Cheat Sheets

Windows repair commands — in the right orderWindows

The single most common support mistake is running SFC first. SFC repairs system files using the local component store — if that store is itself corrupt, SFC will fail or "fix" nothing. Repair the store with DISM first, then run SFC.

1. Check the store — read-only, changes nothing.DISM /Online /Cleanup-Image /ScanHealth
2. Repair the store — needs internet, or a known-good source.DISM /Online /Cleanup-Image /RestoreHealth
3. Now repair system files.sfc /scannow
4. Reboot, then re-run sfc /scannow to confirm it reports no violations.

When DISM can't reach Windows Update

Mount a matching Windows ISO and point DISM at its install image. Change D: to your mounted drive letter and 1 to the correct edition index:

Disk-level checks

Other repairs worth knowing

Windows boot repair & recoveryWindows

Getting into the Recovery Environment (WinRE)

• From Windows — hold Shift while clicking Restart.
• From the login screen — click the power icon, hold Shift, click Restart.
• From a dead machine — interrupt boot three times (power off during the Windows logo). The fourth boot enters WinRE automatically.
• From install media — boot the USB, then choose Repair your computer rather than Install.

Safe Mode

In WinRE: Troubleshoot > Advanced options > Startup Settings > Restart, then press 4 for Safe Mode, 5 for Safe Mode with Networking, 6 for Safe Mode with Command Prompt. From a working desktop you can also set it with:

Rebuilding the boot record

From a WinRE command prompt, in this order:

If bootrec /fixboot returns Access is denied on a UEFI machine, rebuild the EFI partition instead. Use diskpart to find and assign a letter to the ~100MB EFI System Partition, then:

Startup Repair and rollback

• Startup Repair — WinRE > Troubleshoot > Advanced options. Worth one attempt; rarely worth three.
• Uninstall Updates — removes the latest quality or feature update. The fastest fix when a machine broke straight after Patch Tuesday.
• System Restore — only if restore points were enabled; they are off by default on many builds.

Blue screen stop codes — what they actually meanWindows

The on-screen name matters more than the hex code. These are the ones that come up in practice, with the first thing worth checking.

Reading the dump

Minidumps land in C:\Windows\Minidump. Open with WinDbg or BlueScreenView from NirSoft — both are in the tools directory. The driver named in the dump is where to start, not the stop code.

Run box, shell and ms-settings commandsWindows

Press Win+R and type any of these. Faster than hunting through Settings, and they work when the Settings app itself is broken.

Keyboard shortcuts worth muscle memory

Windows lifecycle & the ESU deadlineWindows

Windows 10 reached end of support on 14 October 2025. Extended Security Updates buy time — they do not extend the product lifecycle, and they deliver critical and important security fixes only, with no feature updates and no technical support.

Getting consumer ESU (free options exist)

• Device must be on Windows 10 version 22H2, fully updated, signed in with an administrator Microsoft account (not a child account).
• Free if you enable Windows Backup / PC settings sync, free for 1,000 Microsoft Rewards points, or a one-off $30 (local equivalent).
• One licence covers up to 10 devices. Enrol via Settings > Update & Security > Windows Update.
• Not available for domain-joined, Entra-joined, MDM-enrolled or kiosk devices — those need commercial ESU.

Verified against Microsoft's ESU page, August 2026. Widely republished articles still quote an October 2026 consumer end date; Microsoft has since extended it to October 2027.

Windows 11 — make it behave like Windows 10Windows

Restore the full right-click menu

Removes the "Show more options" second click. Run in a normal (non-admin) Command Prompt, then restart Explorer or reboot:

To reverse it:

Show every system tray icon

Win+R, then paste:

Other common requests

BIOS & boot menu keys by manufacturerHardware

Tap the key repeatedly from the instant you press power — holding it down sometimes registers as a stuck-key error instead. On a modern UEFI machine with fast boot enabled the window can be under a second, which is why the software routes below are more reliable than the key.

The two routes that always work on Windows

• From a running machine: hold Shift and click Restart, then Troubleshoot > Advanced options > UEFI Firmware Settings.
• One command, from an elevated prompt — reboots straight into firmware, no key timing at all:

Both need UEFI rather than legacy BIOS, and the second needs administrator rights. On a machine that won't boot far enough for either, you're back to the keys.

Laptops & prebuilt desktops

Swipe the table sideways on a small screen

Motherboards — self-built desktops

Servers

Legacy BIOS vendors — very old kit

Reset OneDriveMicrosoft 365

The standard fix when OneDrive is stuck on "Processing changes", shows the wrong account, or refuses to sign in. It does not delete files — it clears the client's state and re-reads the cloud. On a large library, re-indexing afterwards can take hours.

1. Clear the Store cache first — Win+R, then wsreset.exe. A console window opens, then the Store opens. Close it.
2. Win+R again and run the reset command for wherever OneDrive is installed. Try each in turn; the wrong path silently does nothing.
3. Wait up to five minutes. OneDrive should relaunch on its own. If it doesn't, start it from the Start menu.
4. Let it finish re-indexing before judging whether the fix worked.

If a reset doesn't fix it

• Unlink and relink — OneDrive settings > Account > Unlink this PC. Keeps local files.
• Run the Support and Recovery Assistant (SaRA) — Microsoft's own diagnostic, faster than guessing.
• Check the file isn't the problem — an invalid character, a 400-character path, or a locked file will stall the whole queue. See the limits sheet below.
• Error 0x8004de42 — you're behind an authenticated proxy. OneDrive does not support them.

OneDrive & SharePoint limitsMicrosoft 365

Most "mystery" sync failures are one of these limits, not a fault. Figures below are from Microsoft's restrictions and limitations page, checked August 2026.

Sizes and paths

Item counts

Characters that block sync

The genuinely forbidden set is short — nine characters, plus leading and trailing spaces:

These are now supported on macOS (changed January 2025). Several others are conditionally a problem and are frequently listed as banned when they aren't:

• # and % — fine unless your tenant predates the change and hasn't had support enabled.
• ; — breaks saving via the Office desktop Backstage view to that folder.
• & — only a problem for Office 2010.

Names that are blocked outright

.lock, CON, PRN, AUX, NUL, COM0–COM9, LPT0–LPT9, _vti_ (anywhere in the name), desktop.ini, and anything starting ~$. forms is blocked at the root of a library only.

Microsoft 365 admin URLsMicrosoft 365

Deep links straight to the console you actually want, instead of three clicks from the landing page.

First three places to look in a suspected account compromise

1. Risky sign-ins in Entra — impossible travel, unfamiliar sign-in properties.
2. Inbox rules on the mailbox — attackers almost always create a rule that files or deletes replies. Check via Exchange admin or Get-InboxRule.
3. Audit log search in Purview — filter on the user, look for mail forwarding, app consent grants and MFA method changes.

Network troubleshooting commandsNetworking

The five-minute triage, in order

1. Do I have an IP? ipconfig /all — a 169.254.x.x address means DHCP failed entirely.
2. Can I reach the gateway? ping 192.168.1.1 — fails here and it's local: cable, switch port, VLAN.
3. Can I reach the internet by IP? ping 1.1.1.1 — works here but not by name, and it's DNS.
4. Can I resolve names? nslookup itproexpert.com 1.1.1.1 — compare against the local resolver.
5. Where does it break? tracert 1.1.1.1 or, better, pathping for loss per hop.

Port numbers worth knowingNetworking

DNS record types & TTLNetworking

TTL, in practice

• 3600 (1 hour) — a sensible default for stable records.
• 300 (5 minutes) — set this at least 24–48 hours before a planned migration, so caches have already picked up the short value.
• Lowering the TTL on the day of a cutover achieves nothing: resolvers are still holding the old, long TTL.
• Raise it back to 3600 once the change has settled.

Subnet mask & CIDR referenceNetworking

Private ranges (RFC 1918)

• 10.0.0.0/8 — 10.0.0.0 to 10.255.255.255
• 172.16.0.0/12 — 172.16.0.0 to 172.31.255.255 (not 172.0–172.255)
• 192.168.0.0/16 — 192.168.0.0 to 192.168.255.255
• 169.254.0.0/16 — APIPA. Seeing this means DHCP failed
• 100.64.0.0/10 — carrier-grade NAT. Your "public" IP isn't public

Quick mental maths

Usable hosts = 2^{(32 − prefix)} − 2. The minus two is the network address and the broadcast address. A /31 is the exception — it is valid for point-to-point links with no waste.

Ethernet cable categories & PoE standardsNetworking

Power over Ethernet

T568B colour code — pin by pin

Use T568B. It is the predominant standard on commercial installs, it is what almost every factory-made patch lead uses, and it is what the colour print on most keystone modules lists first. T568A is equally valid and identical in performance — the two differ only by swapping the orange and green pairs — but mixing them on one cable makes an accidental crossover.

Order, 1 to 8: white/orange, orange, white/green, blue, white/blue, green, white/brown, brown

Getting it right at the connector

• Orientation. Hold the plug with the clip facing away from you and the gold contacts towards you — pin 1 is on the left. Look at the plug the other way and you'll wire it backwards.
• Both ends must match. B at both ends is a straight-through cable. A at one end and B at the other is a crossover — modern gear auto-senses around it, but it fails certification and creates a fault nobody can find later.
• Untwist no more than 13 mm (½ inch) at the termination. Excessive untwisting is the leading cause of NEXT failures on otherwise good cable.
• Trim the spline flush with the jacket if the cable has one, keep the jacket inside the strain relief, and check all eight conductors are seated to the front of the plug before crimping.
• Keystone modules are printed with both codes. Punch down to the B row and ignore the A row entirely — mixing the two on one module is the usual cause of a "wired but dead" outlet.

Which pairs actually do the work

• 10/100 Mbps uses only pins 1, 2, 3 and 6 — the orange and green pairs.
• Gigabit and above (1000BASE-T, 2.5G, 5G, 10G) uses all four pairs, bidirectionally, on the same pinout. This is why a damaged blue or brown pair produces the classic symptom: the link works but never exceeds 100 Mbps. At 100 Mbps those pins were never used, so the fault was invisible.
• PoE mode A puts power on the data pairs (1–2 and 3–6). Mode B uses the spare pairs (4–5 and 7–8). The switch decides which, not the device. 802.3bt uses all four pairs, so there are no spare pairs left to sacrifice.

Wi-Fi channels, bands & standardsNetworking

2.4 GHz — only three channels exist

Use 1, 6 and 11 only. Every other channel overlaps two of them. A site using channels 3 and 9 "to avoid congestion" is actively making it worse for everyone including itself. Stay on 20 MHz width — 40 MHz on 2.4 GHz is self-defeating.

5 GHz in the UK

• Channels 36–48 (U-NII-1) — indoor, no DFS. The safe default.
• Channels 52–64 and 100–140 — DFS. More spectrum, but a radar detection event silently boots every client off the channel. Avoid DFS for anything carrying voice.
• Channels 149–165 (U-NII-3) — higher power, allowed in the UK, good for outdoor and point-to-point.
• Use 40 MHz width in offices, 80 MHz only where the airtime is genuinely clear. Wider channels mean fewer non-overlapping options.

6 GHz

The UK permits 5925–6425 MHz — the lower 500 MHz, indoor low-power use. That's roughly 24 × 20 MHz channels, or three 160 MHz channels. The US has the full 1200 MHz, so US channel plans and reviews do not transfer. WPA3 is mandatory on 6 GHz; there is no WPA2 fallback.

Find a saved Wi-Fi passwordNetworking

Five routes, depending on what's in front of you. All require administrative or owner access to the device — this recovers a key the machine already holds, it does not break into a network.

Windows 11

Since build 23466 the key is visible in the GUI: Settings > Network & internet > Wi-Fi > Manage known networks, select the SSID, then View Wi-Fi security key.

Windows 10

Control Panel > Network and Internet > Network and Sharing Center. Click the Wi-Fi name next to Connections, then Wireless Properties > Security > Show characters. Only shows the network you're currently connected to.

Any Windows — command line, including networks you're not on

The key appears as Key Content. To dump every saved network at once:

macOS

Open Keychain Access (or Passwords in System Settings on Sonoma and later), select System under System Keychains, click Passwords, double-click the network, tick Show password and authenticate. Terminal equivalent:

Chromebook

Select the time > Settings (or Alt+Shift+S) > Network > your Wi-Fi > Network Details. On managed devices the key is often hidden by policy; chrome://net-export plus a netlog parser is the usual workaround, and needs the device owner's consent.

SPF, DKIM & DMARC — records that actually workSecurity

Google and Yahoo made authentication mandatory for bulk senders in February 2024; Microsoft followed in May 2025 with full rejection from November 2025. "Bulk" means roughly 5,000+ messages a day to that provider's consumer inboxes — but unauthenticated mail from small senders is filtered harder too, so this applies to everyone.

SPF — one record, ten lookups

• Exactly one SPF record per domain. Two records is a permanent fail, and it's the single most common mistake.
• Ten DNS lookup limit, counting every nested include:. Exceed it and SPF returns permerror — which DMARC treats as a fail.
• ~all (softfail) while testing, -all (hardfail) once you're certain every sender is listed.
• Never use +all. It authorises the entire internet to send as you.

DKIM

• Published as a TXT record at selector._domainkey.yourdomain.com.
• Minimum 1024-bit key — Yahoo rejects 512-bit outright. 2048-bit is the sensible default.
• The signing domain (d=) must align with the visible From domain for DMARC to pass on DKIM.
• Rotate selectors periodically; keep the old selector published until the last signed mail has aged out.

DMARC

The rollout that doesn't break your mail

1. Publish p=none with rua= and leave it for 2–4 weeks.
2. Read the reports. Find every legitimate sender — CRM, invoicing, marketing, the scanner in the corner that emails PDFs.
3. Authenticate each one via SPF include or DKIM signing.
4. Move to p=quarantine with pct=25, then 100.
5. Then p=reject. Staying at p=none indefinitely is now read as a negative trust signal.

Password & MFA policy that matches current guidanceSecurity

NIST finalised SP 800-63B revision 4 in 2025, and it reverses most of what corporate policy still says. If your password policy enforces complexity and 90-day expiry, it is now actively contrary to the standard.

MFA, strongest first

1. Passkeys / FIDO2 hardware keys — phishing-resistant. The only tier that survives a convincing fake login page.
2. Push with number matching — resists MFA fatigue attacks. Plain approve/deny push does not.
3. TOTP authenticator app — fine, but phishable in real time by an attacker-in-the-middle proxy.
4. SMS and voice — last resort. Vulnerable to SIM swap and interception.

Practical policy for a UK SME

• 15+ character passphrases, no expiry, breach screening at set and change.
• Passkeys for anyone who will take them; number-matched push for everyone else.
• Password manager deployed and paid for — the policy above is unworkable without one.
• Separate, unlicensed break-glass admin accounts, excluded from conditional access, credentials sealed and physically stored.

Cyber Essentials — the five controls & what changed in 2026Security

The UK government-backed baseline, run by IASME for the NCSC. Two tiers: Cyber Essentials (verified self-assessment) and Cyber Essentials Plus (hands-on technical audit of the same controls).

Version 3.3 "Danzell" — live from 27 April 2026

It replaced v3.2 "Willow". The five controls are unchanged; the marking tightened significantly. Under Willow you could carry up to two major non-compliances and still pass. That margin has gone for the critical items.

• Auto-fail: MFA missing on any cloud service where MFA is available.
• Auto-fail: high and critical patches not applied within 14 days.
• Cloud services are defined and explicitly in scope for the first time.
• Scoping tightened — all specified internet-connected devices are in scope; partial scope still allowed but you must justify exclusions to the assessor.
• Updates also to backups, certification transparency and application development questions.

We cover the process in more depth in our Cyber Essentials guide, and can prepare and certify you through our cyber security service.

Ransomware — the first hourSecurity

Decisions made in the first hour determine whether this is an incident or a catastrophe. Print this and keep a paper copy — if it only exists on the file server, you won't have it when you need it.

Do immediately

1. Isolate, don't power off. Pull the network cable or disable Wi-Fi. Powering off destroys memory-resident evidence and can destroy encryption keys still in RAM.
2. Disconnect backups and NAS. Anything reachable from an infected host is a target — that is precisely how attackers make recovery impossible.
3. Identify scope. Which machines, which shares, which accounts. Check for the same file extension appearing across servers.
4. Disable compromised accounts and revoke sessions — a password reset alone leaves stolen tokens valid.
5. Preserve evidence. Photograph the ransom note, keep a sample encrypted file and the note itself, record timestamps.
6. Start a written timeline. Who did what, when. Insurers and the ICO will both ask.

Capture the RAM first — the free lottery ticket

Encryption keys have to exist in memory while files are being encrypted. Capturing RAM before the machine is rebooted or powered off preserves the only copy that will ever be in your hands. It takes five minutes, costs nothing, and occasionally recovers everything. Do it straight after isolating the machine, before any other troubleshooting.

Method 1 — Task Manager, no downloads needed

The single best target is the ransomware process itself, and Windows can dump it with no tools at all. Use this if the machine is still actively encrypting.

1. Open Task Manager with Ctrl + Shift + Esc and switch to the Details tab.
2. Sort by CPU. The ransomware is usually the process burning CPU with an unfamiliar name — note it, but do not end it.
3. Right-click it > Create dump file. Windows writes a .DMP to your temp folder and shows you the path.
4. Copy that file to the USB stick immediately, then repeat for anything else suspicious.

Method 2 — full system RAM capture

More thorough, and the one to use if the process has already exited or you can't identify it. Both tools are free, portable, and need no installation — put one on a USB stick now, before you need it. Both are listed in our tools directory.

Finish the capture properly

1. Name the file so it identifies itself — hostname, date and time, e.g. ACC-PC04_2026-08-01_1420.raw.
2. Hash it so nobody can question it later. From a clean machine:Get-FileHash E:\ACC-PC04_2026-08-01_1420.raw -Algorithm SHA256
3. Write down who took it, when, and from which machine. Add it to the incident timeline.
4. Keep the stick out of the infected network and hand it to whoever runs the investigation — your insurer's responder, or us.

Do not

• Do not reboot or run "cleanup" tools before the scope is understood. Some strains encrypt further on restart.
• Do not restore straight away. Restoring into a network the attacker still holds simply re-encrypts your only clean copy.
• Do not pay before advice. Payment may be a criminal offence depending on the sanction status of the group, funds rarely produce a working decryptor, and it marks you as payable.
• Do not tell everyone on the compromised email system. Assume the attacker is reading it. Move to phones or a separate channel.

UK reporting clocks

Phishing — red flags & header checksSecurity

What actually gives it away

• Display name matches, address doesn't. Check the real address, not the friendly name. On mobile this takes a deliberate tap — which is why mobile users click more.
• Reply-To differs from From. The classic invoice-fraud signature.
• Lookalike domain — rn for m, .co for .co.uk, an added hyphen, or a legitimate-looking subdomain like microsoft.login-verify.com. Read domains right to left: the bit before the final slash is what counts.
• Urgency plus secrecy. "Before end of day", "don't discuss this with the team" — the two together are close to diagnostic.
• A payment detail change. Any bank detail change arriving by email is fraud until verified by phone on a number you already had.
• Unexpected MFA prompt. Means someone already has the password. Deny, then change it.
• QR codes in email — increasingly used because the link never appears in text for filters to scan.

Reading the headers

In Outlook: open the message, File > Properties > Internet headers. In the new Outlook and OWA: … > View > View message details. In Gmail: ⋮ > Show original. What to look for:

If someone has already clicked

1. Change the password from a different device, then revoke all sessions.
2. Re-register MFA methods — attackers add their own authenticator immediately.
3. Check mailbox rules and forwarding, in the mailbox and at tenant level.
4. Check for new OAuth app consents granted by that user.
5. Run a Purview audit search for that account over the past 30 days.
6. Warn finance directly, by phone, if the account has any payment authority.

Failing drive — what to do in the first ten minutesData

Almost every unrecoverable case we see was recoverable when it started. The damage is usually done by well-meaning troubleshooting, not by the original fault.

Stop immediately

1. Power the machine down and leave it down. Every additional minute of spinning on a failing head assembly grinds the platters.
2. Do not run chkdsk, defrag, or recovery software. Recovery software is for deleted files on a healthy disk. On a failing disk it hammers the drive and can turn a head problem into unrecoverable platter damage.
3. Do not open the drive. One second of exposure lets in dust that makes cleanroom recovery far harder or impossible.
4. Do not swap the PCB from a "matching" donor. Without transferring the ROM chip, the new board writes the wrong adaptives and can render the drive unrecoverable.
5. Do not freeze it. Condensation on the platters.

SSD and NVMe are different — and more urgent

Sounds and what they mean

Full detail, guide prices and turnaround on our data recovery page. There is usually only one good attempt at a recovery — spend it on the right equipment.

RAID levels & the 3-2-1-1-0 backup ruleData

3-2-1-1-0

Define RTO (how long you can be down) and RPO (how much data you can lose) per system rather than applying one policy to everything, and test a full restore on a schedule — including the restore of the thing nobody has ever restored.

macOS startup keys — Apple Silicon vs IntelmacOS

Identifying ports, connectors & cablesHardware

USB-C is a connector shape, not a capability. Two identical-looking ports on the same laptop can differ by a factor of forty in bandwidth, and one may not carry video at all.