Windows 11 deployment runbook (on-site and remote)

Mac deployment
Windows deployment
Mac returned-device refresh
Windows returned-device refresh
macOS setup instructions

Scope: Google Workspace, Rippling enrollment, Windows sign-in aligned to the company, baseline productivity tools (open source where applicable), Bitwarden, OpenVPN, PuTTY, Notepad++.

Note: these are plain HTML forms with checkboxes. They do not save state unless you print to PDF or copy notes elsewhere.

0) Inputs you need (before touching the laptop)

1) Unbox and hardware sanity checks

2) Windows 11 setup (baseline security)

Create the end user sign-in per company policy (work account preferred; avoid personal Microsoft accounts) (Microsoft docs: Manage user accounts in Windows; Windows sign-in options and account protection)
Set device name (example): ET-lastname-win (use your naming standard) (Microsoft docs: Rename your Windows device)
Run Windows Update until fully current (including optional driver/firmware updates, if approved) (Microsoft docs: Install Windows updates)
Enable automatic updates per policy (Microsoft docs: Windows Update - FAQ; Get Windows updates as soon as they're available)
Configure lock screen + sleep settings (password required on wake; short idle timeout per policy) (Microsoft docs: Windows sign-in options and account protection)
Enable full-disk encryption (BitLocker if available) and escrow/store recovery key in approved system (MDM/vault) (Microsoft docs: Device encryption in Windows; Find your BitLocker recovery key)
Confirm Windows Defender / Endpoint Security is active (or your approved EDR is installed) (Microsoft docs: Virus and threat protection in Windows Security)
Confirm Windows Firewall is enabled (unless managed/enforced by your endpoint tooling) (Microsoft docs: Firewall and network protection in Windows Security)
Confirm standard user vs local admin posture (default: standard user) (Microsoft docs: Manage user accounts in Windows)

3) Google Workspace (productivity platform)

4) Rippling enrollment

5) Windows sign-in aligned to the company

Goal: the company can recover access, rotate credentials, and reassign the laptop without depending on a personal account.

6) Standard build - browsers, productivity tools, Bitwarden, PuTTY, Notepad++

6.1 Browsers (standard)

6.2 Typical productivity tools (open source where applicable)

6.3 Bitwarden (standard password manager)

6.4 PuTTY and Notepad++

7) OpenVPN (standard) - pre-deploy VPN config profile

Goal: the user receives a laptop that can connect to the corporate VPN on day 1. This requires (a) installing an OpenVPN client, and (b) staging/importing the correct VPN profile.

Windows 11 deployment runbook (on-site and remote)

0) Inputs you need (before touching the laptop)

1) Unbox and hardware sanity checks

2) Windows 11 setup (baseline security)

3) Google Workspace (productivity platform)

4) Rippling enrollment

5) Windows sign-in aligned to the company

6) Standard build - browsers, productivity tools, Bitwarden, PuTTY, Notepad++

6.1 Browsers (standard)

6.2 Typical productivity tools (open source where applicable)

6.3 Bitwarden (standard password manager)

6.4 PuTTY and Notepad++

7) OpenVPN (standard) - pre-deploy VPN config profile

7.1 Install the OpenVPN client

7.2 Pre-deploy the VPN profile

7.3 Remote worker note

8) Final verification (before handoff)

9) Handoff process

9.1 On-site handoff

9.2 Remote handoff

10) Failure handling quick guide