Routine for a new microscope computer (Win 11)

Page Version: 2026-08-12

This is the suggested routine for new computers from our Leica microscopes with operating system Windows 11. You have to log in as administrator to do most of these things. As of August 2026, this routine is only a suggestion, not tested yet. It is based on the respective procedure for Win 10 computers, with some alterations. Parts of this page and the linked scripts were created with the help of AI.

If this page should prove useful to you, I would apreciate a message to dietzel@lmu.de, to estimate if it is worth putting them online. 

1. Copy down the MAC-Address(es) of the computer. We need to enter this into a database of the local IT (using a computer that is already online) otherwise the computer won't be allowed into the network.
   In a Powershell, use "ipconfig /all" to see all connections. When in doubt, write down all potentially correct MACs and enter them in the data base.
2. Before attaching the Ethernet cable, make sure that Windows Defender is running.
3. Download and install available Windows Updates.
4. Switch the keyboard layout to "German" system wide, since we use keyboards with the German layout. Do not change other system parameters to German(y), or the Leica LAS X version 3 will complain.
   
   • In Windows settings - Time & Language - Region & Language, add German (Germany).
   • In Control Panel => Language => Advanced settings => Override for default input method: Select German, then save. This sets the keyboard for the current user. This setting may have moved in Win11 to Settings → Time & Language → Typing → Advanced keyboard settings → Override for default input method
   • In the language window, now go on Change date, time, or number formats. In the new window, go to the Administrative Tab and click on 'Copy settings'. The current user should show: Display: English US, Input: German, Format: English US. If so, select copy to "Welcome Screen" and "New user accounts".
5. Change the Leica admin password from the standard value to something secret.
6. Create a new account with administrator rights for the core facility staff. The account "administrator" exists but is disabled by default, so it cannot be used. I suggest something with an a, so that it will be at the beginning of the account list and easier to find, like admincore or so.
7. Set the User Account Control (UAC) settings to "always notify": In the task bar search box type UAC. Pull the lever in the new window to the highest position. This makes it more difficult for unwanted software to get installed accidentally.
8. Create a bunch of needed accounts, e.g. for core facility staff members. If the new computer is a replacement computer for a pre-existing microscope, see "Moving Users from old to new microscope computer".
9. Install Mozilla Firefox as default browser. 
10. Uninstall Adobe Reader. This software asks for a manual download of an update program and subsequent manual installation every few weeks, which is very annoying if you have ten computers to take care of. pdf files can also be viewed with Firefox.
    Go to "Control Panel\All Control Panel Items\Programs and Features", select Adobe Reader and click uninstall
11. Change computer name to the name of the microscope and the workgroup to Bioimaging:
    Control Panel\All Control Panel Items\System => click on 'change settings' and 'change'
12. Disable "Sign-in last interactive user automatically after restart"

    When a user shuts the system down without explicit log-out (i.e. the usual way), after the next restart, Windows 10/11 automatically signs that last user back in, meaning all his or her background programs are running again. That includes the PPMS tracker with which we monitor microscope usage, so that usage would be reported incorrectly when none occurred (after a restart). There are two options to disable this behavior. Both cause the same change in the registry, so use either one or the other.

    Option 1: Start the Group Policy Editor (gpedit.msc) and navigate to Computer Configuration ->Administrative Templates -> Windows Components -> Windows Logon Options. Double-click on "Sign-in last interactive user automatically after a system-initiated restart" and set it to disable (Thanks to www.thewindowsclub.com).

    Option 2: Alternatively, you can directly edit the Registry: In the registry, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System . Create DisableAutomaticRestartSignOn of type REG-DWORD and set the value to 1.

13. A related setting is Windows Fast Startup, which is enabled by default in newer Windows versions: Windows is not really shutting down, but only hibernating. To make sure that every user is getting a new and clean start, this behavior should be disabled:

    • Open Control Panel (search for it via Start).
    • Hardware and Sound → Power Options.
    • Click "Choose what the power button does" (left sidebar).
    • Click "Change settings that are currently unavailable" (needs admin rights — this unlocks the grayed-out section below).
    • Under Shutdown settings, uncheck "Turn on fast startup (recommended)". If this is greyed out, hibernation is disabled and all is well. 
    • Click Save changes.
      
      Alternatively, use "powercfg /h off" in a Powershell with admin rights. This disables hibernation entirely, which also disables Fast Startup as a side effect.

14. Disable "Lock" in the start menu

    Problem: When a user quits Windows with "Lock" instead of "Sign out" s/he is still logged in, meaning the tracker is still reporting usage and the user will be charged. Best is to disable this option: Go to "Control Panel\Hardware and Sound\Power Options" and click on "Choose what the power buttons do". Select "Change Settings that are currently unavailable" and remove the checkmark in front of "Lock". winaero.com has the whole procedure more detailed and with images.

15. Remove unimportant program icons from the public desktop, to minimize confusion for users.
16. Once the system is allowed on the network, install the system logger for our Stratocore PPMS booking system. The 'new tracker' of PPMS does not only track but also does access control on the microscope computer. We don't want that, therefore we still use the old tracker. Request download links from Stratocore. In the PPMS web interface, as administrator go to the settings page of the system that you are installing (which obviously requires that this page was previously created). Open the usage tracker configuration but only to copy the id and the code to the ppms.vbs.txt you downloaded. Continue according to downloaded instructions to activate it. 
    If the new computer is a replacement of an old computer, copy the ppms.vbs from there, deactivate it on the old and activate it on the new system. 
17. In the device manager check date of display adapter driver. Depending on its age, you may want to update the driver or install the latest version from the nvidia web site. If you have more similar computers to update, copy the installation file to a respective folder on a server or USB stick.
18. In the device manager check for non-recognized hardware. Just to be safe. 
19. In File Explorer menu View-Options-View, show file extensions and hidden files (this is the admin account.)
20. Check that Windows Defender is working and up to date.
21. Office Installation: Install Office 2024 from its folder on the USB stick. See Office folder for a text file with instructions. Should activation be necessary, try the following (works only at our university like this)
    Activate office (details): Start a Power shell "as administrator" and type in these two commands:
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /sethst:mskms.lrz.de
    cscript "C:\Program Files\Microsoft Office\Office16\ospp.vbs" /act
    Both should give some kind of positive feedback. Should it not work, check if path is different, e.g. c:\Program Files\Microsoft Office\root\Office16 (with "root"). 

    Unplug USB stick and reboot when Windows Updates from above are done. It may take a long time until the updates are installed and the login screen appears.
    Login as admin and check for Windows Updates again. A lot of Office updates may appear,  install them. If not, check in "Advanced options" whether "Give me updates for other Microsoft products when I update Windows" is selected.

22. Some of our systems have Hyvolution/SVI Huygens installed. Huygens needs new license files on the new computers to run. 

23. Install a script that automatically deletes users' temporary files at shutdown. Without such a script, over time Browser cache files an other temp files may clock up the system drive (c:\). The script ShutdownCleanup.ps1 (rename to this file name after download) specifically deletes files in the following sub folders of all users' AppData folders:
    Firefox cache — AppData\Local\Mozilla\Firefox\Profiles\<profile>\cache2
    Chrome cache — AppData\Local\Google\Chrome\User Data\<Default or Profile *>\Cache
    Chrome code cache — same location, \Code Cache
    Chrome GPU cache — same location, \GPUCache
    Edge cache — AppData\Local\Microsoft\Edge\User Data\<Default or Profile *>\Cache
    Edge code cache — same location, \Code Cache
    Edge GPU cache — same location, \GPUCache
    Windows Temp folder — AppData\Local\Temp
    and all Recycle Bins. 
    
    The script can be run manually (with admin rights) or installed as follows such that it is executed on each system shutdown. The procedure is also explained in the text file ShutdownCleanup.txt.

1. Copy the file to a dedicated folder, e.g. C:\scripts

2. Make sure the folder is writable only with admin rights with the following command in an admin-powershell.
   icacls C:\Scripts /inheritance:r /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)RX"
   If necessary, this can be reset with icacls C:\Scripts /reset /T /C

3. Register the script as a Group Policy shutdown script:

1. Start gpedit.msc

2. Go to Computer Configuration → Windows Settings → Scripts (Startup/Shutdown) → Shutdown and double click Shutdown.

3. switch to the tab called PowerShell Scripts. This is not the default tab. 

4. Click Add, browse to the script's location and select it, click OK/Apply. 

24. A related problem is that some users tend to save large (image) files on the system partition, despite being instructed not to. To delete users' large (image) files on C:\, the script FreeSpaceOnC.ps1 can be used. Best copy it in the same folder as the previous script. Run manually as needed. Specifically, it can delete the following for all users.

    • All files in the Downloads folder and subfolders
    • All *.lif and *.lifext files in Documents or on the Desktop and their subfolders

    The script first lists all the respective files, the admin can then decide to delete them all, go through one-by-one or to delete nothing.

25. Once everything is set up, make a backup of the system partition (C:\) on an external hard drive. To do this, best boot from a CD or USB stick with your backup software. Repeat backup every time the system configuration is changed. Don't delete the 'old' backup too soon. The backup might be needed if a Windows Update should turn out to be incompatible with the microscope software, hard disk failure, manually messed up configuration files, virus infections or encrypting trojans.
    To boot from USB, you may first have to enable this option in the system BIOS. On a HP Z6, hit F10 during boot. In BIOS-Advanced, Secure Boot: change from "Legacy Support Disable, Secure Boot enable" to "Legacy Support enable, Secure Boot disable". Also in Boot options, enable Legacy Boot Order. (A restart may be required between these two steps). Attach USB Stick if not yet done, Reboot and hit ESC key to enter startup menu. Select "Boot Legacy - General UDisk" to boot from the Acronis USB stick.
26. To avoid viruses and trojans as much as possible, discourage use of USB devices for data transfer. Instead, network transfer should be encouraged. Physically block free USB slots, if desired, with USB-locks.