A technician identified an issue on a workstation, obtained details from the user, and made...

After the issue has been identified and the backup of the system has been made, the next step is to establish a theory of probable cause. This involves researching the issue to determine the root cause of the problem. This can involve researching internally (e.g. referring to the system logs) or externally (e.g. searching online). Once the probable cause has been identified, the technician can then move on to the next step of designing a plan of action to resolve the issue and implementing the solution.