All jobs / IT support / sysadmin

Windows interview questions

Windows questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.

  1. An application’s Windows service is stopped and the application is down. What do you do?

    The strongest answer: Start it, then look at its startup type and recovery settings and read the System and Application logs around the time it stopped — a service that dies has a reason

    Why it works: Exactly. Restore service, then find out why it stopped and whether it is set to start itself next time.

    • Start it, then find out why.
    • Check the startup type and recovery.
    • Read System and Application logs.
    • Never run a service as domain admin.

  2. A vendor article tells you to change a registry value on a production server. What do you do before and after?

    The strongest answer: Export the key first, write the old value into the ticket, make the change in a change window, restart whatever reads it, then confirm the symptom is actually gone

    Why it works: Right — the export is the way back, and the ticket is what tells the next person why the value is odd.

    • Export the key before you edit.
    • Record the old value in the ticket.
    • Change inside a window.
    • Restart the reader, then verify.

  3. A Windows box fails at login after a patch. Where do you look before you wipe it?

    The strongest answer: Event Viewer for the time of the failure, the patch log, and whether it is one box or many — wipe is a last write

    Why it works: Exactly. Time, patch, scope. Images are expensive hypotheses.

    • Logs and scope before wipe.
    • Match the failure time.
    • Do not fleet-rollback on one box.
    • Do not disable logging to look clean.

  4. A laptop blue-screens during boot right after a graphics driver update. What do you try before reimaging?

    The strongest answer: Get into the Windows recovery environment, start in Safe Mode, and roll back or uninstall that driver; if that fails, a System Restore point from before the update

    Why it works: Exactly. The recovery environment is the way in, and the driver you just changed is the first thing to undo.

    • Undo the change before you wipe.
    • Boot into the recovery environment.
    • Safe Mode, then roll back the driver.
    • System Restore if a point exists.

  5. The policy works on every other laptop on the floor, and the user swears they have restarted.

    A Group Policy you linked is not taking effect on one laptop. How do you diagnose it?

    The strongest answer: Read the resultant policy on that machine to see what applied and what was filtered, then check which OU the computer object is really in, whether the setting is computer or user side, and security filtering, inheritance blocks and enforcement

    Why it works: Exactly. The resultant-policy report tells you whether it was never delivered or delivered and overridden — those are different faults.

    • Ask what actually applied, not what you linked.
    • Read the resultant policy on the machine.
    • Check the OU, and computer versus user.
    • Then filtering, inheritance, enforcement.

  6. An auditor asks who added an account to a privileged group four months ago. That laptop was reimaged in March.

    Every Windows log lives only on the machine that wrote it, and machines get reimaged. What do you build, and what do you collect?

    The strongest answer: Central collection off the endpoints with a retention the business has agreed to, carrying sign-in successes and failures, account and group changes, service installations and PowerShell activity — the rest is noise you pay to store

    Why it works: Right — off the box, kept for an agreed period, and deliberately scoped. A chosen subset you can search beats everything you cannot afford.

    • Logs must outlive the machine.
    • Collect centrally, retain by agreement.
    • Scope it: sign-ins, accounts, services.
    • Noise you cannot afford is not coverage.