Routine for a new microscope computer (Win 11)

Page Version: 2026-09-04

This is the suggested routine for new computers for our Leica microscopes with operating system Windows 11. You have to log in as administrator to do most of these things. The guide was written for computers at our site. Some points obviously will not apply to other sites, but it is easy enough to skip those. 

As of September 2026, this routine was used only twice and thus not thoroughly tested. It is based on the respective procedure for Win 10 computers, with some alterations. Parts of this page and the linked scripts were created with the help of AI. 

If this page should prove useful to you, I would appreciate a message to dietzel@lmu.de, to estimate if it is worth putting them online. 

The HP Z4G5 does not boot if the side panel is open. This is unexpected and also stupid in case you need to trouble shoot the computer. But this is controlled by a hardware switch that you can see near the top front corner of the side panel and in the computer. The switch probably can be disabled with a coin and tape, but apparently not in the BIOS/UEFI.

Procedure

1. Copy down the MAC-Address(es) of the computer. We need to enter this into a database of the local IT (using a computer that is already online) otherwise the computer won't be allowed into the network.
   In a Powershell, use "ipconfig /all" to see all connections. When in doubt, write down all potentially correct MACs and enter them in the data base.
2. Before attaching the Ethernet cable, make sure that Windows Defender is running.
3. Download and install available Windows Updates.
4. Switch the keyboard layout to "German" system wide, since we use keyboards with the German layout. Do not change other system parameters to German(y), or the Leica LAS X version 3 will complain.
   
   • In Windows settings - Time & Language - Region & Language, add German (Germany).
   • In the Time & Language window now go to Typing - Advanced Keyboard Settings: German (don't override).
   • In the search box or in a shell, type intl.cpl to get the old Region window. Strangely, the search box will not suggest this, so you have to type all of it. In the new window, go to the administrative tab, click copy settings. The "current user" should show: Display: English US, Input: German, Format: English US. If so, select checkmarks for copy to "Welcome Screen" and "New user accounts" and ok.
5. Change the Leica admin password from the standard value to something secret. Be aware which keyboard layout is currently active!
6. Create a new account with administrator rights for the core facility staff. The account "administrator" exists but is disabled by default, so it cannot be used. I suggest something with an a, so that it will be at the beginning of the account list and easier to find, like admincore or so. Log in with the new account to continue.
7. Create a bunch of needed accounts, e.g. for core facility staff members. If the new computer is a replacement computer for a pre-existing microscope, see "Moving Users from old to new microscope computer".
8. Install Mozilla Firefox as default browser. To do that, right-click on the downloaded installer and install as admin. Else Firefox will be installed only for the current user.
9. Change computer name to the name of the microscope and the workgroup to Bioimaging: Go to Settings->System and do NOT use the link at the top of the window, or you will have to reboot to change the workgroup. Instead click on "Domain and Workgroup" and change both parameters there. If you can't find it type workgroup in the search window at the top and select the correct window from there. 
10. Disable "Sign-in last interactive user automatically after restart"

    When a user shuts the system down without explicit log-out (i.e. the usual way), after the next restart, Windows 10/11 automatically signs that last user back in, meaning all his or her background programs are running again. That includes the PPMS tracker with which we monitor microscope usage, so that usage would be reported incorrectly when none occurred (after a restart). There are two options to disable this behavior. Both cause the same change in the registry, so use either one or the other.

    Option 1: Start the Group Policy Editor (gpedit.msc) and navigate to Computer Configuration ->Administrative Templates -> Windows Components -> Windows Logon Options. Double-click on "Sign-in last interactive user automatically after a system-initiated restart" and set it to disable (Thanks to www.thewindowsclub.com).

    Option 2 (not tested under Win11): Alternatively, you can directly edit the Registry: In the registry, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System . Create DisableAutomaticRestartSignOn of type REG-DWORD and set the value to 1.

11. A related setting is Windows Fast Startup, which is enabled by default in newer Windows versions: Windows is not really shutting down, but only hibernating. It appears, however, that on Win 11 Leica Workstations (HP Z4-G5) hibernation is disabled already, so this problem should not occur. In a shell, type powercfg /a to confirm. If hibernation is active, then try the following to disable Fast Startup (copied from the Win10 procedure):

    • Open "Control Panel" (search for it via Start).
    • → Power Options.
    • Click "Choose what the power button does" (left sidebar).
    • Click "Change settings that are currently unavailable" (needs admin rights — this unlocks the grayed-out section below).
    • Under Shutdown settings, uncheck "Turn on fast startup (recommended)". If this is greyed out, hibernation is disabled and all is well. 
    • Click Save changes.
      
      Alternatively, use "powercfg /h off" in a Powershell with admin rights. This disables hibernation entirely, which also disables Fast Startup as a side effect.

12. Disable "Lock" in the start menu

    Problem: When a user quits Windows with "Lock" instead of "Sign out" s/he is still logged in, meaning the tracker is still reporting usage and the user will be charged. Best is to disable this option: Go to "Control Panel\Power Options" and click on "Choose what the power buttons do". Select "Change Settings that are currently unavailable" and remove the checkmark in front of "Lock" and save the changes. winaero.com has the whole procedure more detailed and with images.

13. Copy links to Firefox and possibly to the instrument web site in the folder of the Global Desktop: C:\Users\Public\Desktop. Delete Edge Icon if you want
14. Once the system is allowed on the network, install the system logger for our Stratocore PPMS booking system. The 'new tracker' of PPMS does not only track but also does access control on the microscope computer. We don't want that, therefore we still use the old tracker. Request download links from Stratocore. In the PPMS web interface, as administrator go to the settings page of the system that you are installing (which obviously requires that this page was previously created). Open the usage tracker configuration but only to copy the id and the code to the ppms.vbs.txt you downloaded. Continue according to downloaded instructions to activate it. 
    If the new computer is a replacement of an old computer, copy the ppms.vbs from there, deactivate it on the old and activate it on the new system.
    C:\Scripts may be a good location for the ppms.vbs file.
15. In the device manager check date of display adapter driver. Depending on its age, you may want to update the driver or install the latest version from the nvidia web site. If you do it, create a restore point first. If you have more similar computers to update, copy the installation file to a respective folder on a server or USB stick. 
16. In the device manager check for non-recognized hardware. Just to be safe, there should be none. 
17. In the File Explorer menu go on View-Options-View, and set the following: show file extensions, hidden files and system protected files (this is the admin account.) Only the latter was not yet set on the Leica Workstations.
18. Check that Windows Defender is working and up to date.
19. Office Installation: Install Office 2024. See Office Installation files folder for a text file with instructions. Should activation be necessary, activate Office (works only at our university like this, details):
    
    Start a Power shell "as administrator" and type in these two commands:
    
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /sethst:mskms.lrz.de
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /act
    
    Both should give some kind of positive feedback. Should it not work, check if path is different, e.g. C:\Program Files\Microsoft Office\root\Office16 (with "root"). 

    Reboot when Windows Updates from above are done. It may take a long time until the updates are installed and the login screen appears.
    Login as admin and check for Windows Updates again. A lot of Office updates may appear,  install them. If not, check in "Advanced options" whether "Give me updates for other Microsoft products when I update Windows" is selected.

20. Some of our systems have Hyvolution/SVI Huygens installed. Huygens needs new license files on the new computers to run because the Huygens hardware ID changes with a new computer or a new operating system. 

21. Install a script that automatically deletes users' temporary files at shutdown. Without such a script, over time browser cache files and other temp files may clog up the system drive (C:\). The script ShutdownCleanup.ps1 (rename to this file name after download) specifically deletes files in the following sub folders of all users' AppData folders:
    Firefox cache — AppData\Local\Mozilla\Firefox\Profiles\<profile>\cache2
    Chrome cache — AppData\Local\Google\Chrome\User Data\<Default or Profile *>\Cache
    Chrome code cache — same location, \Code Cache
    Chrome GPU cache — same location, \GPUCache
    Edge cache — AppData\Local\Microsoft\Edge\User Data\<Default or Profile *>\Cache
    Edge code cache — same location, \Code Cache
    Edge GPU cache — same location, \GPUCache
    Windows Temp folder — AppData\Local\Temp
    and all Recycle Bins. 
    
    The script can be run manually (with admin rights) or installed as follows such that it is executed on each system shutdown. On one system that was running over 5 years with >80 user accounts running it manually freed about 75 Gbytes, so running it automatically can be well worth it. The procedure is also explained in the text file ShutdownCleanup.txt.

1. Copy the file to a dedicated folder, e.g. C:\scripts. If desired the folder can be made writeable to admins only, but for convenience, this should be done only after all other operations in that folder are done. See below for how to do it. 

2. Register the script as a Group Policy shutdown script:

1. Start gpedit.msc

2. Go to Computer Configuration → Windows Settings → Scripts (Startup/Shutdown) → Shutdown and double click Shutdown.

3. switch to the tab called PowerShell Scripts. This is not the default tab. 

4. Click Add, browse to the script's location and select it, click OK/Apply. 

22. Other clean-up tools can be found under Clean-up Tools.

23. If you are moving user accounts from another system, now is a good time to install them, if you did not under #10 above. See Moving Users from old to new microscope computer.

24. Set the User Account Control (UAC) settings to "always notify": In the task bar search box type UAC. Pull the lever in the new window to the highest position. This makes it more difficult for unwanted software to get installed accidentally.

25. When you have done all that you need at this point with C:\Scripts, you can now write-protect it: If desired use the following command in an admin-powershell should make the folder writable only with admin rights. 
    
    icacls C:\Scripts /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
    
    If necessary, this can be reset with icacls C:\Scripts /reset /T /C

26. Once everything is set up, make a disaster-recovery-backup of the system partition (C:\) on an external hard drive with your favorite backup software. Such a backup allows to restore the system partition on a new hard disk or a new computer. Repeat backup every time the system configuration is changed. Don't delete the 'old' backup too soon. The backup might be needed if a Windows Update should turn out to be incompatible with the microscope software, hard disk failure, manually messed up configuration files, virus infections or encrypting trojans.
    To boot from USB for the recovery (possibly also for the backup, depending on your software), you may first have to enable this option in the system BIOS. On a HP Z6, hit F10 during boot. In BIOS-Advanced, Secure Boot: change from "Legacy Support Disable, Secure Boot enable" to "Legacy Support enable, Secure Boot disable". Also in Boot options, enable Legacy Boot Order. (A restart may be required between these two steps). Attach USB device if not yet done, Reboot and hit ESC key to enter startup menu. Select "Boot Legacy - General UDisk" to boot from the Acronis USB stick.
27. To avoid viruses and trojans as much as possible, discourage use of USB devices for data transfer. Instead, network transfer should be encouraged. Physically block free USB slots, if desired, with USB-locks.