Why laptop setup is the bottleneck nobody budgets for

Here's a number that should make every HR manager wince: (Vlerick Business School) found that 43% of new hires have to wait more than a week just for their workstation and tools to be ready. That's a full week on payroll before the person can do any real work.

For SMBs without a dedicated IT department, ordering and setting up a laptop for a new employee is one of the most time-consuming steps in the onboarding process. You need to pick the right device, configure the operating system, create accounts, install software, and apply security policies, all manually, for every single hire. Each device easily eats three to five hours of someone's day, and that someone is usually an HR manager, office manager, or founder who has plenty of other things to do.

This guide walks you through the entire process: from choosing the right laptop and configuring it properly, all the way to handing it over on day one. We'll also cover zero-touch deployment as the modern alternative for companies that want to stop treating every new hire like a mini IT project.

Prerequisites: what you need before ordering

Hardware and account requirements

Before you shop for a device, answer three questions. First, which operating system does this role need? Most business teams run fine on Windows. Design, engineering, and creative roles often require macOS. Second, what's your budget? Decide whether you're buying outright, leasing, or using a vendor program. Third, do you have admin credentials ready for Google Workspace or Microsoft 365, plus licences for any role-specific software?

Getting these answers documented before you even open a browser tab saves a surprising amount of back-and-forth later.

Define a standard device policy

A device policy is just a short reference table that tells you what to order for each type of role. Write it once, and every future order becomes consistent and auditable. Here's a simple example:

This table prevents two common mistakes: over-specifying devices for non-technical roles (wasting budget) and under-specifying them for technical roles (costing productivity). If you're building your first onboarding checklist, a device policy belongs at the very top.

Step 1: Choose the right laptop for the role

Match the device specs to the job function, not to the latest product launch. A salesperson running a CRM and a browser doesn't need 32 GB of RAM. An engineer compiling code locally does.

Think about where the employee will work, too. If you're onboarding someone remotely, the device may need to ship directly to their home address. That changes your vendor choice and your timeline. Remote onboarding already comes with its own set of challenges: (Workable) reports that 37.4% of HR professionals cite remote onboarding as the top challenge when filling roles, ranking above sourcing candidates or negotiating offers.

If you're hiring across multiple departments, refer back to your sales onboarding checklist or HR onboarding checklist to make sure you're matching hardware to each team's actual tool requirements.

Step 2: Order the device and plan the timeline

Work backward from the employee's start date. A safe minimum lead time is 10 to 14 business days. That covers ordering, shipping, and the time you need for manual setup and testing.

Factor in the unexpected. Shipping delays happen. Vendor stock runs out. A wrong configuration ships. If you know you'll be hiring steadily over the next quarter, keep a small buffer stock of two or three standard-spec laptops. It sounds like a luxury, but consider the alternative: a new hire sitting idle on day one. (CareerBuilder) estimates that a failed first-year hire costs approximately $14,900 when you factor in recruiting, onboarding, training, lost productivity, and re-hiring. A laptop gathering dust in a closet for a few weeks is a much cheaper insurance policy.

For companies with distributed teams, the timeline matters even more. Shipping to a remote employee's home in another city (or country) adds days. Plan accordingly, and confirm the delivery address early.

Step 3: Configure the device: OS, accounts, software, and security

Set up the OS, create accounts, and install software in one pass

When the laptop arrives, resist the temptation to hand it straight to someone for a "quick setup." A structured, single-pass configuration prevents forgotten steps and inconsistent setups across your team.

Start with system updates. A fresh-out-of-box operating system is never fully patched. Run all available updates, restart, then check again. This alone can take 30 to 60 minutes depending on the device.

Next, provision the employee's core accounts: email, cloud storage (Google Drive or OneDrive), and any SSO or directory accounts. If your company uses Microsoft 365, the employee will sign in with their work account during the Windows setup wizard. For Google-first companies, the flow differs slightly. Either way, have the credentials ready before you start.

Then install role-specific software. A per-department checklist is essential here. Your operations onboarding checklist will look different from your data analytics onboarding checklist, and both differ from UX/UI onboarding requirements. Document what each department needs, and check the list off as you go.

Enforce security baselines before the device leaves your hands

Security configuration is not optional, and it is not something you can leave for the employee to handle later. Before the device gets handed over, you should:

• Enable full disk encryption (BitLocker on Windows, FileVault on macOS)
• Set a password policy that enforces minimum complexity
• Activate endpoint protection (antivirus and anti-malware)
• Enable multi-factor authentication (MFA) on all critical accounts

Why is this non-negotiable? Because (Verizon Business) reports that 90% of successful cyberattacks and as many as 70% of successful data breaches originate at endpoint devices. Your new hire's laptop is an endpoint. It needs to be locked down before it connects to your network.

The patching discipline matters, too. (Automox) found that in 2024, 60% of organizations that experienced a data breach cited a known, unpatched vulnerability as the root cause. That's a problem you can solve during setup, not after a breach.

Step 4: Test the device and prepare for handover

Once you've finished configuration, run a final checklist before handing the device over. This takes fifteen minutes and catches problems that would otherwise surface on the employee's first day, when stakes are highest and patience is lowest.

Your handover checklist should include:

• Wi-Fi connects and authenticates correctly
• VPN connects (if applicable)
• Email syncs and sends/receives
• All required apps launch and accept login credentials
• Printer access works (for on-site employees)
• MFA is configured and the employee has a second factor ready

For remote employees, include a short welcome document in the shipping box: login steps, Wi-Fi setup instructions, and the IT contact for questions. Don't assume anything is self-explanatory. (Paychex) found that 74% of employees declared their remote onboarding process a failure. A simple welcome guide goes a long way toward preventing that.

If you're onboarding new recruiting team members or anyone who touches sensitive candidate data, double-check that access permissions are scoped correctly before handover.

Step 5: Handle the worst case: laptop arrives after the start date

Even with good planning, it happens. A device gets delayed in shipping, or someone forgot to place the order. The employee shows up on Monday morning and there's nothing on their desk.

You have a few interim options:

1. Loaner device: If you keep buffer stock, assign a temporary laptop with basic access until the permanent one arrives.
2. Remote desktop access: Set the employee up with a virtual desktop so they can start working from any machine.
3. Cloud-only setup on a personal device: For roles that primarily use browser-based tools, a personal device with access to Google Workspace or Microsoft 365 can bridge a few days. Be careful with security here: enforce MFA, and avoid downloading company data to an unmanaged device.

How do you prevent this from happening again? Three things help: maintaining buffer stock for predictable hiring, using a vendor with guaranteed lead times, and considering zero-touch deployment (covered in the next step), which removes much of the manual timeline risk entirely.

The cost of getting this wrong isn't just wasted salary. (Gallup) reports that only 12% of employees strongly agree their organization does a great job of onboarding. A missing laptop on day one is the kind of signal that tells a new hire they might have made the wrong choice. (Digitate) found that 52% of employees who experienced weak onboarding later had negative perceptions of the entire company.

Step 6: Zero-touch deployment as a scalable alternative

How zero-touch provisioning works

With zero-touch deployment, the laptop ships directly from the vendor to the employee's address, pre-enrolled in a mobile device management (MDM) system. When the employee opens the box and powers on the device, configuration, apps, security policies, and accounts apply automatically on first boot. There's no manual setup step. There's no IT person in the middle.

The device is linked to the employee by its hardware serial number. The MDM knows what to install, which policies to enforce, and which accounts to provision. The result: a fully configured, security-hardened laptop ready to use within minutes of unboxing.

When to switch from manual to zero-touch

Manual setup works fine when you're hiring one or two people a quarter and everyone sits in the same office. Once you're onboarding regularly, across multiple locations, or hiring remote employees, the manual process doesn't scale. Each device costs hours of someone's time, and the risk of missed steps or inconsistent configurations grows with every hire.

This is where deeploi fits. The full zero-touch provisioning workflow runs through the platform: device ordering, automatic MDM enrollment, app installation, security configuration, and account creation are all handled end-to-end. The onboarding process in deeploi has five steps. You add the employee (either manually or synced from an HR system like Personio), fill out an onboarding form with the start date, email, and software bundle, and submit it at least four days before the start date. If a device is part of the onboarding, the order is coordinated through deeploi with a confirmation step. On the employee's first day, the device is already configured and ready.

For companies that have moved past occasional hires, the contrast is stark. Instead of a multi-hour manual process per device, the admin work takes minutes. (Brandon Hall Group) found that organizations with strong onboarding processes improve new hire retention by 82% and productivity by over 70%. Getting IT right from day one is a meaningful part of that equation.

Companies already investing significantly in hiring should weigh the setup cost against the overall spend. (SHRM) puts the average cost per hire at nearly $4,700, and many employers estimate the total cost can reach three to four times the position's annual salary. Losing days of productivity to a manual laptop setup is a surprisingly expensive inefficiency relative to the total investment you've already made in that hire.

Troubleshooting: common setup issues and fixes

Even with a solid process, things go wrong. Here are the most common issues and how to handle them.

Device arrives with the wrong OS language or region settings. This happens more often with internationally sourced hardware. On Windows, you can add a language pack under Settings → Time & Language → Language & Region. On macOS, go to System Settings → General → Language & Region. It's a quick fix, but it's annoying for the employee if nobody catches it before handover.

Employee can't sign in because SSO or MFA wasn't pre-configured. If you didn't set up single sign-on or multi-factor authentication before handing over the device, the employee hits a wall at login. The fix is straightforward: configure SSO and MFA during Step 3, not after. If you're already past that point, walk the employee through the MFA setup over a video call.

Software licences exceeded or expired before the start date. This catches companies off guard, especially with seat-based licences. Check your licence counts before you start provisioning. If you need additional seats, order them alongside the hardware, not the day before the employee starts.

Shipped device stuck in setup assistant because MDM wasn't linked to the hardware serial. This is a zero-touch-specific issue. The device needs to be registered in your MDM system with the correct serial number before it ships. If it isn't, the setup assistant won't pull the configuration profile and the employee gets a stock, unconfigured experience. The prevention is simple: register the serial in your MDM as soon as the vendor confirms the order. With deeploi, devices are added to inventory and pre-registered before they reach the employee.

Endpoint visibility matters here. (CSO Online) reports that 54% of security professionals said more than 20% of their overall endpoints were unmanaged. If you're setting up devices manually and losing track of which ones have been configured, that gap grows fast.

Remote employees face an additional layer of complexity: connection issues during setup, confusion about which credentials to use, and no colleague nearby to ask. (Gallup) found that only 28% of remote workers feel strongly tied to the mission and purpose of their organizations, down from 35% in 2019. A frustrating first-day IT experience doesn't help that number.

FAQ

How far in advance should I order a laptop for a new employee?

Plan for a minimum of 10 to 14 business days before the start date. This accounts for ordering, shipping, manual configuration, and testing. Custom configurations or international shipments may take longer. If you're hiring frequently, keeping two or three buffer devices in stock is worth the upfront cost.

Can I set up a laptop remotely for a distributed hire?

Yes, but the method depends on your setup. For manual provisioning, you can configure the device at your office and ship it, or use remote desktop tools to walk the employee through setup. For a scalable approach, zero-touch deployment lets you ship a device directly to the employee's home, pre-enrolled in MDM so it configures itself on first boot.

What is the best onboarding software for SMBs in Germany and Europe?

For IT provisioning specifically, look for platforms that combine MDM, automated account creation, and device management. deeploi is built for exactly this use case in the DACH and European market, integrating HR systems like Personio with device provisioning and security configuration. The right choice depends on your tech stack, team size, and whether you need support for macOS, Windows, or both.

Do I need an MDM solution if I only have a small team?

Once you manage 10 or more devices, or have any remote employees, an MDM solution pays for itself. Below that threshold, you can get by with manual setup, but you lose visibility into device health, patch status, and security compliance. The transition point usually comes sooner than expected, especially when you factor in offboarding and device recovery.

What do I do if the laptop arrives after the employee's start date?

Assign a loaner device from buffer stock, set up remote desktop access, or provide temporary cloud-only access on a personal device (with MFA enforced). To prevent this from recurring, build buffer stock, choose vendors with reliable lead times, and evaluate zero-touch deployment so the device ships directly to the employee without an intermediate setup step at your office.

Conclusion

Manual laptop setup works until it doesn't. For a company hiring its fifth or tenth employee, the process is manageable if tedious. But as you scale, every manual step becomes a multiplier: more devices, more configurations, more chances for something to slip through. (Gallup) reports that 88% of companies admit they aren't great at executing a solid onboarding experience. A big part of that gap is IT readiness.

If you're still setting up every laptop by hand, this guide gives you a reliable process to follow. But if you want day-one readiness to be the default rather than the exception, evaluate zero-touch deployment early. Don't wait until the process breaks under pressure.

For SMBs, the entire IT onboarding workflow can be automated through deeploi, from device ordering to configuration to account provisioning, so new hires can start working the moment they open their laptop. If you're ready to stop spending hours on manual setup, explore how to optimize your onboarding or book a consultation to set up zero-touch provisioning for your next hire.