Set Up a New Work Laptop Securely on Day One

TL;DR — On day one, your work laptop should be enrolled in your company’s device management, fully updated, protected by disk encryption, and reporting into your endpoint security tool. If you only do one thing first, complete company sign-in and device enrollment before installing personal apps or copying files. Reading time: ~5 min

Goal

When you finish, your laptop signs in with your work account, appears in your company’s device management and endpoint security tools, has full-disk encryption (storage protection if the laptop is lost) turned on, has current operating system updates installed, and is protected by a screen lock and multi-factor authentication (MFA, a second sign-in check).

Prerequisites

• Your new work laptop and its charger
• A stable internet connection
• Your work email address and password
• Your MFA method ready: authenticator app, security key, or phone
• The enrollment instructions from your employer, if they sent a device management link or QR code
• Local admin access only if your company told you to use it; otherwise use your normal work sign-in
• For Windows: Windows 11 Pro or Enterprise — check in Settings → System → About
• For macOS: macOS 14 or later — check in Apple menu → About This Mac
• 30-60 minutes with the laptop plugged into power

Steps

Step 1: Connect to the internet and sign in with your work account

On first boot, follow the setup assistant and choose your company sign-in when prompted.

For Windows, use: Settings → Accounts → Access work or school → Connect

For macOS, use the company-provided enrollment flow during setup, or if you are already on the desktop: System Settings → Privacy & Security → Profiles

If your company gave you a web enrollment link, open that exact link in the browser and sign in with your work account.

What you should see when this succeeds: your work account appears under Access work or school on Windows, or a company management profile appears under Profiles on macOS.

Step 2: Complete device enrollment in company management

This step registers the laptop in your company’s MDM (mobile device management, the tool that applies security settings to laptops and phones).

In your provider’s dashboard or enrollment portal, use the exact enrollment option your employer sent. Common paths are:

• Windows: Settings → Accounts → Access work or school → <your work account> → Info
• macOS: System Settings → Privacy & Security → Profiles → Install

If the portal asks to download a profile or management agent, install it and approve the prompts exactly as shown.

What you should see when this succeeds: the device status changes to enrolled/managed in the company portal, or the laptop shows “This device is managed by your organization.”

Step 3: Turn on full-disk encryption

⚠️ Do not skip the recovery key step. If the laptop has a hardware issue later, the recovery key may be the only way to unlock your data.

For Windows, go to: Settings → Privacy & security → Device encryption → Device encryption: On

If you do not see Device encryption, try: Control Panel → System and Security → BitLocker Drive Encryption → Turn on BitLocker

For macOS, go to: System Settings → Privacy & Security → FileVault → Turn On

When prompted, choose the company-managed recovery option if offered. If you are shown a recovery key, store it only where your employer instructed, not in personal notes or email.

What you should see when this succeeds: Windows shows Device encryption: On or BitLocker shows the system drive as encrypted; macOS shows FileVault is turned on for the disk.

Step 4: Install all operating system updates

For Windows, go to: Settings → Windows Update → Check for updates → Download & install all

Restart when prompted, then return to: Settings → Windows Update → Check for updates

Repeat until the page says the device is up to date.

For macOS, go to: System Settings → General → Software Update → Update Now

Restart when prompted, then check the same page again.

What you should see when this succeeds: the update page says the laptop is up to date and shows today’s check time.

Step 5: Confirm endpoint protection is installed and active

This is the EDR (endpoint detection and response, software that watches for malware and suspicious activity) step.

First, check the company portal or the app list for the security agent your employer uses. If they gave you an installer, run that exact installer and sign in if prompted.

Then verify locally:

• Windows: Settings → Privacy & security → Windows Security → Open Windows Security → Virus & threat protection
• macOS: System Settings → General → Login Items & Extensions and Privacy & Security for any security approvals the agent requests

If your company uses a web dashboard, open it and confirm the device appears as active/healthy.

What you should see when this succeeds: the security app shows protection is on, and the company security portal lists the device as online or healthy.

Step 6: Set a strong screen lock and short auto-lock timer

For Windows, go to: Settings → Accounts → Sign-in options

Set:

• Password or Windows Hello if your company allows it
• Additional settings → If you've been away, when should Windows require you to sign in again? → Every Time

Then go to: Settings → Personalization → Lock screen → Screen saver → On resume, display logon screen

For macOS, go to: System Settings → Lock Screen

Set:

• Require password after screen saver begins or display is turned off → Immediately
• Start Screen Saver when inactive → 5 minutes or your company standard
• Turn display off on battery when inactive → 5 minutes

What you should see when this succeeds: locking the screen requires your password, PIN, or approved biometric sign-in immediately.

Step 7: Install only approved work apps and restore files safely

Use your company’s app portal if they have one. Otherwise install only the apps your employer told you to use: browser, office suite, VPN, chat, password manager, and any required business tools.

Do not copy files from an old personal laptop with a USB drive unless your employer approved that method. Prefer company cloud storage or the migration method they provided.

What you should see when this succeeds: required work apps open normally, and company files sync from approved storage without security warnings.

[Work Account]
      |
      | 1. sign in + MFA
      v
[Managed Laptop] ---- 2. enroll ----> [MDM]
      |
      | 3. report health
      v
[EDR Agent] ---- 4. status ----> [Security Console]

Verify it works

Run these checks end to end:

1. Device management check

• Windows: Settings → Accounts → Access work or school and confirm your work account is connected
• macOS: System Settings → Privacy & Security → Profiles and confirm the company profile is present

1. Encryption check

• Windows: Settings → Privacy & security → Device encryption and confirm it says On
• macOS: System Settings → Privacy & Security → FileVault and confirm it says On

1. Update check

• Open the OS update page again and confirm it says the laptop is up to date

1. Endpoint protection check

• Open the security app or company security portal and confirm the device status is Healthy, Protected, or Online

1. Screen lock check

• Lock the laptop manually:
  • Windows: Start → profile icon → Lock
  • macOS: Apple menu → Lock Screen
• Unlock it and confirm it requires your approved sign-in method

Expected result: all five checks pass, and the company portal shows the laptop as managed and protected.

Common pitfalls

The laptop was set up with a personal account first

Mistake: signing into Windows or macOS with a personal Microsoft account or Apple ID before company enrollment.

Symptom: the device does not appear in the company portal, or company apps keep asking to enroll.

Fix: add the work account through Settings → Accounts → Access work or school → Connect on Windows, or install the company profile in System Settings → Privacy & Security → Profiles on macOS.

Encryption was started but the recovery key was not stored correctly

Mistake: clicking through BitLocker or FileVault without following the company recovery-key instructions.

Symptom: later recovery prompts cannot be completed, and support has no key on file.

Fix: stop and confirm where your employer wants the recovery key stored before proceeding; if already completed incorrectly, contact your internal IT team before reconfiguring encryption.

Updates were checked only once

Mistake: running one update pass and stopping after the first restart.

Symptom: the laptop still shows pending updates, missing drivers, or repeated restart prompts.

Fix: return to the same update page after every restart and run Check for updates again until it says up to date.

The EDR app is installed but missing required approvals

Mistake: on macOS especially, closing the prompts that ask for background access, system extension approval, or full disk access.

Symptom: the security portal shows the device as unhealthy, inactive, or partially protected.

Fix: reopen System Settings → Privacy & Security and approve the pending security prompts for the company security app.

Personal file migration introduced unapproved software

Mistake: copying old apps, browser extensions, or scripts from another machine before enrollment is complete.

Symptom: security alerts appear, or the device is marked non-compliant in the company portal.

Fix: remove the unapproved apps or extensions and install only the software listed by your employer or available in the company app portal.

This article was written by an AI system and published pending human review. Verify anything you intend to act on.