New computer checklist for work..

So I'm creating a New Computer Setup Checklist, but I'm honestly drawing a blank after the basics (updates, AV, etc).

Just wondering if anyone would post theirs up for me to compare. (I know it'll be different, because every company has different software...)

Thanks!

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

dynamik

Just setting up for users?

Updates, AV, Acrobat, iTunes, Firefox, Office, Live Messenger, file server shortcuts/mappings, email, and printers. There's probably more; I always forget stuff. Making a list sounds like a good idea...

Edit: Oh, and a 30" monitor...

tiersten

You install iTunes on user PCs? o.O

dynamik

tiersten wrote: »

You install iTunes on user PCs? o.O

That wasn't a policy I created; I would get lynched if I didn't. The owner and a lot of the sales reps have iPhones as well.

Claymoore

A checklist is nice to get started, but have you considered automating your deployments so that a manual checklist is unnecessary?

It doesn't take a lot of money since most of the tools from MS are free:
MAP - For assessment, inventory and identification
ACT - For application information
WDS - For image deployment
MDT - For deployment management and task creation
WSUS - For updating
Group Policy - For settings and application deployment

You can get as detailed as you want with highly specialized task sequences in the MS Deployment Toolkit, or you can just deploy a captured image through Windows Deployment Services with Group Policy pushing down a few apps that Windows Server Update Services patch. You have some choices, but whenever you eliminate manual tasks you reduce errors (or you make the same error lots of times in a hurry) and speed up the process.

Add in roaming profiles and/or folder redirection and it quickly becomes easier and faster to re-image a workstation than to resolve some weird mystery issue.

vCole

Claymoore wrote: »

A checklist is nice to get started, but have you considered automating your deployments so that a manual checklist is unnecessary?

It doesn't take a lot of money since most of the tools from MS are free:
MAP - For assessment, inventory and identification
ACT - For application information
WDS - For image deployment
MDT - For deployment management and task creation
WSUS - For updating
Group Policy - For settings and application deployment

You can get as detailed as you want with highly specialized task sequences in the MS Deployment Toolkit, or you can just deploy a captured image through Windows Deployment Services with Group Policy pushing down a few apps that Windows Server Update Services patch. You have some choices, but whenever you eliminate manual tasks you reduce errors (or you make the same error lots of times in a hurry) and speed up the process.

Add in roaming profiles and/or folder redirection and it quickly becomes easier and faster to re-image a workstation than to resolve some weird mystery issue.

I would love to automate our deployments, but we just don't have the time right now.

But thanks for the list!

tiersten

dynamik wrote: »

That wasn't a policy I created; I would get lynched if I didn't. The owner and a lot of the sales reps have iPhones as well.

Ah. For business deployments, they should make a small lightweight syncing app that just handles email, contacts and calendar. Needing to install iTunes and QuickTime (bleh) on a work PC is just annoying especially with the autoupdate system that it uses. If you want music then you'd do it via iTunes at home or something.

wd40

The most important thing, inventory details.

brad-

If you're in a production environment, alot of ppl need crystal reports viewer, SQL client...

If you dont install the office suite, maybe PPT viewer.

Latest Adobe Reader.

paintb4707

Let's not forget those browser plugins. Flash, Java, etc.

vCole

paintb4707 wrote: »

Let's not forget those browser plugins. Flash, Java, etc.

yes! Totally forgot those!

dynamik

paintb4707 wrote: »

Let's not forget those browser plugins. Flash, Java, etc.

I told you I always forget something

Psoasman

Lets see... Xp, Sp3, updates from WSUS, drivers, Office 2k3 or 2k7, adobe reader / flash, firefox, IE7, office compatibility pack, defrag, check disk.

HeroPsycho

Things I'd add to the suggested lists above:

Scan the machine using Microsoft Baseline Security Analyzer to ensure Microsoft patches are up to date and there are no glaring security misconfigurations.

Rename the built in administrator account, create a new account called administrator, cut and paste the description of the old admin account to the fake one.

At the very least, you should have a GPO that configs Automatic Updates related settings, restricted groups, basic password and security policies, and map their home directories to a file server. That doesn't take long to implement.

Move the computer to the appropriate OU. They don't just keep desktops in the default Computers container, right?

kriscamaro68

here is s spread sheet that i made for our i.t department to follow. Also we use a program called ping that works well and is free for deployment.

ScreenShot001.jpg

Xcluziv

Outlook email & contacts, e-Fax, AS/400 sessions, Adobe Flash & Acrobat, printers, home folder, favorite/cookies, VIP, shortcuts

snokerpoker

I install all the necessary drivers, outlook 2003, flash player, shockwave,adobe reader,and run windows updates for all the critical updates. I also like to remove games, outlook express, mouse pointers and windows messenger. Then I make an image of the disk. We have several Dell pc's so I to keep an image of each model to make it easier in the future. I leave the pc's alone with the base image until they are ready to be deployed out to a user. At that point I install AV, change the computer name and join the domain. Once it is on the domain WSUS is in charge of patching.

NightShade03

We are actually still setting up a zero touch deployment configuration with SCCM. So far everything is configured via scripts so I don't really have to do anything but via script we include:

Flash
Shockwave
Quicktime
Java
Adobe Reader
Office 2007 Compatability Pack (for 2003/2007 to play nicely together)
Sysinternals (this way i can trouble shoot from the local computer instead of pointing to a network share and pulling things down)
Office 2003 (outlook is configured automatically)
iTunes (not my policy)
Scripts to force install all windows updates after completion of imaging
Auto-Add user as local admin (not my policy)
Auto-configure printer
Inventory computer and store results in database (via script)
Auto-install AV
Auto-apply all drivers
Auto-apply security policy

If anyone would like any of the scripts just let me know

snokerpoker

NightShade03 wrote: »

We are actually still setting up a zero touch deployment configuration with SCCM. So far everything is configured via scripts so I don't really have to do anything but via script we include:

Flash
Shockwave
Quicktime
Java
Adobe Reader
Office 2007 Compatability Pack (for 2003/2007 to play nicely together)
Sysinternals (this way i can trouble shoot from the local computer instead of pointing to a network share and pulling things down)
Office 2003 (outlook is configured automatically)
iTunes (not my policy)
Scripts to force install all windows updates after completion of imaging
Auto-Add user as local admin (not my policy)
Auto-configure printer
Inventory computer and store results in database (via script)
Auto-install AV
Auto-apply all drivers
Auto-apply security policy

If anyone would like any of the scripts just let me know

I forgot about Java! And we need to incorperate Office 2007 Compatability Pack. Seems like lately we have been getting more and more complaints from people not being able to open up files made in Office 2007. I would be interested in taking a look at the scripts you have setup. Please PM me whenever you get a chance. Thanks very much.

NightShade03

snokerpoker wrote: »

And we need to incorperate Office 2007 Compatability Pack. Seems like lately we have been getting more and more complaints from people not being able to open up files made in Office 2007.

Actually you can install the single .exe file if you want however it is also offered as an update if I'm not mistaken. You could approve it via the WSUS server and just let it be pushed out as an update to all users which I find easier.

snokerpoker

NightShade03 wrote: »

Actually you can install the single .exe file if you want however it is also offered as an update if I'm not mistaken. You could approve it via the WSUS server and just let it be pushed out as an update to all users which I find easier.

Yeah, we need to do that asap it would help out a lot.