Example Co. · IT Service Desk · team interview
What the team told us
How the people who do the work describe it: how they decide, what they wait for, what makes a case unusual, and where they disagree. Answers are pooled and paraphrased; a task is only included when at least 5 people answered.
Password resets and account unlocks
6 people answered
Restore a user's access to their account by resetting the password or unlocking the account, after confirming who is asking, and record the outcome in the ticket.
- Starts when: A call or a ticket saying the user is locked out.
- Done when: The user confirms they can sign in, and the ticket is resolved with the standard resolution note.
- Order: Open the ticket, verify identity, find the user in Active Directory Users and Computers and set the new password, return to the ticket, add the resolution notes, then set the State.
How decisions are made
| Field | How the team decides | Agreement |
|---|
| Whether to handle the case or pass it on | If the requester is an executive, hand the case to the senior tech. Otherwise the tech handles it directly. | Most agree |
| Whether MFA re-registration is needed | If the user has a new phone, also do MFA re-registration, following the MFA steps in the IT Knowledge Base page on unlocking accounts, in addition to the reset or unlock. | Most agree |
| How to verify the requester's identity | Always verify identity with the employee ID and the manager's name before any reset. Answers on any further method (security questions, verification code or authenticator app, recognizing the ticket or channel, or something else) are spread out. | Split |
What cases wait for
Unusual cases
- The requester is an executive (mostly sometimes (under 1 in 10). a smaller share said often): Pass the case to the senior tech.
- The user has a new phone (same pooled frequency as the other unusual cases.): Also perform MFA re-registration, using the knowledge base steps.
Rules and checks
- Verify identity with employee ID and manager name before any reset.
- Record the outcome using the standard resolution note.
- Close the case only after the user confirms they can sign in.
Why extra steps happen
- About 18% of cases open the IT Knowledge Base page on unlocking accounts. The reason given is to look up MFA re-registration steps for users with a new phone.
- About 10% of cases redo steps. The reasons given are that the user did not receive the temporary password, or the account locked again from an old phone.
- The username is copied by hand from the ServiceNow ticket into Active Directory Users and Computers. It is retyped in about 28% of cases, and about 2% of transfers show a mismatch.
Where people disagree
- Methods of confirming the requester's identity beyond the employee ID and manager name vary: other methods, ticket or channel recognition, security questions, and verification code or authenticator app each got a share.
- Estimates of how often unusual cases come up differ: most said sometimes, one said often, one said almost never.
Still open
- Who gives the approval that causes a pause, and which cases need one? Only the answer 'an approval' was given.
- Is the approval step connected to the executive handling, or to something else?
- Which identity check applies to which situation, and is a written policy the source for them?
- What triggers the senior tech's involvement besides executives, and how is the handoff done?
- How is the temporary password delivered, and what is done when the user does not receive it?
- How is the account lockout from an old phone prevented? Only the cause was given.
Status update emails to users
6 people answered
Keep requesters informed about the progress of their ticket by sending a status update email that says what was done, what happens next and how to reply.
- Starts when: A new item appearing in the queue.
- Done when: The requester is satisfied and the ticket is closed.
- Order: Open Outlook, then write the message body. This is the observed path in about 83% of cases, and no order variants were seen.
What cases wait for
- Waiting on another team (50%)
- Waiting for a reply from the requester (50%)
Unusual cases
- Urgent requests from leadership (disputed: most said almost never (60%), the rest said often,): Not described. Answers named the case but not what is done differently.
Rules and checks
- Follow the team's knowledge base (KB). No specific approvals, checks or sender restrictions were named.
- Include the ticket number in the update so the requester can reply.
Why extra steps happen
- Rework happens in about 19% of cases. Respondents say the cause is the requester replying with new information, which means the update has to be rewritten.
- Observed re-editing is concentrated in the message body.
- Some cases pause and are picked up again after a wait. Pauses typically follow the message body edit or a look at the Outlook profile corruption KB article.
Where people disagree
- Wait reason is split evenly between another team and the requester's reply.
- Frequency of unusual (leadership-urgent) cases is split between almost never and fairly often.
Still open
- How are urgent leadership requests handled differently (priority, wording, speed, approval)?
- Which KB article or articles govern status updates, and what do they require?
- Is a standard template used, or does each person word the message themselves? Answers differed slightly.
- What does the 'requester is happy' condition mean in practice, and is there a check before closing?
- How are other teams chased or handed work during a wait? No transfers were observed.
- Why does the median Outlook step take about 220 seconds? It is far longer than the editing step and is not explained by the answers.
Remote troubleshooting sessions
6 people answered
Resolve a user's technical problem by connecting to their device in a remote session, diagnosing it, and recording the outcome in the ticket.
- Starts when: A new item appears in the team's queue (a ServiceNow incident); all six respondents describe it this way.
- Done when: The requester is satisfied and the ticket is closed (four of six answered; no further closing criteria were given).
- Order: Typical sequence observed: open Quick Assist, then Event Viewer and Device Manager, review the ServiceNow incident, then edit Work notes. Order varies in only about 1% of cases.
How decisions are made
| Field | How the team decides | Agreement |
|---|
| Handling of urgent leadership requests | Urgent requests from leadership are treated differently from the normal flow, but the answers don't say how (e.g. whether they jump the queue). | Unclear |
| Escalation target when the remote session doesn't solve the | Not described. All six respondents said they are not sure who gets the case or what information is sent. | Unclear |
| Which diagnostic tools to open (Quick Assist, Event Viewer, | Not stated in the answers. Observed data show Quick Assist in about 65% of cases, Event Viewer and Device Manager in about 71% each, so tool choice varies by case, but the criteria are unknown. | Unclear |
Unusual cases
- Urgent requests from leadership (mostly 'often' (1 in 10 to 1 in 3) for 67% of respondents; 1): Not described beyond the fact that they are handled differently.
Rules and checks
- Follow the team's knowledge base (KB) for remote sessions; the answers don't list the specific rules (consent, identity checks, approvals, access limits).
- Record what was done and the outcome in the ticket's Work notes after each session.
Why extra steps happen
- Sessions stop or can't proceed mainly because the problem needs another team (40%), and otherwise because of missing permissions or approval, an unavailable or unresponsive employee, or a device that is offline or not enrolled in the team's tools (20% each).
Where people disagree
- Frequency of unusual cases: most say they come up often, but some say sometimes or almost never.
Still open
- What do the KB rules say about user consent, identity verification, approvals and access limits?
- Who receives the case when a remote session fails, and what information must be sent with it?
- How are urgent leadership requests handled differently (priority, process, documentation)?
- What counts as 'resolved' beyond requester satisfaction and ticket closure (confirmation method, required fields)?
- What criteria decide which diagnostic tools to use?
- Is there a standard Work notes template (e.g. symptoms, steps, result, follow-up)?
Triage and route incoming tickets
6 people answered
Review each new incoming ticket and set its category, priority and assignment group so it leaves the unassigned queue and reaches the right team.
- Starts when: A new ticket appears in the unassigned queue, arriving from email or the portal.
- Done when: Category, priority and assignment group are all set and the ticket has left the unassigned queue.
- Order: Open the incident, set Category, then Priority, then Assignment group (the main path used in about 87% of cases).
How decisions are made
| Field | How the team decides | Agreement |
|---|
| Category | Choose from what the requester describes: login problems are Access, laptop problems are Hardware. Software and Network follow the same description-based approach, though the answers give examples only for Access and Hardware. | Most agree |
| Priority | Use the impact and urgency matrix; outages are P1 (Critical). In practice most tickets end up Moderate (about 60%) or Low (about 29%), and few are High (about 10%). | Most agree |
| Assignment group | Follow the category: Access to Service Desk, Software to App Support, Hardware to Desktop Support, Network to Network Ops. Exception: VIP tickets go to the senior desk. Security incidents go straight to the security team. | Most agree |
What cases wait for
Unusual cases
- Security incident (rare: half said almost never, a quarter said under 1 in 10, ): Skip the unassigned queue and send straight to the security team.
- VIP requester (not stated): Route to the senior desk instead of the group the category would give.
- P1 priority (not stated; high priority is about 10% of tickets.): Assigning is not enough. Also phone the on-call engineer.
Rules and checks
- Priority comes from the impact and urgency matrix.
- A P1 needs a phone call to the on-call engineer in addition to assignment.
- Security incidents bypass the queue and go directly to the security team.
- VIP tickets go to the senior desk.
Why extra steps happen
- About 11% of tickets have fields re-edited, mostly the assignment group, and about 7% have steps redone after a pause. Everyone attributes the rework to missing information in the ticket.
Where people disagree
- Assignment group: some say it simply follows the category, others add that VIP tickets go to the senior desk. These are probably compatible but the VIP rule is not applied consistently in the answers.
Still open
- What specific information is missing from tickets, and how is it requested from the requester? All answers just say 'missing information'.
- What approval is being waited on after assignment, and who gives it?
- How is a VIP identified, and what exactly is the senior desk?
- What are the impact and urgency thresholds for each priority level, other than outages being P1?
- How are Software and Network tickets recognised from the description?
- Which tickets that don't match the category-to-group mapping (about 6–11% of cases) are explained by VIP or security handling, and which by other causes?
Provision software and access requests
6 people answered
Grant a requester the software or access they asked for by adding them to the right security group, assigning a license where the app is paid, and recording and closing the ServiceNow item.
- Starts when: A requested item (RITM) arrives in the ServiceNow access queue, usually from the service portal, after the requester's manager has approved it.
- Done when: The user is in the group, the license is assigned (if the app is paid), a work note is written, and the item is set to Closed Complete.
- Order: Typical order is open the item, add the group, assign the license (paid apps), write the work note, then set State; all respondents say order 'depends', and only 7% of cases vary.
How decisions are made
| Field | How the team decides | Agreement |
|---|
| Add members | The group follows the catalog item requested: each item has its own security group (Visio goes to SG-Visio-Users, Project to SG-Project-Users, Adobe to SG-Adobe-Users, VPN to SG-VPN-Users). If unsure, check the group list in the KB article. | Most agree |
| Assign license | Assign a license only when the requested item is a paid app. Free apps and access like VPN need only the group. Check licenses remain first. Observed: SG-Visio-Users gets Visio Plan 2, SG-Project-Users gets Project Plan 3, SG-Adobe-Users gets Adobe Acrobat Pro, each in 100% of cases. | Most agree |
| State | Set Closed Complete once the group and license are done and the work note is written. Set Pending if waiting on licenses (none left). | Most agree |
What cases wait for
- An approval (67%)
- A reply from the requester (17%)
- A system to update or sync (17%)
Unusual cases
- Request is for an admin or finance (privileged) group (unusual; most say under 1 in 10 or almost never, a minority ): Needs a security review/sign-off before access is granted.
- No licenses left for a paid app (not stated separately): Raise a purchase request and set the item to Pending.
- Requester is a contractor (not stated separately): Obtain the sponsor's approval in addition to the usual approval.
Rules and checks
- Manager approval must be on the RITM before work starts.
- Privileged groups need security sign-off.
- Contractors also need their sponsor's approval.
- Check license availability before assigning a paid license.
- Write a work note before closing.
Why extra steps happen
- Pauses while waiting for an approval (the most common reason).
- Waiting on licenses, which leads to a purchase request and Pending state.
- Occasional lookup of the KB article to confirm the group for an item.
Where people disagree
- Whether the order of steps matters: everyone answered 'it depends' without saying on what.
- How often exceptions occur: answers range from almost never to often (1 in 10 to 1 in 3).
Still open
- What determines when order matters?
- Exact wording expected in work notes.
- When is the cost center needed in addition to email and item name?
- What approvals are the 'approval' waits for (manager, security, sponsor), and how long do they take each?
- How is the license count checked, and what happens after the purchase request is fulfilled?
- Where policies are written down (only the KB group list is mentioned).