New Laptop Setup Checklist
A new laptop setup checklist for business machines: encryption, MDM, updates, accounts, backup and handover. Works for Mac and Windows, for one device or fifty.
- Typical schedule per device
- The checklist 4 sections, 19 items
- Variables
{{asset_tag}}{{user_name}}
Use this checklist whenever you prepare a company laptop for a person: a new purchase, a replacement after a failure, or a reused device after someone left. It works for macOS and Windows. Small teams without zero-touch provisioning do most of these steps by hand, which is exactly when steps get missed.
Who owns it
Whoever prepares the device owns the run, usually IT or an office manager. The user confirms the last section at handover. If your MDM does most of the work, keep the checklist anyway and use it to verify that the automation actually did what it should.
Common pitfalls
- Encryption "on" but the key not stored. If FileVault or BitLocker is enabled without escrowing the recovery key in your MDM or a vault, a forgotten password means a lost disk.
- Setting it up under a personal account. Apple IDs, Microsoft accounts and app store purchases made with a personal login are hard to untangle later. Use company accounts or MDM-managed apps.
- The user is a local admin by default. Decide deliberately. Many teams allow it for developers and not for others.
- Skipping updates because it is new. New devices often ship months behind on OS and firmware updates. Patch before handover.
- No asset record. If the serial number is not linked to a person, the device is hard to recover when they leave.
Keep one run per device. The completed run doubles as a record of how that machine was configured.
The checklist: Set up laptop {{asset_tag}} for {{user_name}}
Before you start
-
Serial number, model and purchase date recorded in the asset register as
{{asset_tag}} -
Device registered in your enrolment programme optional
For example Apple Business Manager or Windows Autopilot, so it enrols in MDM on first boot.
-
Reused device was wiped and its previous user removed from the asset record optional
Base configuration
-
Operating system and firmware updated to the latest version
-
Device enrolled in MDM and the company profiles applied
-
Full-disk encryption on, with the recovery key escrowed in MDM or the vault
FileVault on macOS, BitLocker on Windows. Check that the key is actually visible in the console.
-
Firewall enabled and the screen lock set to a short timeout
-
Local admin rights set according to policy for
{{user_name}}'s role -
Device name set to the naming convention, including
{{asset_tag}}
Software
-
Endpoint protection installed and reporting to the console
-
Backup or file sync client installed and signed in
-
Standard apps installed: browser, office suite, chat, password manager
-
Role-specific apps installed optional
-
Automatic updates enabled for the OS and the apps
Accounts and handover
-
{{user_name}}signs in with their company account and enrols MFA -
Email, chat and file sync confirmed working on the device
-
Printer, Wi-Fi and VPN tested optional
-
Asset register updated: assigned to
{{user_name}}with the handover date -
{{user_name}}confirmed receipt and the acceptable use policy
Checklist as Markdown
Frequently asked questions
What should I do first when setting up a new work laptop?
Record the serial number in your asset register, then update the operating system and enrol the device in your MDM. Turn on disk encryption early and store the recovery key centrally. Install apps and sign in only after the base configuration is done.
Do I need an MDM for a small team?
Not strictly, but it pays off quickly once you have more than a handful of devices. An MDM lets you enforce encryption, store recovery keys, push updates and wipe a lost laptop remotely. Without one, use this checklist and verify each security setting by hand.
Should employees have admin rights on their laptops?
It depends on the role and your risk tolerance. Developers often need admin rights to install tools, while most other roles do not. Whatever you choose, make it a written policy and apply it the same way on every device.
Updated