Helpdesk Questions Required To Ask Users 3

[Anton36]

Hi,

Can someone give me an exhaustive list of questions to ask a user if he or she cannot logon to the company network. I know how to ultimately reset passwords in User Manager, but I would like to be a bit more curious with my questioning.

I've just got a job on a Helpdesk logging calls, but I need to be a bit more investigative and ask more questions than I do at the moment. The problem I have, is not knowing what questions to ask the user (as I'm not receiving any training).

My organisation use Windows 2000, Exchange 5.5 with Outlook 2000.

Hoping someone can help.

Anton36

 

[browolf]

depends on how much your users know? how technical can you get b4 they stop understanding you ;-)

good simple ones are:
-does it work if someone else logs on to your computer?
-have they accidently put a space after their username?
-is the flylead plugged into the network socket?
-is there a green light on the back of network card?

if you get a lot of calls it's worth making some sort of system, like a database in access to record stuff that happens. That will give you a better idea in the end how to approach problems and you can pick out things that happen a lot and try and come up with some prevention strategies.

hth
===============
Security Forums

http://www.security-forums.com

 

[ChrisRAnthony]

- is the CAPS LOCK key on.

This would affect any case sensitive passwords

 

[NickFerrar]

The password issues I have dealt with are (roughly in order of frequency):

1). CAPS LOCK key was on
2). They have a laptop and Num Lock key was on (on Dell's at least this causes numbers to be typed rather than letters for the part of the keyboard that the num pad is on).
3). User just plain forgets password
4). User changed password and didn't reboot immediately - things like Outlook cache passwords and it will lock the account out if they don't reboot after a password change
5). Someone changed the user on the PC (e.g. Administrator logged on last) - the user is so used to just typing their password they don't realise the username isn't their own anymore.


Password issues are a hassle - I normally ask the user to type the password into the username box and verify they are typing what they think they are typing. If they say they are typing it correctly I'll just reset the password - it's really not worth the time to investigate it more unless it happens frequently. For an account lockout I'll usually enable the account straight away and investigate it a bit after (checking audit logs etc).

One thing to be careful of is social engineering. It's all too easy for a hacker to obtain a username and a helpdesk number and just phone the helpdesk asking for the password to be changed. Some companies have strict policies on it, others aren't even aware of the issue.

Personally I check if the person is calling from an internal number or not - we also get the number displayed if external so I can check if it's a company mobile phone etc. If I don't recognise the person's voice or number I'll ask a couple of questions that whilst not proof that the person is who they say they are would be enough to throw off most hackers.

 

[NickFerrar]

Err sorry forgot it was a general log on query not a password specific one Although I'm 3rd line support now and never worked on an official helpdesk the questions I ask are along the lines of:

1). Are you getting any error message?
- This should hopefully tell you if it's a logon credentials problem or a network connectivity issue.
2). If it's username/password related see my previous post.
3). If it seems like a network problem check if they have a laptop - if so check the network cable is plugged in.
4). If it's a desktop or they have a docking station ask them to check if a network cable is connected (might not be possible if your users aren't very computer literate)
5). If you know the hostname of the computer then try pinging it from your workstation - if you don't get a reply it's usually quicker just to go and visit the person (or assign someone else to if your strictly answering calls only).
6). Even if you do get a ping reply it's usually quicker to physically visit the PC at this point - although you could try remote controlling it if you have such tools.

I work at a small office (about 150 users) - I imagine things are a bit more formalised at a larger company with a proper helpdesk in place...

 

[Anton36]

Wow, thank you all so much for your time, I never expected such quick responses.

This information will really enable me to improve my questioning of users on the network.

Thanks Again.

Anton.