A First-Pass Diagnostics Checklist For Startup IT

Clarify The Symptom

Write the symptom in one sentence before running checks. Avoid starting with the fix; a fix is not the symptom.

• +The laptop is slow and the fan has been loud for 30 minutes.
• +The user can reach public websites but cannot resolve internal hostnames.
• +The service starts and then exits within a few seconds.
• +The main volume has less than 5 GB free.

Identify The Surface Area

Put the issue into one primary bucket so the first checks are relevant instead of generic.

• +Endpoint performance.
• +Disk or storage pressure.
• +Network connectivity.
• +VPN or DNS.
• +Local service startup.
• +Recent errors or logs.
• +Support handoff or escalation.

Run Read-First Checks

Start with checks that observe state rather than change it. The goal is not to run every command; the goal is to run enough relevant checks to support the next decision.

• +Disk: main volume usage, largest safe-to-review user directories, downloads, trash, caches, and old logs.
• +Performance: load, CPU and memory processes, memory pressure, swap, and recent relevant errors.
• +Network: active interface, IP address, default route, gateway reachability, DNS servers, DNS resolution, and external connectivity.
• +Services: service status, recent logs, restart loops, port conflicts, and config readability.

Separate Evidence From Guesses

A useful first-pass note separates facts, interpretation, and next action. That makes it easier to escalate without forcing the next person to repeat the same checks.

• +Symptom.
• +Checks performed.
• +Evidence.
• +Likely cause.
• +Confidence.
• +Recommended next action.
• +Needs specialist review.

Keep Fixes Approval-Gated

Do not collapse diagnosis and remediation into one step. Actions that change state should be reviewed first, especially when the person running the diagnostic is not the final owner of the machine, service, or customer environment.

• +Killing processes.
• +Restarting services or networking.
• +Deleting files.
• +Changing resolver state.
• +Changing permissions.
• +Running elevated commands.

Save The Handoff

The first-pass output should be usable in a ticket, support reply, or escalation. Summaries are usually easier to act on than raw command dumps.

After the first pass, mark the outcome as useful, partial, not useful, or blocked. That tracking shows which issue types are getting easier and which still need a better runbook or specialist.