Security & Continuity

MSP Toolkit
Practical troubleshooting paths for MSP technicians dealing with real-world support failures.

What This Category Covers

Security and continuity issues need evidence before containment or recovery work. Separate detection, policy, identity, endpoint state, backup/recovery status, and business impact.

First Layer to Isolate

Security signal first, then scope, containment, recovery path, and business priority.

Useful Tools, Logs, and Portals

  • Security portal
  • RMM/EDR logs
  • Backup console
  • Identity logs
  • Change history
  • Incident notes

Before You Escalate

  • Impact and scope captured
  • Security owner notified where needed
  • Recovery point verified
  • Changes documented

Articles in This Path

Pick the closest symptom and work from there.

ACME challenge path accessible publicly but renewal validation still failsACME renewal works on standby node not active nodeApplication aware backup disabled itself after patchingBackup copy job finishes but offsite repository missing newest restore pointsBackup job completes with warnings because application log truncation skippedBackup notifications arrive, but failure subject lines always show successBackup repository free space looks healthy while synthetic full job still failsBackups & Recovery alerts indicate success while end-user experience never changesBackups & Recovery configuration survives testing but resets after restart or syncBackups & Recovery credential or certificate rotation breaks an existing integrationBackups & Recovery feature works in web app but fails in desktop clientBackups & Recovery healthy dashboard status masks a failing production workflowBackups & Recovery new deployment works for pilot group but not for production rolloutBackups & Recovery policy change applies in admin console but target users never receive itBackups & Recovery quarantine or protection action triggers but recovery workflow failsBackups & Recovery workflow succeeds for one account but fails for shared or delegated accessBackups completing with warnings but not restorableBare metal restore media boots but cannot see RAID volumeBare-metal recovery media boots on BIOS hardware but not UEFI replacementBitLocker key rotates but inventory system shows old key IDBitLocker network unlock not working after certificate renewalBitLocker policy escrowed keys but startup PIN requirement never appliedBitLocker recovery key prompt after firmware updateBitLocker recovery repeats after docking station changesBitLocker recovery screen appears after firmware patch on multiple laptopsBitLocker suspended for maintenance and never resumedBitLocker to Go media prompts for recovery key after device policy refreshBrowser shows certificate warning on internal applianceBrowser trust warning appears only on mobile devicesCertificate auto-renewal failed silently on applianceCertificate chain valid on Windows not on macOSCertificate private key present on server but export option unavailableCertificate revocation check slows VPN login from remote regionsCertificates alerts indicate success while end-user experience never changesCertificates configuration survives testing but resets after restart or syncCertificates credential or certificate rotation breaks an existing integrationCertificates feature works in web app but fails in desktop clientCertificates healthy dashboard status masks a failing production workflowCertificates logging shows delivery yet the target workflow never completesCertificates new deployment works for pilot group but not for production rolloutCertificates policy change applies in admin console but target users never receive itCertificates quarantine or protection action triggers but recovery workflow failsCertificates workflow succeeds for one account but fails for shared or delegated accessCloud backup seed completes but daily incrementals resend full data setCloud backup throttled by ISP fair use policyCode signing certificate installed but build agent cannot use itCode signing certificate installed but signing pipeline cannot locate thumbprintConditional Access alerts indicate success while end-user experience never changesConditional Access blocks service account unexpectedlyConditional Access configuration survives testing but resets after restart or syncConditional Access connector health looks normal but data stops syncingConditional Access credential or certificate rotation breaks an existing integrationConditional Access feature works in web app but fails in desktop clientConditional Access healthy dashboard status masks a failing production workflowConditional Access logging shows delivery yet the target workflow never completesConditional Access new deployment works for pilot group but not for production rolloutConditional Access policy change applies in admin console but target users never receive itConditional Access policy exception fixes one case but similar workflows still failConditional Access quarantine or protection action triggers but recovery workflow failsConditional Access report-only logs differ from real enforcement outcome

FileVault personal recovery key displayed once and never captured

Submitted by Anonymous (not verified) on

Field Summary

FileVault personal recovery key displayed once and never captured is a Encryption ticket where the visible symptom can be misleading. Endpoint tickets usually live in profile state, local services, drivers, update health, management policy, encryption, or security tooling. Prove whether the issue follows the user or the machine before rebuilding anything. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

SAML app metadata imported but app still trusts old signing cert

Submitted by Anonymous (not verified) on

Field Summary

SAML app metadata imported but app still trusts old signing cert is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Restore from immutable repository slower than expected under pressure

Submitted by Anonymous (not verified) on

Field Summary

Restore from immutable repository slower than expected under pressure is a Backups & Recovery ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Verify last good backup, repository health, and a safe restore target before declaring recovery available.

BitLocker key rotates but inventory system shows old key ID

Submitted by Anonymous (not verified) on

Field Summary

When BitLocker rotates a recovery key but inventory still shows the old key ID, the risk is practical: the key a tech sees during an outage may not unlock the device at the recovery screen. Start by matching the recovery key ID shown at boot against the protector ID on the endpoint, then confirm whether the new key escrowed to Entra ID, Intune, AD DS, or the RMM inventory source that technicians actually use.

New SaaS app blocked because device platform not recognized

Submitted by Anonymous (not verified) on

Field Summary

New SaaS app blocked because device platform not recognized is a Conditional Access ticket where the visible symptom can be misleading. When this Microsoft 365 workflow fails, separate account access, web-versus-desktop behavior, token state, licensing, Conditional Access, and service health before changing the client. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

Browser trust warning appears only on mobile devices

Submitted by Anonymous (not verified) on

Field Summary

Browser trust warning appears only on mobile devices is a Certificates ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

Restore test succeeds but users cannot launch restored app

Submitted by Anonymous (not verified) on

Field Summary

Restore test succeeds but users cannot launch restored app is a Backups & Recovery ticket where the visible symptom can be misleading. Server and directory tickets need service state, event logs, DNS, authentication, replication, permissions, storage, and backup context before disruptive work. Reboots can hide evidence and create wider impact. Verify last good backup, repository health, and a safe restore target before declaring recovery available.

BitLocker recovery repeats after docking station changes

Submitted by Anonymous (not verified) on

Field Summary

BitLocker recovery repeats after docking station changes is a Encryption ticket where the visible symptom can be misleading. Endpoint tickets usually live in profile state, local services, drivers, update health, management policy, encryption, or security tooling. Prove whether the issue follows the user or the machine before rebuilding anything. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

EFS certificate missing after profile rebuild

Submitted by Anonymous (not verified) on

Field Summary

EFS certificate missing after profile rebuild is a Encryption ticket where the visible symptom can be misleading. Endpoint tickets usually live in profile state, local services, drivers, update health, management policy, encryption, or security tooling. Prove whether the issue follows the user or the machine before rebuilding anything. Record subject, issuer, SAN, expiration, binding, and trust chain before replacing certificates.

Encrypted USB drive opens on one PC only

Submitted by Anonymous (not verified) on

Field Summary

Encrypted USB drive opens on one PC only is a Encryption ticket where the visible symptom can be misleading. Endpoint tickets usually live in profile state, local services, drivers, update health, management policy, encryption, or security tooling. Prove whether the issue follows the user or the machine before rebuilding anything. The fastest path is to identify which layer changed and prove it with logs or a repeatable test.

Subscribe to Security & Continuity