My first week on help desk, a user called saying she was locked out of her account. I remoted into a server, clicked through the Active Directory console for five minutes looking for her, and the whole time she’s sitting on the phone listening to me breathe. A year later? One line in PowerShell. Ticket closed before the hold music finished.
That’s the gap this post closes. Not the certs. Not the theory. The ten commands I actually typed, over and over, until they stopped being commands and started being reflexes. If you’re studying for the A+ or sitting in your first help desk seat wondering when any of it starts feeling real — this is the list I wish someone had handed me on day one.
Every one of these comes with the moment it saved me. Because a command without a story is just syntax, and syntax doesn’t stick.
Part 1 — Network Triage
“The internet is down” is the most common lie in IT. The internet is fine. Something between the user and the internet is not, and these four commands find out what — in order, every time.
1. ipconfig /all
# The full network picture for every adapter — IP, gateway, DNS, DHCP lease
ipconfig /allFirst command I run on any “can’t connect” ticket. Full stop. The plain ipconfig gives you the headline; /all gives you the story — DHCP server, lease times, DNS servers, MAC address, the whole lot.
The beat that saved me: an address starting with 169.254. First time I saw it I thought the machine had been given some exotic subnet. It hadn’t. That’s APIPA — Windows saying “I asked for an address and nobody answered.” A 169.254.x.x address means no DHCP lease, and that one fact re-routes the entire ticket. Stop blaming the browser. Start looking at the cable, the switch port, or the DHCP server itself.
2. ping
# The ladder: gateway first, then an external IP, then an external name
ping 192.168.10.1
ping 8.8.8.8
ping google.comEveryone knows ping. Almost nobody uses it in the right order. I climb the same ladder every time: gateway first — if that fails, the problem is inside the building. Then an external IP — if the gateway answers but 8.8.8.8 doesn’t, the problem is the route out. Then an external name — if the IP answers but google.com doesn’t, it’s not the network at all.
Three rungs. Thirty seconds. It cuts the entire planet down to one of three suspects before you’ve even opened a ticket note.
3. nslookup
# Ask DNS directly — what does this name resolve to, and who answered?
nslookup fileserver.trevtech.labThat third rung on the ping ladder — IP works, name doesn’t — is DNS. And nslookup is how you interrogate it.
The war story: a user who could reach every website except the one internal app she actually needed. Everyone was stumped. I ran nslookup on the app’s hostname and the record pointed at a server we’d decommissioned a month earlier. Stale DNS record. The network was fine, the app was fine — the phone book had a dead number in it. One record fixed, ticket closed, and I looked like a wizard for typing one word.
4. tracert
# Show every hop between you and the destination — and where it dies
tracert 8.8.8.8Ping tells you the packet didn’t arrive. Tracert tells you where it died. Every router between you and the destination, hop by hop, until the replies stop — and the hop where they stop is where your problem lives.
This is the difference between telling your senior “it’s broken” and telling them “it dies at hop three, which is the far side of the site-to-site VPN.” One of those gets you handed the ticket back. The other one gets you invited to the fix.
Part 2 — Machine & User
Network’s fine but the machine or the user is misbehaving? These three.
5. whoami /groups
# Every group the CURRENT session's token actually contains
whoami /groupsThe scenario that burned me: I added a user to a security group so he could reach a share. Told him it was done. He tried it — access denied. I checked AD, and he was in the group. AD said yes, the machine said no, and I sat there doubting my own eyes.
Here’s the thing nobody tells you: group membership is stamped into your token at logon. Change a user’s groups and nothing happens until they log off and back on. whoami /groups shows you what the current session actually holds — not what AD says it should hold. When those two disagree, the fix is a logoff, not another hour of troubleshooting. Learned that one the slow way so you don’t have to.
6. gpupdate /force + gpresult /r
# Push policy now instead of waiting for the refresh cycle
gpupdate /force
# The underrated half — what actually applied, and what got skipped
gpresult /rEveryone learns gpupdate first, and fair enough — it forces a Group Policy refresh instead of waiting up to 90 minutes for the background cycle. But gpupdate is the loud half of the pair. The underrated half is gpresult.
gpresult /r shows you which GPOs applied, which were filtered out, and which OU the machine thinks it lives in. The day this clicked for me: a drive-mapping policy that refused to land on one machine. I ran gpupdate until my fingers hurt. Nothing. One gpresult later — the computer object was sitting in the wrong OU, so the policy was never linked to it in the first place. You can’t force-apply a policy that was never yours. Gpresult tells you that in ten seconds.
7. sfc /scannow
# Scan and repair protected Windows system files — run from an ELEVATED prompt
sfc /scannowThe weird ones. Start menu won’t open, settings pages crash, some system dialog throws an error nobody’s ever screenshotted before. Before you reimage, run the System File Checker.
Two things to know. One: it must run from an elevated prompt — regular user shell just errors out, and yes, that’s the first mistake I made with it. Two: it takes a while, so kick it off, take the next call, come back. It has quietly rescued more than one machine I’d already mentally scheduled for a rebuild. Fifteen minutes of scan versus two hours of reimage — I know which one I’m picking.
Part 3 — PowerShell
This is where the list changes gear. CMD tells you about one machine. PowerShell talks to the whole domain.
8. Test-NetConnection
# Ping, grown up — tests a specific PORT, not just the host
Test-NetConnection fileserver.trevtech.lab -Port 445Ping tells you the server is alive. It does not tell you the server is listening. A file server can answer ping all day long while the service you actually need is down or firewalled — and that’s exactly the gap Test-NetConnection closes. Point it at a port: 445 for file shares, 3389 for RDP, 443 for web.
The ticket that made it a reflex: “can’t reach the file share.” Server pinged fine, so the old me would have said “network’s fine” and bounced the ticket. Port 445 test failed — a firewall rule had eaten SMB. Host up, service unreachable. Ping literally cannot see that difference. This can.
9. Get-ADUser
# The account's health screen in one line
Get-ADUser bwayne -Properties LockedOut, Enabled, PasswordExpiredHere’s my honest take after a year of both: the AD console is a slow front-end to information PowerShell hands you instantly. When an account is playing up, there are three usual suspects — locked out, disabled, or password expired. In the console that’s a search, an open, and a tab-hunt through property pages. In PowerShell it’s one line, and the answer comes back as three clean true/false values.
User can’t log in, and Bruce in accounting is adamant his password is right? Run it. LockedOut: True. No guessing, no clicking, no “have you tried turning it off and on again” while you stall for time. Diagnosis in five seconds, and the fix is command number ten.
10. Search-ADAccount + Unlock-ADAccount
# Find every locked-out account in the domain
Search-ADAccount -LockedOut
# Unlock in one line — ticket closed
Unlock-ADAccount -Identity bwayneThe most common ticket in IT. Not one of the most common — the most common. Someone fat-fingers their password on a Monday morning, the lockout policy trips, and the phone rings.
Search-ADAccount shows you every locked account in the domain — you don’t even need the user to spell their name right. Unlock-ADAccount clears it in one line. The first time I did this live on a call, the user was mid-apology for “breaking her computer” and I’d already fixed it. That pause, and then — “wait, that’s it?” That’s the moment this stops being a job you’re surviving and starts being a job you’re good at.
This pair is why I put PowerShell last. It’s the payoff the other nine build toward.
The Gotchas
A few things that would have saved me some embarrassment:
CMD commands work inside PowerShell. Ipconfig, ping, nslookup — the lot run fine in a PowerShell window. You don’t need two terminals open. One window, all ten commands.
Elevation matters. Sfc /scannow and gpupdate want an elevated prompt. If a command errors instantly with something about privileges, you’re not broken — you’re just not admin. Right-click, run as administrator, go again.
The AD commands need RSAT. Commands 8 through 10 use the ActiveDirectory module, which comes with RSAT — installed on a machine you manage the domain from, not on every client. If Get-ADUser comes back “not recognized,” that’s the fix.
Don’t memorise the flags. Nobody’s quizzing you. Memorise what each command is for — tab completion and Get-Help carry the rest. The skill is knowing which tool to reach for, not reciting switches.
Verdict
Certs teach concepts. These close tickets.
Both matter — the cert gets you the interview. But your first week on the desk, nobody asks you to define DHCP. They hand you a ticket that says “internet down” and watch what you type. These ten are what I typed.
Practice Them Before Someone’s Watching
Every command in this post I learned properly in my homelab — a Dell R730 I picked up for $400, running Proxmox, with a Windows Server domain controller and a test user who can’t complain when I lock his account on purpose. Break it at home so you can fix it at work. If you want the exact build, I’ve put the whole thing in my homelab ebook — link below.
The full walkthrough of all ten commands — including me running each one live in the lab — is in the video on TrevTech-IT. And there’s a deeper PowerShell-for-AD series already on the channel when you’re ready to go past one-liners.
What’s the first command that made you feel like you actually knew what you were doing? Tell me in the comments — on the blog or under the video.
— Trev | I broke it. Fixed it.
