IT Help Desk Services for Small Teams

How requests get triaged once a ticket is opened

Every request that arrives — by phone, email or portal — becomes a ticket with an owner, a timestamp and a priority. That last part is what stops a help desk from working first-in-first-out, which sounds fair and is in fact terrible: it means the person whose entire office cannot send email waits behind a question about how to change a font in Word.

Priority is not the same as urgency-as-felt-by-the-caller. It is a product of two things: impact (how many people are stopped) and severity (how completely they are stopped). One person mildly inconvenienced and thirty people fully down are not the same ticket, however politely each was reported. Most desks use a P1–P4 scale, and the useful version looks like this.

Two mechanics keep the scale honest. Escalation moves a ticket up a tier when the first technician has exhausted their scope — a mailbox issue that turns out to be a tenant-level mail flow rule, or a slow application that turns out to be a failing disk. Aging automatically raises priority when a ticket sits too long, so a P3 does not quietly become permanent because P1s kept arriving.

The metric worth watching is first-call resolution — the share of tickets closed on the first contact without a callback. A well-run small-business desk lands somewhere around 70–80%. Below that, either information is missing at intake or the same underlying fault keeps recurring under different ticket titles, which is a signal to fix the cause rather than the symptom. That is why recurring patterns get reviewed: five separate “printer offline” tickets in a month is not five tickets, it is one DHCP reservation nobody set.

Emergency or routine? What genuinely warrants an urgent call

Small business owners tend to err in both directions — calling at 9pm about a font, or waiting until Monday morning to mention that Friday’s files all had their extensions changed to something odd. The second one costs far more. Here is the honest dividing line.

Call immediately, whatever the hour

• Anything that looks like ransomware. Files renamed with an unfamiliar extension, a ransom note text file on the desktop, documents that will not open. Disconnect the machine from the network — unplug the cable, turn Wi-Fi off — but do not power it down, and call.
• A server or line-of-business system down. Nobody can access the shared drive, the practice-management or ERP system, or the database.
• All email down. Not one mailbox — everyone. That is a tenant, DNS or mail flow problem and it is costing you conversations you will never know you missed.
• POS or payment processing offline during trading hours. Every minute is directly revenue.
• Suspected account compromise. An MFA prompt you did not trigger, a mailbox rule you did not create, colleagues receiving mail “from you” that you never sent, or a payment request that turned out to be fraudulent.
• Total internet or firewall failure at the office.
• Water, fire, power surge or theft affecting equipment — the recovery clock starts the moment you call, not the moment someone arrives.

Fine to log as a normal ticket

• A single printer jammed, out of toner, or offline when another printer works.
• “How do I…” questions about Excel, Teams, SharePoint or any application feature.
• One computer running slowly, as long as it still runs.
• Software installation requests, new peripherals, a second monitor.
• New-hire setup for a start date that is more than 48 hours away.
• Password resets during business hours — unless it is the only person who can process payroll, today.

One judgement call sits between the lists: a single user who cannot work at all, in a five-person company, is effectively 20% of the business. Scale matters. If you genuinely cannot tell, call — a thirty-second conversation is cheaper than either mistake.

What to have ready so it gets fixed on the first contact

Most callbacks happen because the ticket said “it’s not working” and the technician had to spend the first exchange establishing what “it” is. Five details usually collapse a two-day back-and-forth into one session.

• Who and which machine. The affected person’s name and the computer name — on Windows, Settings → System → About shows it, or press Win+Pause. In an office with nine identical laptops this matters more than it sounds.
• The exact error text. A photo of the screen with your phone beats a paraphrase every time. “Something about a certificate” and “NET::ERR_CERT_DATE_INVALID” lead to completely different fixes.
• Scope. Is it just you, everyone at your desk cluster, or the whole office? Does it happen on another computer, or on the same computer with a different login? This single answer separates a device problem from an account problem from a network problem.
• When it started and what changed. New software, a Windows update, a new printer, a move to a different desk, a password change, a storm on Sunday night. People withhold this because it sounds like an admission; it is actually the fastest route to a fix.
• What you already tried, including a restart. Knowing a reboot did not help saves a step, and knowing a reboot fixes it for two hours points somewhere very specific.
• How reachable you are. A number you will actually answer, and whether you are able to sit at the machine for a remote session now or after 3pm.

It also helps to nominate one person per office as the point of contact for anything company-wide. Seven people independently reporting the same outage creates seven tickets, and the time spent merging them is time not spent fixing it. For everything else, log tickets individually — grouping unrelated problems into one email guarantees at least one of them gets forgotten.

Finally, keep the answers to the questions you will be asked in an emergency somewhere that does not depend on the systems being down: your ISP account number, who your phone provider is, where the firewall and switch physically live, and the support number — +1 (202) 960-2022 — written on paper. A contact list stored only in the email system you cannot reach is a contact list you do not have.

Frequently asked questions

What is the difference between response time and resolution time?

Response time is how long before a technician is actually engaged with your ticket — not an automated “we received this” email. Resolution time is how long until you can work again. A provider quoting only response times is quoting the easier number. Ask for target resolution or an acceptable workaround per priority level, and ask what percentage of tickets met it last quarter.

Do I have to use a ticket portal, or can I just call?

Call, email or portal — all three create the same ticket. Phone is best for anything urgent; email is fine for routine requests and gives you a written record. The portal is mainly useful for tracking several open items at once and for owners who want visibility into what their team has been reporting.

What counts as after-hours, and is it charged extra?

Standard coverage runs during US business hours. Genuine P1 emergencies — outage, breach, business stopped — are handled outside those hours under a flat-rate plan without surprise invoices. Non-urgent work requested at 10pm is scheduled for the next business day, which is normally what the requester wanted anyway.

The same problem keeps coming back. Is that normal?

No, and it should be treated as a defect in the support, not in your equipment. Repeat tickets on the same user, device or application are a signal that the fix has been treating symptoms. Recurring patterns get pulled out during review and dealt with at the root — a driver rollback, a static IP reservation, a failing disk replaced before it takes the machine with it.