Routine for a new microscope computer (Win 10)

This ist the routine we go through with the computers from our Leica microscopes when they are new. Operating system is Windows 10 Enterprise LTSB 2016. You have to log in as administrator to do most of these thing

1. Copy down the MAC-Address of the computer. We need to enter this into a database of the local IT (using a computer that is already online) otherwise the computer won't be allowed into the network.
   In a power shell, "use ipconfig /all" to see all connections. When in doubt, write down all potentially correct MACs and enter them in the data base.
2. Before attaching the Ethernet cable, make sure that Windows Defender is running.
3. Download and install Windows Updates.
4. Switch the keyboard layout to "German" system wide, since we use keybords with the German layout. Do not change other system parameters to Germany, or the Leica LAS X version 3 will complain.
   In Windows settings - Time & Language - Region & Language, add German (Germany).
   In Control Panel => Language => Advanced settings => Override for default input method: Select German, then save. This sets the keyboard for the current user.
   In the language window, now go on Change date, time, or number formats. In the new window, go to the Administrative Tab and click on 'Copy settings'. The current user should show: Display: English US, Input: German, Format: English US. If so, select copy to "Welcome Screen" and "New user accounts".
5. Change the Leica admin password from the standard value to something secret.
6. Create a new account with administrator rights for the core facility staff. The account "administrator" is hidden by Windows 10, so it cannot be used. I suggest something with an a, so that it will be at the beginning of the account list and easier to find, like admincore or so.
7. Set the user account Control Settings to "always notify": In the task bar search box type UAC. Pull the lever in the new window to the highest position. This makes it more difficult for unwanted software to get installed accidentally.
8. Create a bunch of needed accounts, e.g. for core facility staff members.
9. Install Mozilla Firefox as default browser. (Internet exporer had too many security problems over the years)
10. Deinstall Adobe Reader. This software asks for a manual download of an update program and subsequent manual installation every few weeks, which is very anoying if you have ten computers to take care of. pdf files can also be viewed with Firefox.
    Go to " Control Panel\All Control Panel Items\Programs and Features ", select Adobe Reader and click uninstall
11. Change computer name to the name of the microscope and the workgroup to Bioimaging:
    Control Panel\All Control Panel Items\System => click on 'change settings' and 'change'
12. Remove unimportant program icons from the public desktop, to minimize confusion for users.
13. Once the system is allowed on the network, install the system logger for our Stratacore PPMS booking system. The 'new tracker' of PPMS does not only track but also does access control on the microscope computer. We don't want that, therefore we still use the old tracker. Request download links from Stratocore. In the PPMS software, as administrator go the the settings page of the system that you are installing (which obviously requires that this page was previously created). Open the usage tracker configuration but only to copy the id and the code to the ppms.vbs.txt you downloaded. Continue according to downloaded instructions.
14. Using Firefox, create direct access icons for the web page of the microscope (at our core facility web site) and for the booking system on the public desktop:
    Open the page in firefox.
    Grab the icon left to the http:// address line and drag it on the desktop. This puts the icons on the user's desktop. When all icons are there, move them to the public desktop: Select them all, cut them (ctrl-x) and paste them to C:\Users\Public\Desktop
15. Office Installation: Install Office Profesional Plus 2016 from its folder on the USB stick. Do not "continue online". We only have the de-de Version, so continue with installation of the multi-language pack to install en-us option.
    Activate office (details): Start a Power shell "as administrator" and type in these two commands:
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /sethst:mskms.lrz.de
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /act
    

    Unplug USB stick and reboot when Windows Updates from above are done. One one machine, it took over an hour, until the updates were installed and the login screen appeared.
    Login as admin and check for Windows Updates again. A lot of Office updates should appear,  install them. If not, check in "Advanced options" whether "Give me updates for other Microsoft products when I update Windows" is selected.

16. Once everyting is set up, make a backup of the system partition (C:\) on an external hard drive. To do this, best boot from a CD or USB stick with your backup software. We use Acronis 2016. Repeat backup every time the system configuration is changed. Don't delete the 'old' backup too soon. The backup might be needed if a Windows Update should turn out to be incompatible with the microscope software, hard disk failure, manually messed up configuration files, virus infections or enrcrypting trojans.
    To boot from USB, you first have to enable this option in the system BIOS. On a HP Z6, hit F10 during boot. In BIOS-Advanced, Secure Boot: change from "Legacy Support Disable, Secure Boot enable" to "Legacy Support enable, Secure Boot disable". Also in Boot options, enable Legacy Boot Order. (A restart may be required between these two steps). Attach USB Stick if not yet done, Rebooot and hit ESC key to enter startup menu. Select "Boot Legacy - General UDisk" to boot from the Acronis USB stick.

To avoid viruses and trojans two as much as possible, discourage use of USB devices for data transfer. Instead, network transfer should be encouraged. Free USB slots may be blocked physically with USB-locks.