Computer and device procurement and setup
New hires should open a laptop on day one and find it ready: encrypted, patched, protected and signed in to the right apps. We handle the full device lifecycle, from choosing the right hardware to wiping and disposing of it securely when it retires.
Reviewed by the ITRS security team · Last updated
Choosing business-grade devices
Consumer laptops from big-box stores often look like a bargain and turn out to be the opposite: short warranty, preinstalled software, Home editions of Windows that can't join business management, and models that disappear from shelves within months. We recommend business lines from major manufacturers for predictable parts, longer support and consistent drivers.
We standardize on a small number of models per role (for example, a standard laptop, a high-performance laptop for heavy spreadsheets or design, and a desktop for reception) so support is simpler and spare parts are interchangeable.
| Consider | Why it matters |
|---|---|
Operating system edition | Windows Pro or higher is needed for business management features and BitLocker management |
TPM and modern CPU | Required for current Windows versions and hardware-backed security |
Warranty length and type | Next-business-day on-site support versus mail-in makes a big difference to downtime |
Memory and storage | Undersized machines age quickly; too little memory is the most common early complaint |
Docking and peripherals | Standard docks and monitors make hot-desking and replacement simple |
Zero-touch enrolment
With Windows Autopilot, a new PC can ship straight to an employee's home or the office and set itself up the first time it connects to the internet. The device is registered to your organization, joins Microsoft Entra ID, enrols in Intune, and pulls down its apps and security settings automatically. Microsoft describes Autopilot as a way to set up and pre-configure new devices so they are ready for productive use.
For Macs, Apple Business Manager with automated device enrolment does the same job; for company-owned iPhones and Android devices, there are equivalent zero-touch programs. Devices enrolled this way can't simply be reset and taken out of management.
Standard build and security baseline
These settings follow the Canadian Centre for Cyber Security's baseline controls for small and medium organizations, which include automatic patching, enabling security software, securely configuring devices and encrypting data.
- Full-disk encryption (BitLocker or FileVault) with recovery keys escrowed to your tenant, not a sticky note.
- Endpoint detection and response installed and reporting.
- Automatic patching for the operating system and common applications.
- Standard user accounts for staff; local admin rights removed or managed.
- Firewall on, unused services off, screen lock enforced.
- Intune compliance policy assigned so the device is checked before it can reach company data.
- Line-of-business apps, printers and VPN pushed by policy rather than installed by hand.
Asset tracking
Every device is recorded with its serial number, model, purchase date, warranty end date, assigned user and location. That record supports insurance claims, lost-device reports, budgeting for replacements, and offboarding: when someone leaves, the register shows exactly what they should return.
We reconcile the asset register with Intune and your directory regularly, so a device that has not checked in for weeks is noticed and followed up.
Repairs and warranties
When a device fails, we triage remotely, log the warranty claim with the manufacturer and swap in a spare where one is available so the user keeps working. Before any device leaves for repair, we check whether the drive must stay with you (many manufacturers offer keep-your-drive options) and confirm the disk is encrypted.
Secure retirement and disposal
A retired laptop still holds whatever was ever saved to it. The Cyber Centre's guidance on sanitizing and disposing of electronic devices (ITSAP.40.006) explains that deleting files or a factory reset does not truly erase data, and recognizes four methods: erase and factory reset, overwrite and secure erase, crypto erase, and physical destruction. The method should match the sensitivity of the data.
Confirm no hold applies
A device belonging to someone involved in a dispute or investigation is preserved, not wiped.
Remove from management
Deregister from Autopilot or Apple Business Manager and retire in Intune.
Sanitize
Crypto erase or secure erase for encrypted drives being reused or resold; physical destruction for highly sensitive data or failed drives.
Document
Record the serial number, method, date and who did it; keep any certificate of destruction from a disposal provider.
Update the register
Mark the asset as retired so it doesn't appear as missing later.
Questions we hear
Usually, if they meet current Windows or macOS requirements. Existing devices can be enrolled in management; Autopilot registration for older PCs is also possible.
Plan around the manufacturer warranty and operating system support. Replacing on a regular cycle beats running devices until they fail.
If it is encrypted and managed, the data is protected and the device can be locked or wiped remotely. Report it immediately so we can act.
Related work.
- Case studyRecovering a Total ERP Database Outage in a Single MorningHow IT Rapid Support traced a total Spire database outage to a changed server network profile and had every affected workstation back the same morning.
- Case studyFrom Breach Forensics to a Company-Wide Identity PlanFrom reconstructing a 2018 mailbox compromise minute by minute to scoping centralized Entra ID and Intune management for a 40 to 50 person pharma firm.
Related.
- PracticeManaged IT SupportHelpdesk and break/fix, networking, security systems, devices, Microsoft 365, cloud and backup.
- GuideBuilding a device compliance baseline with IntuneA compliance policy answers one question about every laptop and phone: is this device safe enough to open company data?
- GuideEmployee onboarding security checklistThe first week sets habits that last years. If a new hire gets admin rights "just to get started", skips MFA because IT was busy, or never hears how to report a…
- GuideWhat to do if a work laptop is lost or stolenWhether a missing laptop is an inconvenience or a reportable privacy breach usually comes down to one question: was the drive encrypted, and can you prove it?
- ServiceIT Support ServicesManaged IT support for GTA and Ontario businesses: a helpdesk your staff can reach, patching and monitoring of your devices, Microsoft 365 administration, backup checks…
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.