New Employee Laptop Setup: The Joiner Checklist

/01 — THE DEVICE

Start With a Laptop That Belongs to the Business

The first decision is the one people skip: whose laptop is it. A machine the business bought, on the business’s own account, is the only version of this that ends well. Everything else — a personal laptop the new starter already owns, a spare from a director’s house, the machine the last person handed back — creates a problem that only shows up later, usually on the day you need the device back.

A personally owned laptop sits outside whatever you use to manage company machines. You are relying on the owner to keep it patched and protected, and anything saved locally on it is a copy you cannot see or account for. If you do want to allow personal devices, what you can ask of them — and what you would need agreed in writing — is a question for your HR adviser or solicitor. Our part is making sure the work itself lives in your business accounts rather than on their hard drive.

A hand-me-down is a different trap: it is usually still signed in to somebody else’s accounts, still holding their files and saved browser passwords, and often old enough that the battery and the warranty are both spent. If you are reusing a device, check first that anything the business still needs from the previous user has been recovered — local files, anything only stored in a locally cached mailbox, licence or software details — because a reset cannot be undone. Once you are sure, reset it back to a clean state and set it up under the new person’s own business account. It is also worth knowing that consumer editions of Windows are not really built to be joined to a business account or managed centrally, so an off-the-shelf laptop bought in a hurry can be awkward to bring properly into a business setup.

/03 — DAY-ONE ACCESS

What They Should — and Should Not — Have on Day One

The instinct on someone’s first morning is to give them everything so they are not sitting there blocked. It feels helpful, and it is the reason so many small businesses end up with every member of staff able to open the payroll folder.

Day one should cover what the job genuinely needs: their own mailbox and calendar, the shared folders or sites for their team, the specific apps their role uses, the printer and the WiFi. Set those up before they arrive, so their first hour is work rather than waiting.

Hold back the things that are hard to unwind. A new starter does not need administrator rights on their own laptop, and they certainly do not need administrator rights over your Microsoft 365. Keep finance, payroll and HR folders, banking and card details, the domain and website logins and any shared password vault out of the initial setup. None of that is about trust — it is that access is easy to grant and awkward to take back, and every extra permission is one more thing to remember when they eventually move on.

Resist the shared login too. If your team has one account that everybody uses for a system, adding one more person to it makes the eventual clean-up harder. Separate accounts per person are the whole reason a leaver process can work at all.

/05 — THE RECORD

Write Down What You Set Up — the Leaver Process Depends On It

The last step takes minutes and is the one that pays for the whole exercise: write down what you set up. A joiner record does not need to be sophisticated — one document or spreadsheet, kept somewhere the business controls, listing:

• the device, with make, model and serial number, and who owns it;
• the accounts created and the email address in use;
• the licences assigned to that person;
• the shared folders, sites and systems they were given access to;
• the third-party apps and supplier portals they hold a login for;
• the phone, SIM, dongles, keys or fobs handed over;
• where the disk encryption recovery key is stored.

This is the mirror image of our leaver checklist, and it is why the two belong together. Everything on that page — blocking sign-in, keeping the mailbox, reassigning files, reclaiming the licence, recovering the device — quietly assumes somebody knows what the person had. When nobody wrote it down, offboarding becomes detective work: a licence still being billed months on, a supplier portal only they could get into, a laptop nobody can unlock. Keep the record current as roles change, and the day somebody hands in their notice becomes an afternoon of admin rather than a fortnight of surprises.