# IT support incident — independent lab simulation

Status: Planned — not performed
Ticket ID:
Title:
Exercise date and timezone: [fill after performing]
Technician:
Environment: [guest OS edition/build, VM, local or test tenant]
Fictional requester:

## User report and impact
Exact symptom/error:
Task the user cannot complete:
Affected users/devices:
When it started / last known working time:
Impact and urgency:
Priority and reason:
Identity verification / authorization:

## Baseline and fault injection
Clean checkpoint or backup:
Known-good configuration:
Change used to introduce the fault in the disposable lab:

## Diagnostic timeline
Record actual times. Separate observations from hypotheses.

| Time | Check and purpose | Actual observation | Interpretation / next step |
| --- | --- | --- | --- |
| | | | |

## Cause
Observed cause: [leave blank until verified]
Evidence supporting it:
Alternative causes ruled out and how:

## Change
Authorization and scope:
Smallest change made:
Reason this change follows from the evidence:
Recovery path:

## Verification
Original task tested as affected standard user:
Result observed:
Negative test / permission boundary:
User confirmation:
Actual elapsed time:

## User update
Write a short, plain-language update covering what was found, what was changed,
what the user should try, and when the next update will be sent if unresolved.
Do not invent a requester reply for a lab simulation.

## Escalation and restoration
Close or escalate, and why:
Escalation package: scope, timestamps, error, checks, changes, remaining hypothesis.
Rollback or baseline restoration performed:
Known limitations:

## Evidence
- Before: [sanitized file or screenshot]
- Diagnostics: [sanitized output]
- Change: [sanitized configuration]
- After: [verification]
- Official references:

## Reflection
What was learned:
What would be checked sooner next time:
How this would differ in a production environment:

## Publication review
- [ ] Exercise was actually performed in an authorized lab.
- [ ] Dates, observations, root cause, elapsed time, and results are factual.
- [ ] Original symptom and final user task were both tested.
- [ ] Secrets, personal data, and sensitive identifiers were removed.
- [ ] Raw evidence is private; published copies are reviewed.
- [ ] Baseline is restored or remaining changes are documented.
- [ ] The page clearly identifies the work as a lab simulation.

Change status to Verified lab exercise only after completing this review.