A new laptop arrives configured to make setup frictionless, not to make it safe. Between unboxing and the first real login, most people join whatever network is closest, sign into personal accounts, and click through prompts that quietly enable things they would not have chosen. That window is the best time to harden the machine, because nothing sensitive is on it yet and every default is still changeable. The sequence below covers ten steps and takes about an hour, ordered so each one protects the next.

1. Inspect the Machine Before You Power It On

Start offline. Unless the installer forces you online, leave Wi-Fi disconnected during the first boot. Windows 11 Home pushes hard toward an online account, while macOS and most Linux installers let you finish setup locally. Staying disconnected means no sync, no updates, and no account creation happen before you have made any decisions.

Check the hardware while you are still calm about it: tamper seals intact, packaging unremarkable, and the serial number on the case matching the invoice. Then open the firmware setup screen — usually F2, F10, Del, or Esc at power-on — and look for a supervisor password you did not set, a boot order you did not choose, or Secure Boot switched off. On a refurbished or second-hand machine, an unknown firmware password is a reason to send it back, not a puzzle to solve.

2. Separate the Administrator Account From Daily Use

The account you use every day should not be the one that can install software, change security settings, or switch off the firewall. Windows makes the first account you create an administrator; keep it for maintenance and recovery, then add a standard user for actual work. macOS lets you create a standard account in System Settings, and on Linux the first user usually lands in the sudo group unless you separate the roles yourself.

Give the administrator account a long, unique passphrase and store it in a password manager. Set the screen to lock after a short idle period, require the password immediately after sleep, and disable automatic login. In a small business, do not let a shared admin login float between employees: record who holds it and rotate the credentials when someone leaves.

3. Patch Firmware and the Operating System

Connect to a network you control — your own router, the office, or a phone hotspot. Hotel and café Wi-Fi can wait until the machine is fully patched.

Update the firmware first. UEFI and BIOS updates address flaws that sit below anything an antivirus can see, and they are easiest to apply on a laptop with nothing on it. Use the manufacturer's own support page or update utility rather than a third-party driver tool. Then run operating system updates repeatedly until nothing remains, rebooting when asked instead of postponing.

Skip the add-on utilities

Do not install system optimizers, registry cleaners, or third-party driver updaters. They add privilege and failure modes without solving anything the operating system does not already handle. The same applies to the security trial that shipped preinstalled: keep one protection tool — ideally the one built into the OS or mandated by your IT policy — not three competing ones.

4. Turn On Full-Disk Encryption

Encryption is what stops a stolen laptop from becoming a data breach. Windows offers BitLocker on Pro and Enterprise editions and Device Encryption on many Home machines; macOS uses FileVault; Linux typically encrypts with LUKS during installation. Enable it now, while the drive holds nothing you would miss.

Encryption protects a laptop that is switched off. Updates protect one that is switched on.

Then treat the recovery key like the only copy of something valuable. Save it in your password manager, print one copy, and store it where you would actually look during a bad week. For business machines, keep the key in company records alongside the device serial number. Without that key, encryption is permanent loss rather than temporary inconvenience. Confirm the status reads as protected — "waiting for activation" is not the same thing.

5. Cut the Attack Surface

Defaults exist for convenience, and convenience is the opposite of a small attack surface. Work through this list in the settings and firmware menus:

1. Turn the firewall on for every network profile and leave it there.
2. In firmware: enable Secure Boot, set a supervisor password, and disable booting from USB or external media.
3. Remove preinstalled software you cannot name a use for — trial security suites, coupon tools, vendor assistants, bundled games.
4. Turn off features you do not use: remote desktop, file and printer sharing, SMBv1, Wake-on-LAN, nearby sharing, and Bluetooth when idle.
5. Review privacy settings and set them to what you are comfortable with instead of accepting the default.
6. Disable the guest account, disable auto-login, and require a password on wake.

6. Credentials, Browsing, and Backups

Set up a password manager before you sign into anything else. Generate unique passwords, and replace reused ones as you encounter them. Turn on two-factor authentication wherever it is offered; an authenticator app or a hardware key is stronger than SMS, though SMS beats nothing.

For browsing, pick one mainstream browser and keep it current. Install extensions deliberately — if you cannot explain what an extension does, remove it. Turn on DNS-over-HTTPS with a resolver you trust, block third-party cookies, and avoid letting the browser store passwords if your manager already does that job.

Then set up backups before you need them: one copy on an external drive, one copy stored elsewhere, and a restore you have actually tested. For a small business, add an asset record with the serial number, assigned user, encryption key location, purchase and warranty dates, and who to contact if the machine disappears. If you handle client data or operate under a regulatory scheme, check with someone who understands your obligations before deciding that encryption and backups alone are sufficient.

The Habit Behind the Checklist

Ten steps, once, is the easy part. What holds up over time are habits: install updates when they appear rather than tapping "remind me later", work from the standard account, lock the screen when you walk away, and never keep the recovery key in the laptop bag next to the laptop.

Put a recurring reminder in your calendar — quarterly is enough — to check firmware updates, confirm backups are running, review who has access to what, and uninstall software you have stopped using. If you only complete three items from this list, make them these: turn on disk encryption, keep the system patched, and keep your daily account separate from the administrator. Everything else becomes far easier once those three are in place.

Photo: Anna Keibalo / Pexels