GUIDINEE.COM › IT & Systems › Level 6 › 6.1

6.1 · Case studies

Level 6 · In practice

6.1Case studies

Goal: see how the skills from levels 0 to 5 come together on real situations.
Estimated time: 14 min · If you only have 5 min: read “The essentials in 30s” + the diagram.

The essentials in 30 seconds

  • Assemble: standard workstation prepared and cloned → network (box, switch, Wi-Fi) → email and files as SaaS → security (MFA, least privilege, backups) → documentation.
  • Prove: a backup exists only if the restore has been tested; a printer IP is stable only if it is reserved; a workstation is ready only if the data has been restored and verified.
  • Secure: isolate first in case of an incident, restore from a clean, disconnected copy, then fix the root cause — it is the sequence, not an isolated move, that brings the situation under control.

Sofiane’s thread — three interventions in Algiers

Sofiane, an IT support technician (N1 → N2) in a distribution SME in Algiers, reviews his three standout projects of the quarter: setting up the IT for a small partner firm (standard workstation, network, cloud, security, documentation), reacting to ransomware hour by hour, and onboarding a new recruit end to end (workstation, account, MFA, access, knowledge base). The cases below follow his sequence through levels 0 to 5: prepare, network, secure, document, prove.

Each case follows the flow Context → Steps → Result: replay it on your own situations.

Why case studies

The previous levels laid the bricks (hardware, systems, network, accounts, cloud, security, backups, assets); here we assemble them on real situations, end to end. This is where skill shows — in stringing together the right reflexes, not in isolated knowledge.

Replaying end to end

A case is not copied: it is replayed. You follow the order of the intervention, adapt to the context (size, budget, local constraints) and keep the same demand for proof at every step.

From the workshop to the field

The real test of an intervention is not “it seems to work,” but “it holds over time”: restored backup, reserved IP, accounts with least privilege, written procedure that a colleague can replay.

Case 1 — Building the IT of an 8-person firm

Context: A partner firm is opening: 8 workstations, a printer, a box, needs for email and file sharing. No server for now — Sofiane must deliver a simple, secure and documented IT setup.

Déroulé :

  1. Inventory the needs: workstations, printing, shared files, email, backup.
  2. Prepare a template PC (install, drivers, updates, standard account, licensed software) and clone it.
  3. Set up the network: box (DHCP/NAT), switch, Wi-Fi; DHCP reservation for the printer.
  4. Cloud first: email + files as SaaS, MFA enforced.
  5. Secure: updates, firewall, antivirus, least privilege, tested 3-2-1 backups.
  6. Document: addressing plan, accounts, procedures, knowledge base.

Result: A simple, secure information system, with no on-site server to maintain, and documented to last.

Case 2 — Responding to ransomware, hour by hour

Context: A PC shows a ransom demand; shared files are encrypted. Sofiane applies his reaction chain, minute by minute.

Déroulé :

  1. H+0 — Isolate: unplug the PC from the network (cable/Wi-Fi) to stop the spread.
  2. H+0 — Do not pay; alert the manager; preserve the evidence.
  3. H+1 — Measure the extent: which shares/PCs are hit? cut the affected access.
  4. H+2 — Restore from a CLEAN, disconnected backup (never a compromised online copy).
  5. H+4 — Rebuild the PC (clean reinstall), change passwords, re-enroll MFA.
  6. D+1 — Post-mortem: how did it get in? harden (updates, awareness, offline backups).

Result: Incident contained thanks to immediate isolation and a tested, disconnected backup — the best insurance.

Case 3 — Onboarding a new recruit end to end

Context: A saleswoman joins the SME on Monday. Sofiane prepares the workstation, accounts and access before her arrival, then gets her up and running.

Déroulé :

  1. Prepare the workstation: up-to-date system, drivers, antivirus, encryption, licensed software from the template PC.
  2. Create the STANDARD user account (not admin), with MFA from the first login.
  3. Grant access by need: email, her department’s shares, printer; nothing more.
  4. Run the first-login ritual: password, MFA, data restore, email/printer test.
  5. Document the arrival: identifier, assigned workstation, access granted, point of contact; the sheet joins the knowledge base.
  6. Plan the exit: deactivation, return of equipment, data backup — anticipated right now.

Result: A frictionless arrival, the right access, and a reusable sheet for the next recruit.

Common misinterpretation: “copying the cases identically.” No. The cases show an order of intervention (prepare, network, secure, document, prove), not a fixed recipe: follow the order, adapt to your size and local constraints.
Text version of the diagram (SEO / screen readers / translation): 1) Prepare the workstation (cloned template PC, up-to-date system, drivers, standard account, licensed software, N1). 2) Set up the network (box DHCP/NAT, switch, Wi-Fi, reserved IP for the printer, N2). 3) Move to the cloud (email and files as SaaS, MFA enforced, N4). 4) Secure (updates, firewall, antivirus, least privilege, tested 3-2-1 backups, N5). 5) Document (addressing plan, accounts, procedures, knowledge base, N5). 6) Prove (restore to verify, test an access, replay the procedure). Lesson: a reliable IT setup comes from the sequence of levels, not from an isolated move.

Script ready to say — framing an intervention (30 s)

“The need: [set up the IT / react to an incident / onboard a recruit]. My approach: prepare a template PC, network it properly, secure it (MFA, least privilege, backups), then document and test.”

Keep this to frame an intervention with your management.

Script ready to say — explaining your intervention (30 s)

“I start from a clean workstation, put it on the network, move to the cloud for email and files, secure it and document it — then I prove that the restore and the access work.”

Useful for explaining your approach without technical jargon.

Copy-paste template — express network diagnosis

ipconfig /all
ping 
ping 8.8.8.8
ping www.example.com
tracert www.example.com
-- 169.254.x.x = no DHCP; IP OK but name KO = DNS

Copy-paste template — workstation onboarding sheet

Workstation: [name]  User: [name]
OS + drivers + updates: OK
Account: STANDARD (not admin) + MFA
Access: email / [department] shares / printer
Data restored and verified: OK
Documented: addressing plan + knowledge base

Very small business / small budget

A single case replayed small: one template PC, one box, one reserved printer, one tested backup — the essentials fit right there.

Algiers SME

Adapt to local realities: network outages, a single Internet link, heterogeneous hardware, content and dates in French.

Remote / hybrid

Double the traceability at a distance: named workstation, written procedure, intervention and test dates noted.

Intercultural

Make labels explicit before transposing: a service name or date format obvious to one person must speak to every newcomer.

Caution: Generic reminder: an intervention commits your organization — relay only verified procedures, never open an administrator account for day-to-day use, test every backup before treating it as a given, and keep a disconnected offline copy.

48h challenge — apply it tomorrow

Take 1 real intervention and replay the sequence: clean workstation, networking, securing and 1 piece of proof (tested restore, verified access or written procedure).

Section exit checklist
  • I can chain workstation, network, cloud, security and documentation on a real case.
  • I have a replayable chain (template PC, reserved IP, tested backup, written procedure).
  • I did the 48h challenge or scheduled its date.
Self-assessment 1-5: does my intervention start from a clean base?is my proof tested (restore, access, docs)?
Next : Recurring problems (playbook) (V3) →
Check your understanding

Sofiane is setting up the IT for a firm. Which sequence follows the guide?