5.4.1. OS/Software Failure Symptoms and Causes
💡 First Principle: Most OS/software failures in production environments have a triggering event — a patch, a configuration change, a software install, or a workload increase. The first diagnostic question should always be "what changed?" If something was working and now it's not, a change caused it.
Common OS and Software Problems
| Symptom | Most Likely Cause | Key Investigation |
|---|---|---|
| Unable to log on | Account locked, expired password, domain connectivity failure, clock skew | Check account status, AD connectivity, time sync |
| Unable to access resources | Permission change, share offline, DNS failure | Verify permissions, check share status, test name resolution |
| System file corruption | Incomplete update, storage failure, malware | Run SFC (Windows), check package integrity (Linux) |
| Slow performance | Memory leak, CPU-intensive process, resource contention | Task Manager / top, performance counters |
| Service failures | Missing dependency, configuration error, corrupt binary | Service logs, event viewer, dependency check |
| Application hanging/freezing | Deadlock, memory exhaustion, network timeout | Process monitor, application logs, memory usage |
| Patch update failure | Conflicting patches, insufficient disk space, service interruption | Windows Update logs, patch management console |
| End of life / end of support | Vendor no longer provides patches | Inventory software versions, plan upgrades |
Root Cause Analysis
| Cause | Typical Symptom | Diagnostic |
|---|---|---|
| Incompatible/unstable drivers | BSOD, hardware not recognized | Device Manager (Windows), dmesg (Linux) |
| Improperly applied patches | Regression after update, service failures | Review patch history, rollback candidate patches |
| Memory leaks | Gradually increasing RAM use, eventual crash | Performance Monitor, top/htop |
| Buffer overrun | Crashes, security vulnerabilities | Application logs, crash dumps |
| Clock skew | Kerberos auth failures, "time difference" errors | Check NTP sync: w32tm /query /status (Windows), timedatectl (Linux) |
| Missing dependencies | Application won't start, DLL not found | Application logs, dependency checker |
| Downstream update failures | Cascade failures after update | Review what changed and what broke |
| Inappropriate app permissions | App can't write logs, access config files | Check service account permissions |
Clock Skew — A Special Case
Kerberos authentication (used by Active Directory) requires that client and server clocks be within 5 minutes of each other. If clocks drift beyond this threshold:
- Users receive "The time difference with the KDC is too great" errors
- Cannot log into domain-joined systems
- Group Policy fails to apply
- Replication between domain controllers fails
Fix: synchronize all systems to the same NTP source. Domain-joined Windows systems synchronize automatically to the domain hierarchy; Linux systems use ntpd or chrony.
⚠️ Exam Trap: "Users can't log in to the domain" has multiple causes. Clock skew is one — but check in order: (1) network connectivity to the DC, (2) DNS resolution of the DC name, (3) account status, (4) clock skew. Clock skew is often tested as the specific cause in scenarios where everything else checks out.
Reflection Question: After a routine server maintenance window that included OS updates and a firmware upgrade, users report that the application on that server is 50% slower than before. The application team says no application changes were made. What is your first troubleshooting step, and why?
