallucinations and accuracy, care over plagiarism, and private tools for private data.

Sources

1. National Institute of Standards and Technology. (2024). Artificial intelligence risk management framework: Generative artificial intelligence profile (NIST AI 600-1). nvlpubs.nist.gov (PDF)
2. Brezinski, D., and Killalea, T. (2002). Guidelines for evidence collection and archiving (RFC 3227, BCP 55). Internet Engineering Task Force. rfc-editor.org
3. Kent, K., Chevalier, S., Grance, T., and Dang, H. (2006). Guide to integrating forensic techniques into incident response (NIST SP 800-86). National Institute of Standards and Technology. csrc.nist.gov
4. National Institute of Standards and Technology. (n.d.). Chain of custody; Personally identifiable information [Glossary]. Computer Security Resource Center. csrc.nist.gov (chain of custody); csrc.nist.gov (PII)
5. Joint Task Force. (2020). Security and privacy controls for information systems and organizations (NIST SP 800-53 Rev. 5), control AC-8. National Institute of Standards and Technology. csrc.nist.gov
6. US Department of Health and Human Services. (n.d.). Summary of the HIPAA Privacy Rule. hhs.gov; PCI Security Standards Council. (n.d.). Can card verification codes be stored for card-on-file or recurring transactions? [FAQ]. pcisecuritystandards.org; Internal Revenue Service. (n.d.). How long should I keep records? irs.gov
7. Microsoft. (n.d.). What's the difference between Microsoft 365 and Office 2024? Microsoft Support. support.microsoft.com; Oracle. (2024). VirtualBox Extension Pack Personal Use and Educational License (PUEL), version 12. virtualbox.org; Open Source Initiative. (n.d.). The Open Source Definition. opensource.org
8. 17 U.S.C. § 1201. Legal Information Institute. law.cornell.edu; US Copyright Office. (n.d.). Rulemaking proceedings under section 1201 of title 17. copyright.gov; General Services Administration. (n.d.). Plain language guide series. Digital.gov. digital.gov

Three jobs left

The course ends with three procedures. The first two are Core 2's last objectives: scripting (4.8) and remote access (4.9), the tools that let one technician look after many computers. The third is the plan that gets you through two exams. As in Lesson 37, each is a sequence of steps.

Procedure 1: write and run a script safely

A script is a text file of commands that a program called an interpreter runs in order. The objectives name six file types:

The use cases are the repetitive parts of support work:

• Restarting machines. PowerShell's Restart-Computer restarts the operating system on local and remote computers.
• Remapping network drives. net use S: \\fs01\sales /persistent:yes connects a drive letter to a share and keeps it across sign-ins (Lesson 24).
• Installing applications and initiating updates. winget install adds an app, and Microsoft documents winget upgrade --all as upgrading all installed packages. On Ubuntu, apt does the same job (Lesson 27).
• Automated backups. robocopy C:\Data E:\Backup /e copies a folder with its subfolders. Its /mir switch mirrors a tree, which Microsoft defines as /e plus /purge: files deleted at the source are deleted from the copy too, so read the switches before you schedule one.
• Gathering information. systeminfo or PowerShell's Get-CimInstance collects specifications from a whole fleet in minutes.
• Basic automation. Anything done the same way twice a week, scheduled with Task Scheduler (Lesson 23).

The objectives also name three ways scripts go wrong, and the steps below answer them:

1. Know the source. Write the script yourself, or take it from a trusted place, and read every line. A script copied from a forum, or written by an AI assistant (Lesson 39), can unintentionally introduce malware.
2. Test in a sandbox. Run it first in a virtual machine or test PC, never straight on production. Otherwise you risk inadvertently changing system settings on every PC it touches.
3. Watch the resources. A loop that never ends, or one that opens a browser window or loads a large file on every pass, can cause browser or system crashes from mishandled resources. Add limits and test with real data volumes.
4. Run with least privilege and log the results. Use an administrator account only when the task needs one.
5. Treat deployment as a change. A script pushed to fifty PCs gets a change request, a rollback plan and a maintenance window (Lesson 37).

The upshot: a script multiplies whatever it does, good or bad, so the care goes in before it runs.

Procedure 2: choose and secure a remote access method

Remote access lets a technician help a user without travelling. Each method is also a door into the network, so the choice comes with its security considerations:

The steps for any remote session follow from the table. Use an approved tool. Confirm who is asking for help before connecting. Get the user's consent before taking control. And end the session, and any temporary access, when the job is done. A caller who asks a user to install a remote tool is the scam CISA describes, not a support call.

The upshot: every remote access method is a door. Know who holds the key, and keep the door out of sight of the internet.

Procedure 3: plan for exam day

The facts, from CompTIA's pages (Lesson 1 has the detail):

• Two exams from the same version, V15: Core 1 (220-1201) and Core 2 (220-1202). Each has a maximum of 90 questions in 90 minutes, mixing multiple-choice, drag-and-drop and performance-based questions (PBQs).
• Passing scores: 675 for Core 1 and 700 for Core 2, on a scale of 100 to 900.
• For A+ simulations, CompTIA's PBQ explainer says there is a reset button, you can skip a PBQ and come back, and partial credit is possible.
• ID: two original, unexpired IDs, one of them government-issued with a photo. Candidates aged 17 and under need parental consent through CompTIA's process before registering.
• Retakes: no wait between the first and second attempts; at least 14 calendar days before the third and later attempts. The certification is valid for three years and renewable through continuing education.

The plan:

1. Map your weak spots by weight. Use the table below and your quiz scores. Time follows the percentages.
2. Practice retrieval, spaced out. Dunlosky and colleagues rated practice testing and distributed practice as the high-utility techniques (Lesson 1). Retake each module quiz a few days apart, then take this course's final exam under time.
3. Rehearse the clock. Ninety questions in ninety minutes is about a minute each, and PBQs take longer, so practice moving on.
4. Prepare the logistics. Check that the name on your registration matches your IDs. If you test online, follow the testing provider's instructions for your computer and room well before the day.
5. In the exam, read the qualifier. Words such as FIRST, BEST and MOST likely decide between two true answers. The troubleshooting order from Lesson 17 settles many of them.
6. Use the PBQ rules. If a simulation stalls you, do what you can, skip it and return; partial credit means every completed part counts.
7. Afterward, either way. Pass both, and the three-year clock starts on the date you pass the second exam. Miss one, and review by domain before the retake, using the retake rules above.

The upshot: no course can promise a pass, and this one does not. What it can give you is a map, a method and practice. Use all three.

Common misconceptions

• "The PowerShell execution policy stops malicious scripts." Microsoft says it is a safety feature, not a security boundary; users can bypass it.
• "A .js file only runs in a browser." Windows Script Host runs .js files too, which is why they are blocked as email attachments.
• "VNC is encrypted like RDP." RFC 6143's protocol has only a weak password check; protect it with encryption or a tunnel.
• "Legitimate remote tools are always safe." CISA documents criminals using legitimate RMM software; the question is who installed it and why.
• "A PBQ is all or nothing." CompTIA says partial credit is possible on simulations.

Pulling it together

• Script types: .bat, .ps1, .vbs (deprecated), .sh, .js and .py. Uses: restarts, drive mappings, installs, updates, backups, information gathering and automation.
• Script risks: malware, unintended setting changes and resource exhaustion. Read, sandbox, limit, log and treat deployment as a change.
• Remote access: RDP, VPN, VNC, SSH, RMM, SPICE, WinRM and third-party tools, each with its own security considerations; approved tools, verified callers, consent and closed sessions.
• Exam day: 90 questions and 90 minutes per exam, 675 and 700 to pass, PBQs with reset, skip and partial credit. Study by domain weight with spaced practice tests, and know the ID and retake rules.

Sources

1. Microsoft. (n.d.). about_Execution_Policies; Restart-Computer; upgrade command (winget). Microsoft Learn. learn.microsoft.com (execution policies); learn.microsoft.com (Restart-Computer); learn.microsoft.com (winget)
2. Microsoft. (n.d.). Deprecated features in the Windows client; wscript; robocopy; Net use. Microsoft Learn. learn.microsoft.com (deprecated features); learn.microsoft.com (wscript); learn.microsoft.com (robocopy); learn.microsoft.com (net use)
3. Free Software Foundation. (n.d.). Shell scripts. GNU Bash Reference Manual. gnu.org
4. Microsoft. (n.d.). How to use Remote Desktop. Microsoft Support; OpenSSH for Windows overview; Installation and configuration for Windows Remote Management; Use Quick Assist to help users. Microsoft Learn. support.microsoft.com (Remote Desktop); learn.microsoft.com (OpenSSH); learn.microsoft.com (WinRM); learn.microsoft.com (Quick Assist)
5. Richardson, T., and Levine, J. (2011). The remote framebuffer protocol (RFC 6143). Internet Engineering Task Force. rfc-editor.org; SPICE project. (n.d.). SPICE. spice-space.org
6. Cybersecurity and Infrastructure Security Agency. (2023). Protecting against malicious use of remote monitoring and management software (Advisory AA23-025A); #StopRansomware guide. cisa.gov (RMM); cisa.gov (ransomware guide)
7. CompTIA. (n.d.). CompTIA A+ Core 1 and Core 2 (V15); Performance-based questions explained; CompTIA certification retake policy; Candidate ID policy. comptia.org (A+ V15); comptia.org (PBQs); comptia.org (retakes); comptia.org (ID)
8. Dunlosky, J., Rawson, K. A., Marsh, E. J., Nathan, M. J., and Willingham, D. T. (2013). Improving students' learning with effective learning techniques. Psychological Science in the Public Interest, 14(1), 4-58. doi.org