Brand New PC/Laptop - Recommended Actions - Best Practice

Hello,

Asking the eleven forums community for help with the following:

Updated, comprehenisve guidance - on best practice on prepping a new laptop/pc from first power up, to a 'ready-to use' state.

I have a tendency towards having local accounts over online MS account login (primarily).

Due to the digital markets act - I tend to put country as IRELAND.

Make sure the bit locker key is recorded.

Full windows updates.

Local account & admin users set up.

Driver updates directly from manufacturer.


I have a tendency towards security and privacy.

I like to keep the machine lean & responsive.

I would hope to open a discussion on the different approaches and levels of locking down, that people use for themselves.

With Thanks,

KD

@KingDing


FIRST thing to do is make a full backup.


That way, if you mess something up, you can just restore from the backup.

For HP it's best to have the most up to date on board hardware diagnostics so that troubleshooting can be performed despite the status of Windows.

HP PC Hardware Diagnostics UEFI – v10.8.1.0




Also useful is the HP Support Assistant:

@KingDing

Before doing Anything with the laptop take a complete copy of its internal hard disk(s) using a stand alone program so if any problems you can restore it to its shop state if you need to RMA it. Absolutely true what others have said but you need 2 backups -- this one first and then the next one AFTER the initial setup.

(Most people do the one of the initial set up but forget or fail to do the initial one).

Then you can go through its set up routine and when its ready make another image copy - you might need this for any special drivers etc.

Finally install the software of your choice -- will ususlly be a lot less bloated than the original - certainly won't be riddled with trial software etc etc-- and update using the driver software from your backup if necessary.

Now enjoy !!!

Cheers
jimbo

My wife bought a 10th generation HP 250 laptop (Intel 13th generation CPU, 16GB RAM), and I wanted to clean install Windows 11. So I booted from my Windows 11 USB flash drive, wiped the disk and proceeded. I noticed that there were a lot of drivers missing, including WiFi, so if I didn't use the bypassNRO workaround to create a local account, I would not be able to even complete the initial configuration (OOBE). Thankfully I had access to my own computer and downloaded all drivers directly from HP. I first upgraded the BIOS and then proceeded to install the drivers. So my advice is to always make sure you download all the drivers in advance and upgrade the BIOS for best compatibility and performance before installing anything else.

KingDing said:

Hello,

Asking the eleven forums community for help with the following:

Updated, comprehenisve guidance - on best practice on prepping a new laptop/pc from first power up, to a 'ready-to use' state.

I have a tendency towards having local accounts over online MS account login (primarily).

Due to the digital markets act - I tend to put country as IRELAND.

Make sure the bit locker key is recorded.

Full windows updates.

Local account & admin users set up.

Driver updates directly from manufacturer.


I have a tendency towards security and privacy.

I like to keep the machine lean & responsive.

I would hope to open a discussion on the different approaches and levels of locking down, that people use for themselves.

With Thanks,

KD

Click to expand...

As others say, once through the out of box experience and on the desktop - make a system image. In case you ever need to restore the original factory settings in future. EDIT - before you do that you need to turn off "Device Encryption" - so you can restore your image in future!

After that - this is my list of things to do (linked below) (it says for a clean install but it's similar). In addition to that you may have various preinstalled manufacturer softwares aka bloatware that you want to uninstall. It might not be much to uninstall. If it is a lot then some people would just clean install Windows 11. But there may some preinstalled stuff you want to keep. If you did decide to do a clean install, then it's a good idea to backup all the installed drivers first (this is quick and easy with a small program called double driver).

Assuming you don't want to do a clean install, I would at least uninstall any preinstalled antivirus (McAffee etc) - and if you have a list of other programs you're not sure about you could post them here so we can say whether they might be needed, useful, or a problem.

But for Windows itself - there are a lot of settings to check - depending on whether you're bothered about ads, pop ups and things running in the background - so this is my settings list:

@KingDing I use multiple programs that help block telemetry, immunize against known malware websites,
help against unwanted data collecting/polling/etc.

It also helps in better performance. They also block known malware websites by modifying the HOSTS file which is helpfule as it creates loopbacks on bad websites so they are UNABLE to be reached with or without your knowledge
here's just a smidgen of examples:
127.0.0.1 virus-alert-center.com
127.0.0.1 virus-begone.com
127.0.0.1 virusburst.com
127.0.0.1 viruscrusher.com
127.0.0.1 virusdifesa.com
127.0.0.1 virusforsvar.com

I recommend installing SuperAntispyware,

Spybot Anti-Beacon

Spybot Search & Destroy,
Immunizing your PC and creating a WHITELIST.


O&O ShutUp10++

I've never had a BSOD in Windows 11, have not had a bunch of unwanted programs or ads in Windows 11 that I've heard some in the Forums mention.
I've have had rock-solid performance.

Also, for browser I recommend Adblock Plus (ABP), Ublock Origin, Privacy Badger, in browser settings turn off third-party cookies.

That's a start. Hopefully it is helpful for you in some way.

I forgot to mention that after clean install Windows 11 on my wife's new laptop (see my previous post), my first thought was to check BitLocker and unlock and decrypt the SSD. This is because version 24H2 and 25H2 automatically encrypt the drive. However, since I created a local account, BitLocker was disabled by default, thanks God.

Whether you end up using a Local Account does not matter as you can easily change once up and running.
I always specify Home editions as BitLocker is not enabled.

The OOBE is important as there are scores of ticked boxes that need to be unticked, read the descriptions carefully. Covers two of your points, security & privacy/lean and mean.

Initial hardware checks, preferably before connecting to the internet. Look in Device Manager, maybe note the specific bits of hardware.
a) Do you actually have the hardware as ordered.
b) Pixel check for Display Panel on Laptops.
c) Check SSD to see how they have partitioned it and whether there is a manufacturers Media recovery partition, or you have to download it.

Once connected to internet, download Windows updates, configure manufacturers updating App. That is where virtually all your system updates come from.
Download and keep manufacturers Recovery media. In time that is less useful as it will be the version of Windows supplied at purchase time.

Pre-installed Apps, usually an AV and a version of MS Office, configure and use until the trial ends and then uninstall them.

To keep lean and mean, consider carefully every App you install, and when you do configure the settings. It is a continuous process over years and you can expect to remain lean and mean for over 10 years.