> ## Documentation Index
> Fetch the complete documentation index at: https://docs.derekdinh.com/llms.txt
> Use this file to discover all available pages before exploring further.
# IT Troubleshooting Knowledge Base Glossary of Terms
> Definitions of 40+ common IT terms used throughout this knowledge base, from BSOD and BIOS to VPN, VLAN, RAID, and Zero-Trust security concepts.
This glossary defines the technical terms, acronyms, and concepts used throughout this IT troubleshooting knowledge base. Whether you are a new helpdesk technician getting up to speed, or an experienced engineer looking for a quick reminder of an unfamiliar acronym, each entry provides a concise definition and, where relevant, context for how the term applies to day-to-day IT support work. Entries are organised alphabetically and grouped by starting letter.
**Active Directory (AD)**
Microsoft's on-premises directory service, built on LDAP and Kerberos, used to manage users, computers, groups, and policies within a Windows domain. Active Directory stores user account information, authenticates logins, and applies Group Policy Objects (GPOs) to domain members. See also: *Azure AD / Entra ID*, *LDAP*, *GPO*.
***
**Azure AD / Microsoft Entra ID**
Microsoft's cloud-based identity and access management (IAM) service, serving as the cloud equivalent and extension of on-premises Active Directory. Manages authentication for Microsoft 365, Azure, and thousands of integrated SaaS applications using protocols such as OAuth 2.0, OIDC, and SAML. As of 2023, Microsoft has rebranded Azure AD to **Microsoft Entra ID**. See also: *SSO*, *MFA*, *Conditional Access*.
***
**APIPA (Automatic Private IP Addressing)**
A Windows feature that automatically assigns an IP address in the `169.254.0.0/16` range when a DHCP server cannot be reached. An APIPA address (`169.254.x.x`) on a workstation indicates a DHCP failure — the device cannot communicate beyond the local subnet. See also: *DHCP*, *IP Address*.
**BIOS (Basic Input/Output System)**
Firmware stored on a motherboard chip that initialises hardware during the Power-On Self-Test (POST) and loads the bootloader. BIOS has largely been replaced by UEFI in modern systems. Accessed by pressing a key (typically `Del`, `F2`, or `F10`) during startup. See also: *UEFI*, *POST*.
***
**BSOD (Blue Screen of Death)**
A Windows stop error screen displayed when the operating system encounters a critical, unrecoverable fault — typically a kernel-mode driver crash or hardware failure. The BSOD displays a stop code (e.g., `SYSTEM_SERVICE_EXCEPTION`) and a hex error code (e.g., `0x0000003B`). Windows writes a minidump file to `C:\Windows\Minidump` that can be analysed to identify the faulting component. See also: *Minidump*, *Stop Code*.
***
**Bitlocker**
Microsoft's full-disk encryption feature built into Windows Pro, Enterprise, and Education editions. BitLocker encrypts the entire drive and requires a recovery key to access data if the TPM or boot configuration changes. Recovery keys should be backed up to Active Directory, Azure AD, or a secure management solution. See also: *TPM*, *Encryption*.
**Conditional Access**
An Azure AD / Entra ID feature that enforces policies controlling whether and how users can sign in to applications, based on signals such as user identity, device compliance, IP location, and sign-in risk level. Conditional Access can require MFA, restrict access to compliant devices, or block access entirely based on policy conditions. See also: *MFA*, *Azure AD / Entra ID*.
***
**CIDR (Classless Inter-Domain Routing)**
A notation for expressing IP address ranges that replaces the older class-based system. Written as an IP address followed by a `/` and a prefix length (e.g., `192.168.1.0/24`). The prefix length specifies how many bits are the network portion. `/24` = 256 addresses, `/16` = 65,536 addresses. See also: *Subnet Mask*, *IP Address*.
**DHCP (Dynamic Host Configuration Protocol)**
A network protocol that automatically assigns IP addresses, subnet masks, default gateways, and DNS server addresses to devices on a network. DHCP uses a discover/offer/request/acknowledge (DORA) handshake over UDP ports 67 and 68. Without DHCP, each device requires a manually configured static IP address. See also: *IP Address*, *DNS*, *APIPA*.
***
**DNS (Domain Name System)**
The internet's distributed naming system that translates human-readable hostnames (e.g., `www.company.com`) into IP addresses (e.g., `203.0.113.10`). DNS queries typically use UDP port 53. Common record types: **A** (IPv4 address), **AAAA** (IPv6), **MX** (mail server), **CNAME** (alias), **TXT** (text records for verification and SPF), **PTR** (reverse lookup). See also: *IP Address*.
***
**Domain Controller (DC)**
A server running Active Directory Domain Services (AD DS) that authenticates users and computers, applies Group Policy, and maintains the directory database for a Windows domain. Every Active Directory domain requires at least one domain controller; production environments should have at least two for redundancy. See also: *Active Directory*, *GPO*, *Kerberos*.
**Encryption**
The process of converting data into an unreadable format using a cryptographic algorithm and key, so that only authorised parties with the decryption key can read it. **At-rest encryption** protects stored data (e.g., BitLocker, FileVault). **In-transit encryption** protects data moving over a network (e.g., TLS/SSL). See also: *SSL/TLS*, *BitLocker*.
**Firewall**
A network security device or software that monitors and controls inbound and outbound traffic based on defined security rules. Firewalls operate at different OSI layers: packet filters (Layer 3/4), stateful inspection, and next-generation firewalls (NGFW) with application awareness (Layer 7). Windows includes **Windows Defender Firewall** as a host-based firewall. See also: *NAT*, *Proxy*, *Port*.
***
**FTP (File Transfer Protocol)**
A legacy plain-text protocol for transferring files between systems over TCP ports 20 and 21. Because FTP transmits credentials and data in clear text, it should be replaced with **SFTP** (FTP over SSH, port 22) or **FTPS** (FTP over TLS, ports 989/990) in all environments. See also: *SFTP*, *SSL/TLS*.
**Gateway (Default Gateway)**
The IP address of the router or layer-3 device that a host sends traffic to when the destination IP is outside the local subnet. Typically the first or last usable address in a subnet (e.g., `192.168.1.1`). A missing or incorrect default gateway means a device can communicate locally but cannot reach external networks or the internet. See also: *IP Address*, *Subnet Mask*, *Routing*.
***
**GPO (Group Policy Object)**
A collection of settings in Active Directory that defines the working environment for users and computers. GPOs can enforce password policies, deploy software, configure Windows settings, restrict applications, and much more. Applied to sites, domains, or Organisational Units (OUs) and processed in the order: Local → Site → Domain → OU (LSDOU). See also: *Active Directory*, *Domain Controller*.
**IMAP (Internet Message Access Protocol)**
An email retrieval protocol that allows clients to access and manage mailboxes stored on a mail server without downloading all messages locally. IMAP keeps messages on the server, enabling access from multiple devices. Uses port 143 (plain text) or 993 (IMAPS, TLS). Contrast with *POP3*, which downloads and deletes messages from the server. See also: *POP3*, *SMTP*.
***
**IP Address**
A numerical label assigned to each device on an IP network. **IPv4** addresses are 32-bit numbers written in dotted-decimal notation (e.g., `192.168.1.100`). **IPv6** addresses are 128-bit numbers written in hexadecimal (e.g., `2001:0db8:85a3::8a2e:0370:7334`). IP addresses can be private (RFC 1918 ranges: `10.x.x.x`, `172.16-31.x.x`, `192.168.x.x`) or public. See also: *DHCP*, *Subnet Mask*, *NAT*.
**Kerberos**
The authentication protocol used by Active Directory. Kerberos uses tickets (TGT — Ticket Granting Ticket, and service tickets) issued by a Key Distribution Centre (KDC, running on a domain controller) to authenticate users to services without transmitting passwords over the network. Kerberos uses port 88 (TCP/UDP) and requires accurate system clocks — a time skew of more than 5 minutes causes authentication failures. See also: *Active Directory*, *MFA*.
**LDAP (Lightweight Directory Access Protocol)**
An open, vendor-neutral protocol for accessing and maintaining distributed directory information services. Used extensively to query Active Directory and other LDAP-compatible directories for user, group, and computer information. Operates on port 389 (plain text) or 636 (LDAPS, TLS). See also: *Active Directory*, *Azure AD / Entra ID*.
***
**LAN (Local Area Network)**
A network connecting devices within a limited geographic area, such as an office floor, building, or campus. LANs typically operate over Ethernet (wired) or Wi-Fi (wireless). Contrast with *WAN* (Wide Area Network), which spans larger geographic areas. See also: *VLAN*, *Switch*, *Router*.
**MAC Address (Media Access Control Address)**
A unique 48-bit hardware identifier assigned to each network interface controller (NIC) at the time of manufacture. Written as six pairs of hexadecimal digits (e.g., `00:1A:2B:3C:4D:5E`). MAC addresses operate at Layer 2 (Data Link) of the OSI model and are used for communication within a local network segment. Unlike IP addresses, MAC addresses do not cross routers. See also: *NIC*, *IP Address*.
***
**MFA (Multi-Factor Authentication)**
An authentication method requiring two or more verification factors from different categories: **something you know** (password), **something you have** (authenticator app, hardware token, SMS code), and **something you are** (fingerprint, face recognition). MFA significantly reduces the risk of account compromise from stolen or guessed passwords. See also: *SSO*, *Azure AD / Entra ID*, *Conditional Access*.
**NAT (Network Address Translation)**
A technique where a router modifies IP address information in packet headers, allowing multiple devices on a private network to share a single public IP address. Home and office routers universally use NAT. **PAT (Port Address Translation)** or **NAPT** further multiplexes connections using unique source port numbers. See also: *IP Address*, *Firewall*, *Gateway*.
***
**NIC (Network Interface Controller)**
The hardware component — either a physical card, an integrated motherboard chip, or a virtual adapter — that connects a device to a network. Each NIC has a unique MAC address. A device may have multiple NICs (e.g., wired Ethernet and Wi-Fi). See also: *MAC Address*, *IP Address*.
**OST (Offline Storage Table)**
A local copy of a Microsoft Exchange or Microsoft 365 mailbox cached on a user's computer by Outlook. The OST file (`*.ost`) allows Outlook to function when offline and synchronises with the server when connectivity is restored. OST files can become corrupted; the **Inbox Repair Tool** (`scanpst.exe`) can repair them. See also: *PST*.
***
**OU (Organisational Unit)**
A container within Active Directory used to organise users, computers, and groups into logical administrative units. OUs can have Group Policy Objects linked to them, allowing different settings to be applied to different parts of the organisation. See also: *Active Directory*, *GPO*.
**POP3 (Post Office Protocol 3)**
An email retrieval protocol that downloads messages from the mail server to the local client and typically deletes them from the server. Less flexible than IMAP for multi-device access. Operates on port 110 (plain text) or 995 (POP3S, TLS). See also: *IMAP*, *SMTP*.
***
**Proxy Server**
An intermediary server that forwards requests from clients to other servers. Forward proxies handle outbound internet requests from internal users (used for content filtering, caching, and anonymity). Reverse proxies handle inbound requests to servers (used for load balancing, SSL termination, and caching). See also: *Firewall*, *NAT*.
***
**PST (Personal Storage Table)**
A Microsoft Outlook data file that stores messages, calendar items, contacts, and other data locally. PST files (`*.pst`) are used for archiving or when an Exchange/Microsoft 365 account is not available. Unlike OST files, PSTs are standalone files that are not synchronised with a server. See also: *OST*.
**QoS (Quality of Service)**
A set of network technologies that manage traffic to ensure certain types of data — such as VoIP, video conferencing, or critical business applications — receive the bandwidth and low latency they need. QoS mechanisms include traffic classification, queuing, policing, and shaping. See also: *VoIP*, *VLAN*.
**RAID (Redundant Array of Independent Disks)**
A data storage technology that combines multiple physical disks into a logical unit for redundancy, performance, or both. Common RAID levels:
* **RAID 0** — Striping, no redundancy, increased performance
* **RAID 1** — Mirroring, full redundancy, 50% usable capacity
* **RAID 5** — Striping with parity, requires ≥3 disks, can survive one disk failure
* **RAID 6** — Striping with double parity, can survive two disk failures
* **RAID 10** — Mirror + stripe, requires ≥4 disks, high performance and redundancy
RAID is **not a backup** — it does not protect against accidental deletion, ransomware, or simultaneous multiple-disk failure. See also: *SMART*, *Backup*.
***
**RDP (Remote Desktop Protocol)**
Microsoft's proprietary protocol for remote graphical access to Windows desktops and servers over TCP/UDP port 3389. RDP sessions are encrypted using TLS. Network Level Authentication (NLA) should always be enabled. Direct internet exposure of RDP is a major security risk. See also: *VPN*, *SSH*, *VNC*.
**SMART (Self-Monitoring, Analysis and Reporting Technology)**
Built-in monitoring system in hard drives and SSDs that tracks performance and reliability indicators such as reallocated sectors, spin retry counts, and read error rates. SMART data provides early warning of drive failure. Query with `smartctl -a /dev/sda` (Linux/macOS) or CrystalDiskInfo (Windows). See also: *RAID*, *HDD*, *SSD*.
***
**SMB (Server Message Block)**
Microsoft's network file-sharing protocol used for accessing files, printers, and other resources on Windows networks (UNC paths like `\\server\share`). SMBv1 is obsolete and dangerous (exploited by WannaCry ransomware); ensure SMBv1 is disabled on all systems. Modern environments use SMBv3, which supports encryption. Operates primarily on TCP port 445. See also: *File Sharing*, *Active Directory*.
***
**SMTP (Simple Mail Transfer Protocol)**
The protocol used for sending email between mail servers (port 25) and from email clients to outgoing mail servers (port 587 for authenticated submission). SMTP itself is unencrypted, but STARTTLS upgrades the connection to TLS after the initial handshake. See also: *IMAP*, *POP3*, *TLS*.
***
**SSH (Secure Shell)**
An encrypted protocol for secure remote command-line access, file transfer (SFTP), and tunnelling over TCP port 22. SSH uses public-key cryptography for authentication. All remote management of servers and network devices should use SSH; Telnet (port 23) should be disabled everywhere. See also: *RDP*, *VPN*.
***
**SSL/TLS (Secure Sockets Layer / Transport Layer Security)**
Cryptographic protocols that provide authenticated and encrypted communication over a network. SSL is the deprecated predecessor to TLS. **TLS 1.2 and TLS 1.3** are the current standards; TLS 1.0 and 1.1 are deprecated and should be disabled. Used to secure HTTPS, SMTPS, IMAPS, LDAPS, and many other protocols. See also: *Certificate*, *HTTPS*.
***
**SSO (Single Sign-On)**
An authentication mechanism that allows users to log in once and gain access to multiple applications and services without re-entering credentials. Implemented using standards such as SAML 2.0, OAuth 2.0, and OpenID Connect (OIDC). Azure AD / Entra ID provides SSO for Microsoft 365 and thousands of integrated applications. See also: *MFA*, *Azure AD / Entra ID*, *LDAP*.
***
**Subnet Mask**
A 32-bit number that divides an IP address into network and host portions. Written in dotted-decimal (e.g., `255.255.255.0`) or CIDR notation (`/24`). The subnet mask tells devices which part of an IP address identifies the network and which part identifies the individual host. See also: *IP Address*, *CIDR*, *Gateway*.
**TPM (Trusted Platform Module)**
A dedicated hardware chip (or firmware implementation) on a motherboard that provides hardware-based security functions including cryptographic key storage, random number generation, and platform integrity verification. Required for Windows 11 and used by BitLocker to store encryption keys. TPM 2.0 is the current standard. See also: *BitLocker*, *Secure Boot*.
**UEFI (Unified Extensible Firmware Interface)**
The modern replacement for BIOS, providing a graphical firmware interface, support for drives larger than 2 TB (via GPT partition tables), Secure Boot, faster startup, and network boot capabilities. Virtually all computers manufactured after 2012 use UEFI. UEFI settings are accessed similarly to BIOS, typically via `Del`, `F2`, or `F10` at startup. See also: *BIOS*, *Secure Boot*, *GPT*.
**VLAN (Virtual Local Area Network)**
A logical segmentation of a physical network into multiple isolated broadcast domains, configured at the switch level using IEEE 802.1Q tagging. VLANs are used to separate traffic for security (e.g., guest Wi-Fi vs. corporate network), performance, and management purposes without requiring separate physical infrastructure. See also: *LAN*, *Firewall*, *QoS*.
***
**VNC (Virtual Network Computing)**
A remote desktop sharing system that uses the Remote Frame Buffer (RFB) protocol to transmit screen contents and input events over a network. VNC is cross-platform and operates on port 5900 (and 5901+ for additional displays). VNC itself provides minimal encryption; it should always be used through a VPN or SSH tunnel. See also: *RDP*, *SSH*, *VPN*.
***
**VPN (Virtual Private Network)**
A technology that creates an encrypted tunnel over a public network, allowing remote users or offices to securely connect to a private network as if they were physically present. Common VPN protocols include **IKEv2/IPSec**, **OpenVPN**, **WireGuard**, and **SSL/TLS-based VPNs** (Cisco AnyConnect, Palo Alto GlobalProtect). See also: *SSL/TLS*, *RDP*, *Firewall*.
***
**VoIP (Voice over Internet Protocol)**
Technology that transmits voice and multimedia communications over IP networks rather than traditional telephone lines. Common protocols include SIP, H.323, and RTP. VoIP is sensitive to network latency, jitter, and packet loss; QoS policies are typically applied to prioritise VoIP traffic. See also: *QoS*, *RTP*.
**WAN (Wide Area Network)**
A network that spans a large geographic area, such as multiple offices, cities, or countries. The internet is the largest WAN. Enterprise WANs connect branch offices using MPLS, SD-WAN, leased lines, or VPN over the internet. Contrast with *LAN*. See also: *VPN*, *MPLS*, *SD-WAN*.
***
**WMI (Windows Management Instrumentation)**
A Windows management infrastructure that provides a standardised interface for querying and managing system information, hardware, software, and services programmatically. Used extensively by PowerShell, SCCM/MECM, monitoring tools, and diagnostic scripts. See also: *PowerShell*, *GPO*.
**Zero Trust**
A security framework based on the principle of *"never trust, always verify"* — no user, device, or network is trusted by default, even if inside the corporate perimeter. Zero Trust relies on continuous verification through identity (MFA), device compliance, least-privilege access, and micro-segmentation. Microsoft's Zero Trust model is built around **Azure AD / Entra ID**, **Intune**, and **Conditional Access**. See also: *MFA*, *Conditional Access*, *VPN*.
Terms in this glossary cross-reference each other using the *See also* notation. For practical troubleshooting steps related to any of these technologies, refer to the relevant guide in the knowledge base navigation.