Security & Continuity

MSP Toolkit
Practical troubleshooting paths for MSP technicians dealing with real-world support failures.

What This Category Covers

Security and continuity issues need evidence before containment or recovery work. Separate detection, policy, identity, endpoint state, backup/recovery status, and business impact.

First Layer to Isolate

Security signal first, then scope, containment, recovery path, and business priority.

Useful Tools, Logs, and Portals

  • Security portal
  • RMM/EDR logs
  • Backup console
  • Identity logs
  • Change history
  • Incident notes

Before You Escalate

  • Impact and scope captured
  • Security owner notified where needed
  • Recovery point verified
  • Changes documented

Articles in This Path

Pick the closest symptom and work from there.

ACME challenge path accessible publicly but renewal validation still failsACME renewal works on standby node not active nodeApplication aware backup disabled itself after patchingBackup copy job finishes but offsite repository missing newest restore pointsBackup job completes with warnings because application log truncation skippedBackup notifications arrive, but failure subject lines always show successBackup repository free space looks healthy while synthetic full job still failsBackups & Recovery alerts indicate success while end-user experience never changesBackups & Recovery configuration survives testing but resets after restart or syncBackups & Recovery credential or certificate rotation breaks an existing integrationBackups & Recovery feature works in web app but fails in desktop clientBackups & Recovery healthy dashboard status masks a failing production workflowBackups & Recovery new deployment works for pilot group but not for production rolloutBackups & Recovery policy change applies in admin console but target users never receive itBackups & Recovery quarantine or protection action triggers but recovery workflow failsBackups & Recovery workflow succeeds for one account but fails for shared or delegated accessBackups completing with warnings but not restorableBare metal restore media boots but cannot see RAID volumeBare-metal recovery media boots on BIOS hardware but not UEFI replacementBitLocker key rotates but inventory system shows old key IDBitLocker network unlock not working after certificate renewalBitLocker policy escrowed keys but startup PIN requirement never appliedBitLocker recovery key prompt after firmware updateBitLocker recovery repeats after docking station changesBitLocker recovery screen appears after firmware patch on multiple laptopsBitLocker suspended for maintenance and never resumedBitLocker to Go media prompts for recovery key after device policy refreshBrowser shows certificate warning on internal applianceBrowser trust warning appears only on mobile devicesCertificate auto-renewal failed silently on applianceCertificate chain valid on Windows not on macOSCertificate private key present on server but export option unavailableCertificate revocation check slows VPN login from remote regionsCertificates alerts indicate success while end-user experience never changesCertificates configuration survives testing but resets after restart or syncCertificates credential or certificate rotation breaks an existing integrationCertificates feature works in web app but fails in desktop clientCertificates healthy dashboard status masks a failing production workflowCertificates logging shows delivery yet the target workflow never completesCertificates new deployment works for pilot group but not for production rolloutCertificates policy change applies in admin console but target users never receive itCertificates quarantine or protection action triggers but recovery workflow failsCertificates workflow succeeds for one account but fails for shared or delegated accessCloud backup seed completes but daily incrementals resend full data setCloud backup throttled by ISP fair use policyCode signing certificate installed but build agent cannot use itCode signing certificate installed but signing pipeline cannot locate thumbprintConditional Access alerts indicate success while end-user experience never changesConditional Access blocks service account unexpectedlyConditional Access configuration survives testing but resets after restart or syncConditional Access connector health looks normal but data stops syncingConditional Access credential or certificate rotation breaks an existing integrationConditional Access feature works in web app but fails in desktop clientConditional Access healthy dashboard status masks a failing production workflowConditional Access logging shows delivery yet the target workflow never completesConditional Access new deployment works for pilot group but not for production rolloutConditional Access policy change applies in admin console but target users never receive itConditional Access policy exception fixes one case but similar workflows still failConditional Access quarantine or protection action triggers but recovery workflow failsConditional Access report-only logs differ from real enforcement outcome

ACME challenge path accessible publicly but renewal validation still fails

Submitted by Anonymous (not verified) on

Field Summary

ACME challenge path accessible publicly but renewal validation still fails is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

Certificate revocation check slows VPN login from remote regions

Submitted by Anonymous (not verified) on

Field Summary

Certificate revocation check slows VPN login from remote regions is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Code signing certificate installed but signing pipeline cannot locate thumbprint

Submitted by Anonymous (not verified) on

Field Summary

Code signing certificate installed but signing pipeline cannot locate thumbprint is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Queue, driver, port, and spooler evidence should come before deleting printers.

CSR generated with wrong SAN list for customer portal migration

Submitted by Anonymous (not verified) on

Field Summary

CSR generated with wrong SAN list for customer portal migration is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

RADIUS certificate valid in store but NPS still presents old chain

Submitted by Anonymous (not verified) on

Field Summary

RADIUS certificate valid in store but NPS still presents old chain is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Let’s Encrypt renewal succeeds but web service never reloads new certificate

Submitted by Anonymous (not verified) on

Field Summary

Let’s Encrypt renewal succeeds but web service never reloads new certificate is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

TLS inspection appliance resigns traffic with untrusted root on kiosks

Submitted by Anonymous (not verified) on

Field Summary

TLS inspection appliance resigns traffic with untrusted root on kiosks is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

Certificate private key present on server but export option unavailable

Submitted by Anonymous (not verified) on

Field Summary

Certificate private key present on server but export option unavailable is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Internal PKI issues certificate correctly yet auto-enrollment ignores new template

Submitted by Anonymous (not verified) on

Field Summary

Internal PKI issues certificate correctly yet auto-enrollment ignores new template is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Wildcard certificate renewed but one subdomain continues serving expired cert

Submitted by Anonymous (not verified) on

Field Summary

Wildcard certificate renewed but one subdomain continues serving expired cert is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Subscribe to Security & Continuity