Write for the person who picks this up at 8am tomorrow knowing nothing. That person may well be you, and you will not remember.
A structure that always works
- 1
What the user reported
In their words, including the exact error text.
- 2
What you verified
Facts you established — account type, device, network, whether other devices work.
- 3
What you tried
And what each attempt did. A failed attempt is useful information.
- 4
Where it stands
Resolved, blocked on something specific, or escalated to a named team.
- 5
What should happen next
The single most valuable line in the whole ticket.
Compare
User called about VPN. Troubleshot. Still not working. Escalated.Reported: VPN fails at sign-in on personal MacBook from home.
Error verbatim: "Unable to establish secure connection."
Verified: web sign-in to email works (account is fine). MFA prompt
arrives and is approved. Fails on home network; connects fine on
phone hotspot.
Tried: quit + relaunch client, device restart, hotspot test.
Status: escalated to Network. Cause appears specific to the user's
home network, not the account or the client.
Next: confirm whether the user's router blocks the VPN protocol.
User is reachable after 3pm weekdays.