New laptop provisioning: the one setup that never happens twice

Every new laptop in a small office gets set up by a different person, on a different day, with a different idea of what "ready" means — and then it serves for four years with whatever the first hour left out. The machine that never got disk encryption, the one where everyone knows the admin password because the admin account is the daily account, the one that was never enrolled for remote wipe and then went through an airport. Provisioning is the moment to fix all of it, because it is the only moment the machine is empty: one standard build, from a one-page sheet, before the new hire's first login. About ninety minutes for the first laptop, sixty for every one after.

1. Write the build sheet before the laptop arrives (30 minutes)

The build sheet is the whole program: one page, versioned, dated. OS version you standardize on, the approved app list, the four non-negotiable settings (disk encryption, screen lock, firewall, automatic updates), the naming convention, and where the recovery key and asset row go. A laptop provisioned from the sheet matches the last one; a laptop provisioned from memory matches nothing.
Keep the app list boring and sourced. Every entry names its official download source — vendor site or the OS package manager, never "the installer Sarah has on her desktop". Browsers, office suite, video meetings, the password manager, the VPN client, the PDF reader. Everything else gets added to the list first, installed second; that list is the same one the software license register counts seats from.
Decide the exceptions on paper too. Developers need a different build (dev tools, admin rights on a separate machine or a sanctioned exception), contractors get the contractor build with the extra line: nothing syncs to a personal account. The sheet has two variants or it has a lie.

2. Disk encryption on before the first login

Enable FileVault or BitLocker before data exists, not "next week". Encryption on an empty machine takes minutes and no decisions; encryption on a laptop full of client files takes an afternoon and a migration. The moment of enablement is the one thing the build sheet gets to demand in capital letters.
Verify it from the console, not the checkbox. fdesetup status on the Mac, manage-bde -status on Windows — the setting that says "on" and the volume that says "encrypted" are different claims, and only the second one protects the disk. Screenshot the output into the asset row; the cyber insurance application asks for exactly this and a dated screenshot answers it.
Escrow the recovery key the same hour. A recovery key that lives only on the laptop it unlocks is a decoration. It goes into the password manager vault or the key escrow routine, labeled with the asset name — and the escrow entry is what the lost laptop runbook and the "I forgot my password" morning both reach for.

3. Two accounts: the human and the admin

Daily work runs on a standard account; the admin account exists but is not the daily one. The single-account laptop means every click-to-run installer, every browser extension, every "urgent update" runs with the keys to the machine. The build sheet creates name (standard) and name-admin (local admin, its own long password in the password manager), and the human enters the admin password a few times a month, not constantly.
This is the control auditors ask about by name. "Do end users run with local admin rights?" appears on the enterprise security questionnaire and in the annual review. "No, by default — here's the build sheet" is an answer; "usually, it's easier" is a finding.
The break-glass rule holds on laptops too. One documented local admin per machine, credentials in the vault, and a note of which three accounts are on the machine. The break-glass checklist covers the org-level account; the laptop's local admin is its small sibling and gets the same paper trail.

4. Enrollment is the wipe button — install it while the machine is open

Enroll the laptop in whatever does remote lock and wipe. Apple Business/Finder's activation lock and Find My, Microsoft Intune or InTune-lite via Microsoft 365 Business, or a third-party MDM if that is what the tenant runs. The lost laptop runbook is a wish without it: the first hour of a lost laptop is "revoke sessions and mark it", and remote wipe is the only step that reaches the disk.
Test the enforcement, not the checkbox. Open the management console, find the machine, confirm it checks in (last-seen timestamp today), and confirm a screen-lock command actually reaches it. Enrollment that says "pending" is the same as absent; the console's last check-in line is the receipt.
Screen lock is a setting and a habit. Five minutes to lock, password required immediately on wake, and the owner's first-week note that closing the lid is the culture. The machine protects itself only when it is locked; the provisioning pass sets it so the habit has something to stand on.

5. First-boot pass: updates, restart, firewall, and the receipts

Update to current before the handover, not the new hire's first morning. OS updates, the browser, the app set — a fresh machine is often one or two point releases behind the fixes. The update pass ends with one restart, because the update that says "restart required" never applied the patch it promised.
Firewall on, file sharing off, and the default apps chosen once. The laptop's firewall on (Windows it defaults on; macOS it defaults off — check), no shares, the password manager as the default password filler and the default browser set. Ten decisions made once, instead of ten people making them differently.
Back up the settings, not just the sheet. A screenshot of the finished settings pages into the asset row costs thirty seconds and settles every "was it ever on?" argument later — including the one the breach first-24-hours review asks.

6. Name it, register it, hand it over

Hostname convention, chosen once: something like lap-initials-year (lap-hq-26). The name appears in the MDM console, the Wi-Fi list, and the asset register, and a machine called "John's MacBook Air" is unfindable in all three. Rename before enrollment so the console shows the real name from day one.
The asset row is born with the machine, not remembered later. One line in the asset inventory on day one: make, serial, hostname, assignee, purchase date, build-sheet version, warranty end. Machines added at audit time are the ones nobody can say who has.
Handover is a 20-minute acceptance test with the new owner present. Walk the sheet together: encryption status on screen, the two accounts demonstrated, lock timeout shown, one app opened from the approved list, the password manager signed in. The new hire signs the row; the signature is what makes the next audit thirty minutes instead of an afternoon — the same receipt logic the file permission audit runs on.

7. Keep the build honest: quarterly drift check

Once a quarter, diff the fleet against the sheet. The MDM or inventory console lists every laptop; the check asks three questions per machine: encrypted (verified, not assumed), enrolled and checking in, and still on the current build-sheet version. Anything that fails gets re-provisioned or explicitly accepted in writing.
The sheet itself gets versioned like code. When a real laptop needed something the sheet did not have, the sheet gains the line — otherwise the next machine repeats the exception and the exception becomes the standard. The change management checklist is one row for this: what changed in the build, why, when.
Offboarding closes the loop the provisioning opened. The offboarding checklist returns the machine; the provisioning row is what receives it: wipe or re-image against the current sheet, keys rotated where the machine held them, and back to available — not "in a drawer with everything still on it".

Small-team honesty note: the first laptop you provision this way will take ninety minutes and feel like ceremony. The second takes an hour, the third forty minutes, and by the fourth the sheet is quietly paying for itself — in machines you can wipe remotely, disks you can prove were encrypted, and the day a new hire's laptop is ready before their coffee is. Write the sheet once. Let it earn the rest.