Ticket Documentation Standard

HALO PSA

Document Type: Standard Operating Procedure Audience: All Technicians (T1 / T2 / T3), Account Managers Last Updated: February 2026 Version: 1.0

1. Why This Matters

Every HALO ticket is a piece of institutional knowledge. When you write clear, structured notes, three things happen:

The next tech doesn't start from zero. Whether it's an escalation, a callback, or the same issue at another client six months from now — your notes are the starting point.
Tickets become searchable. Vague notes like "fixed the issue" are invisible to search. Specific notes like "PBS Endo endoui.exe.config wiped by update — restored from Veeam backup" get found when someone searches "PBS Endo config" next year.
Escalations don't lose context. When a T1 hands a ticket to T2, the T2 should be able to pick up exactly where T1 left off — not re-ask the client the same questions.

The standard: Write notes as if the next person reading them has never spoken to this client and has 5 minutes to get up to speed.

2. The DTC Note Structure

Every note entry — whether it's initial triage, a work session, an escalation, or a resolution — should follow this structure. You don't need to write a novel. You need to answer these questions:

2.1 The Four Questions

Every note should answer at least these four:

Question	What to Write	Example
What did the user report?	Their words, their symptoms — not your interpretation yet	"User reports PBS Endo opens then immediately closes on all workstations since this morning"
What did you find?	Your diagnostic findings — what you observed, tested, checked	"endoui.exe.config in Client folder is 0 KB. Server Updates folder contains blank config. Service starts with errors but eventually runs."
What did you do?	Actions taken, in order, with specifics	"Restored endoui.exe.config from Veeam backup (pre-update). Copied to server Client folder, then to 4 workstations via UNC path."
What's the current state?	Resolved? Partially fixed? Waiting? What's next?	"PBS Endo opens without error on all workstations. Verified data access. Renamed bad Updates folder, restored 3 original files from backup."

2.2 Note Entry Format

Use this format for every note entry:

[WHAT WAS REPORTED / CONTEXT]
Brief description of the issue or reason for this entry.

[WHAT WAS FOUND]
- Finding 1
- Finding 2
- Finding 3

[ACTIONS TAKEN]
1. Step 1
2. Step 2
3. Step 3

[CURRENT STATE]
Result of actions. Next steps if not resolved. Who owns the next action.

You can shorten this for quick updates, but never skip "What did you find?" and "What did you do?" — those are the two that matter most for searchability and escalation.

3. Good Notes vs. Bad Notes

Bad Note — Tells the next tech nothing:

Fixed the printer issue for the front desk. Working now.

Why it's bad: What printer? What was wrong? What did you do? If the same printer breaks tomorrow, the next tech learns nothing from this.

Good Note — Searchable, actionable, complete:

User reported front desk Canon MF663Cdw not printing from Dentrix.
Print queue showed jobs stuck in "Error" status.

Found printer was configured with WSD port (auto-discovered).
WSD port had lost connection — device showed offline in Devices and Printers.
Printer IP confirmed as 10.0.0.50 via UniFi portal.

Removed WSD printer. Added new printer using TCP/IP Standard Port on 10.0.0.50.
Installed Canon UFR II driver from manufacturer website.
Printed Dentrix test claim successfully.

Note: This printer should be added to print server and deployed via GPO
during next maintenance window. See Network Printer GPO Deployment SOP.
Flagged for Account Manager.

Why it's good: The issue, root cause, and fix are all documented. It's searchable by printer model, error type, and software name. It flags follow-up work. The next time any tech sees a WSD printer issue, this ticket shows up in search.

Bad Escalation Note:

Can't figure this out, escalating to T2.

Good Escalation Note:

ESCALATION TO T2:

User reports 5-minute black screen after login on their profile only.
Other users log in normally on the same workstation.

Tested:
- Created new local profile — logs in normally in 15 seconds
- Deleted user's cached profile and re-logged — same 5-min delay
- Ran SFC /scannow — no integrity violations
- Checked Event Viewer — no errors during login delay period
- Confirmed no GPO processing delays (gpresult /r shows normal)

Suspicion: System-level corruption tied to this user's AD account/SID,
not profile corruption (since new profile with new local account works fine,
but new profile with same AD account reproduces the issue).

Recommend: In-place Windows upgrade per Windows In-Place Upgrade SOP.
Reference: Ticket 1117316 — similar pattern, resolved via in-place upgrade.

Why it's good: T2 knows exactly what's been tried, what's been ruled out, what the working theory is, and there's a reference to a similar ticket. T2 doesn't repeat any work.

4. Searchability — Write for Future You

The number one reason tickets can't be found later: generic language. HALO search works on keywords in ticket subjects and notes. Make your notes findable:

4.1 Subject Line Standards

The ticket subject is the most searchable field. Make it specific:

Bad Subject	Good Subject
Printer not working	Canon MF663Cdw offline — WSD port failure
Software issue	PBS Endo open/close loop after workstation update
Computer slow	Workstation login delay — 5 min black screen — user profile
Can't take X-rays	DEXIS sensor not acquiring — USB not detected — Operatory 3
Email problem	Outlook 365 stuck on loading profile — OST file corruption
Server issue	C: drive 96% full — Windows Installer orphaned patches 128 GB

Rules for subjects:

Include the software or hardware name (Dentrix, DEXIS, Canon, etc.)
Include the specific symptom (not "not working")
Include the location or scope if relevant (workstation name, operatory, "all users")
Keep it under ~80 characters — concise but specific

4.2 Keywords to Include in Notes

When writing notes, naturally include terms that someone would search for:

Software names and versions: "Eaglesoft 21.20," "DEXIS 10.0.18," "Sidexis 4.3"
Error messages: Paste the exact error text. "SystemServiceModelsChannel.ServiceChannel cannot be used for communication because it is in the Faulted state"
File paths and file names: C:\PBSEndo\Client\endoui.exe.config
Hardware models: "DEXIS Platinum sensor," "Canon imageCLASS MF663Cdw"
Technique used: "in-place upgrade," "GPO deployment," "Veeam restore," "profile rebuild"

4.3 Cross-Reference Related Tickets

When you find a similar past ticket during troubleshooting, reference it in your notes:

Reference: Ticket 1121433 — same root cause pattern (Windows Installer 
bloat causing .NET framework failures). PatchCleaner resolved.

This creates a web of linked knowledge. Future techs searching for either ticket number will find both.

5. Time Entries

Every work session gets a time entry. This isn't just for billing — it's the timeline of the ticket.

5.1 Time Entry Standards

Field	What to Enter
Start / End Time	Actual start and end of your work session. Round to nearest 5 minutes.
Duration	Auto-calculated, but verify it's reasonable.
Note	Brief description of what you did during this specific session. Not a copy of the full ticket notes — just this session.
Billable	Mark appropriately per client agreement. When in doubt, ask your manager.

5.2 Time Entry Note Examples

Bad:

Worked on the issue.

Good:

Remote session via Splashtop. Diagnosed PBS Endo config wipe caused by 
bad update payload. Restored config from Veeam backup, deployed to 4 
workstations. Verified application opens and data accessible on all.

Good (short session):

Called user to verify printer working after yesterday's fix. Confirmed 
printing from Dentrix and Eaglesoft. No further issues. Closing ticket.

5.3 Multiple Sessions on One Ticket

If you work a ticket across multiple sessions, each session gets its own time entry with its own note. This creates a clear timeline:

Session 1 (1/15, 30 min): Initial triage. Identified WSD port failure 
on front desk Canon. Reconfigured to TCP/IP. Test print successful.

Session 2 (1/16, 15 min): Follow-up. Added printer to print server, 
created GPO for deployment. Tested GPO application on one workstation. 
Scheduled full deployment for maintenance window.

Session 3 (1/20, 10 min): Post-maintenance verification. GPO deployed 
to all 8 workstations. Confirmed printing from all stations. Closing.

6. Escalation Documentation

Escalation is where context dies. When you escalate, you are the historian. The receiving tech's effectiveness depends entirely on what you hand them.

6.1 Escalation Note Checklist

Before you reassign or escalate, your notes must include:

Item	Included?
Clear problem statement (what the user reports)	☐
Environment details (server OS, workstation OS, software name/version, hardware involved)	☐
Everything you tested and the result of each test	☐
What you ruled out and why	☐
Your working theory (what you think the problem is)	☐
Any relevant error messages — exact text, not paraphrased	☐
Similar tickets referenced (if you found any)	☐
What you recommend the next tech try	☐
Client contact and availability (when can the next tech reach them?)	☐

6.2 Escalation Note Template

Copy and fill in:

ESCALATION TO [T2/T3/VENDOR]:

ISSUE: [One-sentence summary]

ENVIRONMENT:
- Client: [Name]
- Server: [OS, hostname if relevant]
- Workstation: [OS, hostname]
- Software: [Name, version]
- Hardware: [If relevant — sensor model, printer model, etc.]

WHAT WAS REPORTED:
[User's description in their words]

WHAT WAS TESTED:
1. [Test] → [Result]
2. [Test] → [Result]
3. [Test] → [Result]

RULED OUT:
- [Thing] — because [reason]

WORKING THEORY:
[Your best assessment of what's happening and why]

RECOMMENDED NEXT STEP:
[What you'd try if you had the skill/access/time]

REFERENCES:
- Ticket [#] — [brief description of similar issue]
- SOP: [relevant SOP name if applicable]

CLIENT CONTACT:
- [Name], [phone/email], available [times]

7. Resolution & Closure Documentation

When you close a ticket, write the resolution as if it's a knowledge base article. Someone will search for this issue again.

7.1 Resolution Note Template

RESOLVED:

ISSUE: [One-sentence summary]
ROOT CAUSE: [What actually caused the problem]
RESOLUTION: [What fixed it — specific steps]

PREVENTION / FOLLOW-UP:
- [Any follow-up work flagged]
- [Any proactive measures to prevent recurrence]
- [Any SOP created or updated as a result]

7.2 Resolution Examples

Example 1 — Software Issue:

RESOLVED:

ISSUE: PBS Endo open/close loop on all workstations after update
ROOT CAUSE: Update payload in server Updates folder contained blank 
endoui.exe.config. Running workstation update deployed blank config, 
wiping WCF service connection settings.
RESOLUTION: 
1. Restored endoui.exe.config from Veeam backup (pre-update snapshot)
2. Placed restored config in server PBSEndo\Client folder
3. Renamed corrupted Updates folder on server
4. Restored 3 original update files from backup to new Updates folder
5. Copied correct config to all 4 workstations via UNC path
6. Verified application opens and data accessible on all stations

PREVENTION: 
- Monitor PBS Endo Updates folder contents before applying workstation updates
- Verify config file is non-zero-byte before proceeding
- Reference: PBS Endo Update Config Wipe SOP added to BookStack

Example 2 — Hardware / Infrastructure:

RESOLVED:

ISSUE: C: drive at 96% capacity (9.1 GB free of 236.3 GB)
ROOT CAUSE: Orphaned Windows Installer patches accumulated over time.
C:\Windows\Installer consuming 128.1 GB (.msp files: 127.2 GB).
RESOLUTION:
1. Ran Disk Cleanup with Windows Update Cleanup — recovered 8 GB
2. DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase — recovered 4 GB
3. PatchCleaner identified 115 GB orphaned installers — safely removed
4. Final state: 138 GB free (41% utilization)

PREVENTION:
- Added workstation to 80% disk threshold monitoring
- Reference: Ticket 1121433 — same root cause pattern

8. HALO PSA — Field-by-Field Guide

This section covers the specific HALO fields and how to use them consistently.

8.1 Ticket Creation Fields

HALO Field	Standard	Notes
Summary / Subject	Follow subject line standards from Section 4.1 — software/hardware name + specific symptom	Most searchable field. Make it count.
Client	Select the correct client. Double-check for multi-location clients.	Don't leave as default.
Site	Select the correct site/location if client has multiple offices.	Critical for on-site dispatch.
User / Requested By	The person who reported the issue. Not you.	Important for follow-up and SLA tracking.
Category	Select the most specific category available.	Drives reporting and routing. See Section 8.3.
Priority	Use the priority matrix in Section 8.4.	Don't default everything to Medium.
Ticket Type	Incident, Service Request, Problem, or Change as appropriate.	See Section 8.2.
Assigned Agent	Assign to yourself when you start working. Reassign when escalating.	Unassigned tickets are invisible tickets.

8.2 Ticket Types

Type	When to Use	Example
Incident	Something is broken or not working as expected	"Dentrix won't open," "printer offline," "sensor not acquiring"
Service Request	User is asking for something new or a standard task	"Add new user to AD," "install software on new workstation," "map network drive"
Problem	Recurring root cause investigation across multiple incidents	"Third WSD printer failure this month — need to convert all printers to TCP/IP"
Change	Planned modification to infrastructure or systems	"Server OS upgrade," "VLAN reconfiguration," "software version update"

8.3 Category Selection

Select the most specific category that matches. When in doubt, pick the category that will make this ticket show up in the right report. Common dental MSP categories:

Category	Use For
Hardware — Workstation	PC won't boot, slow performance, disk space, hardware failure
Hardware — Server	Server hardware, RAID, UPS, storage
Hardware — Printer	Any printer issue — paper jams to driver problems
Hardware — Imaging	Sensors, pano units, CBCT, intraoral cameras
Software — PMS	Dentrix, Eaglesoft, Open Dental, SoftDent, PBS Endo, TDO, WinOMS
Software — Imaging	DEXIS, Sidexis 4, DTX Studio, CS Imaging, Romexis, EzDent-i, Apteryx
Software — Other	Outlook, Office, Adobe, patient communication software
Network — Connectivity	Internet down, slow network, DNS issues, WiFi problems
Network — Infrastructure	Firewall, switches, APs, VLANs, cabling
Security	AV alerts, phishing, unauthorized access, account lockouts
Backup & DR	Veeam alerts, backup failures, restore requests
User Management	AD accounts, password resets, permissions, new hires, terminations
Project	Onboarding, migrations, infrastructure upgrades, scheduled work

Note: If your HALO instance has different categories, follow your existing structure — but the principle is the same: be as specific as possible so tickets show up in the right reports.

8.4 Priority Matrix

Don't guess. Use the matrix:

Priority	Criteria	Response Target	Example
Critical	Practice cannot see patients. Revenue-impacting. All users affected.	15 min response	Server down, PMS inaccessible, internet completely down, ransomware
High	Significant impact to workflow. Multiple users or critical function affected.	1 hour response	Imaging not acquiring (all operatories), main printer down, Dentrix slow for all users
Medium	Single user or non-critical function impaired. Workaround exists.	4 hour response	One workstation slow, one operatory sensor issue, Outlook not syncing for one user
Low	Minimal impact. Cosmetic, informational, or can wait for maintenance window.	8 hour / next business day	Desktop shortcut request, non-urgent software install, documentation request

Escalation trigger: If a ticket has been at the same priority for more than 2x the response target without progress, escalate or re-prioritize.

8.5 Status Workflow

Use status changes to communicate where a ticket stands:

Status	Meaning	When to Set
New	Just created, not yet reviewed	Auto-set on creation
In Progress	Tech is actively working or has a plan	When you start working the ticket
Waiting on Client	Ball is in the client's court	You asked a question, need approval, or scheduled a time with them
Waiting on Vendor	Waiting for vendor support response	Opened case with PBS Endo, Patterson, Henry Schein, etc. Include vendor case # in notes
Waiting on Third Party	Waiting on ISP, phone vendor, copier company, etc.	Include third-party reference # and contact in notes
Scheduled	Work is planned for a specific date/time	Maintenance window scheduled, on-site visit booked
Resolved	Fix applied, pending client confirmation	Solution in place, waiting for user to verify
Closed	Confirmed resolved and documented	Client confirmed or no response after follow-up period

Rules:

Never leave a ticket in "New" once you've looked at it. Move it to "In Progress."
Always add a note when you change status — explain why the status changed.
"Waiting on Client" tickets should have a follow-up date. Don't let them sit forever.
When setting "Waiting on Vendor," include the vendor name, case/reference number, and who you spoke with in your note.

9. Special Scenarios

9.1 Vendor Case Tracking

When you open a case with a vendor (PBS Endo, Patterson, Henry Schein, Dentsply Sirona, etc.), document it:

VENDOR CASE OPENED:
- Vendor: PBS Endo Support
- Vendor Case #: [case number]
- Spoke with: [rep name]
- Issue submitted: [brief description]
- Expected follow-up: [date/time or "they will call back"]
- Vendor phone: 800-535-0198

Status changed to: Waiting on Vendor

9.2 On-Site Visit Documentation

If the ticket requires an on-site visit, document the on-site work as a separate note entry:

ON-SITE VISIT — [Date]
Arrived: [time] | Departed: [time]

[Standard note format — What found, What did, Current state]

Parts/hardware used: [if applicable]
Client signed off: [name] confirmed working

9.3 Recurring Issues

If you notice you're working the same issue for the same client (or across clients), escalate it as a Problem ticket:

PATTERN IDENTIFIED:
This is the 3rd WSD printer failure at this client in 60 days.
Tickets: 1119859, 1122XXX, 1125XXX

Root cause: Printers are deployed via WSD auto-discovery instead 
of static TCP/IP ports. WSD connections drop when the printer's 
IP changes via DHCP.

Recommendation: Convert all printers to print server + GPO 
deployment per Network Printer GPO Deployment SOP. Schedule for 
next maintenance window.

10. Quick Reference — Copy/Paste Templates

10.1 Standard Work Note

[REPORTED]
[Brief description of issue or reason for session]

[FOUND]
- [Finding 1]
- [Finding 2]

[ACTIONS]
1. [Action 1]
2. [Action 2]

[STATE]
[Current status. Next steps if applicable.]

10.2 Escalation

ESCALATION TO [T2/T3/VENDOR]:

ISSUE: [One sentence]

ENVIRONMENT:
- Client: 
- Server/Workstation: 
- Software: 
- Hardware: 

REPORTED: [User's words]

TESTED:
1. [Test] → [Result]
2. [Test] → [Result]

RULED OUT: [What and why]
THEORY: [Best assessment]
RECOMMENDED: [Next step]
REFERENCES: Ticket [#], SOP: [name]
CONTACT: [Name, phone, availability]

10.3 Resolution / Closure

RESOLVED:

ISSUE: [One sentence]
ROOT CAUSE: [What caused it]
RESOLUTION:
1. [Step 1]
2. [Step 2]

FOLLOW-UP: [Prevention, monitoring, SOP reference]

10.4 Vendor Case

VENDOR CASE OPENED:
- Vendor: [Name]
- Case #: [Number]
- Spoke with: [Rep name]
- Submitted: [Brief description]
- Expected follow-up: [When]
- Vendor phone: [Number]

10.5 Quick Update (When Full Format Isn't Needed)

For brief check-ins, status updates, or confirmations:

Called [user] to verify [X] working after yesterday's fix. 
Confirmed [working/not working]. [Next step or closing.]

11. Ticket Documentation Dos and Don'ts

Do	Don't
Use specific software and hardware names	Say "the software" or "the program"
Paste exact error messages	Paraphrase errors from memory
Document what you tested, even if it didn't help	Only document the thing that worked
Reference related tickets by number	Assume the next tech will "just know"
Write timestamps for multi-day troubleshooting	Assume ticket chronology is obvious
Update status when it changes	Leave tickets in "New" or "In Progress" for weeks
Include file paths, IPs, hostnames	Write vague location references
Flag follow-up work for the Account Manager	Silently close without noting needed improvements
Write a clear resolution note when closing	Close with no resolution documentation
Keep notes professional and factual	Editorialize about the client or the issue

12. Ticket Examples from Real DTC Work

These are based on patterns from actual HALO tickets referenced across DTC SOPs.

Example A — Well-Documented Incident (Software)

Ticket 1125653 — Guardian Dentistry Partners (DHCNV)
Subject: C: drive 96% full — Windows Installer orphaned patches 128 GB
Note 1 (Triage): User reported workstation sluggish. Remote connected via Splashtop. C: drive at 96.1% capacity (9.1 GB free of 236.3 GB). Ran WizTree — C:\Windows\Installer consuming 128.1 GB. .msp files alone account for 127.2 GB (57.4% of total disk). This is abnormal accumulation of orphaned installer patches.
Note 2 (Remediation): Ran Disk Cleanup with Windows Update Cleanup options — recovered 8 GB. Ran DISM /Online /Cleanup-Image /StartComponentCleanup /ResetBase — recovered 4 GB. Installed PatchCleaner — identified 115 GB orphaned installers. Safely removed. Final state: 138 GB free (41% utilization). Workstation responsive.
Note 3 (Resolution): RESOLVED. Root cause: Orphaned Windows Installer patches accumulated over years of software updates. Resolution: PatchCleaner + DISM cleanup recovered 127 GB. Added workstation to 80% disk threshold monitoring. Reference: Ticket 1121433 — same root cause contributed to .NET installer failures.

Example B — Well-Documented Escalation

Ticket 1117316 — [Client]
Subject: Workstation login delay — 5 min black screen — user profile — [Username]
Note (T1 Escalation): User reports 5-minute black screen after login. Other users log in normally on the same workstation.
Tested: New local profile → logs in 15 seconds. Deleted cached AD profile, re-logged with same AD account → same 5-min delay. SFC /scannow → no violations. Event Viewer → no errors during delay. gpresult /r → normal GPO processing.
Ruled out: Profile corruption (new profile with same AD account still reproduces). GPO delay (gpresult clean). System file corruption (SFC clean).
Theory: System-level corruption tied to AD account identity, not profile data. New account works; existing account fails even with fresh profile.
Recommended: In-place Windows upgrade per Windows In-Place Upgrade SOP. This has resolved similar patterns where user-specific issues persist across clean profiles.

Document	Relevance
Windows In-Place Upgrade SOP (Dental Environment)	Referenced as resolution in escalation examples
Network Printer GPO Deployment SOP	Referenced in recurring issue/Problem ticket example
PBS Endo Update Config Wipe SOP	Source of detailed resolution example
Cross-Platform Imaging Troubleshooting Decision Tree	Feeds structured diagnostic notes into tickets
Network Assessment Guide & Checklist	On-site assessment documentation feeds into onboarding tickets

14. Document Control

Version	Date	Author	Changes
1.0	February 2026	IT Support Engineering	Initial release. Establishes ticket documentation standard, HALO field-by-field guide, note templates, escalation checklist, resolution format, priority matrix, status workflow, and searchability standards. Includes real-world examples from DTC HALO tickets.

Confidential — Internal Use Only