Set up the call
Who is at the keyboard?
How many machines are affected?
Open Command Prompt
I’m going to have you open a black window called Command Prompt. Hold down the Windows key — the one with the four squares, next to the space bar — and press the letter R at the same time.
A small box will open in the bottom left. Type the three letters cmd and press Enter.
You should see a black window with white text. I’ll give you things to type, one line at a time. Type it exactly, then press Enter and read me what comes back.
If they can’t find the Windows key, have them click the Start button, type cmd, and press Enter. If the window is missing entirely, they may be on a Mac or a Chromebook — confirm before continuing.
Windows key + R, cmd, Enter. Standard prompt is fine for everything here except shutdown /r on some builds — run as administrator if it refuses.
Identify the machine and its address
Do this first on every call. Without the hostname and IP, nothing after this is useful to Tier 2.
Machine name
One line comes back. That is the machine name — you need it for the ticket and for any remote session.
Address, subnet, and gateway
Read the active adapter: IPv4 Address, Subnet Mask, Default Gateway. Ignore any adapter that says “Media disconnected.”
Full detail, including DNS and MAC
This adds DNS Servers, DHCP Server, Physical Address, and the lease dates. If DHCP Enabled says No, the machine is statically addressed — note that, it changes everything downstream.
Test connectivity outward
Work outward from the machine. Each answer narrows where the break is.
Can it reach the gateway?
This uses the gateway you captured above. If the gateway does not answer, nothing past the local switch will either.
Can it reach the public internet?
The -t runs continuously, which is how you catch a connection that drops every few seconds. Let it run at least 30 seconds. Press Ctrl + C to stop it — that prints the packet loss percentage, which is the number Tier 2 wants. Testing the raw IP skips DNS entirely, so this tells you about the path, not name resolution.
Where does the traffic stop?
Run this whenever the ping fails or is lossy. Hop 1 should be the gateway. If it dies at hop 1 or 2, the problem is inside the building. If it dies further out, it is upstream at the ISP. Capture the last hop that answered.
Is name resolution working?
Clear the cache first, then test with sites the machine has almost certainly never visited. Testing google.com is a false pass — it answers from cache and looks healthy even when DNS is broken.
What matters is the line before the replies: if it shows Pinging dennys.com [an IP address], DNS resolved and you can stop worrying about it. If it says the host could not be found, DNS is the problem even when 8.8.8.8 pings fine. Some hosts drop pings by design, so a resolved name with no replies still counts as working DNS.
Optional. Run it when names resolve but pages still will not load.
Renew the address
Run this when the address is 169.254.x.x, when the machine cannot reach the gateway, or after a switch or DHCP change. Warn the user first — the connection drops the moment you release.
This next command will disconnect you for about thirty seconds, and anything open in a browser may stop working for a moment. Are you at a good point for that?
Drops the current lease. The adapter will report no address until the renew finishes. This is expected.
Requests a fresh lease. It can take up to a minute. If it returns an error or lands on 169.254 again, DHCP is not answering — that is a network-side problem, not a workstation problem.
Confirm what it landed on.
Check for an IP conflict
Run this when the connection works intermittently, when Windows has shown a duplicate address warning, or when a machine drops off only sometimes. Two devices holding the same address will each work in bursts.
Confirm the address
Write down the IPv4 address exactly. The whole test depends on it.
Take the machine off the network
Ping the address from a different device on the same network
Run this from another internal machine at the same site — not from the one you just unplugged, and not from outside the network.
Restart the machine
Last workstation-side step before escalating. A restart clears the adapter, the stack, and any stuck service, and it resolves a large share of single-machine issues.
Before I restart this for you, please save anything you have open. Word documents, spreadsheets, anything in a browser. The restart will close it all without asking. Let me know when you’re saved.
Restarts immediately. Use /t 60 instead of /t 0 to give a one-minute grace period, and shutdown /a to cancel a pending restart.