How to build a secure, patched Windows laptop: a build checklist
Endpoint security · 7-min read · Check a version for CVEs → · updated August 2026
A new laptop isn’t secure the moment it powers on — factory images are weeks out of date, unencrypted and unmanaged. A repeatable build process turns each device into a patched, encrypted, managed and consistent endpoint before the user ever logs in. Here are the ten steps — and the one most checklists forget.
The 10-step secure build
Record the device — asset tag, serial, model — and confirm it boots clean. Everything that follows hangs off an accurate inventory.
Install every pending quality and feature update before anything else. A device patched on day one is the single biggest security win in the whole build.
Turn on full-disk encryption and escrow the recovery key (to Azure AD / Intune). A lost or stolen laptop should expose nothing.
Bring the device under management so policy, compliance and updates are enforced centrally — ideally zero-touch via Windows Autopilot.
Deploy the productivity apps, license them, and confirm the user can sign in. Configure OneDrive Known Folder Move so documents back up automatically.
Push your hardened security baseline: firewall on, antivirus/EDR active, Attack Surface Reduction (ASR) rules, and a screen-lock policy. Standardise it so every device is built the same way.
Install the company and role-specific software the user needs — and make sure each one is on a current, supported version, not whatever the installer shipped.
Map printers, network drives and user settings so the device is usable from minute one.
This is the step most checklists skip. "Up to date" is not a one-time tick: your gold image and bundled apps can carry already-vulnerable or end-of-life versions. Check the OS build and each app against known CVEs and EOL dates before sign-off.
Confirm functionality, performance and user sign-in; verify the device reports compliant in Intune; record sign-off. Now it is ready for the user.
Why it matters
| Outcome | What it buys you |
|---|---|
| Better security | Every device encrypted, patched and policy-protected from day one. |
| Faster deployments | Standardised, automated builds save IT and end-user time. |
| Consistent configuration | Every device built the same way — fewer drift bugs and support tickets. |
| Audit-ready | Encryption, baselines and version checks are exactly the evidence frameworks ask for. |
Automate where possible
With Windows Autopilot and Intune, most of the build can run hands-off: zero-touch deployment, automatic app installs, configuration profiles, policy and compliance enforcement, and security baselines. That leaves your team doing what automation can’t — verifying the result and signing it off.
Turn this into action. A new laptop isn’t secure just because it’s switched on. The 10-step build — updates, BitLocker, Intune, baselines — plus the step most checklists miss: proving the versions in your image aren’t already vulnerable or end-of-life.
Check a version for CVEs — free →Frequently asked questions
Why isn’t a new laptop secure out of the box?
Factory images ship weeks or months old: missing OS patches, no disk encryption, no management, default policies and sometimes outdated bundled software. A build process makes every device patched, encrypted, managed and consistent before a user ever touches it.
What does a secure build checklist cover?
At minimum: full Windows updates, BitLocker encryption with key escrow, MDM/Intune enrolment, productivity + line-of-business apps on supported versions, hardened security baselines (firewall, AV/EDR, ASR), backup (OneDrive), and a final compliance and version check before hand-over.
Can the build be automated?
Largely, yes. Windows Autopilot enables zero-touch deployment, and Intune handles app deployment, configuration profiles, policy/compliance enforcement and security baselines — so the human steps shrink to verification and sign-off.
Why check software versions if Windows is already updated?
Windows Update covers the OS and Microsoft apps — not your third-party and line-of-business software, and not whether a component is end-of-life. A "patched" laptop can still ship a browser, runtime or app on a version with a known-exploited CVE, or one the vendor no longer supports. Verify each version explicitly.
How do I stop baking end-of-life software into the image?
Before you standardise a gold image, check every included product against its end-of-life dates. Software that is already unsupported (or about to be) stops getting security fixes — so it becomes a liability on every device you build from that image.
This guide is vendor-neutral and informational, grounded in publicly-available guidance from bodies such as OWASP, NIST and CISA. IsItPatched is independent and not affiliated with them, and this is not legal or compliance advice. See our disclaimer.