Windows Server troubleshooting: the diagnostic workflow

Start DC01, SRV01 and CL01. Take a snapshot of SRV01 (“Before troubleshooting”). Work as SAATLAB\adm.rahul in PowerShell as administrator.

In each scenario you first cause the problem yourself, then pretend you just got the ticket.

1Build a “what changed?” function

On SRV01, save this as C:\Lab\Get-RecentChange.ps1 and load it:

function Get-RecentChange {
    param([int]$Hours = 24)
    $start = (Get-Date).AddHours(-$Hours)
    $filters = @(
        @{ LogName = 'System';      Id = 41, 104, 1074, 6005, 6006, 6008, 7040, 7045; StartTime = $start },
        @{ LogName = 'Setup';       Id = 2;                                          StartTime = $start },
        @{ LogName = 'Application'; ProviderName = 'MsiInstaller'; Id = 1033, 11707, 11724; StartTime = $start }
    )
    $events = foreach ($f in $filters) {
        Get-WinEvent -FilterHashtable $f -ErrorAction SilentlyContinue
    }
    $events | Sort-Object TimeCreated -Descending |
        Select-Object TimeCreated, Id,
            @{ n = 'Message'; e = { ($_.Message -split "\r?\n")[0] } }
}

. C:\Lab\Get-RecentChange.ps1
Get-RecentChange -Hours 24 | Format-Table -Wrap

You’ll see something like this:

TimeCreated          Id Message
-----------          -- -------
19/10/2026 09:02:11 6005 The Event log service was started.
19/10/2026 09:02:11 6006 The Event log service was stopped.

Each ID answers one question. 7040 means someone changed a service’s start type, 7045 a new service was installed, 1074 a planned restart (with who and why), 41 and 6008 a dirty shutdown, 104 a log was cleared. Setup event 2 is an update installed, and MsiInstaller events are software installs or removals.

✅ Checkpoint: Get-RecentChange runs and lists recent events (or nothing yet) without errors.

2Scenario 1: “The intranet is down”

Cause it: on DC01, delete the intranet A record:

Remove-DnsServerResourceRecord -ZoneName saatlab.internal -Name intranet -RRType A -Force

Define: on CL01, reproduce what the user sees:

Clear-DnsClientCache
Invoke-WebRequest https://intranet.saatlab.internal -UseDefaultCredentials -UseBasicParsing

You’ll see something like this:

Invoke-WebRequest : The remote name could not be resolved: 'intranet.saatlab.internal'

Scope: does the server answer by IP? Does the name exist?

Test-NetConnection 10.0.0.20 -Port 443 | Select-Object RemoteAddress, TcpTestSucceeded
Resolve-DnsName intranet.saatlab.internal

You’ll see something like this:

RemoteAddress TcpTestSucceeded
------------- ----------------
10.0.0.20     True

Resolve-DnsName : intranet.saatlab.internal : DNS name does not exist

The web server is fine by IP, so the problem is name resolution. Now ask what changed in DNS.

What changed: on DC01, check the DNS audit log:

Get-WinEvent -FilterHashtable @{ LogName = 'Microsoft-Windows-DNSServer/Audit'; Id = 516 } -MaxEvents 3 |
    Format-List TimeCreated, Message

You’ll see something like this:

TimeCreated : 19/10/2026 10:40:12
Message     : A resource record of type 1, name intranet and RDATA 10.0.0.20 was deleted from scope Default of zone
              saatlab.internal.

Fix and verify: put the record back, then test from CL01:

# On DC01
Add-DnsServerResourceRecordA -ZoneName saatlab.internal -Name intranet -IPv4Address 10.0.0.20

# On CL01
Clear-DnsClientCache
(Invoke-WebRequest https://intranet.saatlab.internal -UseDefaultCredentials -UseBasicParsing).StatusCode

You’ll see something like this:

200

✅ Checkpoint: You proved the cause (record deleted at 10:40) from the DNS audit log, not by guessing, and the user check returns 200.

3Scenario 2: “The intranet is down again”

Cause it: on SRV01, stop and disable the web service:

Stop-Service W3SVC
Set-Service W3SVC -StartupType Disabled

Define and scope: on CL01, same symptom check, then test by name and port:

Resolve-DnsName intranet.saatlab.internal | Select-Object Name, IPAddress
Test-NetConnection intranet.saatlab.internal -Port 443 | Select-Object PingSucceeded, TcpTestSucceeded

You’ll see something like this:

Name                      IPAddress
----                      ---------
intranet.saatlab.internal 10.0.0.20

PingSucceeded TcpTestSucceeded
------------- ----------------
True          False

This time DNS works and the server answers ping, but nothing listens on port 443. Same symptom, different layer: look at the service on SRV01.

What changed: on SRV01, run your function:

Get-RecentChange -Hours 2 | Format-Table -Wrap

You’ll see something like this:

TimeCreated          Id Message
-----------          -- -------
19/10/2026 11:05:37 7040 The start type of the World Wide Web Publishing Service service was changed from auto start
                         to disabled.

Fix and verify:

Set-Service W3SVC -StartupType Automatic
Start-Service W3SVC
Get-Service W3SVC | Select-Object Name, Status, StartType

You’ll see something like this:

Name  Status  StartType
----  ------  ---------
W3SVC Running Automatic

Then run the Invoke-WebRequest check on CL01 again and confirm StatusCode 200.

✅ Checkpoint: Get-RecentChange showed event 7040, and the intranet works again from CL01.

4Scenario 3: “SRV01 restarted at lunchtime”

Cause it: on SRV01, restart with a reason and a comment:

shutdown /r /t 0 /d p:4:1 /c "Lab restart test"

What changed: after it comes back, run:

. C:\Lab\Get-RecentChange.ps1
Get-WinEvent -FilterHashtable @{ LogName = 'System'; Id = 1074 } -MaxEvents 1 | Format-List TimeCreated, Message

You’ll see something like this:

TimeCreated : 19/10/2026 12:31:08
Message     : The process C:\Windows\system32\shutdown.exe (SRV01) has initiated the restart of computer SRV01 on
              behalf of user SAATLAB\adm.rahul for the following reason: Application: Maintenance (Planned)
               Reason Code: 0x84040001
               Shutdown Type: restart
               Comment: Lab restart test

Event 1074 tells you the process, the account, the reason and the comment. If a restart has no 1074 but has 41 or 6008, nobody restarted it: it lost power or crashed. You’ll see that in the Break It lab.

✅ Checkpoint: Event 1074 shows who restarted SRV01 and why.

5Write the incident report

On SRV01, save a short report for Scenario 1:

$report = @"
Incident: INC-001 Intranet unavailable
Impact:   All users, intranet.saatlab.internal, 10:40 to 10:58
Symptom:  "The remote name could not be resolved"
Cause:    A record 'intranet' deleted from zone saatlab.internal (DNS audit event 516, 10:40)
Fix:      Record re-created (10.0.0.20), verified HTTP 200 from CL01
Prevent:  DNS changes through change requests; alert on DNS audit event 516
"@
$report | Set-Content C:\Lab\INC-001.txt
Get-Content C:\Lab\INC-001.txt | Select-Object -First 2

You should see this:

Incident: INC-001 Intranet unavailable
Impact:   All users, intranet.saatlab.internal, 10:40 to 10:58

Keep it short and factual. Times, evidence and the prevention step matter more than long explanations.

✅ Checkpoint: C:\Lab\INC-001.txt holds impact, symptom, cause, fix and prevention.