# Knowledge Base Article

Writes a structured knowledge base (KB) article from notes about a resolved issue or technical question. Use it right after closing a ticket so the fix is captured before context fades.

## Prompt

## Context
You are a technical writer helping an IT or cybersecurity professional capture a resolved issue or technical question as a reusable knowledge base (KB) article. The audience is a team member or end user who hits the same problem later and needs to solve it without escalating.

System or application: [SYSTEM OR APPLICATION]
Issue summary: [ISSUE SUMMARY]
Symptoms as the user experienced them: [SYMPTOMS]
Root cause: [ROOT CAUSE]
Resolution steps taken: [RESOLUTION STEPS]
Verification that the issue is resolved: [VERIFICATION STEPS]
Any workarounds if the full fix is not available: [WORKAROUNDS]
Related ticket number or reference: [TICKET OR REFERENCE NUMBER]
Audience (end user, tier-1 technician, or engineer): [AUDIENCE]

## Task
Produce a KB article with these sections: Title, Summary (two sentences), Applies To, Symptoms, Root Cause, Resolution, Verification, Workaround (if applicable), Related Resources.

## Standards
- Title format: [Action or Resolution] for [Issue] on [System]. Example: Fix for Login Failure After Password Reset on Okta.
- Write for the stated audience. End-user articles avoid command-line steps. Engineer articles can include commands verbatim.
- Include exact steps, commands, and paths only when the author supplied them. Mark any value you cannot fill as [PLACEHOLDER].
- Root Cause states only what the author supplied. Do not theorize beyond the supplied facts.
- Do not invent error codes, log lines, CVE identifiers, hostnames, or system behaviors not in the inputs.
- Related Resources lists only references the author provides. Write [ADD REFERENCES] if none were supplied.
- If symptoms or resolution steps are missing, ask before drafting.

## Variables

- SYSTEM OR APPLICATION
- ISSUE SUMMARY
- SYMPTOMS
- ROOT CAUSE
- RESOLUTION STEPS
- VERIFICATION STEPS
- WORKAROUNDS
- TICKET OR REFERENCE NUMBER
- AUDIENCE

## Input checklist

- [ ] The resolved ticket or incident record with the actual symptoms reported by the user
- [ ] The root cause as documented during the investigation, not reconstructed from memory
- [ ] The exact resolution steps taken, including commands or settings changed, from your notes or the ticket
- [ ] Confirm that all technical details (error messages, commands, system names) come from your actual case and environment, not from the AI
- [ ] Redact any customer personally identifiable information (PII), credentials, or sensitive configuration data before pasting, per your data handling policy

## Verification checklist

- [ ] Resolution steps verified to work in the actual environment before the article is published
- [ ] Symptoms match what the user actually reported, not an AI paraphrase that changes the meaning
- [ ] Root cause confirmed by investigation, not inferred by the AI from the symptoms
- [ ] No invented error codes, log entries, or system behaviors appear in the article
- [ ] Audience level is appropriate: commands and technical terms that end users cannot act on are removed from user-facing versions
- [ ] Article reviewed by a second technician who was not part of the original resolution

## Sample output

Sample output. Generated by AI from sample inputs:

# Fix for VPN Client Disconnect After Windows Update on GlobalProtect

## Summary
Users on Windows 11 workstations running GlobalProtect 6.2 may experience automatic VPN disconnection after installing the June 2026 cumulative update (KB5039302). Reverting the network adapter driver resolves the issue.

## Applies To
- Operating system: Windows 11 22H2 and 23H2
- VPN client: Palo Alto GlobalProtect 6.2.x
- Affected systems: Domain-joined workstations at Northwind Corp

## Symptoms
- VPN connects but drops within 30-90 seconds
- Event Viewer shows: "Network connection lost" under Application logs
- Issue began after Windows Update on or after June 10, 2026

## Root Cause
The June 2026 cumulative update (KB5039302) replaced the Intel Ethernet adapter driver with a version incompatible with the GlobalProtect virtual adapter on affected hardware. The driver version introduced was 12.19.1.36.

## Resolution
1. Open Device Manager on the affected workstation.
2. Expand Network Adapters.
3. Right-click the Intel Ethernet adapter. Select Properties.
4. Go to the Driver tab. Click Roll Back Driver.
5. Select the rollback reason and confirm.
6. Restart the workstation.
7. Connect to GlobalProtect and confirm stability over 5 minutes.

## Verification
VPN connection holds for at least 5 minutes without dropping. Event Viewer shows no network disconnect events during that window.

## Workaround
If rollback is not available (hardware has no prior driver stored), pause Windows Update and contact the IT Help Desk. A driver package is available on the internal software share at [PATH].

## Related Resources
- Ticket: HD-20481
- Vendor advisory: [ADD REFERENCES]

## Customization notes

For end-user-facing articles in a self-service portal, strip the Event Viewer steps and replace the resolution with click-by-click instructions with screenshot placeholders. For engineering-level articles, add a section on detection signals (what monitoring alerted, what logs showed) so future responders know how to find it fast. Link the KB article to the incident record in your ticketing system so the connection is searchable.

---

From The IT & Cybersecurity Library at vetslearn.com/libraries/it-cyber