What a setup can do (step catalogue)

More than installing Windows

Installing Windows is the first step, not the whole job. A StageReady setup is an ordered pipeline of steps, each one optional, configurable, and reorderable, that takes a device from a blank disk to genuinely ready-to-hand-over. Every step reports to your dashboard live and is recorded permanently.

The steps below are the building blocks. Compose the ones a given client needs into a template, layer per-client add-ons on top, and generate a code.

In WinPE

Before Windows exists: BIOS settings, then the OS install itself.

Before first boot

Identity, accounts, certificates, and the answer file for OOBE.

During setup

Apps, registry, language and region, as SYSTEM.

After handover

Long-running update loops that survive reboots and report back.

Operating system & first boot

• Install Windows 11: true bare-metal install that wipes the target disk — it runs whenever you boot from the USB, whatever was on the disk before. Start the job from inside an existing Windows instead and it's skipped, along with the rest of the WinPE phase including BIOS configuration, which needs WinPE to run. The right OEM driver pack is injected during install.
• OOBE configuration: auto-answers the out-of-box screens (region, keyboard, EULA, optional Wi-Fi) and sets the computer name (supports a serial-number placeholder). Optionally pre-creates the local admin so the "who will use this device?" screen is skipped entirely and the machine lands ready at the sign-in screen, with no duplicate account.
• Language & region: display language, keyboard layout, regional format, home location and timezone for the installed OS and all new users. Autopilot-compatible.

Identity & enrollment

• Autopilot registration: captures the hardware hash and registers the device into the client's Microsoft Autopilot via Graph.
• Domain join: joins an on-prem Active Directory domain (optional OU path), using a service credential resolved from the vault and never stored on the USB.
• Local administrator: creates or updates a managed/break-glass local admin account; the password comes from the vault and is never persisted.

Applications

• Install applications: one step installs a whole list of apps, in order, from the curated catalogue: MSI/EXE straight from the vendor's own download URL (with Authenticode signature verification) or Winget packages. See Application deployment for the full story and the ready-to-deploy catalogue.

Security & compliance

• Install certificate: installs a certificate (public .cer or private-key .pfx) from the vault into the machine store, before any network or VPN flow.
• Secure Boot check: reports whether Secure Boot is enabled; can optionally fail the setup if it isn't.
• HP / Dell BIOS configuration: applies firmware settings in WinPE before Windows installs: Secure Boot, TPM, virtualization, boot order, wireless/Bluetooth, Wake-on-LAN and more, with an optional BIOS admin password.

Hardware & updates

• Hardware update: brings drivers, firmware and BIOS to the OEM-supported level using the manufacturer's own tooling (Dell Command Update, HP CMSL + Image Assistant, Lenovo). Cleanly skips on hardware it doesn't recognise (VMs, Surface).
• Windows Update: installs OS quality/security and Microsoft-published driver updates across reboots until they're exhausted. (OEM firmware, optional drivers and feature upgrades are out of scope; use Hardware Update for OEM firmware/drivers.)

Configuration

• Registry (HKLM): writes machine-wide registry values (any type).
• Registry (default user): seeds the Default user profile so every new user inherits the settings. These are the per-user defaults Intune can't reach on a fresh device.

How they fit together

Every step is optional and independently configurable, and the whole pipeline is reorderable. You build the sequence once as a template, then specialise it per client with profiles; nothing is copy-pasted between clients.