Setting up a new laptop: account, encryption and updates

What order should you work in?

The order matters. On Windows, the account you sign in with decides whether encryption switches on by itself and where the recovery key is stored. Updates close known security holes before your own files and programs arrive. Tidying up comes last, once you can see what is really on the machine.

Tip: Do the set-up at home, with time for large updates and your passwords close at hand.

Which account should you use?

Microsoft states that Windows 11 Home and Windows 11 Pro for personal use require an internet connection and a Microsoft account during initial set-up. Use your own account, not a relative's, and not an email address you might lose access to later. On Windows, this account is also where the encryption recovery key ends up, so it deserves the same protection as your email inbox. Your email account comes first: protect the key to everything else explains how.

Germany's Federal Office for Information Security (BSI) recommends a separate, password-protected account for everyone who uses the device. For everyday work, the BSI advises an account with limited rights and keeping the administrator account for major system changes and installing new programs. If malware gets onto the computer, administrator rights let it reach deeper into the system.

Do the next steps as administrator all the same, because only an administrator can set up Device encryption or FileVault. Add an everyday account without those rights at the end.

Is your laptop encrypted?

Encryption protects your data if the laptop is lost or stolen. Austria's official Onlinesicherheit platform explains why: an unencrypted drive can be removed and the data on it read.

According to Microsoft, Device encryption is turned on when you first sign in with a Microsoft account, provided the device meets the prerequisites. With a local account it is not turned on automatically. Device encryption is also available on Windows Home, while BitLocker comes with the Pro, Enterprise and Education editions.

On a Mac with Apple silicon or the T2 security chip, Apple says your data is encrypted automatically. FileVault adds another layer: without your login password, nobody can decrypt or access the data.

Where should the recovery key live?

Microsoft explains that you may be asked for the BitLocker recovery key during startup, for example after a hardware change or because of a security risk. The key is a 48-digit number. If you set the laptop up with a Microsoft account, open aka.ms/myrecoverykey on another device and sign in with that account to find it.

Microsoft lists other places where the key may be: a printout or a USB flash drive, and for work devices the organisation's account. Keep at least one copy away from the laptop.

On a Mac you decide when turning on FileVault whether your iCloud account can unlock the disk or whether you get a recovery key. Apple is clear: if you forget your login password, cannot reset it and no longer have the recovery key either, you will not be able to log in, and your files and settings will be lost for good. Keep the key somewhere safe that is not your Mac.

Tip: For a simple system to store keys and codes so you can still find them years from now, see Storing recovery codes safely and finding them again.

How do you bring the system up to date?

The Swiss National Cyber Security Centre advises letting security updates install automatically. France's cybermalveillance.gouv.fr adds a sensible check: turn on automatic download and installation where the software allows it, and, if need be, check manually that updates really run.

Apple notes that macOS updates also bring new versions of built-in apps such as Safari, Notes, Messages and Apple Music. To tell genuine update notices from fake browser pop-ups, read Doing updates without being fooled by a pop-up.

Tip: After the restart, check again until nothing new appears. Only then copy your files across.

Which pre-installed programs can you remove?

Look at what came on the laptop. Spain's national cybersecurity institute INCIBE advises uninstalling the junk apps that come pre-installed on a new computer, because they can contain unpatched vulnerabilities. The Swiss NCSC puts it more generally: only install the programs and apps you need, and always download them from official sources.

Take your time. Microsoft points out that some apps and programs are built into Windows and cannot be uninstalled, and that some cannot be removed from the Settings app at the moment, only from Control Panel. If a program has a name you do not recognise, check the laptop maker's support pages first to see whether your device needs it.

What do cyber security agencies and consumer groups across Europe recommend?

The steps on the device are the same everywhere. National bodies stress different points and add the screen lock, firewall and backup to your first hour.

Make a first backup as soon as your files are on the new machine. An external drive as a backup: a routine you can repeat shows how to turn it into a habit.

An example: Siobhán sets up her new Mac

Fictional example: Siobhán in Galway has bought a Mac for her bookkeeping work at home. She signs in as the administrator, opens System Settings and turns on FileVault. She chooses a recovery key rather than iCloud, because she wants a copy she controls herself.

She writes the key on a card and keeps it with her passport, not in the laptop sleeve. Then she runs Software Update, installs what is offered and restarts.

Her partner sometimes borrows the Mac, so Siobhán creates a separate account for him without administrator rights. Finally she makes her first backup on an external drive before moving any invoices across.