SD-00: Service Desk Foundation Setup

Overview

In this setup lab, I created the operational layer needed for a realistic first-line Service Desk workflow. The aim was to keep infrastructure build evidence separate from support evidence, so the later TS ticket labs can focus on triage, investigation, escalation, validation and resolution.

This lab prepares the environment for ServiceNow-based troubleshooting tickets covering Active Directory, Windows, Microsoft 365, Outlook, Teams, OneDrive, VPN, printer, file access, security, request/admin and escalation scenarios.

Objective

The objective was to create a safe support model where Service Desk analysts can work normal user-account incidents without using Domain Admin privileges. The model delegates routine first-line actions to a dedicated group while keeping IT/admin accounts, service accounts, groups and infrastructure objects outside the delegated scope. I also cleaned up the ServiceNow incident categories and subcategories, then added resolver groups so future tickets can show realistic first-line ownership, escalation and specialist routing.

Environment

Configuration

1. ServiceNow Dashboard

I created a dedicated ServiceNow dashboard for the troubleshooting ticket series. The dashboard provides a single workspace for first-line support queues, open incidents, unassigned incidents, high-priority work and recently resolved tickets.

Context: A dedicated dashboard gives the Service Desk analyst a clean place to create, triage and manage the TS ticket queue without relying on default ServiceNow demo data.

2. ServiceNow Users

I created the ServiceNow users needed for the support workflow, including first-line analysts, an escalation/admin resolver, and business callers from HR, Finance, Sales and Management.

Context: The ticket labs need realistic callers and resolvers so incident history can show who raised the ticket, who worked it, and when escalation was required.

3. Active Directory Service Desk Group

I created a dedicated Active Directory security group called GG_ServiceDesk_L1 for delegated first-line support permissions. Chloe Bennett and Daniel Smith were added as the Service Desk analysts.

Context: I used a separate delegation group instead of a general IT resource group. This keeps file/share access separate from account-administration rights and supports least-privilege administration.

4. Password Reset Delegation

I delegated password reset, forced password change at next logon, and read-only user information permissions to GG_ServiceDesk_L1 for normal business-user OUs.

Context: These rights allow first-line analysts to handle common password reset tickets without requiring Domain Admin access.

5. Account Unlock Delegation

I also delegated account unlock capability by granting the Service Desk group permission to read and write the lockoutTime attribute on user objects in the normal business-user OUs.

Context: Unlocking an account is not just the same as resetting a password. Clearing a lockout requires permission to modify the lockout state, so this delegation supports realistic L1 account lockout handling.

6. Incident Categories

I updated the ServiceNow incident category choices to better match a realistic Microsoft-focused Service Desk queue. The active categories now cover Microsoft 365, account/access, operating system, hardware, network, printing, application, security, request/admin and inquiry/help scenarios.

Context: The default lab categories were too limited for realistic troubleshooting evidence. Cleaning up the category list allows future tickets to be logged consistently and makes triage, reporting and escalation decisions easier to follow.

7. Microsoft 365 Subcategories

I configured Microsoft 365 subcategories for the most common cloud productivity support areas: Exchange Online, Outlook, Teams, SharePoint, OneDrive, Licensing, MFA, Entra ID and Microsoft Office Apps.

Context: This prevents Microsoft 365 issues being forced into vague categories such as Software or Email. Future tickets such as SharePoint access, licensing, MFA, Outlook and mailbox issues can now be classified more accurately.

8. Cloud / Azure Subcategories

I added Cloud / Azure subcategories for common junior-support and escalation scenarios, including virtual machines, storage, networking, identity/RBAC, cost/subscription, backup/recovery and monitoring.

Context: Azure tickets often need a different path from normal Microsoft 365 app support. These subcategories allow Azure VM, networking, identity/RBAC, subscription and monitoring issues to be classified cleanly.

9. Resolver Groups and Escalation Model

I created dedicated ServiceNow resolver groups so tickets can show realistic routing when first-line support reaches a permissions boundary or needs specialist investigation.

Context: Chloe Bennett and Daniel Smith represent first-line Service Desk analysts. Kristian Nietzold is used as the senior lab resolver/admin account for escalated fixes that require higher permissions or specialist investigation.

Populated ServiceNow Queue

After the Service Desk foundation was configured, the incident queue was populated with realistic Microsoft support scenarios. This validates the caller, resolver, priority, assignment and ticket-state model used across the Service Desk portfolio.

Complete Incident Classification Reference

The main screenshot shows the active Incident categories that were configured. I captured separate Microsoft 365 and Cloud / Azure subcategory screenshots because these areas are important for the troubleshooting ticket series. The remaining subcategories are documented below so the page still explains the full setup without needing a screenshot for every category.

Service Desk Role Model

This table defines who is used in the ticket labs and what each account represents. The aim is to make later incidents easier to follow by separating callers, first-line resolvers and the senior lab escalation resolver. The role model distinguishes responsibilities within the simulated environment.

Resolver Group Routing

The ServiceNow resolver groups define where a ticket should be routed after first-line triage. This gives the ticket labs a simple but realistic escalation model without creating too many specialist teams too early.

Delegated Scope

The Service Desk delegation was applied only to normal business-user areas. Privileged areas such as IT/admin accounts, service accounts, groups and domain infrastructure were deliberately kept out of scope so first-line analysts can handle routine account issues without receiving unnecessary administrative access.

Validation

The setup was validated by confirming that the ServiceNow dashboard was available, the Nietz Ltd users were present and active, the Active Directory Service Desk delegation group contained the correct first-line analysts, the Delegation of Control Wizard applied the required password reset, read-user-information and account unlock permissions, the ServiceNow Choice List contained the updated incident categories and Microsoft 365 / Cloud Azure subcategories, and the ServiceNow resolver groups had the expected memberships.

Key Technical Outcomes

This lab demonstrated how to prepare a realistic support operating layer on top of a Microsoft lab environment. It showed the difference between resource-access groups and delegated administration groups, created a safer model where first-line analysts can support normal users without broad domain administrator permissions, and configured ServiceNow so incidents can be categorised consistently across Microsoft 365, access, Windows, network, printing, application, security and request workflows.

The setup also creates a clear escalation boundary: Chloe and Daniel can handle routine first-line account support, while higher-risk or higher-permission actions can be escalated to Kristian as the senior lab resolver through Second Line, Infrastructure, Network or Security Support queues.