What a setup can do (step catalogue)

More than installing Windows

Installing Windows is the first step, not the whole job. A StageReady setup is an ordered pipeline of steps — each one optional, configurable, and reorderable — that takes a device from a blank disk to genuinely ready-to-hand-over. Every step reports to your dashboard live and is recorded permanently.

The steps below are the building blocks. Compose the ones a given client needs into a template, layer per-client add-ons on top, and generate a code.

Operating system & first boot

• Install Windows 11 — true bare-metal install from a blank disk (skipped automatically if the device already has Windows; everything after it still runs). The right OEM driver pack is injected during install.
• OOBE configuration — auto-answers the out-of-box screens (region, keyboard, EULA, optional Wi-Fi) and sets the computer name (supports a serial-number placeholder). Optionally pre-creates the local admin so the "who will use this device?" screen is skipped entirely and the machine lands ready at the sign-in screen — no duplicate account.
• Language & region — display language, keyboard layout, regional format, home location and timezone for the installed OS and all new users. Autopilot-compatible.

Identity & enrollment

• Autopilot registration — captures the hardware hash and registers the device into the client's Microsoft Autopilot via Graph.
• Domain join — joins an on-prem Active Directory domain (optional OU path), using a service credential resolved from the vault — never stored on the USB.
• Local administrator — creates or updates a managed/break-glass local admin account; the password comes from the vault and is never persisted.

Applications

• Install applications — one step installs a whole list of apps, in order, from the curated catalogue: MSI/EXE straight from the vendor's own download URL (with Authenticode signature verification) or Winget packages. See Application deployment for the full story and the ready-to-deploy catalogue.

Security & compliance

• BitLocker — enables BitLocker on the OS drive with a TPM protector; the recovery key is escrowed centrally and visible per device in your dashboard, across every client.
• Install certificate — installs a certificate (public .cer or private-key .pfx) from the vault into the machine store, before any network or VPN flow.
• Secure Boot check — reports whether Secure Boot is enabled; can optionally fail the setup if it isn't.
• HP / Dell BIOS configuration — applies firmware settings in WinPE before Windows installs: Secure Boot, TPM, virtualization, boot order, wireless/Bluetooth, Wake-on-LAN and more, with an optional BIOS admin password.

Hardware & updates

• Hardware update — brings drivers, firmware and BIOS to the OEM-supported level using the manufacturer's own tooling (Dell Command Update, HP CMSL + Image Assistant, Lenovo). Cleanly skips on hardware it doesn't recognise (VMs, Surface).
• Windows Update — installs OS quality/security and Microsoft-published driver updates across reboots until they're exhausted. (OEM firmware, optional drivers and feature upgrades are out of scope — use Hardware Update for OEM firmware/drivers.)

Configuration

• Registry (HKLM) — writes machine-wide registry values (any type).
• Registry (default user) — seeds the Default user profile so every new user inherits the settings — the per-user defaults Intune can't reach on a fresh device.

How they fit together

Every step is optional and independently configurable, and the whole pipeline is reorderable. You build the sequence once as a template, then specialise it per client with profiles; nothing is copy-pasted between clients. New step types can be added without ever rebuilding the USB.