Windows 11 – Troubleshooting and System Diagnostics from Scratch

DAY 1

0. Training Kick-off and Organization

• Workshop objectives, incident-based workflow, lab structure
• How to document diagnostics (L2/L3 note format)
• Overview of the lab environment and baseline (“what is considered normal”)

1. Structured Approach to Windows 11 Troubleshooting

• Workflow model: symptom → scope → hypotheses → data → fix → verification → prevention
• Issue classification: boot / logon / network / policy / app / performance / security
• “Quick triage”: what to check within 5 minutes (checklist)
• Sources of truth: logs, ETW, tools, policies, configuration

2. Diagnostic Foundations: Logs and Built-in Tools

• Event Viewer: key channels (System, Application, Security, Microsoft-Windows-*)
• Reliability Monitor: correlation of failures, updates, and drivers
• Task Manager and Resource Monitor: CPU / RAM / Disk / Network (bottleneck identification)
• Services / Scheduled Tasks: diagnosing “what triggers the issue”
• Basics of evidence collection (log exports, screenshots, reports)
• LAB 1: “Incident triage”
  • Participant receives a symptom (e.g. freezes, random restarts, applications not launching)
  • Data collection: Reliability Monitor + Event Viewer + Resource Monitor
  • Creation of a short note: hypotheses + confirmed/excluded causes

3. System Startup and Recovery

• Windows 11 boot flow (UEFI → Boot Manager → kernel → logon)
• Recovery modes: WinRE, Safe Mode, Advanced Startup
• Repair tools: Startup Repair, System Restore, Reset (when applicable)
• System image repair: DISM / SFC – scenarios and pitfalls
• Basics of boot/logon issue diagnostics (logs, recent changes, updates)
• LAB 2: “System does not boot / boots slowly”
  • WinRE / Safe Mode → DISM + SFC → log verification
  • Drawing conclusions: root cause vs symptom + prevention recommendations

4. Drivers, Devices, and Updates

• Device Manager: common conflicts and symptoms
• Driver Store management: pnputil, rollback, blocking problematic drivers
• Windows Update and drivers: when an update “breaks” functionality
• BSOD diagnostics basics (L2 level): where to look and what to collect (minidumps)
• LAB 3: “Something stopped working after an update”
  • Identifying the faulty driver or update
  • Rollback / removal / blocking + repair confirmation

5. Sysinternals in Diagnostics (L2/L3 Essentials)

• Process Explorer: handles, process tree, signatures, dependencies
• Autoruns: startup items, services, scheduled tasks, browsers
• ProcMon: filters and classic scenarios (ACCESS DENIED, missing file/registry)
• TCPView: quick connection diagnostics
• Sigcheck: file signature and reputation verification
• LAB 4: “Application does not start – ProcMon”
  • Identifying missing files/keys, access denial, or policy issues
  • Fix and validation (before/after)

6. PowerShell – Diagnostics Starter Pack

• Get-WinEvent (filtering), Get-Service, Get-Process
• System snapshot (mini “health check” script)
• Best practices: what to automate and what not to automate

DAY 2

7. Network Troubleshooting (Windows 11 Client)

• Problem layers: link → IP → routing → DNS → application
• Tools: ipconfig, ping, tracert/pathping, nslookup, netsh
• PowerShell: Test-NetConnection, Get-NetIPConfiguration, Get-DnsClientCache
• Common corporate issues: DNS suffix, proxy, split tunneling, captive portal, routing conflicts
• LAB 5: “No access to corporate resources”
  • Scenario: DNS + routing / proxy / firewall
  • Identifying the root cause and documenting fix + verification

8. VPN and Remote Access Diagnostics

• Types of issues: authentication vs tunnel vs resource access
• Logs and system locations containing relevant errors
• Common hybrid-work symptoms (home + office)
• LAB 6: “VPN connects, but nothing works”
  • Analysis of routes, DNS, firewall rules, split/full tunnel
  • Fix and final testing

9. Group Policy – Client-side Diagnostics

• GPO processing logic (order, inheritance, priorities)
• Common pitfalls: loopback, security filtering, WMI filters, policy conflicts
• Tools: gpresult /h, rsop.msc, GroupPolicy/Operational logs
• Diagnostics of logon scripts, mappings, printers, and settings
• LAB 7: “Policy does not apply”
  • Creating a gpresult report and identifying the failure point
  • Fixing filters/conflicts and confirming deployment

10. MDM / Intune and Hybrid Environment Diagnostics (Client-side)

• Where to check device management state (AADJ / Hybrid / Workplace)
• Symptom differences: GPO vs MDM policies
• Basics: what to check when “policies are not applied”
• Mini-LAB: “Cloud policies are not applied”
  • Quick checklist: device state + synchronization + logs

11. Security as a Source of Issues

• Defender: detections, quarantine, blocks, file reputation
• Firewall: profiles, rules, common blocks (applications / ports)
• SmartScreen / application control (common launch blocks)
• BitLocker: recovery, TPM, post-change scenarios (firmware / boot)
• LAB 8: “Application blocked / no access to data”
  • Identifying the blocking mechanism (Defender / Firewall / SmartScreen / BitLocker)
  • Fix and prevention recommendations (without weakening security)

12. PowerShell – Network, Policies, and Security

• Test-NetConnection, Get-NetFirewallRule (basics), quick configuration snapshots
• Exporting reports to files (for escalation)