Preparing a standard computer setup for new staff: checklist

Use the same checklist for each new starter: confirm the baseline, add only what the role needs, record exceptions and test readiness before handover. Record what the preparer should see and how each check is verified; a copied configuration alone does not prove readiness.

Define checks someone can verify

Record the baseline version, expected state and check method for each item, and keep results with the device record. Include the supported operating-system version, required updates, individual sign-in, screen lock and protection settings, plus encryption where required.

For protection and patching requirements, consult Australian Cyber Security Centre guidance titled Secure your Microsoft Windows device and Patching applications and operating systems. Record the business requirement and what the preparer should see; check intended settings separately from any device-enrolment record.

Use an ordinary account for the worker’s daily tasks. Reserve administrator access for tasks that require it, and keep those credentials with authorised administrators.

Security & Compliance Metrics for New Devices

Prepare this computer

Match the asset label and serial number to the assignment record. Check the charger and any required dock, adapter or other accessory. For a previously issued computer, follow the business’s reset and reassignment process after arranging for any work records that must be retained.

Confirm that the operating system remains supported and that required updates are installed. An update may fail or wait for a restart, so check its installed state after restarting where necessary. Apply the business’s screen-lock and protection settings; where encryption is required, confirm its state and the authorised recovery route for that device.

If device management is used, enrol the computer through the method supported by that platform and plan. For Windows enrolment in Microsoft Intune, use Settings > Accounts > Access work or school > Connect, then confirm the device appears in the Microsoft Intune admin centre under Devices > All devices. Check the intended settings separately.

Add the role settings and test them

Install approved applications and connect required peripherals. Confirm that the worker’s own account has the resources needed for the role. Record each deviation from the baseline with its reason, approver and review point, alongside the device record.

Before handover, check power, network access and the peripherals the role uses. Have the worker sign in and complete the same representative task chosen for that role; check that the required resources are available and the task can be completed.

Record the results with the device record. Mark anything that cannot yet be checked as pending, with an owner and next action. Keep the baseline version and results there so the next setup uses the current standard.