New PC Setup Checklist: Set Up Windows 11 the Right Way

A fresh Windows 11 install ships with OEM bloatware, outdated drivers, and default settings that favor Microsoft’s telemetry over your performance. Fix that in the first hour. This checklist covers the full sequence: out-of-box experience (OOBE), updates, drivers, encryption, security baseline, debloating, and scripted app installation with winget. Each step includes copy-pasteable commands.

Quick Takeaways

• Order matters: Update Windows and firmware first, then drivers, then apps. Reversing this causes driver rollbacks and failed installs.
• Create a restore point and a recovery key backup before changing system settings or enabling BitLocker.
• Automate app installs with winget import. A single JSON file rebuilds your software stack on any future machine.
• Verify with built-in tools (sfc, DISM, Get-MpComputerStatus) before you call the setup finished.

Prerequisites and Hardware Baseline

Windows 11 enforces specific hardware requirements. Confirm them before you troubleshoot strange behavior later.

Open PowerShell as Administrator (right-click Start, select Terminal (Admin)) and run these checks:

Get-Tpm
Confirm-SecureBootUEFI
Get-ComputerInfo -Property OsName, OsVersion, OsBuildNumber, CsProcessors, CsTotalPhysicalMemory

• Get-Tpm reports whether TpmPresent and TpmReady are True.
• Confirm-SecureBootUEFI returns True when Secure Boot is active. An error means the PC runs in legacy BIOS mode.
• Get-ComputerInfo prints the OS edition, build, CPU, and RAM in bytes.

Phase 1: Complete the Out-of-Box Experience Correctly

Choose Your Account Type

Windows 11 Home requires a Microsoft account and an internet connection during OOBE. Pro allows a local account only when you skip the network step on many builds. Microsoft has removed several well-known bypass methods in recent releases, so do not rely on them. Check what your build supports at the OOBE screen.

A Microsoft account gives you automatic BitLocker/device-encryption key escrow and easier recovery. A local account gives you more privacy but demands that you store your recovery key yourself. Pick one deliberately.

Decline Optional Data Collection

On the privacy screen, set Diagnostic data to required only, and turn off Tailored experiences, Find my device (keep it on for laptops), and Advertising ID. You can change these later under Settings > Privacy & security.

Phase 2: Update Windows, Firmware, and Drivers

Run Windows Update to Completion

Open Settings > Windows Update and click Check for updates. Install everything, reboot, and check again. Repeat until the page reads “You’re up to date.” New PCs often need three or four cycles because cumulative updates unlock the next batch.

Enable Get the latest updates as soon as they’re available only if you want feature rollouts early. Production machines are safer without it.

Under Advanced options > Optional updates, review Driver updates. Install chipset, storage, and network drivers from here. Skip optional GPU updates if you plan to install the vendor driver manually.

Update BIOS/UEFI Firmware

Check your OEM’s support page for the latest firmware. Use the vendor tool (Dell Command Update, Lenovo Vantage, HP Support Assistant, ASUS Armoury Crate or MyASUS). Plug in AC power before flashing. A power loss during a firmware write can brick the board.

Install the GPU Driver Cleanly

Download the driver directly from NVIDIA, AMD, or Intel. Choose a clean install option when offered. This removes leftover profile data from the OEM image.

Phase 3: Lock Down Security

Enable Disk Encryption

Check encryption status:

manage-bde -status C:

• manage-bde is the BitLocker command-line tool.
• -status C: shows Conversion Status, Percentage Encrypted, and Protection Status.

Enable it on supported editions (Pro, Enterprise, Education):

Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -RecoveryPasswordProtector

• -EncryptionMethod XtsAes256 selects the strongest standard cipher mode.
• -RecoveryPasswordProtector generates a 48-digit recovery key. Save it immediately to your Microsoft account, a USB drive, or a password manager. Never store it only on the encrypted disk.

Windows 11 Home uses Device Encryption instead. Find it under Settings > Privacy & security > Device encryption.

Verify Microsoft Defender and the Firewall

Get-MpComputerStatus | Select-Object AMServiceEnabled, RealTimeProtectionEnabled, AntivirusSignatureLastUpdated
Get-NetFirewallProfile | Select-Object Name, Enabled
Set-MpPreference -PUAProtection Enabled

• The first command confirms real-time protection is on and signatures are current.
• The second confirms that Domain, Private, and Public firewall profiles are all True.
• -PUAProtection Enabled blocks potentially unwanted applications, such as bundled adware installers.

Remove any OEM trial antivirus (McAfee, Norton) first. Two active real-time scanners cause conflicts and slowdowns.

Create a Standard Daily-Use Account

Running as an administrator all day increases malware risk. Create a second administrator account for elevation, then switch your daily account to Standard under Settings > Accounts > Other users.

Turn On Core Isolation and Passkey Sign-in

Go to Settings > Privacy & security > Windows Security > Device security > Core isolation and enable Memory integrity. If it refuses, a legacy driver is blocking it. The page names the offending driver. Update or remove it.

Set up Windows Hello (PIN, fingerprint, or face) under Settings > Accounts > Sign-in options.

Phase 4: Debloat and Tune Performance

Create a Restore Point First

Enable-ComputerRestore -Drive "C:\"
Checkpoint-Computer -Description "Pre-Debloat Baseline" -RestorePointType MODIFY_SETTINGS

• Enable-ComputerRestore turns on System Protection for the drive.
• Checkpoint-Computer creates the snapshot. Windows limits automatic frequency, so a second restore point within 24 hours may be skipped by default.

Remove Preinstalled Apps

List installed packages:

Get-AppxPackage -AllUsers | Select-Object Name, PackageFullName

Remove a specific one (example: Clipchamp):

Get-AppxPackage *Clipchamp* | Remove-AppxPackage

• The * wildcard matches the package name.
• Remove-AppxPackage removes it for the current user.

Do not mass-delete packages. Removing Microsoft.WindowsStore, Microsoft.DesktopAppInstaller (which provides winget), or Microsoft.UI.Xaml libraries breaks other components. Uninstall OEM utilities you do not need via Settings > Apps > Installed apps.

Trim Startup Items

Press Ctrl + Shift + Esc, open the Startup apps tab, and disable anything with a High startup impact that you do not need at login. Cloud sync clients, chat apps, and OEM updaters are common offenders.

Set the Power Plan

powercfg /list
powercfg /setactive SCHEME_BALANCED
powercfg /hibernate off

• /list shows available schemes and their GUIDs.
• /setactive SCHEME_BALANCED activates the Balanced plan. Use SCHEME_MIN for High Performance on desktops.
• /hibernate off deletes hiberfil.sys and frees several gigabytes. Skip this on laptops where you rely on hibernation.

Confirm SSD TRIM Is Active

fsutil behavior query DisableDeleteNotify

A result of DisableDeleteNotify = 0 means TRIM is enabled. That is the correct state for SSDs.

Enable Storage Sense and Long Paths

Turn on Storage Sense under Settings > System > Storage to clear temp files automatically. Developers should also enable long path support:

New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\FileSystem" -Name "LongPathsEnabled" -Value 1 -PropertyType DWORD -Force

• This sets the LongPathsEnabled registry value, which lifts the legacy 260-character MAX_PATH limit for apps that opt in.

Phase 5: Install Your Software with winget

winget ships with current Windows 11 builds as part of App Installer. Update it and verify:

winget --version
winget upgrade --all --accept-source-agreements --accept-package-agreements

• winget upgrade --all updates every package winget can manage.
• The two --accept flags suppress interactive license prompts.

Install a baseline stack in one command:

winget install --id Google.Chrome --id Mozilla.Firefox --id 7zip.7zip --id VideoLAN.VLC --id Microsoft.PowerToys --id Microsoft.VisualStudioCode -e

• --id targets an exact package ID instead of a fuzzy name match.
• -e (--exact) forces an exact match.

Export and Reuse Your App List

Once you have your ideal setup, snapshot it:

winget export -o "$HOME\Documents\apps.json" --include-versions
winget import -i "$HOME\Documents\apps.json" --accept-package-agreements --ignore-unavailable

• export writes installed packages to JSON.
• import reinstalls them on the next machine. --ignore-unavailable skips packages that no longer exist in the source.

Store apps.json in a Git repository or cloud folder. A rebuild then takes minutes.

Optional: Enable WSL 2 for Linux Workloads

wsl --install
wsl --set-default-version 2

• wsl --install enables the required Windows features and installs the default Ubuntu distribution.
• Reboot when prompted. Reboot is required to finish the feature install.

Phase 6: Verify System Integrity and Back Up

Run the integrity tools in this order:

DISM /Online /Cleanup-Image /RestoreHealth
sfc /scannow

• DISM /RestoreHealth repairs the component store using Windows Update as the source.
• sfc /scannow checks protected system files against that repaired store. Running DISM first ensures SFC has a healthy source.

Then configure backups. Use File History or Windows Backup (Settings > Accounts > Windows backup) for user data. Create a full system image or use third-party imaging software before installing heavy software. Follow the 3-2-1 rule: three copies, two media types, one offsite.

Windows 11 Edition and Account Comparison

Troubleshooting and Real-World Recovery Routines

Windows Update Stuck at a Percentage or Failing (0x80070002, 0x800f0922)

Reset the update components:

net stop wuauserv
net stop bits
Rename-Item C:\Windows\SoftwareDistribution SoftwareDistribution.old
net start wuauserv
net start bits

• net stop halts the Windows Update (wuauserv) and BITS services.
• Renaming SoftwareDistribution forces Windows to rebuild the download cache.
• Restart the services, then rerun Windows Update. Error 0x80070002 usually means missing files in this cache.

Device Encryption or BitLocker Prompts for a Recovery Key After Every Boot

A firmware or Secure Boot change invalidated the TPM measurements. Suspend and resume protection:

Suspend-BitLocker -MountPoint "C:" -RebootCount 1
Resume-BitLocker -MountPoint "C:"

Run Suspend-BitLocker before BIOS updates to avoid the prompt entirely.

Slow Boot After Setup

Open Task Manager > Startup apps and sort by Startup impact. Check Settings > Apps > Startup as well. Use Event Viewer (eventvwr.msc) and filter Applications and Services Logs > Microsoft > Windows > Diagnostics-Performance > Operational for Event ID 100 to see boot duration and the slowest components.

Missing Wi-Fi or Ethernet After a Clean Install

Windows installation media often lacks the NIC driver. Download the driver on another device, copy it by USB, and install it through Device Manager (devmgmt.msc) with Update driver > Browse my computer. Alternatively, use a USB tethered phone, because Windows ships with a generic driver for tethering.

Blue Screen After a Driver Install

Boot to Windows Recovery Environment (hold Shift while selecting Restart, or interrupt boot three times). Select Troubleshoot > Advanced options > System Restore and choose the baseline restore point created earlier.

FAQ

How long does a Windows 11 new PC setup take?

Expect 90 to 150 minutes. Most of that time is Windows Update and driver downloads. The hands-on configuration takes around 30 minutes if you use the commands above.

Should I do a clean install of Windows 11 on a new PC?

Only if the OEM image contains heavy bloatware or the PC shipped with a damaged install. Otherwise, remove bundled apps manually and update drivers. A clean install requires you to find all OEM drivers yourself.

Is it safe to disable Windows Defender and use third-party antivirus?

Windows turns Defender off automatically when a registered third-party antivirus is active. Microsoft Defender scores competitively in independent testing, so most home users do not need a paid replacement. Never run two real-time scanners simultaneously.

What should I back up before resetting or reinstalling Windows?

Back up the Documents, Desktop, Pictures, and Downloads folders, browser profiles and password vaults, SSH keys, and your BitLocker recovery key. Export the app list with winget export to simplify reinstalling software.