drop ticket priority to rock bottom, circle back hours or days later (whatever your process calls for), confirm if user is still experiencing the issue presently. IMHO, I think its unwise to spend any amount of time investigating apart from a quick glance at the various dashboards readily available (which dont require remoting into the target machine). nothing stands out? sit on ticket, maybe back and forth asking for more specific information adn guidance what to look for, re-confirm later if issue still persists. The goal is to and filter out transient issues. there will ALWAYS be transient issues.

I think the idea I'm getting at here is focusing on answering the question how much time investment is warranted based on specific criteria and metadata available, user ticket history, where are they at on the org chart, etc. I feel like alot of us get tunnel vision on a reported issue looking for a smoking gun that doesnt exist or it did but disappeared never to be found again. I think we can still put more pressure on the user to guide us to the problem and patterns and still provide far superior support than big tech like Microsoft would ever be willing to give us. like, actually reading tickets and previous case notes.