Lab 05 · KCS Article Factory

Turn five resolved tickets into KCS-structured articles with a technical review gate that catches the AI-invented registry step before it publishes, audit a 30-article KB for stale, duplicate and contradictory content, and rewrite one article so a chatbot can actually retrieve it.

Arjun is the L2 engineer an MSP desk in Pune leans on when tickets reopen — and tickets reopen because the KB is a graveyard. His account just switched on AI article generation, and in the first week it produced more articles than the desk wrote in the previous quarter. It also produced, buried in a confident-looking draft, a registry edit that no engineer ever performed. This lab is the discipline that makes the article factory safe: generate fast, review like the fix depends on it, and audit the KB the articles land in.

The trap in this lab is not subtle once you know to look. One of the drafts you will review contains a resolution step that appears nowhere in the ticket's work log — the AI invented it to make the article feel complete. If that article publishes, the next engineer performs an unnecessary registry edit on a user's machine, and the chatbot built on this KB in lab-11 will recite the invention with a citation. Catch it here.

Time & tier

~75 minutes hands-on · Core tier (maps to module M3). $0 — any free AI chat (ChatGPT, Claude, Gemini, Copilot) plus a text editor. No KB platform required; everything works in markdown files.

Setup

Save the block below as resolved-tickets.txt. These are close-out work logs exactly as engineers wrote them — terse, unordered, and in two cases incomplete. That messiness is the point: it is what the AI must work from.

TKT-2201 | Outlook prompts for password repeatedly (Win11, M365)
Worklog: user hit password prompt loop after mobile number change.
Opened Credential Manager, removed all entries under
"MicrosoftOffice16_Data" and "MicrosoftAccount". Restarted Outlook,
signed in fresh, MFA re-registered. Confirmed no prompt for 2 hrs.

TKT-2202 | Mapped drive H: missing after login (Win11, DFS)
Worklog: GPO drive-map applied but drive absent. gpresult showed the
mapping filtered out - user moved to new OU last week, security group
GG-Ops-Home not carried over. Re-added user to GG-Ops-Home, gpupdate
/force, logoff/logon, drive present. NOT a DFS issue.

TKT-2203 | Teams mic not working, works in Zoom (Win11)
Worklog: privacy settings blocked desktop apps from mic after 24H2
update. Settings > Privacy & security > Microphone > enabled
"Let desktop apps access your microphone". Verified in Teams test call.

TKT-2204 | Excel month-end add-in shows disabled (M365, FinCorp add-in)
Worklog: add-in in Disabled Items after a crash. File > Options >
Add-ins > Manage: Disabled Items > re-enabled FinCorpXL. Also raised
COM add-in LoadBehavior back to 3. Told user to close Excel gently
during month-end, not End Task.

TKT-2205 | Fixed the VPN thing for R.Saxena
Worklog: sorted. token reset. ok now.

Save the next block as teammate-draft.md. A colleague already ran TKT-2201 through the account's AI and wants to publish this draft. You are the technical review gate.

TITLE: Outlook Repeatedly Prompts for Password (Microsoft 365)
ISSUE: Outlook continuously prompts for credentials and does not
accept a valid password.
ENVIRONMENT: Windows 11, Microsoft 365 Apps, Outlook desktop.
CAUSE: Corrupted cached credentials after an MFA method change.
RESOLUTION:
1. Open Credential Manager and remove all entries beginning with
   "MicrosoftOffice16_Data" and "MicrosoftAccount".
2. Open Registry Editor and navigate to
   HKCU\Software\Microsoft\Office\16.0\Common\Identity and set
   DisableADALatopWAMOverride to 1 to force legacy authentication.
3. Restart the Netlogon service.
4. Restart Outlook and sign in; complete MFA re-registration.
VERIFICATION: No credential prompt recurs within two hours of use.

Save the final block as kb-audit-sheet.csv — the account's 30-article KB index with usage and reopen data.

id,title,last_reviewed,views_90d,reopen_rate_pct
KB-1001,Reset your Windows password via self-service,2026-03,412,2
KB-1002,Set up Outlook on Android,2025-11,168,4
KB-1003,Request software via the portal,2026-01,240,1
KB-1004,Outlook keeps asking for password,2024-06,310,9
KB-1005,Connect to office Wi-Fi,2025-09,95,2
KB-1006,Set an out-of-office reply,2026-02,150,0
KB-1007,Fix slow logins on Windows 7 machines,2019-08,3,0
KB-1008,Book a meeting room in Outlook,2025-12,88,1
KB-1009,Disable IPv6 to fix VPN connection issues,2022-02,120,18
KB-1010,Share a calendar with a colleague,2026-01,74,2
KB-1011,Clear Teams cache to fix sign-in issues,2025-10,201,6
KB-1012,Request access to a shared drive,2026-04,330,3
KB-1013,Enable TLS 1.0 in Internet Explorer for the HR portal,2020-05,7,0
KB-1014,Set up MFA on a new phone,2026-05,388,5
KB-1015,Printer shows offline - first checks,2025-08,140,7
KB-1016,Encrypt an email in Outlook,2025-07,42,1
KB-1017,Restore a missing mapped drive,2024-12,265,22
KB-1018,Update your directory profile photo,2025-06,55,0
KB-1019,VPN error 809 - firewall checks,2025-11,178,8
KB-1020,Recall a sent email,2026-02,132,3
KB-1021,Outlook password prompt loop after MFA change,2025-09,244,4
KB-1022,Report a phishing email,2026-05,290,1
KB-1023,Excel add-ins disabled after crash,2026-03,118,5
KB-1024,Set default printer on Windows 11,2025-10,101,3
KB-1025,Request a loaner laptop,2026-01,66,2
KB-1026,Keep IPv6 enabled - required for Always On VPN,2025-12,61,4
KB-1027,Fix OneDrive sync pause,2025-11,187,6
KB-1028,Change your desk phone voicemail PIN,2023-01,9,0
KB-1029,Access the legacy AS400 terminal,2021-07,5,0
KB-1030,Whitelist a sender in Outlook,2025-08,93,2

Guided steps

Generate the five articles. Paste resolved-tickets.txt into your AI with: "For each ticket, draft a KCS-structured article with TITLE, ISSUE (in the user's words), ENVIRONMENT, CAUSE, RESOLUTION (numbered steps), VERIFICATION. Use only facts present in the work log. If the work log is too thin to support an article, say so instead of drafting one." Save the output as articles-draft.md.
Run the review gate on your own drafts. For each article, walk the RESOLUTION steps against the original work log line by line. Every step must trace to something an engineer actually did. Mark each step [traced] or [invented] in the margin. Expected output: TKT-2205 should have produced a refusal or a visibly unusable stub — "sorted. token reset. ok now." cannot support an article. If the AI drafted a confident article for it anyway, that is your first caught error: log it.
Review the teammate's draft. Now apply the same trace to teammate-draft.md against TKT-2201's work log. At least two resolution steps have no basis in the ticket. Record each in caught-errors.md as: step · why it is invented · what it would do to the next user's machine. Do not fix the draft yet — the log entry comes first, because the log is what proves the gate exists.
Correct and publish. Rewrite the teammate's draft with invented steps removed, and finalize your four viable articles. For TKT-2205, write the ticket-quality feedback you would send R.Saxena's engineer instead of an article.
Audit the KB sheet with AI, then verify. Paste kb-audit-sheet.csv with: "Flag candidates in three buckets: stale (content likely obsolete), duplicate (two articles covering one issue), contradictory (two articles giving opposing guidance). Give reasons." Then verify every flag yourself against the titles and dates — the AI proposes, you confirm. Expected output: an kb-audit.md sheet with a confirmed bucket for each flagged article and at least one AI flag you rejected as wrong.
Follow the reopen signal. Sort the sheet by reopen_rate_pct. Anything above ~15% is an article whose documented fix probably does not work. Identify the two worst offenders and write one line each on what the reopen rate implies — this is the honest signal no title-only audit catches.
Rewrite one article retrieval-friendly. Take KB-1021 (or your corrected TKT-2201 article — they cover the same issue, which you should have caught in step 5). Rewrite it with: a title in user vocabulary ("Outlook keeps asking for my password"), a synonym line (credential prompt, password loop, sign-in popup, authentication box), and short self-contained sections under descriptive headings so a RAG chunker can split it cleanly. Save as kb-rewrite.md.
Test findability like a user. Ask your AI, with only the rewritten article pasted as context: "My email password box keeps popping up, what do I do?" — pure user vocabulary, no technical terms. The answer should ground entirely in your article. If the AI reaches past it, your synonym coverage is thin; iterate once.

Warning

The failure mode this lab breaks is publish-on-plausibility. An invented step in a KB article does not look like an error — it looks like thoroughness. The only defense is tracing every resolution step back to what was actually done, every time, before publish.

Verify

articles-draft.md contains four full KCS articles and a refusal or flagged stub for TKT-2205.
caught-errors.md names every invented step in the teammate's draft with its consequence for the next user.
The corrected TKT-2201 article contains only steps traceable to the work log.
kb-audit.md places confirmed articles in stale / duplicate / contradictory buckets, and records at least one rejected AI flag with a reason.
The two highest-reopen articles are identified with a one-line implication each.
kb-rewrite.md has a user-vocabulary title, an explicit synonym line, and chunk-friendly sections — and passed the findability test in user vocabulary.

Self-grading rubric (pass = 7/10): all invented steps in the teammate's draft caught (0–3) · TKT-2205 handled as unpublishable (0–1) · audit buckets correct with the contradiction found (0–3) · reopen-rate insight articulated (0–1) · rewrite passes the user-vocabulary retrieval test (0–2).

▸Answer key — open only after your caught-errors log and audit sheet are writtenoptional deep dive — click to expand

Invented steps in the teammate's draft (both must be caught):

Step 2 — the registry edit.DisableADALatopWAMOverride appears nowhere in TKT-2201's work log. The engineer removed Credential Manager entries and re-signed in; no registry change was made. Worse, this specific value forces legacy authentication behavior — publishing it would have engineers switching users away from modern auth to "fix" a problem the credential cache caused, creating new MFA and conditional-access failures. This is the classic AI invention: a real-sounding, real-syntax step imported from training data, not from the ticket.
Step 3 — "Restart the Netlogon service." Also absent from the work log, and irrelevant to an M365 credential prompt on a workstation. Harmless-looking filler that trains engineers to perform cargo-cult steps.

TKT-2205: "sorted. token reset. ok now." supports no article — no symptom detail, no environment, no verifiable steps. Correct handling is a refusal plus feedback to the engineer; an AI that confidently drafted "VPN Token Reset Procedure" from it fabricated the entire resolution.

KB audit expected findings: Stale — KB-1007 (Windows 7), KB-1013 (TLS 1.0 / Internet Explorer, actively harmful advice), KB-1028 and KB-1029 (near-zero views, legacy systems; verify before deleting AS400 if the terminal still exists — a defensible audit flags, then confirms ownership). Duplicates — KB-1004 and KB-1021 cover the same Outlook prompt loop; merge into the newer, keep one URL. Contradictory — KB-1009 ("Disable IPv6 to fix VPN") vs KB-1026 ("Keep IPv6 enabled — required for Always On VPN"): direct opposition, and KB-1009's 18% reopen rate says its advice fails; retire KB-1009. A reasonable rejected-flag example: an AI often marks KB-1002 (2025-11) stale on date alone — Android Outlook setup is likely still valid; verifying and rejecting that flag is the auditor behavior this lab wants.

Reopen offenders: KB-1017 (22%) — a mapped-drive "fix" that does not persist, exactly the class of issue TKT-2202 exposed (group membership, not drive mapping); KB-1009 (18%) — see above.

Scoring: registry step caught = 2 · Netlogon step caught = 1 · TKT-2205 refused = 1 · contradiction pair found = 2 · duplicates merged = 1 · reopen insight = 1 · rewrite passes user-vocab test = 2. 8+/10 means your review gate holds.

Key Takeaway:

The article factory is only as safe as its review gate — every resolution step must trace to something an engineer actually did, because an invented step published today becomes a chatbot's confident citation tomorrow.

© Anvi Innovate · BXUP — Be Exponentially Upskilled · BXUP is an independent learning platform, not affiliated with or endorsed by AWS, Microsoft, Google, NVIDIA, IBM, Salesforce, Databricks, Oracle or Anthropic. All trademarks belong to their respective owners. · bxup.in