CitadelSuite

Guide

10 PowerShell fixes for common helpdesk tickets

Most Windows tickets are the same handful of problems. These PowerShell snippets diagnose and fix them, with notes on risk so you can decide which are safe to automate.

Test every script on a non-production machine first. Each fix is marked read-only, low risk or needs approval to help you decide what to automate.

1. Printing is stuck Low risk

The classic ticket. Stop the spooler, clear the queued jobs, start it again.

Stop-Service -Name Spooler -Force
Remove-Item -Path "$env:SystemRoot\System32\spool\PRINTERS\*" -Force -ErrorAction SilentlyContinue
Start-Service -Name Spooler
Get-Service -Name Spooler | Select-Object Status

This deletes every queued print job on the device, so the user will need to resend what they were printing.

2. A service has stopped Low risk

Start a named service only if it is set to start automatically and isn't running. Don't start services that were deliberately disabled.

$name = 'Spooler'   # validated service name
$svc = Get-Service -Name $name -ErrorAction Stop
if ($svc.StartType -eq 'Automatic' -and $svc.Status -ne 'Running') {
    Start-Service -Name $name
}
(Get-Service -Name $name).Status

3. A website won't load, others do Low risk

A stale DNS cache is a common cause. Clear it and renew the IP lease.

Clear-DnsClientCache
ipconfig /renew | Out-Null
Resolve-DnsName example.com -Type A | Select-Object -First 1 Name, IPAddress

4. "My computer says the disk is full" Low risk

Check free space, then remove temporary files older than a week.

Get-Volume -DriveLetter C | Select-Object SizeRemaining, Size
$cutoff = (Get-Date).AddDays(-7)
foreach ($path in "$env:SystemRoot\Temp", "$env:TEMP") {
    Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue |
        Where-Object { $_.LastWriteTime -lt $cutoff } |
        Remove-Item -Recurse -Force -ErrorAction SilentlyContinue
}
Get-Volume -DriveLetter C | Select-Object SizeRemaining

Run as SYSTEM, $env:TEMP points to the system profile's temp folder, not the logged-in user's. Clean user temp folders separately if needed.

5. Is antivirus actually running? Low risk

Check Microsoft Defender's status and pull fresh signatures.

Get-MpComputerStatus |
    Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Update-MpSignature

6. Clock is wrong, sign-ins fail Low risk

Time drift breaks Kerberos and many web sign-ins. Make sure the time service runs, then resync.

Start-Service -Name w32time -ErrorAction SilentlyContinue
w32tm /resync
w32tm /query /status

7. "It's been slow all week" Read-only

Check uptime first. A machine that hasn't restarted in weeks is often the answer.

(Get-Date) - (Get-CimInstance Win32_OperatingSystem).LastBootUpTime

8. Is a restart pending? Read-only

$keys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending',
        'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired'
[bool]($keys | Where-Object { Test-Path $_ })

9. What went wrong recently? Read-only

The last day's system errors, newest first. Often enough for a diagnosis.

Get-WinEvent -FilterHashtable @{ LogName = 'System'; Level = 2; StartTime = (Get-Date).AddHours(-24) } -MaxEvents 20 |
    Select-Object TimeCreated, ProviderName, Id, Message

10. Windows Update is stuck Needs approval

Resetting the update cache fixes many stuck updates, but it discards download history, so keep it behind approval.

Stop-Service -Name wuauserv, bits -Force
Rename-Item -Path "$env:SystemRoot\SoftwareDistribution" -NewName ("SoftwareDistribution.old-" + (Get-Date -Format yyyyMMddHHmm))
Start-Service -Name bits, wuauserv

The renamed folder is the rollback: if anything goes wrong, stop the services and rename it back.

Turning snippets into safe automation

A snippet becomes a safe automated fix when it has a defined trigger, validated parameters, a check that proves it worked, and a record of every run. Our guide to automating support tickets with AI walks through that framework.

Frequently asked questions

Do these scripts need administrator rights?

Most of the fixes (stopping services, clearing the spool folder, Windows Temp, Defender updates, time resync) need an elevated PowerShell session. RMM agents normally run as SYSTEM, which has the rights needed. The read-only checks work without elevation.

Which of these are safe to run automatically?

The read-only checks always are. Clearing the print queue, starting a stopped service, flushing DNS and updating Defender signatures are reasonable low-risk candidates. Resetting Windows Update components and restarting network adapters should have a technician's approval.

Help shape CitadelGate before launch

We are looking for a small number of South African MSPs and IT teams to pilot AI-assisted ticket remediation on test devices first. No cost, no commitment.

Join early access