Quick Reference
Keep this page open during the class or during a real first-response investigation.
First-response checklist
Quick commands
resmon
eventvwr.msc
services.msc
taskschd.msc
diskmgmt.msc
ipconfig /all
nslookup example.com
Test-NetConnection example.com -Port 443
Test-NetConnection SERVER-IP -Port 3389
Get-Process
Get-Service
Get-NetIPConfigurationFast symptom map
| Symptom | Start here |
|---|---|
| Server slow | CPU → RAM → Disk → Network → Processes → Services → Logs |
| C: drive full | Usage → consumer → logs/backups/temp → safe cleanup → verify |
| Website down | RDP → local site → IIS → App Pool → Plesk → logs → app/database |
| 503 | IIS → App Pool → worker process → Event Viewer → application logs |
| Internet access fails | DNS → IP → routing → firewall → port → IIS binding |
| Unknown process | Name → path → publisher → parent → service/task → network → EDR → logs |