2026-09-20 · help-desk, tcm, class-notes
Information Technology (IT) is the people, processes and technology an organisation uses to create, store, move and protect information. In practice, IT exists to keep the business working. The payroll team needs…
Class notes · TCM Security, Practical Help Desk · Section 2
Quick reference: the short version of this section is the Section 2 cheat sheet.
By the end of these notes you should be able to:
Information Technology (IT) is the people, processes and technology an organisation uses to create, store, move and protect information. In practice, IT exists to keep the business working. The payroll team needs payroll software that runs; sales needs laptops, email and a CRM; everyone needs to sign in securely.
Function
Examples
Support people
Answering tickets, resetting passwords, setting up new starters, fixing laptops
Run infrastructure
Servers, networks, Wi-Fi, cloud services, identity (Active Directory, Entra ID)
Protect information
Backups, security tools, access control, patching
Enable change
Rolling out new software, integrating systems, automating manual work
Plan and budget
Hardware refresh cycles, licences, vendor contracts
Model
What it means
Typical in
In-house IT
The organisation employs its own IT staff
Medium and large organisations
Managed service provider (MSP)
An outside company runs some or all IT for a monthly fee
Small businesses; also used to cover gaps
Outsourced / offshore service desk
Tier 1 support handled by a third party, often in another country
Large enterprises cutting costs
Hybrid
In-house team plus MSP or cloud providers
Very common today
In the real world: many first help desk jobs are at MSPs. You see many different clients, environments and problems — a fast way to learn, often at a fast pace.
Shadow IT is technology staff use without IT's knowledge — a personal Dropbox for work files, an unapproved browser extension, a team buying its own SaaS tool. It happens because people want to get work done. It matters because IT can't secure, back up or support what it doesn't know exists.
\+----------------------\+
| CIO / IT Director |
\+----------\+-----------\+
|
\+-------------\+---------------\+---------------\+---------------\+
| | | | |
+----+----+ +-----+-----+ +------+------+ +-----+-----+ +------+------+ | Service | | Desktop | | Infrastruc- | | Security | | Development | | Desk | | Support | | ture / Ops | | (CISO) | | / DevOps | +---------+ +-----------+ +-------------+ +-----------+ +-------------+ Tier 1 Tier 2 Sysadmins, SOC analysts, Developers, analysts technicians network, cloud engineers DevOps
Title
Focus
CIO (Chief Information Officer)
IT strategy and how technology serves the business
CTO (Chief Technology Officer)
Technology direction — often product-facing in tech companies
CISO (Chief Information Security Officer)
Security strategy, risk and compliance
IT Director / Head of IT
Running the IT department day to day
IT Manager / Team Lead
People, priorities and escalations for one team
In a small business this collapses: one "IT person" may be the help desk, sysadmin and security team at once. In a large enterprise, each box above may be a department of dozens.
Role
Day-to-day work
Common tools
Typical next step
Help desk / service desk analyst
Answer calls, chats and tickets; reset passwords; triage; escalate
Ticketing system, Active Directory, remote support tool
Desktop support, sysadmin, SOC
Desktop support technician
Hardware repairs, desk visits, imaging and deploying laptops
Imaging tools, Intune/MDM, spare parts
Sysadmin, endpoint engineer
Systems administrator
Servers, Active Directory, Group Policy, patching, backups
Windows Server, PowerShell, backup software
Systems engineer, cloud engineer
Network administrator / engineer
Switches, routers, firewalls, Wi-Fi, VPN
Vendor consoles, monitoring tools
Network architect, security engineer
Cloud engineer
Cloud infrastructure and automation
Azure, AWS, infrastructure-as-code
Cloud architect
Security analyst (SOC)
Monitor alerts, investigate, respond
SIEM, EDR, threat intelligence
Incident responder, threat hunter
Database administrator (DBA)
Database performance, backups, access
SQL Server, PostgreSQL
Data engineer
IT manager
Priorities, people, budgets, vendors
Everything above, plus spreadsheets
Director, CIO
Tier
Who
Handles
0
Self-service
Knowledge-base articles, password-reset portals, chatbots
1
Help desk analysts
Logging, triage, common fixes, first-contact resolution, escalation
2
Desktop support, senior analysts
Deeper troubleshooting, hardware, desk-side visits
3
Engineers and specialists
Server, network or application problems; root-cause fixes
(4)
Vendors
Problems only the manufacturer or software vendor can fix
ITIL is the most widely used framework for IT service management. Its vocabulary is standard across help desks:
Type
Definition
Example
Goal
Incident
An unplanned interruption or loss of quality in a service
"Outlook crashes on start-up"
Restore service fast
Service request
A standard, pre-approved ask
"New starter needs a laptop"
Fulfil it efficiently
Problem
The underlying cause of one or more incidents
"Why does the VPN drop every Monday?"
Find and remove the root cause
Change
A planned addition, modification or removal
"Upgrade the print server on Saturday"
Make it with minimal risk
Exam tip: an incident is about restoring service now; a problem is about preventing it happening again. Ten users with the same crash are ten incidents linked to one problem.
New --> Assigned --> In progress --> Resolved --> Closed | ^ v | Pending (waiting on user / vendor)- Pending pauses the SLA clock in most tools, while you wait on someone else.
High urgency
Medium urgency
Low urgency
High impact (many users, critical system)
P1 Critical
P2 High
P3 Medium
Medium impact (a team)
P2 High
P3 Medium
P4 Low
Low impact (one user, workaround exists)
P3 Medium
P4 Low
P4 Low
A service level agreement (SLA) is a promise about response and resolution times for each priority, for example:
Priority
Respond within
Resolve within
P1
15 minutes
4 hours
P2
1 hour
8 business hours
P3
4 hours
3 business days
P4
1 business day
5 business days
(These are typical figures; every organisation sets its own.)
KPI (key performance indicator)
Measures
First contact resolution (FCR)
% of tickets fixed on the first contact
Mean time to resolve (MTTR)
Average time from ticket open to resolution
SLA compliance
% of tickets meeting their SLA
CSAT
Customer satisfaction score from post-ticket surveys
Backlog
Open tickets waiting
Type
Meaning
Example
Functional
Pass to someone with more expertise
Tier 1 → network team for a switch fault
Hierarchical
Raise to someone with more authority
Notify a manager because a P1 is at risk of missing its SLA
Three tickets arrive at 09:00:
Ticket
Details
A
CEO's assistant: "Second monitor flickers."
B
Finance team (12 people): "Can't open the payroll system — payroll runs at noon."
C
One user: "New keyboard please, the E key sticks."
Assessment:
Weak note:
"Fixed it."
Strong note:
"User unable to connect to VPN since 08:40; error 'authentication failed'. Checked AD: account locked out after 5 failed attempts (source: user's phone with an old saved password). Verified identity via call-back to the number on file. Unlocked account; user removed the old password from the phone's mail app. VPN connects. Advised the user to update saved passwords after changes. Resolved."
A strong note records:
Written well, the next technician — or an auditor — understands it with no context.
Technical skill gets you hired; communication makes you good at the job.
Skill
In practice
Active listening
Let the user finish; repeat the problem back in your own words
Empathy
Acknowledge the impact ("that's frustrating with a deadline today")
Plain language
"Your password expired" not "your AD credential object reached its maxPwdAge"
Setting expectations
"I'm escalating this to the network team; you'll hear back within 2 hours"
Ownership
Follow up even after escalating — the user remembers who kept them informed
Calm under pressure
Slow down when the user speeds up
A simple call structure:
IT Service Desk Analyst (1st Line). Responsibilities: provide first-line support via phone, email and ticketing system; manage user accounts in Active Directory and Microsoft 365; troubleshoot Windows 11, Outlook and Teams; escalate to 2nd line; document in knowledge base. Required: customer service experience, basic Windows troubleshooting. Desirable: CompTIA A+, ITIL Foundation, experience with ServiceNow or Freshservice.
Phrase
What it tells you
How to prepare
Phone, email, ticketing
Multi-channel support; communication matters
Practise explaining fixes out loud
Active Directory and Microsoft 365
Account work — resets, groups, licences, mailboxes
Build the AD lab; learn the M365 admin centre
Windows 11, Outlook, Teams
The everyday apps you'll support
Know common Outlook and Teams fixes
Escalate to 2nd line
They want clean hand-offs
Practise writing escalation notes
Required: customer service
Retail or hospitality experience counts
Put it on your CV with support-style examples
Desirable: A+, ITIL
Differentiators, not blockers
A+ Core 1 and 2; ITIL Foundation vocabulary (section 4)
"1st line", "service desk" and "Tier 1 help desk" are the same job. UK postings tend to use "line", US postings "tier".
Category
Examples
Ticketing / ITSM
ServiceNow, Jira Service Management, Freshservice, Zendesk, osTicket
Identity
Active Directory, Entra ID (Azure AD), Okta
Endpoint management
Intune, SCCM/ConfigMgr, Jamf (Mac)
Remote support
TeamViewer, AnyDesk, Quick Assist, ConnectWise
Productivity
Microsoft 365, Google Workspace
The help desk holds the keys: it can reset passwords and MFA. That makes it one of the most targeted parts of any organisation.
Control
How it helps
Identity verification procedure
Call back on the number already on file; manager approval; a verification tool — never "knowing the employee ID" alone
No exceptions for urgency or seniority
Pressure is a red flag, not a reason to skip steps
Never ask for passwords
Legitimate IT never needs a user's password
Least privilege
Help desk accounts can reset standard users, not administrators
Logging and review
Every reset is recorded in the ticket and audit log
Alerting
Unusual reset patterns (many resets, admin accounts) trigger security review
In the real world: if a caller becomes angry when you insist on verification, that isn't evidence they're genuine. Attackers use anger and urgency deliberately. Follow the process and escalate to your team lead if needed.
Term
Definition
IT
The people, processes and technology used to manage information
MSP
Managed service provider — an outside company that runs IT for clients
Shadow IT
Technology used without IT's knowledge or approval
CIO / CTO / CISO
Chief Information / Technology / Information Security Officer
Service desk
The single point of contact between IT and users
Tier 0–3
Levels of support, from self-service to specialists
ITIL
A widely used framework of IT service management practices
Incident
An unplanned interruption to a service
Service request
A standard, pre-approved request (e.g. new hardware)
Problem
The root cause of one or more incidents
Change
A planned modification to IT services or infrastructure
Impact / urgency
Breadth of effect / how soon it must be fixed — together they set priority
SLA
Service level agreement — agreed response and resolution times
KPI
Key performance indicator — a measure of performance
FCR
First contact resolution
MTTR
Mean time to resolve
Functional escalation
Passing work to someone with more expertise
Hierarchical escalation
Raising an issue to someone with more authority
Knowledge base
A library of documented fixes and how-tos
Social engineering
Manipulating people into giving access or information