Before starting
Windows guest, local lab administrator, and a disposable standard account named lab.employee.
Introduce the fault
From a separate lab administrator session, disable only lab.employee in Local Users and Groups. Keep the administrator signed in. Do not use the built-in Administrator account as the test user.
Diagnose before changing anything
- Confirm which account type is affected: local Windows account, Microsoft account, or work account. Record the exact sign-in message and when access last worked. In a real ticket, follow the organization’s identity-verification procedure before account changes.
- Use the local lab administrator to inspect the test account. In 64-bit Windows PowerShell, run Get-LocalUser -Name "lab.employee" | Select-Object Name,Enabled,LastLogon. Record the actual result; a disabled account is different from a forgotten password.
- Check whether other local accounts can sign in. Review relevant Event Viewer entries if auditing is available; record actual timestamps and event IDs rather than assuming an event must exist.
Make the smallest appropriate change
After recording the disabled state and confirming this is the disposable test account, enable lab.employee with Local Users and Groups or Enable-LocalUser -Name "lab.employee". This exercise does not require a password reset or adding the user to Administrators.
Verify with the affected user
Sign out of the test session, sign in as lab.employee, and open a normal application. Confirm the account remains a standard user. Repeat the sign-in once and capture the successful result without passwords or personal information.
Restore the baseline
Return the test account to its documented baseline: enabled and in the standard Users group. Remove it only when the lab is finished. Use the baseline VM checkpoint if the wrong account was changed.
Know when to escalate
Escalate unexpected administrator-account changes, repeated failures after the local account is enabled, or evidence of compromise. An Entra or domain account requires that identity system’s procedures; this local fix does not apply.
Evidence to collect
- Exact error text and a timestamp before the fix
- The account’s enabled state before and after
- Standard-user group membership and a successful sign-in
- A short explanation of why no password reset was needed
INTERVIEW REFLECTION
How did you distinguish an account-state issue from an incorrect password?
Write the ticket
Use the downloadable ticket template. Record the symptom, scope, timeline, checks, observed cause, action, verification, rollback, and escalation decision. Leave dates, elapsed time, root cause, and result blank until the exercise is performed.
Publication gate: replace “Planned” only after the exercise is reproducible and sanitized evidence has been reviewed. Describe it as an independent lab simulation.