Routine for a new microscope computer (Win 11)

This is the suggested routine for new computers from our Leica microscopes with operating system Windows 11. You have to log in as administrator to do most of these things. As of July 2026, this routine is only a suggestion, not tested yet. It is based on the respective procedure for Win 10 computers, with some alterations.

1. Copy down the MAC-Address(es) of the computer. We need to enter this into a database of the local IT (using a computer that is already online) otherwise the computer won't be allowed into the network.
   In a Powershell, use "ipconfig /all" to see all connections. When in doubt, write down all potentially correct MACs and enter them in the data base.
2. Before attaching the Ethernet cable, make sure that Windows Defender is running.
3. Download and install available Windows Updates.
4. Switch the keyboard layout to "German" system wide, since we use keyboards with the German layout. Do not change other system parameters to German(y), or the Leica LAS X version 3 will complain.
   
   • In Windows settings - Time & Language - Region & Language, add German (Germany).
   • In Control Panel => Language => Advanced settings => Override for default input method: Select German, then save. This sets the keyboard for the current user. This setting may have moved in Win11 to Settings → Time & Language → Typing → Advanced keyboard settings → Override for default input method
   • In the language window, now go on Change date, time, or number formats. In the new window, go to the Administrative Tab and click on 'Copy settings'. The current user should show: Display: English US, Input: German, Format: English US. If so, select copy to "Welcome Screen" and "New user accounts".
5. Change the Leica admin password from the standard value to something secret.
6. Create a new account with administrator rights for the core facility staff. The account "administrator" exists but is disabled by default, so it cannot be used. I suggest something with an a, so that it will be at the beginning of the account list and easier to find, like admincore or so.
7. Set the User Account Control (UAC) settings to "always notify": In the task bar search box type UAC. Pull the lever in the new window to the highest position. This makes it more difficult for unwanted software to get installed accidentally.
8. Create a bunch of needed accounts, e.g. for core facility staff members. If the new computer is a replacement computer for a pre-existing microscope, see "Moving Users from old to new microscope computer".
9. Install Mozilla Firefox as default browser. 
10. Uninstall Adobe Reader. This software asks for a manual download of an update program and subsequent manual installation every few weeks, which is very annoying if you have ten computers to take care of. pdf files can also be viewed with Firefox.
    Go to "Control Panel\All Control Panel Items\Programs and Features", select Adobe Reader and click uninstall
11. Change computer name to the name of the microscope and the workgroup to Bioimaging:
    Control Panel\All Control Panel Items\System => click on 'change settings' and 'change'
12. Disable "Sign-in last interactive user automatically after restart"

    When a user shuts the system down without explicit log-out (i.e. the usual way), after the next restart, Windows 10/11 automatically signs that last user back in, meaning all his or her background programs are running again. That includes the PPMS tracker with which we monitor microscope usage, so that usage would be reported incorrectly when none occurred (after a restart). There are two options to disable this behavior. Both cause the same change in the registry, so use either one or the other.

    Option 1: Start the Group Policy Editor (gpedit.msc) and navigate to Computer Configuration ->Administrative Templates -> Windows Components -> Windows Logon Options. Double-click on "Sign-in last interactive user automatically after a system-initiated restart" and set it to disable (Thanks to www.thewindowsclub.com).

    Option 2: Alternatively, you can directly edit the Registry: In the registry, navigate to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System . Create DisableAutomaticRestartSignOn of type REG-DWORD and set the value to 1.

13. A related setting is Windows Fast Startup, which is enabled by default in newer Windows versions: Windows is not really shutting down, but only hibernating. To make sure that every user is getting a new and clean start, this behavior should be disabled:

    • Open Control Panel (search for it via Start).
    • Hardware and Sound → Power Options.
    • Click "Choose what the power button does" (left sidebar).
    • Click "Change settings that are currently unavailable" (needs admin rights — this unlocks the grayed-out section below).
    • Under Shutdown settings, uncheck "Turn on fast startup (recommended)". If this is greyed out, hibernation is disabled and all is well. 
    • Click Save changes.
      
      Alternatively, use "powercfg /h off" in a Powershell with admin rights. This disables hibernation entirely, which also disables Fast Startup as a side effect.

14. Disable "Lock" in the start menu

    Problem: When a user quits Windows with "Lock" instead of "Sign out" s/he is still logged in, meaning the tracker is still reporting usage and the user will be charged. Best is to disable this option: Go to "Control Panel\Hardware and Sound\Power Options" and click on "Choose what the power buttons do". Select "Change Settings that are currently unavailable" and remove the checkmark in front of "Lock". winaero.com has the whole procedure more detailed and with images.

15. Remove unimportant program icons from the public desktop, to minimize confusion for users.
16. Once the system is allowed on the network, install the system logger for our Stratocore PPMS booking system. The 'new tracker' of PPMS does not only track but also does access control on the microscope computer. We don't want that, therefore we still use the old tracker. Request download links from Stratocore. In the PPMS software, as administrator go the settings page of the system that you are installing (which obviously requires that this page was previously created). Open the usage tracker configuration but only to copy the id and the code to the ppms.vbs.txt you downloaded. Continue according to downloaded instructions. 
    If the new computer is a replacement of an old computer, copy the ppms.vbs from there and make sure that it is disabled on the old system!
17. In the device manager check date of display adapter driver. Depending on its age, you may want to update the driver or install the latest version from the nvidia web site. If you have more similar computers to update, copy the installation file to a respective folder on a server or USB stick.
18. In the device manager check for non-recognized hardware. Just to be safe. 
19. In File Explorer menu View-Options-View, show file extensions and hidden files (this is the admin account.)
20. Check that Windows Defender is working and up to date.
21. Office Installation: Install Office 2024 from its folder on the USB stick. Do not "continue online". We only have the de-de version, so continue with installation of the multi-language pack to install en-us option.
    Activate office (details): Start a Power shell "as administrator" and type in these two commands:
    cscript "C:\Program Files\Microsoft Office\OfficeXX\ospp.vbs" /sethst:mskms.lrz.de
    cscript "C:\Program Files\Microsoft Office\OfficeXX\ospp.vbs" /act
    where XX has to be replaced with the correct number. Also the path may be c:\Program Files\Microsoft Office\root\OfficeXX (with "root"). 

    Unplug USB stick and reboot when Windows Updates from above are done. On one machine, it took over an hour, until the updates were installed and the login screen appeared.
    Login as admin and check for Windows Updates again. A lot of Office updates may appear,  install them. If not, check in "Advanced options" whether "Give me updates for other Microsoft products when I update Windows" is selected.

22. Some of our systems have Hyvolution installed. Huygens needs new license files on the new computers to run. 

23. Once everything is set up, make a backup of the system partition (C:\) on an external hard drive. To do this, best boot from a CD or USB stick with your backup software. Repeat backup every time the system configuration is changed. Don't delete the 'old' backup too soon. The backup might be needed if a Windows Update should turn out to be incompatible with the microscope software, hard disk failure, manually messed up configuration files, virus infections or encrypting trojans.
    To boot from USB, you may first have to enable this option in the system BIOS. On a HP Z6, hit F10 during boot. In BIOS-Advanced, Secure Boot: change from "Legacy Support Disable, Secure Boot enable" to "Legacy Support enable, Secure Boot disable". Also in Boot options, enable Legacy Boot Order. (A restart may be required between these two steps). Attach USB Stick if not yet done, Reboot and hit ESC key to enter startup menu. Select "Boot Legacy - General UDisk" to boot from the Acronis USB stick.

To avoid viruses and trojans as much as possible, discourage use of USB devices for data transfer. Instead, network transfer should be encouraged. Free USB slots may be blocked physically with USB-locks.