Skip to content
Faultory
Sign inStart

Troubleshooting labs

47 interactive IT troubleshooting labs – free

Every lab starts with a realistic ticket. You investigate simulated servers, clients, networks and Microsoft 365 tenants with real commands such as ping, ip route, iptables, Get-ADUser, gpresult or Get-MgUser, find the cause and fix it. What is graded is whether the system really works afterwards.

Try it without an accountSign up for freeSign in

DNS & name resolution

~10 minBeginner

Hostnames are not resolving

A workstation reaches servers by IP address but not by hostname. Find out why name resolution fails.

  • Distinguish name resolution problems from connectivity problems
  • Analyse the DNS client configuration on Windows
  • Use nslookup to query a specific DNS server

WindowsDNSPowerShell

~10 minBeginner

Git server unreachable from just one computer

Everyone reaches the new Git server – except DEV02. DNS returns the correct address, yet the client connects to the wrong one.

  • Know the order of name resolution on Linux (hosts before DNS)
  • Understand the difference between dig/nslookup and application name resolution
  • Clean up static hosts entries safely

LinuxDNS/etc/hosts

~8 minBeginner

Linux client cannot find the intranet

lnx07 reaches the intranet by IP, but not via intranet.firma.local.

  • Test name resolution and connectivity separately
  • Read and correct /etc/resolv.conf
  • Use dig/host against a specific server

LinuxDNSresolv.conf

Routing & gateways

~12 minBeginner

No access to other subnets

A workstation reaches devices in its own network, but neither the server network nor the internet.

  • Distinguish local from remote communication
  • Read the routing table on Linux (ip route)
  • Interpret “Destination Host Unreachable” correctly

LinuxRoutingGateway

~20 minAdvanced

Sites cannot communicate

Since a change on the site router, site A can no longer reach the ERP system at site B. The packets seem to arrive – but the replies do not.

  • Look at the outbound and return path of a packet separately
  • Interpret traceroute and “Destination Net Unreachable”
  • Compare the routing tables of several routers

LinuxWindowsRoutingMultiple sites

~12 minIntermediate

Lab server unreachable after router reinstallation

The newly installed Linux router is reachable from both networks but does not forward packets between the subnets.

  • Interpret traceroute output
  • Check routing tables and IP forwarding on Linux
  • Set kernel parameters with sysctl

LinuxRoutingsysctl

~14 minIntermediate

Office VLAN offline after router replacement

Since the core router was replaced, nobody in office VLAN 20 reaches the gateway any more.

  • Understand a router on a stick with 802.1Q sub-interfaces
  • Check VLAN ids with ip -d link
  • Recreate a VLAN interface with ip link

VLAN802.1QRoutingLinux

~16 minAdvanced

Control station only reachable from the server VLAN

The office cannot reach the MES control station in the production network; from the server VLAN it works.

  • Look at the forward and the return path separately
  • Compare traceroute from several networks
  • Add static routes on an intermediate router

RoutingReturn routetracerouteLinux

DHCP & addressing

~15 minIntermediate

New workstation without network

A freshly installed client only gets a 169.254.x.x address. Existing clients still work.

  • Recognise and interpret APIPA addresses (169.254.0.0/16)
  • Analyse the status of a Linux service with systemctl and journalctl
  • Correct a service configuration on the command line

WindowsLinuxDHCPsystemd

~12 minIntermediate

Till 2 cannot reach the POS server

A workstation with a static IP reaches devices in its own network but not the server in the neighbouring network – even though the gateway is correct.

  • Understand the subnet mask and the on-link decision
  • Analyse and correct the Windows IP configuration with PowerShell
  • Narrow down faults by comparing with a working system

WindowsIPv4SubnettingPowerShell

~15 minIntermediate

Guests do not get an IP address

Devices in guest VLAN 30 only get a 169.254 address; DHCP works in the office.

  • Recognise APIPA addresses
  • Understand how a DHCP relay works (giaddr)
  • Configure and restart isc-dhcp-relay

DHCPRelayVLANWindowsLinux

Firewall & security

~15 minIntermediate

Web shop does not load over HTTPS

The internal web shop in the DMZ answers ping, but HTTPS connections go nowhere.

  • Narrow down network, port and service problems systematically
  • Distinguish a timeout from “Connection refused”
  • Read iptables rules and understand the order in which they are evaluated

LinuxFirewalliptablesHTTPS

~15 minIntermediate

Inventory system loses its database connection

After hardening the firewall on the database server, the application can no longer reach PostgreSQL. The database itself is running.

  • Analyse a host-based firewall (INPUT chain)
  • Check TCP reachability with Test-NetConnection
  • Correct rules with minimal impact (least privilege)

LinuxiptablesPostgreSQLWindows

~8 minBeginner

Staff shop unreachable after hardening

After ufw was enabled on shop01 the staff shop no longer loads. SSH works.

  • Distinguish a timeout from “Connection refused”
  • Show and extend ufw rules
  • Check service and port locally with ss

LinuxufwFirewall

~8 minBeginner

Brute-force attempts on the jump host

Failed logins are piling up in the auth.log of bastion01. The intended protection is not installed.

  • Recognise attack patterns in auth.log
  • Check package status with dpkg and apt
  • Install packages and check the service

Linuxaptfail2banSSH

~15 minIntermediate

Intranet unreachable from the office

After a firewall cleanup on rt01 the intranet no longer loads in the office VLAN.

  • Read iptables rules of the FORWARD chain
  • Write precise rules with interface, destination and port
  • Apply least privilege between network segments

iptablesVLANSegmentationLinux

~12 minIntermediate

Guest VLAN sees internal servers

An audit shows: the intranet and SSH on the servers can be reached from the guest VLAN.

  • Understand rule order in iptables
  • Find and remove rules that are too broad
  • Prove segmentation with tests from every network

iptablesVLANSegmentationSecurity

Linux servers & services

~8 minBeginner

Customer portal offline after maintenance window

After the nightly reboot the customer portal is no longer reachable. The server answers ping, but not HTTP.

  • Check the service status with systemctl
  • Know the difference between “started” and “enabled at boot”
  • Check listening ports with ss

Linuxsystemdnginx

~8 minBeginner

Nightly backup has not run for days

The backup cron job on files01 starts every night, but no archive is created.

  • Read cron jobs and their logs
  • Interpret file permissions with ls -l and stat
  • Set execute permissions precisely with chmod

Linuxcronchmod

~10 minBeginner

Upload directory keeps growing

A nightly cleanup job on app01 should delete old uploads – since a migration nothing happens.

  • Show the crontab of other users as root
  • Find cron messages in syslog
  • Install a crontab non-interactively

Linuxcronsyslog

~8 minBeginner

Key user locked out of the ERP server

After several failed attempts the account m.keller was locked. She has since remembered her password.

  • Recognise locked accounts with passwd -S
  • Evaluate auth.log
  • Unlock accounts with passwd -u / usermod -U

LinuxUsersSSH

~6 minBeginner

New system engineer without admin rights

Lena Brunner has an account on mon01 but cannot run commands with sudo.

  • Check group memberships with id and getent
  • Know the Debian group sudo
  • Add users to a group with usermod -aG

LinuxsudoGroups

~12 minIntermediate

Project team cannot write to the share

Tom and Ana are in the group projekt but cannot create files in /srv/projekte.

  • Read owner, group and permissions of a directory
  • Change group and mode recursively
  • Use the SGID bit for group directories

LinuxchmodchgrpSGID

~12 minIntermediate

Deployment account rejected by SSH

The user deploy exists on git02, but every SSH login ends with “Permission denied”.

  • Read sshd_config and understand access rules
  • Edit configuration files with sed
  • Test SSH access from a client

LinuxSSHsshd_config

~12 minIntermediate

SSH key of the CI account is ignored

The public key is in authorized_keys, yet build01 rejects the login as ci.

  • Read SSH errors in auth.log
  • Understand sshd StrictModes
  • Set safe permissions for ~/.ssh

LinuxSSHKeyschmod

~8 minBeginner

“This account is currently not available”

The deployment account on web03 immediately reports “This account is currently not available” on SSH login.

  • Read login shells in /etc/passwd
  • Know nologin and false as shells of service accounts
  • Change the shell with usermod -s or chsh

LinuxUsersSSH

~12 minIntermediate

Reporting server responds sluggishly

rep01 has been at 100 % since the morning. A test mode was accidentally set up as a permanent job.

  • Sort processes by CPU with top and ps
  • Stop processes selectively
  • Find and remove @reboot entries in crontabs

LinuxProcessescronkill

~15 minIntermediate

New data disk is not usable

files02 received an additional 10 GiB disk. It is neither partitioned nor mounted.

  • Identify block devices with lsblk and fdisk -l
  • Create a partition with parted or fdisk
  • Create and mount a file system

LinuxStoragepartedmkfsmount

~6 minBeginner

New server reports itself as “debian-template”

A server cloned from a template still carries the template's hostname. Monitoring confuses it.

  • Show the hostname (hostname, hostnamectl)
  • Set the hostname permanently with hostnamectl
  • Know the consequences of cloned VMs

LinuxHostnamesystemd

~12 minIntermediate

Configuration file deleted by accident

On kasse01 /etc/nginx/conf.d/kasse.conf was deleted. A backup from yesterday exists as tar.gz.

  • Check archive contents with tar -t
  • Extract single files from an archive
  • Check the restored configuration

LinuxtarBackupnginx

~12 minIntermediate

Intranet reports “certificate expired”

Since this morning every browser warns about the intranet. The new certificate from the internal CA is ready but not yet in use.

  • Check certificates with openssl x509 and s_client
  • Assess validity, name and issuer of a certificate
  • Replace a certificate in nginx and reload the service

LinuxTLSopensslnginx

~18 minAdvanced

Database only through the jump host

db01 cannot be reached: the database is not running and admin access through the jump host no longer works.

  • Understand ProxyJump and ~/.ssh/config
  • Administer across several hops
  • Start and enable a systemd service on a remote host

SSHProxyJumpBastionsystemdLinux

Windows Server & Active Directory

~10 minBeginner

Employee can no longer sign in

An account keeps getting locked even though the user enters her password correctly. Find the source of the failed attempts and unlock the account.

  • Check the account status with Get-ADUser and Search-ADAccount
  • Evaluate security events 4740/4625
  • Unlock locked accounts with Unlock-ADAccount

Active DirectoryPowerShellEvent log

~15 minIntermediate

Screen lock does not apply on a new laptop

A new teacher laptop is missing the screen lock that is deployed via group policy. Other teacher laptops are configured correctly.

  • Determine applied GPOs with gpresult /r
  • Check GPO links and the OU structure in AD
  • Move computer objects to the correct OU

Group PolicyActive DirectoryPowerShell

~15 minIntermediate

File server unreachable after migration

After the file server was moved to new hardware, no client finds the drive \\fs01\Daten any more. Access by IP address works.

  • Check and correct DNS records in an AD-integrated zone
  • Understand the DNS client cache on Windows
  • Test SMB reachability with Test-NetConnection -Port 445

Active DirectoryDNSWindows ServerSMB

~25 minAdvanced

New project member cannot save files

A new employee can see the project share but cannot save anything. Analyse share and NTFS permissions and the group concept.

  • Determine effective permissions from share and NTFS permissions
  • Apply the AGDLP group concept
  • Adjust share permissions with PowerShell

Windows ServerSMBNTFSActive Directory

~20 minAdvanced

Time tracking does not start after server hardening

After a hardening script and a reboot, the time tracking service no longer starts. A manual start fails.

  • Analyse service dependencies on Windows
  • Evaluate Service Control Manager events (7001, 7040)
  • Change the startup type and status of services with PowerShell or sc.exe

Windows ServerServicesPowerShellEvent log

~10 minBeginner

Remote Desktop to the terminal server fails

Accounting can no longer connect to srv01 via RDP. The server answers ping.

  • Check ports with Test-NetConnection
  • Evaluate firewall rules with Get-NetFirewallRule
  • Enable predefined rule groups

WindowsFirewallRDPPowerShell

~6 minBeginner

Nightly data copy missing since Monday

The scheduled task Backup-Data on srv02 has not run for a few days.

  • Find scheduled tasks with Get-ScheduledTask
  • Check the last run with Get-ScheduledTaskInfo
  • Enable tasks

WindowsTask SchedulerPowerShell

~6 minBeginner

Trainee account with administrator rights

The account praktikant on ws05 is a member of the local Administrators. According to policy it only belongs to Users.

  • Check local group members with Get-LocalGroupMember
  • Apply the principle of least privilege
  • Change memberships with Add-/Remove-LocalGroupMember

WindowsLocal accountsLeast privilege

~8 minBeginner

Backup fails with a logon error

The task Nightly-Backup on srv03 ends with error 1326. It runs under the local account svc_backup.

  • Evaluate task results
  • Check local accounts with Get-LocalUser
  • Enable accounts without extending rights

WindowsLocal accountsTask Scheduler

~6 minBeginner

Nobody can print at reception

No printers appear on ws08 any more. The print spooler service is stopped and disabled.

  • Check services with Get-Service and Get-CimInstance
  • Distinguish start type and status
  • Configure services with Set-Service

WindowsServicesPowerShell

Microsoft 365 & cloud

~10 minBeginner

Exchange Online: emails do not arrive in the mailbox

An employee has not received any emails for days – neither internal nor external. The senders do not get an error message.

  • Connect to Exchange Online PowerShell
  • Evaluate a message trace
  • Detect and remove mailbox forwarding

Exchange OnlineMicrosoft 365PowerShellSecurity

~15 minIntermediate

Intune: new laptop does not receive a Wi-Fi profile

A newly enrolled Windows laptop does not connect to the company Wi-Fi; BitLocker is not active either. Older laptops are configured correctly.

  • Trace Intune assignments via groups
  • Distinguish device and group objects in Entra ID
  • Trigger a sync of a managed device

IntuneEntra IDMicrosoft GraphPowerShell

~20 minAdvanced

Entra ID: employee is blocked at every sign-in

An active employee has not been able to sign in to any Microsoft 365 service since today. The password is correct, MFA works.

  • Evaluate sign-in logs and error codes
  • Analyse Conditional Access policies and their target groups
  • Correct group memberships selectively instead of disabling policies

Entra IDConditional AccessMicrosoft GraphSecurity

~15 minIntermediate

Microsoft 365: new employee has no mailbox

A new employee can sign in but has neither Outlook nor Teams. The licence assignment fails.

  • Check the licence inventory with Get-MgSubscribedSku
  • Know the “UsageLocation” prerequisite for licence assignments
  • Assign and release licences with Set-MgUserLicense

Microsoft 365LicensingMicrosoft GraphPowerShell

~20 minAdvanced

PowerShell: onboarding script does not create users

A downloaded automation script is supposed to create new employees in AD but does not start – and afterwards it creates nobody.

  • Understand PowerShell execution policies and their scopes
  • Recognise and remove the Zone.Identifier (files downloaded from the internet)
  • Analyse script parameters and CSV delimiters

PowerShellActive DirectoryAutomationSecurity

The exercises themselves require a free account with a verified email address. Missing a topic? Signed-in users can suggest new labs.