IT Onboarding Checklist: Office Laptop Setup in 5 Stages

Setting up an office laptop for a new hire runs in five stages: planning by role, OS and software configuration, security, asset records, and handover. The IT onboarding checklist below turns those five stages into a working order from five days before the start date to the end of week one, ready to copy into your IT team's spreadsheet or ticketing system.

A new employee's first day at the company creates an impression that is hard to undo. A laptop that is already set up — complete with system access, the required software, and a working connection — sends the message that the company is organised and respects its employees' time. A laptop that has not been configured, or worse has not yet arrived, sends the opposite message.

This article guides the entire process of setting up office laptops for a new team: from planning before employees join, through the technical configuration required, to a well-ordered handover. To ensure devices are available on time, make sure the procurement process has been completed using the corporate laptop procurement checklist.

IT Onboarding Checklist for New Employees (Copy-Ready)

An IT onboarding checklist for a new hire has four groups of tasks: preparation before the employee starts, configuration and testing the day before, handover on day one, and follow-up during the first week. Copy the list into a spreadsheet or ticketing system, one row per employee, and tick off each item.

Five to three days before the start date

• Receive the employee's details from HR: name, job title, department, manager, start date and work location (office or remote).
• Choose the configuration profile for the role (see the components-per-profile table further down).
• Allocate a unit: asset number, serial number and specification; if you rent, order the unit from the vendor now.
• Create accounts: email, directory account (Active Directory or Entra ID), groups, communication channels and application licences.
• Get the manager's approval for access: core applications (ERP, CRM, HRIS), shared folders and VPN.
• Prepare accessories: charger, mouse, headset, plus a monitor or dock if the role needs one.

The day before: configure and test

• Update the OS, then join the unit to the domain or enrol it in MDM.
• Install the standard software and the role-specific software, then activate the licences.
• Turn on disk encryption and store the recovery key where the IT team keeps them.
• Make sure the antivirus or endpoint protection is active and reporting to the console.
• Test sign-in with the employee's account: email, chat, VPN and one core application.
• Add the office printers and the Wi-Fi profile.
• Attach the asset label and record the unit in the asset management system.

Day one

• Hand over the unit and sign the handover record; photograph its condition if it is a rented unit.
• The employee changes the temporary password and registers MFA.
• Test together: email, chat and core applications should open within the first 30 minutes.
• Give a 10–15 minute briefing: how to report a problem, the device usage policy and the rules for storing data.

The first week

• Ask which access is still missing; gaps usually surface on day two or three.
• Make sure file sync or backup is running.
• Close the onboarding ticket and record how long it took, so the next round runs faster.

Who does what

This split prevents the two classic onboarding failures: accounts ready but no laptop yet, or a laptop ready but application access still waiting for a manager's approval.

Why Standardised Setup Matters for a Growing Team

A company that is growing and recruiting regularly cannot rely on an improvised setup process for every cycle. Standardised setup delivers three concrete benefits.

First, speed. With a configuration template already prepared, setting up one unit takes far less time than starting from scratch each time. Second, consistency. Every new employee receives a device with an identical configuration, which simplifies technical support — the IT team does not need to guess which configuration is on which unit. Third, security. A standardised security configuration ensures no unit is "accidentally" left without encryption or without antivirus installed.

Stage 1: Planning Before the Employee Joins

Standard onboarding prep timeline: for batches of 5-10 employees, IT needs 3-5 business days lead time from name confirmation → unit ready at desk. For batches of 20-50, lead time rises to 7-12 business days due to bottlenecks in image deployment & software licensing. Add a +2 day buffer for keyboard layout or locale corrections.

Good setup begins not on the day the employee joins, but several days beforehand.

Define a configuration profile per role

Create configuration profiles that reflect the needs of each group of employees. Administration teams need an office suite, email, and team communication tools. Developer teams need a development environment, code repository access, and possibly DevOps tools. Design teams need creative software and may need different hardware specifications. Field teams may need offline access and robust data synchronisation.

With profiles already defined, when a new employee joins you simply apply the profile matching their role — rather than building configuration from scratch.

Coordinate with the vendor (if renting)

If the company uses a laptop rental service, a good vendor can prepare a basic configuration before delivery: an updated OS image, standard software already installed, and asset tags already applied. This is a significant advantage over buying — the IT team does not have to start from scratch for every unit. Coordinate configuration requirements with the vendor at least a few days before the planned onboarding date. See the device catalogue to select units matching the specifications per role.

Prepare the required accounts and access

Before the laptop arrives, prepare the following items that can be done from the system: create the new employee's company email account, add them to the relevant groups and communication channels, prepare access to the internal systems they will need, and set permissions according to their role and authority level. Doing this before the first day ensures that employees can get straight to work once the laptop is in their hands.

Stage 2: Operating System and Software Configuration

Comparison Table: Manual Setup vs Golden Image vs Automated MDM

Setup time per unit with golden image: 25-45 minutes hands-on time for Windows 11 Pro corporate image (including domain join, antivirus install, M365 licensing). Without golden image: 2-4 hours per unit. Golden image ROI breaks even at fleet ≥15 units per quarter.

This is the core of the setup process. The correct sequence prevents problems that are difficult to debug later.

Operating system and updates

Ensure the OS has been updated to the version that is the company standard. Do not skip security updates — this is not a technical detail, it is a basic security requirement. If the company uses a specific version (for example, due to internal software compatibility), ensure this is documented in the configuration profile.

Productivity and communication software

Install the office suite, email client, team communication platform, and the company's standardised browser. If using licensed versions, ensure licences are activated before the unit is handed to the employee. Unlicensed software creates unnecessary compliance risk.

Role-specific tools

This follows the configuration profile already created. Developers get an IDE and development tools, designers get creative software, field teams get field management applications — all installed and configured before handover.

Connectivity and network access

Configure the VPN if the employee needs access to the company's internal network. For remote employees, the VPN connection is a critical component — ensure it works and has been tested before handover. If the company uses a domain, add the unit to the domain and verify that authentication works correctly.

Stage 3: Security Configuration

Successful onboarding metric: a new employee must be able to log in + access email + access minimum 1 critical SaaS (HRIS, CRM, ERP) within ≤30 minutes from H+0 start of work day. Industry benchmark from Gartner IT Best Practices cites <45 minutes as enterprise standard.

Security is not an add-on done as an afterthought — it must be part of the standard configuration for every unit.

Device encryption

Activate full disk encryption on every unit that stores or accesses company data. For Windows, BitLocker is the commonly used standard. For macOS, FileVault. Encryption ensures that data cannot be accessed if a unit is lost or stolen.

Password policy and authentication

Enforce a strong password policy: minimum length, complexity, and expiry period. If the company uses multi-factor authentication, activate and configure it on the new unit before it is handed to the employee.

Antivirus and endpoint protection

Install and activate the antivirus or endpoint protection solution to the company's standard. Ensure threat definitions have been updated and automatic updates are configured.

Automatic update policy

Configure automatic security updates so that units always receive the latest patches without depending on individual employees' awareness. This is an important passive security layer.

Stage 4: Asset Management and Inventory

Every unit that enters the company's inventory must be correctly recorded — both for accounting purposes, for audits, and for asset lifecycle management.

Asset tagging

Affix a physical asset label to the unit with a unique number. This number links the physical unit to its record in the company's asset management system. For rented units, also ensure the vendor's label or serial number is recorded.

Recording in the asset management system

Record in the system: asset number, unit specifications, serial number, date put into use, and the name of the responsible user. For rented units, also record the vendor information, contract number, and rental end date. A comprehensive guide to IT asset management is available in the IT asset management article for corporate laptops.

Stage 5: Handover to the Employee

A well-ordered handover is not a formality — it is an important moment for ensuring the employee is ready to use the device correctly.

Final verification before handover

Before giving the unit to the employee, carry out a final verification: all software is installed and working, accounts and access are active, the VPN connection has been tested, security is configured, and the unit is recorded in the inventory.

Handover certificate

Create a simple handover certificate recording: the name of the receiving employee, the date of handover, the unit's asset number, and the condition of the unit at the time of handover. The employee signs as confirmation of receipt. This document is important for asset accountability.

Brief for the employee

Take 10–15 minutes to ensure the employee knows: how to access the VPN, how to report a technical problem, the company's device usage policy, and what to do if the unit is lost or damaged. This brief saves many questions later on.

Table: Setup Components per Employee Profile

Scale: Managing Large-Batch Onboarding

When a company carries out large-batch recruitment — for example, 20 to 50 employees at once — a non-standardised setup process becomes a serious bottleneck. Several approaches for efficiently managing large volumes include: use deployment tools that can push configuration to many units simultaneously, coordinate with the vendor to prepare a basic configuration before delivery, and spread out the handover schedule so that the IT team is not overwhelmed.

For large-scale onboarding requirements, renting laptops from a vendor that can supply volume quickly and accommodate corporate configuration before delivery is far more efficient than buying units and configuring them all internally. See the article on laptop rental for employee training and onboarding for more specific context.

Frequently Asked Questions

Can a rental vendor prepare a corporate configuration before delivery?

Yes. Vendors experienced in serving corporates can prepare an OS image, standard software, and asset tags before the units are shipped. This saves the IT team significant time and ensures configuration consistency.

Who should handle the employee's personal account setup?

Accounts that are personal per employee — email, system access, and personal configurations — are generally completed by the company's IT team in accordance with internal policy. The vendor only prepares configurations that are part of the corporate standard.

How should returned units be managed when an employee resigns?

Create a standard device offboarding procedure: back up any data still needed by the company that has not been synced to a cloud system, delete the employee's accounts and access, reset personal configurations from the unit, and return it to inventory (or to the vendor if renting). A documented procedure prevents company data being left on units that are no longer in use.

What should you check when rented laptops arrive, before setup?

Match each unit against the order documents before starting any configuration. Check the serial number and specification against the quotation or PO, inspect the screen, keyboard, ports and battery, make sure the charger is included, and photograph the condition of every unit. Once everything matches, sign the handover record with the vendor and only then apply the configuration profile — this order keeps pre-existing defects from being recorded as your team's fault. Sample documents are in rental laptop handover.

How do you set up a laptop for a new remote employee?

Prepare the unit fully at the office or at the vendor, then ship it straight to the employee's address ready to log in. Test VPN, MFA and MDM enrolment before dispatch, include a short first-login guide, and use a handover record that can be signed electronically together with a photo of the unit on arrival. Schedule a video-call briefing on day one. Further considerations are covered in laptop rental for remote employees.

What goes on an IT onboarding checklist for new employees?

Four groups of tasks: preparation before the start date (details from HR, the role profile, unit allocation, accounts and access), configuration and testing the day before (OS, software, encryption, antivirus, a sign-in test), handover on day one (handover record, password change, MFA, briefing), and follow-up in the first week. The full copy-ready version is in the checklist section at the start of this article.

How many days before a new hire starts should laptop setup begin?

For 5–10 new employees, start 3–5 business days ahead; for 20–50 at once, allow 7–12 business days, because imaging and licensing become the queue. Add a two-day buffer for settings corrections. If you rent, send the requirement to the vendor at the start of that window so the units arrive already configured.

To procure office laptops that arrive already configured, contact our team via the contact page. You can also start by exploring the device catalogue or reading more about how to choose a laptop rental vendor to ensure you are partnering with the right vendor.

The Role of MDM (Mobile Device Management) in Large-Scale Setup

For companies with more than 30–50 units to manage, implementing an MDM (Mobile Device Management) solution is a highly worthwhile investment. MDM enables the IT team to push configuration, updates, and security policies to many units simultaneously from a single centralised dashboard — without physically touching each device.

With MDM, setting up a new unit becomes much faster: once the unit connects to the network and is enrolled in the MDM system, the standard configuration can be applied automatically. This turns what previously took several hours per unit into a process that can run in parallel across many units at once.

MDM also provides visibility into the status of the entire device fleet: which units have been updated, which have security compliance issues, and which have been inactive for a long time. For companies that rent laptops, MDM makes it easier to enrol and un-enrol devices as units are added or returned.

Device Offboarding: A Procedure That Is Often Overlooked

The onboarding process for new employees' devices often receives full attention, but device offboarding when an employee resigns or a contract ends is frequently overlooked — yet it is equally important from a data security standpoint.

A good offboarding procedure covers several steps. The first step is revoking all of the employee's access from every system: email, VPN, internal applications, and every platform accessed using company accounts. The second step is backing up any data that the company may still need and that has not been synchronised to the cloud system. The third step is deleting the employee's personal data and resetting personal configurations from the unit. The fourth step is updating inventory records — the unit is returned to the available device pool or, if renting, returned to the vendor in accordance with the contract procedure.

For rented units returned to the vendor at the end of a contract, a professional vendor will perform data sanitisation to the required standard before the unit is used again. Confirm this procedure in writing in the Rental Agreement from the outset.

The Financial Value of Standardised Setup

Standardising laptop setup does not only save time — it has a real financial value. The difference in time between setup with a template versus without one, multiplied by the number of units per year and the hourly cost of IT staff, produces a concrete savings figure. Standardisation also significantly reduces troubleshooting time — units with a uniform configuration are far easier to debug.

If you use a laptop rental service, ensure the vendor can accommodate a corporate standard configuration before delivery. Contact the Arental team to discuss specific configuration requirements, or read how to choose a laptop rental vendor to ensure you are partnering with the right vendor.

References & Sources

Endpoint configuration standards at NIST SP 800-53 (accessed 8 November 2026); M365 Business licensing at Microsoft Indonesia (accessed 8 November 2026).