IT Support Engineer interview questions and answers

A local account exists only on that one PC and is stored there. A domain account lives in Active Directory on the domain controller, so the user can sign in on any PC in the domain with the same password, and IT can manage it centrally: reset passwords, disable it when someone leaves, and apply Group Policy.

To join a PC: make sure it can reach the domain controller and uses the company's DNS server, then open Settings, System, About, "Domain or workgroup" (or run sysdm.cpl), choose Domain, enter the domain name and an account allowed to join PCs, and restart. Wrong DNS settings are the most common reason a join fails.

Group Policy lets administrators apply settings to many users and computers in an Active Directory domain from one place, through Group Policy Objects linked to sites, domains or organisational units. Typical uses: password and account lockout rules, mapping network drives and printers, setting a standard wallpaper or screen lock after a few minutes, blocking USB storage, deploying software, and configuring Windows Update.

Policies apply in the order local, site, domain, then OU, so when settings conflict, the policy linked to the OU usually wins unless a higher one is set to Enforced. On a PC, gpupdate /force applies changes immediately, and gpresult /r shows which policies actually applied, which is the first thing to check when a setting isn't working.

Collect evidence first. Note the stop code on the blue screen, then open Event Viewer: in the Windows Logs, System log, look for Kernel-Power event 41 (an unexpected restart) and BugCheck event 1001, which records the stop code. Reliability Monitor shows a timeline of crashes alongside recent updates and installs.

Then think about what changed: a new driver, a Windows update or new software points to rolling back or updating it. A crash naming a particular driver file points to that device. Overheating, failing RAM or a failing disk cause random crashes too, so run Windows Memory Diagnostic and check the disk's health. Back up the user's data early if the disk is suspect.

Use central patch management rather than leaving each PC to update itself, for example Microsoft Intune, Configuration Manager or WSUS, depending on what the company has. Test first: deploy to a small pilot group, including a few PCs that run critical or older software, and watch for problems for a few days. Then roll out in waves, with installs and restarts scheduled outside working hours and users warned in advance.

Track compliance in the console and follow up on PCs that failed or were offline. Have a rollback plan: know how to uninstall a problem update or pause the rollout. Security updates rated critical may need a faster path.

DHCP, the Dynamic Host Configuration Protocol, automatically gives devices an IP address, subnet mask, default gateway and DNS server, so nobody has to set them by hand. It happens in four steps, often remembered as DORA. Discover: the computer broadcasts a request for a DHCP server. Offer: a server offers an address. Request: the computer asks for that address. Acknowledge: the server confirms it and leases it for a set time, after which the computer renews it.

If no DHCP server answers, Windows gives itself a 169.254.x.x address and the user has no network. ipconfig /release and ipconfig /renew make the PC ask again.

An IP address identifies a device on the network, such as 192.168.1.25. The subnet mask, such as 255.255.255.0 (written /24), says which part of the address is the network and which is the device, so the PC knows which addresses are on its own local network. The default gateway, usually the router, is where the PC sends traffic for any address outside that network, such as the internet.

Private ranges are reserved for internal networks and aren't routed on the internet: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. The router uses NAT to let those devices share the office's public IP address.

A hub is an old device that copies every incoming signal to all ports, so all devices share the bandwidth and see each other's traffic; you'll rarely find one today. A switch connects devices within the same local network and learns which device is on which port from their MAC addresses, so it sends each frame only where it needs to go. A router connects different networks, such as the office network to the internet, and forwards traffic using IP addresses.

In short, a switch works at layer 2 of the OSI model and a router at layer 3. A typical home Wi-Fi box combines a router, a switch and a wireless access point.

Start with requirements: number of wired and wireless devices, room for growth, internet bandwidth, and whether guests need Wi-Fi. A typical design: an internet line, ideally with a second line for backup, a firewall or router, and a managed switch with enough ports for desks, the printer and access points, preferably PoE to power the access points. Place access points by the floor plan for coverage, not just one in the corner.

Plan addressing: a DHCP scope large enough, a fixed or reserved IP for the printer, and a separate guest Wi-Fi network or VLAN so guests can't reach office PCs. Use WPA2 or WPA3, change default passwords, label cables, and document everything.

A user raises it by portal, email or phone, and the ticket is logged as New with the user's details, a category and a description. It's prioritised from its impact and urgency, and assigned to the right support group or engineer, which starts the response clock. The engineer moves it to In Progress, contacts the user and works on it, adding notes as they go. If they're waiting on the user or a vendor, it goes On Hold or Pending.

Once fixed, it's set to Resolved with the resolution written clearly, and the user is asked to confirm. If they don't reopen it within the agreed days, it's Closed automatically.

An incident is an unplanned interruption or a drop in quality of a service: Outlook won't open, the printer shows an error, the VPN won't connect. The goal is to restore service as quickly as possible. A service request is a user asking for something standard that isn't broken: a new laptop, access to a shared folder, installing approved software, a password reset. These usually follow a set process and may need approval.

A change is adding, modifying or removing something that could affect services, such as upgrading a server or changing firewall rules. Changes go through change management with planning, approval and a rollback plan. Logging tickets under the right type keeps reports and SLAs accurate.

Write one when a problem keeps coming back, when the fix took real effort to find, or when users could solve it themselves, like connecting to the VPN or setting up email on a phone. Writing it saves the next engineer time and helps new joiners.

A good article has a title in the words users search for, such as "Outlook keeps asking for password", the symptoms and error messages, the cause if known, numbered steps with screenshots, and how to check it worked. Mark whether it's for users or only for engineers, and never include passwords or internal details in user articles. Link it to tickets, and review it when software changes.

Listen first, and acknowledge it plainly: a week without an update isn't acceptable. Then check the ticket while they're on the line: who it's assigned to, the last action, and what it's waiting for. Give them an honest status and a clear next step with a time, for example "It's waiting on a replacement part; I'll chase the vendor today and call you by 4 pm."

If it's stuck with another team, escalate it to that team or my lead, and offer a workaround if the problem is stopping their work. Then do what I promised and update the ticket. Afterwards, look at why it went quiet so the same gap doesn't happen again.

First find out exactly what happens. If there are no lights or fans at all, it's power: check the wall socket with another device, the power cable, the UPS or extension board, and the switch on the power supply. If it powers on but the screen is blank, check the monitor's power and input source and the display cable, and make sure it's plugged into the graphics card if one is fitted. Beeps or diagnostic lights point to hardware such as RAM; their meaning depends on the manufacturer, so look it up.

Reseating the RAM often fixes it. If Windows starts loading and then fails, it's a software or disk problem instead.

Start with the printer itself: is it on, is there a paper jam or error on its display, and is it connected to the network? Print a configuration page to see its IP address, and ping it from the user's PC. If the IP has changed, the PC is sending jobs to the old address, so update the port or give the printer a reserved IP in DHCP.

If the printer is fine, clear the queue: cancel the jobs, and if they won't clear, restart the Print Spooler service from services.msc. Check that the right driver is installed and that it's set as the default printer. If others print fine, the problem is on that one PC.

Make a bootable USB drive with Microsoft's Media Creation Tool, or use the company's standard image. Check the laptop meets the requirements, including TPM 2.0 and Secure Boot, which are enabled in the UEFI settings. Boot from the USB using the laptop's boot menu key, choose the edition, delete the old partitions if it's a clean install, and install.

Afterwards install drivers from the manufacturer's support tool, run Windows Update, join the domain or enrol it in Intune, install the standard software and antivirus, and turn on BitLocker. Always back up the user's data before wiping a used laptop. Large companies usually deploy images automatically rather than installing one by one.

Measure before deciding. Task Manager shows whether the CPU, memory or disk is at 100%, and which program is causing it. If it's software, remove startup programs, check for malware, and look for a stuck update or indexing. Heat points to blocked vents, dust or a failing fan, or old thermal paste; cleaning often brings back performance, because a hot CPU slows itself down.

If memory is always full, adding RAM helps, where the laptop allows it. A laptop with a hard disk instead of an SSD gains the most from an SSD. Check the disk's health and battery wear too. Replace it if repairs cost close to a new one or it's out of warranty with repeated faults.

Priority comes from two things: impact, which is how many people or how much of the business is affected, and urgency, which is how quickly it starts hurting. Most companies use a matrix: high impact and high urgency is P1, such as the email server down for everyone; one user who can't work at all is often P2 or P3; a single user's minor problem with a workaround is P4.

I'd follow the company's own definitions, ask the user questions to judge impact, such as "Can you work another way?" and "Is anyone else affected?", and change the priority if new facts appear. A user's seniority alone shouldn't decide it, though many companies have a VIP process.

Payroll first: it affects the whole company and may have a deadline, so I'd start on it or escalate it immediately to the server team as a P1, and keep updating stakeholders. While that's in progress, the password reset takes two minutes and gets someone working, so I'd do it quickly. Next, the CEO's printer: one user, but I'd offer a quick workaround such as another printer. Then the new joiner's laptop, which has until tomorrow, so I'd plan it for later today. The meeting-room Wi-Fi comes last unless a big meeting is due there.

Explain your reasoning, and say you'd ask a colleague to share the load.

Escalate when the issue needs skills or access you don't have, when it's about to breach its SLA, when its impact grows, or when you've followed the knowledge base and still can't fix it. Escalating early isn't a weakness; sitting on a ticket you can't solve is.

Functional escalation moves the ticket to a team with more expertise: L1 to L2, or to the network, server or application team. Hierarchical escalation brings in management, such as your lead or the service manager, because the issue is serious, a customer is unhappy, or a decision or more resources are needed. When escalating, pass on everything you've tried, so the next team doesn't start from the beginning.

Show that you enjoy solving problems and helping people, and that you see it as a base for a career. "I enjoy fixing things and I like helping people get back to work. At college I was the person friends came to for laptop and Wi-Fi problems, and I've since [completed CompTIA A+ or CCNA training, set up a small home network or lab]. IT support gives me hands-on experience with Windows, networking and real users, which I want as the base for growing into [system administration, networking or cloud]."

Don't make it sound like the only job you could get; show the work itself interests you.

Answer honestly and show you understand why it's needed. "Yes. I know IT support can't always be done remotely: hardware has to be fixed in person, and problems don't only happen in office hours. I'm comfortable travelling to branches and taking my turn on call. I'd like to know how the on-call rota works and how often branch visits happen, so I can plan."

If you have a genuine limit, such as no two-wheeler or a long commute, mention it calmly with how you'd manage it. Asking a sensible question about the rota shows you're taking the job seriously rather than just saying yes.

Stay calm and make them feel heard, then simplify. "I'd let them explain without interrupting, and acknowledge it: 'I understand this is stopping your work, let's sort it out.' I avoid jargon, so instead of 'flush your DNS' I'd say 'I'll run a quick command to refresh the connection.' If I need them to do something, I give one step at a time and confirm each one. If the fix will take time, I tell them honestly and offer a workaround so they can keep working."

End by saying you'd follow up afterwards. Never blame the user, even if they caused the problem.

Use STAR and show your method, not luck. "Several users in one department lost access to a shared drive every morning (situation). The usual fixes didn't work, and I had to find the cause (task). I collected the exact error and times, checked Event Viewer on two affected PCs, and noticed it happened only on laptops on Wi-Fi, where Windows signed in before the network was ready, so the drive-mapping policy didn't apply. With my lead's approval I tested the Group Policy setting that makes PCs wait for the network at sign-in, on two laptops first (action). The problem stopped, and I wrote a knowledge base article (result)."

Say how you'd now spot a similar issue faster.

Show a realistic path that starts with doing this job well. "First I want to become strong in support: solving most tickets myself and earning the team's trust. Over the next few years I'd like to move into [system administration, networking, or cloud and Microsoft 365 administration], and I'm already working towards [a certification such as CCNA, Microsoft 365 or Azure fundamentals]. I'd like that growth to happen here, taking on more complex work and helping new support engineers."

Naming a direction and a step you're already taking makes the answer believable.