5.1.2. Scoping, Documentation, and Escalation
💡 First Principle: Determining the scope of a problem is not a formality — it's diagnostic data. A problem affecting one user points to that user's account or workstation. A problem affecting everyone on a specific server points to that server or its network connection. A problem affecting everyone everywhere points to shared infrastructure (DNS, AD, core switch). Scope narrows the hypothesis space before you examine a single log.
Scoping Questions
| Scope Indicator | What It Narrows | Example |
|---|---|---|
| Affects one user only | User account, workstation, profile | Account locked, local drive full |
| Affects one group of users | Group policy, shared resource, role | Group permission changed, file share offline |
| Affects one server | That server's hardware, OS, or config | Service failed, NIC issue |
| Affects one site | Site-level infrastructure | Local switch/router, site link |
| Affects everyone | Core infrastructure | DNS, AD, core switch, internet link |
Documentation During Troubleshooting
Documentation during an active incident isn't just a bureaucratic step — it's operationally necessary:
- Tracks what theories were tested and eliminated (prevents re-testing the same failed approach)
- Creates a timeline for root cause analysis
- Enables handoff if the problem spans a shift change or requires escalation
- Satisfies change management requirements for any changes made during resolution
Escalation
Escalation is appropriate when:
- The problem is outside your skill level or authorization
- You've exhausted your hypotheses without resolving the problem
- The impact is escalating (worsening) and requires faster resolution than you can provide
- The fix requires resources or approvals you don't have
Escalation is not failure — it's correct process. The mistake is escalating too late or not providing the next-level team with your documented findings so far.
⚠️ Exam Trap: The troubleshooting methodology says to escalate "if necessary" — this means escalation is a valid step at any point, not only after exhausting all options. If a problem is clearly outside scope or authorization, escalate immediately.
Reflection Question: A junior technician has been troubleshooting a production database server outage for 2 hours without resolution. The server provides transaction processing for 500 concurrent users. At what point should escalation have occurred, and what information should be provided to the next-level team?
