Newbie Guidance

Intro to the 5 W and H

For T1 IT troubleshooting, where you're often the first point of contact for users and encounter a wide array of problems, the 5 W's and H methodology is your guide. When you're in an unknown environment, unsure of the system's history, or dealing with a completely novel issue, a methodical approach isn't just helpful; it's essential for avoiding wild goose chases and reaching a resolution efficiently.

Before delving into the specifics of each "W" and "H," it's crucial to acknowledge the foundational role of direct client engagement, especially for T1 IT support. While a seasoned T2 or T3 technician might possess the experience to quickly "know the required remediation" for a problem they've seen a hundred times, even the most senior IT professional will struggle with a novel or vaguely described issue. There's a significant difference between "knowing what to do" in a familiar scenario and the process of "knowing the required remediation" that only emerges after a thorough investigation. This is precisely why getting the client on the phone and initiating a conversation, rather than just relying on a ticket's cryptic description, is paramount. That direct dialogue allows T1 to actively ask the right questions, patiently guide the client, and begin gathering the critical pieces of the puzzle that the 5 W's and H methodology is designed to collect. Without this initial, methodical information gathering at the T1 level, even the most complex problems will be escalated as obtuse and time-consuming for T2, leading to unnecessary delays and frustration for both support staff and, most importantly, the end-user. 

Here's a breakdown of each component and its importance in T1 IT troubleshooting:

Who?

This question helps you identify the people involved and their roles.

• For T1 IT: "Who is experiencing the problem?" is your immediate priority. Is it a single user, a department, or everyone? "Who else is affected?" helps gauge the scope. Understanding "who" was doing "what" when the problem occurred can provide crucial context, as user actions or changes they made might be the root cause. It also identifies who you need to communicate with for further information and updates.

What?

This is about defining the problem itself, as precisely as possible.

• For T1 IT: "What exactly is happening?" is often the hardest question to get a clear answer to from a user. Encourage them to describe the symptoms, error messages, or unexpected behaviors in detail. "What is not working as expected?" helps narrow down the scope. "What should be happening?" gives you a baseline for expected functionality. This question helps you understand the impact of the problem and the specific services or applications affected.

When?

Timing is often critical in troubleshooting, helping to pinpoint potential causes related to recent changes.

• For T1 IT: "When did the problem start?" is paramount. Did it just begin, or has it been intermittent? "When was the last time it worked correctly?" provides a valuable comparison point. "When does it happen?" (e.g., only at certain times of day, after specific actions) can reveal patterns. This helps you correlate the issue with recent updates, installations, or environmental factors.

Where?

Location, whether physical or logical, can provide vital clues to the problem's origin.

• For T1 IT: "Where is the user located?" can inform network issues or local hardware problems. "Where is the affected system/device physically located?" (e.g., specific office, data center, home, cloud, internet) helps you visualize the environment. "Where in the application/system does this occur?" (e.g., a specific module, a particular screen) guides you to the relevant software component. This helps differentiate between local client issues, network problems, or server-side malfunctions.

Why?

While often the most challenging, understanding the "why" aims to uncover the underlying cause, not just the symptoms.

• For T1 IT: This is where you start to hypothesize. "Why do you think this is happening?" might get a user's guess, but it encourages them to think. More importantly, you're asking yourself, "Why would this particular 'What' be happening given the 'Who,' 'When,' and 'Where'?" This is your internal detective work, forming theories based on the gathered information. While a T1 technician might not always solve the "why" definitively (that might be for T2 or T3), formulating a probable cause helps guide the next steps and potential escalation.

How?

This question explores the method or process through which the problem manifests or how it can be reproduced.

• For T1 IT: "How can I reproduce the problem?" is invaluable. If you can replicate it, you can often test solutions more effectively. "How is the user trying to perform the action?" details their steps, which might reveal a user error or an unexpected workflow. "How does the system respond when the problem occurs?" (e.g., freezes, crashes, error messages) provides specific evidence. Understanding "how" helps you validate the problem and identify specific actions or sequences that trigger it.

By diligently asking and documenting the answers to these six questions, T1 IT professionals can systematically gather the necessary information to diagnose issues, even in unfamiliar territory, and either resolve them directly or provide a clear, concise hand-off to higher-tier support. It transforms guesswork into a structured investigation, leading to faster and more reliable problem resolution.

Examples

Here's how to apply the 5 W's and H methodology to troubleshoot "Can't dial out from phone" and "Can't access the internet" for T1 IT support, incorporating A+-level troubleshooting steps:

Scenario 1: Can't Dial Out From Phone

• Who?

  • Who is experiencing the problem? (e.g., "Just me," "Everyone in my department," "Certain extensions.")

  • Who else has tried to dial out from this specific phone? (Helps determine if it's user-specific or device-specific.)

  • Who are they trying to call? (Internal extension, external number, long-distance? Is it a known working number?)

• What?

  • What exactly happens when you try to dial out? (e.g., "Silence," "Busy signal," "Error message," "Goes straight to voicemail.")

  • What error message, if any, appears on the phone's display? (Exact wording is crucial for research.)

  • What type of phone is it? (Desk phone, softphone, mobile phone using company app? VoIP or Analog?)

  • What numbers are you trying to dial? (Are they internal, local, long-distance, international? Have you tried a different known good number?)

  • What lights are on or off on the phone itself? (e.g., "No power light," "Network activity light blinking")

• When?

  • When did this problem start? (e.g., "Just now," "Since this morning," "After a power outage.")

  • When was the last time you successfully dialed out from this phone? (Helps identify recent changes or patterns.)

  • When do you experience this problem? (Is it always, or only at certain times of day or only when calling specific numbers?)

• Where?

  • Where is the phone physically located? (e.g., "My desk," "Conference room," "Home office.")

  • Where is the phone connected? (Is it plugged into a wall jack, a network switch, or using Wi-Fi? Is the Ethernet cable securely plugged in on both ends? Is the correct port being used on the switch?)

  • Where are you trying to call from (physical location), and where are you trying to call to? (Can help identify regional routing issues or external carrier problems.)

• Why?

  • (This is the analytical step, after gathering the above information.)

  • Why might this be happening? (Initial thoughts: "Is the phone unplugged?", "Is there a network issue?", "Is the phone registered with the PBX/phone system?", "Is the line provisioned correctly?", "Is there an outage with the phone provider?", "Is there a Firewall blocking the VoIP traffic (SIP, RTP)?")

  • Why would you get that specific error message? (Look up error codes in the phone system documentation.)

• How?

  • How are you trying to dial out? (Are you pressing "9" for an outside line, using a speed dial, or direct dialing? Have you tried a different method?)

  • How can I reproduce the issue? (Can the user demonstrate the steps, or can I try from their phone? Can I access the phone's web interface (if available) to check its status?)

  • How is the phone powered? (Power over Ethernet (PoE), AC adapter? Is the power light on? If PoE, is the switch port configured for PoE?)

  • How does the phone behave when you attempt other functions (e.g., calling an internal extension, checking voicemail)? (Helps isolate the issue to external dialing.)

Scenario 2: Can't Access the Internet

• Who?

  • Who is experiencing the problem? (e.g., "Just me," "Everyone in the office," "Guests on the Wi-Fi.")

  • Who else is using the same network segment or Wi-Fi network? (Helps determine scope: individual device, segment, or entire network.)

  • Who made any recent changes to your computer or network settings? (e.g., installed new software, changed Wi-Fi password, changed network adapter settings.)

• What?

  • What exactly happens when you try to access the internet? (e.g., "Browser says 'Page not found'," "Spinning wheel," "Error message," "No connectivity icon in the system tray." Does a 'Limited Connectivity' or 'No Internet Access' message appear?)

  • What applications are affected? (e.g., "Browser only," "Email, Teams, and browser," "All network applications." Can you ping an IP address (e.g., 8.8.8.8) but not a website (e.g., https://www.google.com/search?q=google.com)? This points to a DNS issue.)

  • What error messages do you see? (Exact wording of any pop-ups, browser errors, or system tray notifications.)

  • What specific websites or services are you trying to access? (e.g., "https://www.google[.]com/", " "Streaming services." Have you tried multiple, varied sites?)

  • What are the network adapter's status lights doing? (Link light on? Activity light blinking?)

• When?

  • When did the problem start? (e.g., "Just now," "Since I restarted my computer," "After the network went down yesterday.")

  • When was the last time you successfully accessed the internet from this device/location? (Crucial for pinpointing recent changes.)

  • When does the problem occur? (Is it intermittent, constant, or only at certain times?)

• Where?

  • Where are you physically located when trying to access the internet? (e.g., "My desk in the office," "Coffee shop Wi-Fi," "Home using company VPN.")

  • Where is your device connected? (e.g., "Ethernet cable," "Office Wi-Fi," "Personal hotspot." Is the Ethernet cable securely plugged into the correct port on the wall and computer? Is the Wi-Fi connected to the correct SSID?)

  • Where else have you tried to access the internet from with this device? (Helps determine if it's a device issue or a location-specific network issue.)

  • Where are you getting your IP address from? (DHCP or Static? Check ipconfig /all on Windows or ifconfig / ip addr on Linux/macOS.)

• Why?

  • (This is the analytical step, after gathering the above information.)

  • Why might this be happening? (Initial thoughts: "Is the network cable unplugged?", "Is Wi-Fi turned off?", "Is the router/modem/access point powered on and working?", "Is there an IP address conflict?", "Is the company VPN not connected?", "Is the DNS server configured correctly and reachable?", "Is the gateway reachable?", "Are firewall rules blocking access?", "Is there an IP address exhaustion issue on the DHCP server?")

  • Why would this specific error message appear? (e.g., a "DNS lookup failed" error points to DNS, not necessarily the physical connection, while a "Destination Host Unreachable" from a ping often indicates a gateway or routing issue.)

• How?

  • How are you trying to access the internet? (e.g., "Opening Chrome," "Clicking an email link," "Connecting to VPN.")

  • How is your device connected to the network? (e.g., "Directly to the wall jack," "Through a docking station," "Using Wi-Fi." Have you tried reseating the network cable?)

  • How can I reproduce the issue? (Can the user demonstrate, or can I try pinging the gateway, an external IP (e.g., 8.8.8.8), and an external hostname (e.g., https://www.google.com/search?q=google.com)? Can I release and renew the IP address (ipconfig /release, ipconfig /renew)?)

  • How are other devices on the same network behaving? (Are they able to access the internet? This helps isolate if it's a localized issue or a broader network outage.)