1.1 The Support Technician Role
Before this lesson: fix a mix-up on IT-1.3
Write ticket notes as action → result pairs that another technician can verify
Why am I seeing this?
- Your answers suggest this mix-up: Writing ticket notes as complaints or slogans instead of action and result (seen 1 time).
- So this review goes straight at that idea instead of re-reading the whole lesson.
- Your recent answers on this objective suggest a short review will help before the next lesson.
- Your estimate is 54% (medium confidence): 2 of 3 questions right; 0 of 2 lab outcomes passed (graded test questions 1/1, chapter check questions 1/2).
- Time on task: about 1 min recorded on lesson 1.3 (estimated 90 min). Short reading time never lowers your estimate.
This is a learning aid, not a grade. Nothing here changes your gradebook. See all my objectives
Course navigation
Start here if you have never done this
This course does not assume you have built a PC, worked a help desk, or taken a vendor exam. If the words motherboard, IP address, or ticket feel new, that is expected. Read this block slowly. The later chapters only work if these pictures are in your head.
What a computer is, in one picture
A computer is a box that:
- Takes power from the wall
- Has a brain (CPU) that follows instructions
- Has short-term workspace (memory / RAM) that empties when power is gone
- Has long-term storage (disk / SSD) that keeps files when power is gone
- Talks to humans through a screen, keyboard, and pointing device
- Often talks to other computers through a network
If power never arrives, nothing else matters. If the brain cannot start, the disk can be healthy and you will still see a dark or beeping box. If memory is unseated, the brain may beep and never show Windows. Those neighborhoods are Chapter 2 and 3. You do not need them today. You need the picture.
What software is
Hardware is the parts you can point at. Software is instructions. An operating system (Windows, macOS, a Linux desktop) is the big program that starts after firmware and then lets you run other programs: Outlook, a browser, a shop tool. An application is one of those other programs. A driver is a small program that teaches the OS how to talk to a specific device (a NIC, a printer).
When “the computer is broken,” you must learn to ask: power, hardware start, operating system, one application, or the network path to something else. Beginners treat all of those as one blob. This course splits the blob.
What a user actually brings you
They do not bring you a layer of the OSI model. They bring a job they cannot finish: a report that will not send, a badge that will not open a door, a printer that will not print the watchbill. Your first sentence is that job, not a part name. Chapter 1.1 trains that sentence until it is boring.
What a ticket is
A ticket is the written memory of the shop. You, sleep, and the next watch. If it is not in the ticket, it did not happen. Beginners write slogans (“VPN broken”). This chapter trains evidence: who, what outcome, tests and results, next person.
Words you will hear this week
| Word | Plain meaning |
|---|---|
| Outcome | What they must be able to do again |
| Break/fix | It used to work |
| Service request | They never had it |
| Incident | Bigger than one desk, or safety/security |
| Escalate | Hand to the owner who is allowed to finish it |
| Firmware / UEFI | Tiny software on the board that runs before Windows |
| POST | That firmware checking hardware before Windows |
| ESD | Tiny static shock that can kill chips; strap exists to prevent it |
Terminal objectives
- State what a support technician is paid to restore, in one sentence a lead would accept
- Sort a contact into break/fix, service request, or incident and say what changes when the label changes
- Verify identity before changing an account or sharing data
- Hand a problem off with facts the next technician can act on without calling you back
In plain English
Users do not bring you “Layer 3.” They bring you outcomes: the report will not send, the floor printer is dead, mail looks wrong. Restore the outcome without a second outage, leave a record, and tell the truth about what you know.
Lab on this chapter — ticket-intake
The live lab sits under this lesson. You will open a raw user sentence, classify it, set impact, decide escalate or keep, write a note, and submit. Finish the desk drills below before you hunt for the “right” command.
Swapped to R1: Plain language — step 1 of 4 Pending SME review
1. What the role actually delivers
On almost every contact you do four things:
- Get the job working again (log in, print, send).
- Do not make things less safe to get there. No switching off security, no sharing admin passwords.
- Write it down so the next person can follow.
- Tell people what is happening and what you need.
Users often say vague things like “the internet is down.” Your first task is to turn that into something you can test, such as “this PC cannot open any website, but the shared drive works.”
1. What the role actually delivers
On almost every contact you do four things:
- Restore service — the required workflow works again (login, print, send, VPN, open the file).
- Reduce risk — you do not turn off security “to make it work,” share admin passwords, or leave an account unlocked for convenience.
- Leave a trail — notes the next watch can trust at 0200 without you on the phone.
- Communicate — the user and your lead know status, next step, and what you need from them.
“The internet is down” might be DNS, captive portal, proxy, VPN, Wi-Fi, or one blocked site. First job: turn vague words into a testable claim.
Arrival order is not treatment order. One laptop offline is real work. Malware across a wing is more important because impact multiplies. Always ask: how many people, and how bad if we wait.
- R0 Original (seen)
- R1 Plain language (worked)
- R2 Analogy
- R3 Visual / step by step
- R4 Try it
You got the check on this section with this explanation.
Next sectionSwapped to R2: Analogy — step 2 of 4 Pending SME review
2. Three kinds of work
Think of a hotel front desk. A guest whose room key stopped working is break/fix: it worked, now it does not, so you fix it. A guest asking for a late checkout they were not booked for is a service request: something new, which may need a manager’s yes. A fire alarm on the third floor is an incident: many people and safety, so you stop routine work, follow the plan and call the right people.
The desk clerk treats each one differently because the label changes who must approve and how fast to act.
2. Three kinds of work
The label changes approvals, clocks, and who must be told.
| Type | Meaning | What you do |
|---|---|---|
| Break/fix | Something that used to work stopped | Troubleshoot, repair, verify with the user |
| Service request | Something new is asked for | Check entitlement, get approval if required, fulfill |
| Incident | Many users, a major service, or security | Contain, coordinate, communicate; page a specialist if needed |
SLA is the published response/resolve target. It is not permission to close before the user can work.
Classify before you touch a keyboard:
- “I need the budget share for the first time.” → service request
- “Outlook worked yesterday; today it loops on password.” → break/fix
- “Half the building cannot badge in.” → incident
- “Someone sent mail as me.” → incident (security) until proven otherwise
Lab commands: classify break-fix, classify request, or classify incident. If two feel true, pick the higher risk (incident beats break/fix).
- R0 Original (seen)
- R1 Plain language (seen)
- R2 Analogy (worked)
- R3 Visual / step by step
- R4 Try it
You got the check on this section with this explanation.
Next sectionExplanations you have seen (3)
Swapped to R1: Plain language — step 1 of 4 Pending SME review
3. Impact and identity
Impact means how many people are affected and how bad it is if you wait. It is not how loud or angry the caller is. Write down both the number and what happens.
Identity: before you reset a password, unlock an account or open someone’s mailbox, make sure you are talking to the right person. Use your shop’s method, such as calling back on a listed number or checking a badge.
If an unknown caller says “just do it,” the answer is no.
3. Impact and identity
Impact is “how many and how bad,” not how loud the caller is. Write both. Lab: impact 1 or impact many.
Before you reset a password, unlock an account, or read a mailbox, prove you have the right human. Follow local policy: badge, callback to a known number, supervisor confirm. “Just do it, we’ll sort it later” from an unknown caller is a no.
- R0 Original (seen)
- R1 Plain language (worked)
- R2 Analogy
- R3 Visual / step by step
- R4 Try it
You got the check on this section with this explanation.
Next sectionSwapped to R4: Try it — step 4 of 4 Pending SME review
4. Keep it or escalate
Put the handoff lines in order, then compare your version with Ticket B in the intake lab.
Open the lab: Block 1 — Ticket intake desk Write a handoff note for the lab ticket and compare it with the pass bar in 1.5.
4. Keep it or escalate
Escalate when you lack access, tools, authority, or time-critical skill, or when safety/security needs a specialist. Transfer understanding, not just the ticket number.
A usable handoff has: who and how many; exact symptom; when it started and what changed; where they are; each test and its result; a clear ask.
A: “VPN not working.” No version, no error, no tests.
B: Client 4.2.1, error 809, LAN ping OK, ping to gateway fails, started after weekend update, hotel Wi-Fi.
Ticket B can be worked. Ticket A forces the next person to start at zero.
- R0 Original (seen)
- R1 Plain language (seen)
- R2 Analogy (seen)
- R3 Visual / step by step (seen)
- R4 Try it (worked)
You got the check on this section with this explanation.
Next sectionExplanations you have seen (5)
5. Closing is not the same as fixed
Closed means the required workflow works and the notes are complete. A green monitor icon is not enough if they still cannot submit the form they called about.
6. Desk drill — paper first
Fill this table for three contacts. Empty cell = not ready for the lab.
| Field | What you write |
|---|---|
| Outcome they need | Send mail / print / badge / log in — not “fix the server” |
| Type | break/fix, request, or incident |
| Impact | 1 or many, plus who |
| Safety stop? | Yes → stop and escalate. No → continue |
| Keep or escalate | One word plus why |
| Tests so far | Each line: action → result |
| Next step | A person or a command, not “look into it” |
A: “Need Adobe on this new PC today.” → request, impact 1, keep only if you have package and approval.
B: “I got a shock from the metal strip under the monitor.” → incident, escalate, do not swap the strip.
C: “Printer worked at 0800, jam icon now, three people in line.” → break/fix unless it is the only printer for a watch (then impact many).
The live lab sentence is closer to B: many users plus heat. You will type that in 1.5.
Common misses
- Calling a first-time access ask “break/fix” because the user is upset
- Writing impact as “high” with no count
- Escalating with “VPN broken” and no test results
Check yourself (say the answer, then open)
1. New share access, never had it.
Service request. Check entitlement. Do not reset a password to “make the share work.”
2. One user, Outlook password loop since this morning.
Break/fix, impact 1, keep unless you lack account tools.
3. Half the building cannot badge.
Incident, impact many, escalate. Do not start swapping a reader alone.
4. Unknown caller wants a password reset “right now.”
Stop. Verify identity per policy. No is a complete sentence.
What this job actually is
You are paid to restore a required outcome, not to look busy on a PC. The outcome is whatever the user must do again: send the report, badge the door, print the watchbill. Hardware, software, and networks are tools you use when they sit on the path to that outcome.
Three kinds of work show up in the same queue and they are not interchangeable. A service request is something the user never had (a share, a mailbox, a software title). Break/fix is something that used to work and does not. An incident is impact beyond one desk — many users, safety, security, or a service the shop has already labeled critical. If you treat a first-time access ask as a broken NIC you will waste an hour and still leave them without the share.
Impact is a count plus a consequence, not a feeling. “High” with no number is not a ticket. “Fourteen users in Bldg 3 cannot badge, mid-watch turnover in 20 minutes” is a ticket.
Worked contacts
A. “I need the budget folder. I never had it.” Service request. Check entitlement. Do not reset a password to “make the share appear.”
B. “Outlook loops my password since 0700. Next desk is fine.” Break/fix, impact one, stay with it unless you lack account tools.
C. “Half the quarterdeck badges failed after lunch. Reader is warm.” Incident, impact many, escalate. Heat plus access control is not a solo swap.
D. Unknown caller wants a reset “right now” and cannot complete the shop identity script. Stop. Urgency is not identity.
Identity before any reset
Every shop has a script: employee number, last four, callback on a listed number, badge in hand, manager on the line. You use the script even when the voice is friendly. A password reset is a privileged change. If you skip identity you have just handed an account to a stranger and written that fact into the ticket history.
Write what you used to verify, not the secret itself. “Verified via callback to listed desk 555-0142” is enough. Never write the new password.
Hour plan for 1.1
This lesson is 90 minutes of teaching, not a 15-minute briefing. Spend it like this:
| Min | You do |
|---|---|
| 0–15 | Read “paid to restore an outcome.” Class says one sentence each. |
| 15–35 | Four labels: request / break-fix / incident / change. Work the table aloud. |
| 35–55 | Identity script. Two volunteers: one is a stranger, one is the real user. |
| 55–75 | Write one Ticket-B note from a raw sentence. Peer scores it. |
| 75–90 | Handoff out loud. Preview show ticket only — lab finish is 1.5. |
What you are paid to restore
A support technician is paid to restore a required outcome without creating a second outage. The outcome is whatever the person or watch must do again: send the report, badge the door, print the watchbill, open the medical record, join the briefing VTC.
Everything else is a tool. A motherboard, an ipconfig line, a print driver, a vCenter snapshot — those matter only when they sit on the path to the outcome. If you cannot name the outcome in one sentence a lead would accept, you are not ready to touch the box.
Examples of good outcome sentences:
- “User in 214 can send mail from Outlook 16 on this PC.”
- “All quarterdeck badges work on reader 3.”
- “The floor printer accepts the watchbill from any staff PC on VLAN 20.”
Examples of bad opening lines:
- “Looking into the network.”
- “Layer 3 might be down.”
- “User is difficult.”
The four labels and what changes when you pick one
| Label | Means | What you do first | What you do not do |
|---|---|---|---|
| Service request | They never had it | Entitlement / who owns the access | Reset a password to “make the share appear” |
| Break/fix | It used to work | When it last worked, what changed | Treat it like a new-hire access ticket |
| Incident | Many users, safety, security, or a named critical service | Stop, scope, escalate per shop | Swap a reader alone while the building is locked out |
| Change | You will introduce something new | Shop process, rollback, window | “I just added the DNS record after 1500” |
The same raw sentence can move labels when facts arrive. “Printer down” is break/fix for one desk and an incident if it is the only printer for a watch that starts in twenty minutes. Write the label you are using now, and change it in the ticket when the facts change.
Impact is a count plus a consequence
“High” is not impact. Impact is:
- How many people or watches cannot do the required outcome
- What happens if it stays broken (turnover, medical, comms, payroll)
- Whether safety or security is in the path
Write “14 users in Bldg 3 cannot badge; mid-watch turnover in 20 minutes.” Do not write “priority high.” The next person cannot act on a feeling.
Desk set — classify these out loud
Do not skip this. Say the label, the impact, and keep-or-escalate.
- New hire, first day, never had the budget share. Next desk works.
- Outlook password loop since 0700. Next desk fine. User known in person.
- Half the building cannot badge. Reader face is warm.
- Unknown caller wants a reset right now and cannot complete the identity script.
- User wants a production DNS record added at 1510 so a vendor demo works.
- One floor printer jammed; two other printers on the floor work.
- The only printer for the mid-watch watchbill is jammed and turnover is in 15 minutes.
- User felt a shock from the strip under the monitor.
Answer key the instructor uses: 1 request / 2 break-fix impact 1 / 3 incident many escalate / 4 stop identity / 5 change, not a silent repair / 6 break-fix impact 1 / 7 incident or at least impact-many for that watch / 8 incident stop escalate. Argue the edge cases. The point is the argument, not a secret code.
Identity before any account change
A password reset, an unlock, a share add, a mailbox open — those are privileged. The shop identity script exists because friendly voices lie. Typical pieces (use your shop list, not this paragraph as policy):
- Person is on a listed callback number, not the number they offered
- Employee / DOD ID / last four as the shop requires
- Badge in hand if they are at the window
- Supervisor on the line if the shop requires it for after-hours
Write how you verified: “Callback to listed desk 555-0142.” Never write the old password, the new password, or the mother’s maiden name. If they cannot complete the script, the answer is no. No is a complete sentence. Document the refusal as a fact.
Handoff that survives 0200
A handoff has five lines:
- Outcome they still cannot do
- How many / where
- Tests you ran and the results
- What you already changed (one thing at a time)
- Next person or next command
Bad: “VPN broken, please fix.” Good: “Outlook 16 on PC214, error 809, LAN ping 10.20.30.50 4/4, gateway 10.20.30.1 fails, started after weekend client update, user on hotel Wi-Fi, next: messaging check account lock.”
Quick check (not graded)
If you miss one after spending a while on its section (or, if you have turned Helix on, it sees you re-reading it), you will be offered a different explanation right here. It is only an offer.
Comprehension check: 4 of 22 sections verified
What to do next: answer the quick check (not graded) in each section below. If one does not click, press “Explain it another way”. Still to do:
- Start here if you have never done this
- What a computer is, in one picture
- What software is
- What a user actually brings you
- What a ticket is
- Words you will hear this week
- 5. Closing is not the same as fixed
- 6. Desk drill — paper first
- What this job actually is
- Worked contacts
- Identity before any reset
- Hour plan for 1.1
- What you are paid to restore
- The four labels and what changes when you pick one
- Impact is a count plus a consequence
- Desk set — classify these out loud
- Identity before any account change
- Handoff that survives 0200