New Laptop Security Checklist: 10 Settings to Change Before You Browse

You open the box, peel the film off the screen, sign in, and within ten minutes you are checking email on a machine that has never been configured for anything except convenience. Factory settings are built to get you online fast and keep the manufacturer's services connected. Neither goal has much to do with your privacy. The fixes are boring, quick, and permanent. Set aside half an hour, work through the list below, and your laptop will behave very differently the first time someone else gets their hands on it.

Install every update before you install anything else

Plug the laptop in and run updates until the system stops finding new ones. On Windows, that means Settings > Windows Update; on macOS, System Settings > General > Software Update. Restart, then check again — updates often arrive in waves, and the second pass finds things the first one missed.

Then go one level deeper. Windows Update rarely covers firmware, chipset, or graphics drivers, so visit your manufacturer's support page, enter the model number, and install what is listed there. Firmware updates are the ones that patch low-level flaws, and they are easy to skip because nothing nags you about them.

While you are in the settings, open your list of installed programs and remove the trial antivirus, the shopping helper, and the cloud drive you never asked for. Running two real-time antivirus tools at once causes conflicts, so pick one and keep it.

Turn on full-disk encryption and store the recovery key properly

Encryption is what turns a stolen laptop into an inconvenience instead of a data breach. Without it, anyone can pull the drive, mount it on another machine, and read everything.

On Windows, look under Settings > Privacy & security for Device encryption, or for BitLocker Drive Encryption if you have a Pro edition. On a Mac, open System Settings > Privacy & Security > FileVault. Both take a while to finish, so start it and leave the machine plugged in.

When it offers you a recovery key, treat that key as the most important file on the machine. Save it in a password manager and print a copy for a drawer. Do not store the only copy in the same cloud account the laptop depends on, and do not tape it to the lid. If you forget your password and lose the key, the data is genuinely gone.

Rebuild your user accounts so one mistake stays small

Most people use an administrator account for everything, which means any malicious program that runs inherits administrator rights too. A few changes fix that.

Work in a standard account

Create a second, administrator account that you use only when installing software or changing system settings, then demote your daily account to Standard. On Windows: Settings > Accounts > Other users. On macOS: System Settings > Users & Groups. It costs you one password prompt every few weeks and limits how far a bad download can spread.

Lock the screen quickly, and require a password on wake

Set the screen to lock after two to five minutes of inactivity and require a password immediately — not after a grace period. On Windows, check the screen saver settings for the "on resume, display logon screen" box, and adjust the sign-in timing under Sign-in options. On macOS, open System Settings > Lock Screen and set the password requirement to immediately. Then turn off automatic sign-in so the machine does not boot straight to your desktop.

Pick a long PIN or passphrase you do not reuse

A four-digit PIN protects against a casual snoop and little else. Use at least six digits, or better, a short passphrase. Never repeat the password you use for email.

Set up two-factor authentication and a password manager

Before you log into anything important on the new machine, add a second factor to those accounts. An authenticator app or a hardware security key is stronger than a code sent by text message, because text codes can be intercepted through phone-number attacks. Start with email, since almost every other account can be reset through it.

Then stop memorising passwords. A password manager — whether a dedicated app or the one built into your browser or operating system — generates long, unique passwords and fills them in for you. If you have been reusing one password across a dozen sites, change the most valuable accounts first and let the rest follow over the coming weeks.

Review privacy and permission settings line by line

Both Windows and macOS have a privacy dashboard, and almost nobody opens it. Walk every category and ask one question: does this app need this access to do the job I want?

• Camera and microphone: allow only apps you would hand a physical key to.
• Location: maps and weather need it; a photo editor rarely does.
• Advertising ID and personalised ads: turn these off.
• Diagnostic and usage data: reduce it to the minimum the system allows.
• Activity history, clipboard sync, and typing suggestions: disable if you would not want them stored in a cloud account.
• Files, screen recording, and accessibility access: these are the powerful permissions, so keep the list short.

Do not switch everything off blindly. Backups and device location depend on some of these settings, and breaking them makes the next section harder.

Keep sharing off and tighten your browser

Turn off file and printer sharing and network discovery, at least for public networks, so your laptop is not advertising itself on café Wi-Fi. Your firewall should already be on by default; verify it rather than assume it.

In the browser, set tracking protection to its strict setting, block third-party cookies, and remove extensions you do not actively use — each one can read what you do. If you bank on unfamiliar networks, a reputable VPN or your phone's hotspot is a reasonable precaution; free VPN apps that sell usage data are not.

Turn on backups and device location now, not later

Enable Find My Device on Windows or Find My Mac on macOS, so a lost laptop is at least locatable. Then set up backups: an external drive with File History or Time Machine, or a cloud service you trust. Test it by restoring a single file before you need it in a hurry.

If you want one more step, set a firmware password in the BIOS or UEFI and disable booting from removable media. That stops someone from starting another operating system to read your disk. Record that password somewhere safe — losing it can lock you out of your own firmware settings.

Your first hour, in order

1. Install operating system, firmware, and driver updates until nothing remains.
2. Remove trial software and any second antivirus tool.
3. Enable full-disk encryption and store the recovery key off the machine.
4. Create an administrator account and use a standard account daily.
5. Require a password the moment the screen wakes.
6. Set a long, unique PIN or passphrase.
7. Add two-factor authentication to email, banking, and work accounts.
8. Install a password manager and generate new passwords.
9. Walk the privacy dashboard and trim camera, microphone, location, and ad settings.
10. Confirm the firewall is on, sharing is off, and backups and device location are running.

That is roughly half an hour of unglamorous clicking. Put a reminder in your calendar to revisit these settings every three months, since updates reset some of them and new features quietly add new permissions. A laptop you configured deliberately is far less interesting to anyone who did not buy it.

Photo: ThorstenF / Pixabay