Windows 11

Post-Installation Setup Guide

A Comprehensive Step-by-Step Reference

Covers: Security · Privacy · Drivers · Performance · Developer Setup

For Windows 11 24H2 (Build 26100+)

 PHASE 1: INITIAL SETUP & MICROSOFT ACCOUNT

1.1 Microsoft Account vs. Local Account

What it does: Links your Windows session to a Microsoft account (cloud sync, OneDrive, app
purchases) or runs as standalone local.
Why it matters: Microsoft accounts enable seamless sync, BitLocker key backup, and Store access —
but send usage data to Microsoft. A local account keeps all data on-device.
📍 Path: Settings → Accounts → Your info
▶ Status: Recommended
Trade-offs: Microsoft Account: easy recovery, synced settings, OneDrive integration — less private.
Local Account: full data isolation — no automatic BitLocker key escrow, limited Store access.
• Tip: Use a Microsoft account during setup, then switch to a local account via Settings → Accounts →
Sign-in options.

1.2 Device Naming

What it does: Sets a unique hostname for your machine visible on the network, in system logs, and in
SSH connections.
Why it matters: The default name (e.g., DESKTOP-XY7Z2) is meaningless. A descriptive name (e.g.,
LAPTOP-WORK) aids network identification and WSL.
📍 Path: Settings → System → About → Rename this PC
▶ Status: Recommended
Trade-offs: Requires a restart to apply.

1.3 Region, Language, and Time Zone

What it does: Sets locale for date/time formatting, keyboard layout, and regional app behavior.
Why it matters: Incorrect settings cause date parsing errors in apps, wrong currency symbols, and
misconfigured timestamps in logs.
📍 Path: Settings → Time & Language → Language & Region / Date & Time
▶ Status: Recommended

PHASE 2: WINDOWS UPDATE STRATEGY

2.1 Run Windows Update Immediately

What it does: Downloads and installs security patches, bug fixes, and feature updates.
Why it matters: A fresh install may be months behind on critical security patches. Unpatched systems
are vulnerable to known exploits within minutes of connecting to the internet.
📍 Path: Settings → Windows Update → Check for updates
▶ Status: Required
• Step 1: Run Windows Update
• Step 2: Restart when prompted
• Step 3: Run Windows Update again — multiple passes are often needed

2.2 Optional Updates & Driver Updates

What it does: Installs Microsoft-published optional feature updates and OEM-signed driver updates.
Why it matters: Optional updates often include driver stability fixes and firmware updates that
significantly improve hardware compatibility.
📍 Path: Settings → Windows Update → Advanced options → Optional updates
▶ Status: Recommended

2.3 Configure Active Hours

What it does: Tells Windows not to restart for updates during your specified working hours.
Why it matters: Prevents unexpected reboots during presentations, recordings, or important work
sessions.
📍 Path: Settings → Windows Update → Advanced options → Active hours
▶ Status: Recommended
Trade-offs: Updates may queue longer if active hours span too wide a range. Windows limits the range
to 18 hours maximum.

2.4 Delivery Optimization (Bandwidth Control)

What it does: Controls whether your PC uploads Windows Update data to other PCs on the internet.
Why it matters: By default, Windows may use your internet upload bandwidth to serve updates to
strangers.
📍 Path: Settings → Windows Update → Advanced options → Delivery Optimization → Allow downloads from other
PCs
▶ Status: Recommended
Set to 'Devices on my local network' only, or disable entirely.

PHASE 3: DRIVER INSTALLATION & VERIFICATION

3.1 GPU Drivers

What it does: Installs optimized graphics drivers from NVIDIA, AMD, or Intel — not the generic
Microsoft-supplied drivers.
Why it matters: Generic drivers lack GPU-specific optimizations, may cause display artifacts, and
disable hardware video encoding, ray tracing, or multi-monitor features. Performance can be 2–10×
worse in GPU-intensive tasks.
📍 Path: Device Manager → Display adapters (verify driver version)
▶ Status: Required
Trade-offs: NVIDIA GeForce Experience includes telemetry; use the standalone DCH driver package for
a leaner install.
• NVIDIA: GeForce Experience or standalone driver from [Link]
• AMD: AMD Software Adrenalin Edition from [Link]
• Intel: Intel Arc & Iris Xe Graphics driver from [Link]

3.2 Chipset Drivers

What it does: Installs low-level drivers for the CPU/platform (AMD Ryzen Chipset, Intel Management
Engine, etc.).
Why it matters: Chipset drivers enable proper CPU core parking, PCIe power management, USB
controller behavior, and overall platform stability.
📍 Path: Device Manager → System devices
▶ Status: Required
• AMD: AMD Chipset Software from [Link]
• Intel: Intel Driver & Support Assistant (IDSA) from [Link]

3.3 Wi-Fi and Bluetooth Drivers

What it does: Replaces generic Windows wireless drivers with OEM-specific drivers.
Why it matters: Generic drivers may not support all Wi-Fi 6/6E features, have poor power
management, or cause intermittent disconnects.
📍 Path: Device Manager → Network adapters / Bluetooth
▶ Status: Recommended
Download from your laptop OEM's support page — search by model number (Dell, Lenovo, HP, ASUS,
etc.).

3.4 Audio Drivers

What it does: Installs Realtek, Dolby Atmos, or OEM-specific audio stack.
Why it matters: Generic HD Audio drivers lack equalizer controls, spatial audio, microphone noise
cancellation, and proper headphone/speaker switching.
📍 Path: Device Manager → Sound, video and game controllers
 ▶ Status: Recommended

3.5 Touchpad Drivers (Laptops)

What it does: Installs precision touchpad drivers (Synaptics, ELAN, or Windows Precision Touchpad).
Why it matters: OEM drivers enable advanced gesture support, palm rejection tuning, and pressure
sensitivity. Generic drivers can cause erratic cursor behavior.
📍 Path: Device Manager → Human Interface Devices / Mice and other pointing devices
▶ Status: Recommended
Windows Precision Touchpad (WPT) drivers are preferred over older Synaptics legacy drivers — WPT
integrates directly with Windows gesture settings.

3.6 BIOS/UEFI Firmware Updates

What it does: Updates the motherboard/laptop firmware to the latest version.
Why it matters: BIOS updates fix CPU microcode vulnerabilities, improve memory compatibility, enable
new features, and fix boot stability issues.
📍 Path: Use OEM app: Dell Command Update / Lenovo Vantage / HP Support Assistant / ASUS MyASUS
▶ Status: Recommended
Trade-offs: A failed BIOS flash can brick a device. Always ensure the laptop is on AC power before
updating. Never interrupt the process.

3.7 Verify with Device Manager

What it does: Shows any devices with missing or problematic drivers.
Why it matters: A yellow exclamation mark means a device is non-functional or using a suboptimal
driver.
📍 Path: Right-click Start → Device Manager
▶ Status: Required

PHASE 4: SECURITY HARDENING

4.1 Windows Security Overview

What it does: Confirms Windows Defender Antivirus, Firewall, and other security features are active.
Why it matters: All items should show green checkmarks before proceeding with any other
configuration.
📍 Path: Settings → Privacy & Security → Windows Security → Open Windows Security
▶ Status: Required
4.2 BitLocker Drive Encryption
What it does: Encrypts your entire system drive so data is unreadable without your credentials or
recovery key, even if the drive is physically removed.
Why it matters: Laptops are frequently stolen. Without encryption, an attacker can remove your SSD
and read all files in minutes. BitLocker makes stolen data unreadable.
📍 Path: Settings → Privacy & Security → Device encryption (Home) OR Control Panel → BitLocker Drive
Encryption (Pro)
▶ Status: Required
Trade-offs: Negligible performance impact on modern SSDs with hardware AES acceleration. Older
HDDs may see ~5–10% read/write slowdown.
Critical: Save your recovery key to your Microsoft account AND print a physical copy. Losing the
recovery key means permanent data loss.

4.3 Secure Boot Verification

What it does: Ensures only cryptographically signed bootloaders run at startup, protecting against
bootkits and rootkits.
Why it matters: Secure Boot prevents malware from loading before Windows — a class of attack that
traditional antivirus cannot stop.
📍 Path: Settings → Privacy & Security → Windows Security → Device Security → Secure Boot
▶ Status: Required
Verify via: Start → Run → msinfo32 → look for 'Secure Boot State: On'

4.4 Core Isolation / Memory Integrity (HVCI)

What it does: Uses hardware virtualization to protect kernel memory from tampering, blocking kernel-
level exploits and driver attacks.
Why it matters: Prevents sophisticated malware (including many ransomware loaders) from injecting
code into the Windows kernel — even with administrator privileges.
📍 Path: Settings → Privacy & Security → Windows Security → Device Security → Core isolation details → Memory
integrity
▶ Status: Recommended
Trade-offs: May cause 1–3% performance overhead. Some older drivers are incompatible — Windows
will list them if they block activation.

4.5 Controlled Folder Access (Ransomware Protection)

What it does: Blocks unauthorized apps from modifying files in protected folders (Documents,
Desktop, Pictures).
Why it matters: Ransomware's primary vector is encrypting personal files. Controlled Folder Access
stops unknown processes from writing to your documents.
📍 Path: Settings → Privacy & Security → Windows Security → Virus & Threat Protection → Manage Ransomware
Protection
▶ Status: Recommended
Trade-offs: Some legitimate apps may be blocked initially. Whitelist trusted apps via 'Allow an app
through Controlled folder access.'

4.6 Windows Firewall Configuration

What it does: Blocks unsolicited inbound network connections to your PC.
Why it matters: The firewall is your first line of defense against network-based attacks, especially on
public Wi-Fi.
📍 Path: Settings → Privacy & Security → Windows Security → Firewall & Network Protection
▶ Status: Required
Ensure ON for all three profiles (Domain, Private, Public). For Public networks: block all incoming
connections.

4.7 Disable SMBv1 (Advanced)

What it does: Disables the legacy SMB 1.0 file sharing protocol, exploited by WannaCry and NotPetya.
Why it matters: SMBv1 has critical, unpatched vulnerabilities. While Windows 11 ships with it disabled,
verifying explicitly takes 30 seconds.
📍 Path: PowerShell (Admin): Set-SmbServerConfiguration -EnableSMB1Protocol $false
▶ Status: Advanced

PHASE 5: PRIVACY SETTINGS REVIEW

5.1 Telemetry and Diagnostics

What it does: Controls how much usage data Windows sends to Microsoft (Basic, Optional).
Why it matters: Optional diagnostics send app usage, browsing metadata, and typing data. Reducing
this limits data sharing while maintaining system health reporting.
📍 Path: Settings → Privacy & Security → Diagnostics & Feedback
▶ Status: Recommended
• Set 'Diagnostic data' to 'Required only'
• Disable 'Improve inking and typing'
• Disable 'Tailored experiences'
• Delete existing diagnostic data using the 'Delete' button
5.2 Advertising ID
What it does: A unique identifier that allows apps to track you for targeted advertising across the
system.
Why it matters: Disabling it prevents apps from correlating your usage across different applications for
advertising purposes.
📍 Path: Settings → Privacy & Security → General → 'Let apps show me personalized ads by using my advertising ID'
▶ Status: Recommended

5.3 App Permissions Audit

Review each of the following permission categories and restrict to per-app only or disable entirely:

Permission Path Suffix Recommended Action

Location Privacy & Security → Location Off or per-app

Camera Privacy & Security → Camera Per-app only

Microphone Privacy & Security → Microphone Per-app only

Contacts Privacy & Security → Contacts Off unless needed

Call history Privacy & Security → Call history Off

Notifications Privacy & Security → Notifications Per-app

Account info Privacy & Security → Account info Review per-app

▶ Status: Recommended

5.4 Activity History

What it does: Logs your activities (files opened, websites visited) locally and optionally to Microsoft.
Why it matters: Disabling prevents a local log of your activity being sent to Microsoft.
📍 Path: Settings → Privacy & Security → Activity History
▶ Status: Recommended
Uncheck 'Store my activity history on this device' and 'Send my activity history to Microsoft'.

PHASE 6: STORAGE CONFIGURATION

6.1 Storage Sense

What it does: Automatically cleans up temporary files, old Windows Update downloads, and Recycle
Bin on a schedule.
Why it matters: Without it, Windows Update caches, temp files, and deleted items accumulate silently,
potentially consuming tens of gigabytes.
📍 Path: Settings → System → Storage → Storage Sense
▶ Status: Recommended
• Run Storage Sense: Every month (or when disk space is low)
• Delete Recycle Bin files after: 30 days
• Leave Downloads folder alone unless you want auto-cleanup

6.2 Default Save Locations

What it does: Redirects where new documents, music, pictures, and videos are saved by default.
Why it matters: On systems with a small C: SSD and a larger D: data drive, redirecting personal folders
prevents filling your system drive.
📍 Path: Settings → System → Storage → Advanced storage settings → Where new content is saved
▶ Status: Recommended

6.3 Drive Health Check

What it does: Verifies your primary drive is healthy using S.M.A.R.T. data.
Why it matters: Early detection of drive failure prevents catastrophic data loss.
📍 Path: Recommended tool: CrystalDiskInfo (free download) — shows reallocated sectors and temperature
▶ Status: Recommended

PHASE 7: POWER AND BATTERY OPTIMIZATION

7.1 Power Plan Selection

What it does: Sets the balance between performance and power consumption.
Why it matters: Correct power plan prevents unnecessary battery drain while ensuring adequate
performance when needed.
📍 Path: Settings → System → Power & Battery → Power mode
▶ Status: Recommended
• On battery: 'Better power efficiency' or 'Balanced'
• Plugged in: 'Balanced' or 'Best performance' for demanding tasks

7.2 Screen and Sleep Timeouts

What it does: Defines when the screen turns off and the system sleeps.
Why it matters: Reducing idle timers is the single most effective way to conserve laptop battery
without affecting real-world usage.
📍 Path: Settings → System → Power & Battery → Screen and sleep
▶ Status: Recommended
• On battery: Screen off 3 min, Sleep after 5 min
• Plugged in: Screen off 10 min, Sleep after 20 min

7.3 Battery Charge Limit

What it does: Limits maximum charge to 80% to extend long-term battery health.
Why it matters: Lithium-ion batteries degrade faster when repeatedly charged to 100%. An 80% limit
can nearly double battery lifespan over 2–3 years.
📍 Path: OEM apps: Dell Power Manager / Lenovo Vantage / ASUS MyASUS / HP Command Center
▶ Status: Recommended
Trade-offs: Effective battery capacity will be lower when you need it for travel — disable temporarily
before long trips.

7.4 Fast Startup

What it does: Saves the Windows kernel state to disk on shutdown (hybrid shutdown/hibernate) to
speed up boot.
Why it matters: Fast Startup can cause issues with dual-boot Linux setups (Linux may see the Windows
partition as locked) and sometimes prevents BIOS entry.
📍 Path: Control Panel → Power Options → Choose what the power buttons do → Turn on fast startup
▶ Status: Optional
Trade-offs: Disable if you dual-boot or experience boot issues. Keep enabled for faster single-boot
systems.

7.5 Hibernate
What it does: Saves the full system state to disk and shuts down completely, allowing resume without
draining battery.
Why it matters: Modern Standby (S0) keeps the system partially awake and can drain 10–20%
overnight. Hibernate is a better choice if the laptop will be in a bag.
📍 Path: Settings → System → Power & Battery → Screen and sleep → 'Hibernate after'
▶ Status: Recommended
If Hibernate is not visible, run in Admin PowerShell: powercfg /hibernate on

PHASE 8: PERFORMANCE OPTIMIZATION

8.1 Startup Apps
What it does: Controls which apps automatically launch when Windows starts.
Why it matters: Many apps add themselves to startup, increasing boot times and consuming memory
silently.
📍 Path: Settings → Apps → Startup (or Task Manager → Startup apps)
▶ Status: Recommended
• Typically disable: Microsoft Teams, Spotify, Discord, Steam, Epic Games Launcher
• Keep: OneDrive, security tools, VPN clients you want always-on

8.2 Game Mode

What it does: Prioritizes CPU and GPU resources for the active game, deprioritizes background
processes.
Why it matters: Can meaningfully improve frame rates and reduce stuttering in CPU-bound games.
📍 Path: Settings → Gaming → Game Mode → On
▶ Status: Recommended
Trade-offs: Can occasionally cause issues with screen recording or streaming software; toggle off if
problems occur.

8.3 Hardware-Accelerated GPU Scheduling (HAGS)

What it does: Moves GPU memory management from the CPU to the GPU, reducing latency.
Why it matters: Reduces CPU bottleneck and input latency in GPU-heavy workloads.
📍 Path: Settings → System → Display → Graphics → Change default graphics settings → Hardware-accelerated
GPU scheduling
▶ Status: Recommended
Trade-offs: Can cause instability on some driver versions — revert if you experience issues. Requires
NVIDIA 10-series+ or AMD 5000-series+.

8.4 Variable Refresh Rate (VRR)

What it does: Enables adaptive sync between GPU and monitor to eliminate screen tearing.
Why it matters: Eliminates distracting screen tearing without the input latency overhead of V-Sync.
📍 Path: Settings → System → Display → Graphics → Change default graphics settings → Variable refresh rate
▶ Status: Recommended
Trade-offs: Only effective if your monitor supports G-Sync, FreeSync, or VESA Adaptive-Sync.

PHASE 9: BROWSER SETUP AND SECURITY

Browser Options

Browser Best For Privacy Performance

Microsoft Edge Windows integration, PDFs, Moderate Excellent

Office

Firefox Privacy, customization High Good

Brave Privacy-first, built-in ad block Very High Good

Google Chrome Ecosystem, extensions Low (Google Good

telemetry)

9.1 DNS over HTTPS (DoH)

What it does: Encrypts DNS queries so your ISP and network observers cannot see every domain you
visit.
Why it matters: Standard DNS queries are unencrypted. DoH prevents ISP logging, man-in-the-middle
interception, and DNS-based tracking.
📍 Path: Firefox: Settings → Privacy & Security → DNS over HTTPS | Edge: Settings → Privacy → Security → Use
secure DNS
▶ Status: Recommended

9.2 Password Manager

What it does: Generates and stores unique, strong passwords for every site.
Why it matters: Reusing passwords is the #1 cause of account takeovers. A password manager
eliminates this risk entirely.
📍 Path: Recommended: Bitwarden (free, open-source), 1Password, or Windows Hello/Microsoft Authenticator
▶ Status: Required

9.3 Two-Factor Authentication (2FA)

What it does: Adds a second verification step beyond just a password.
Why it matters: Even if your password is stolen in a data breach, 2FA prevents account access without
your second factor.
📍 Path: Microsoft Account: [Link] → Security → Advanced security options
▶ Status: Required
Trade-offs: Avoid SMS-based 2FA when possible — use TOTP app codes (Microsoft Authenticator or
Authy) instead.
 PHASE 10: BACKUP AND RECOVERY CONFIGURATION

10.1 OneDrive Folder Backup

What it does: Syncs Documents, Desktop, and Pictures folders to Microsoft cloud automatically.
Why it matters: Automatic cloud backup means you never lose work files to hardware failure or
ransomware. Version history allows recovering previous file versions.
📍 Path: System Tray → OneDrive → Settings → Backup → Manage backup
▶ Status: Recommended
Trade-offs: Syncs to Microsoft's servers. Disable if you use a different cloud provider or prefer local-
only backup.

10.2 File History (Local Backup)

What it does: Continuously backs up personal files to an external drive or network location on a time-
based schedule.
Why it matters: OneDrive syncs changes immediately (including accidental deletions). File History
provides time-based local backup independent of cloud sync, completing the 3-2-1 backup strategy.
📍 Path: Settings → System → Storage → Advanced storage settings → Backup options → Add a drive
▶ Status: Recommended

10.3 System Restore Points

What it does: Creates snapshots of Windows system files and registry that you can roll back to if
something breaks.
Why it matters: Indispensable when a driver update, software install, or registry change causes
instability. Lets you undo without a full reinstall.
📍 Path: Search → 'Create a restore point' → System Properties → System Protection → Create
▶ Status: Required
Best practice: Create a manual restore point after fully configuring your system and before installing any
major software or drivers.

10.4 Recovery Drive

What it does: Creates a bootable USB with Windows recovery tools.
Why it matters: If Windows fails to boot, a recovery drive lets you access repair tools, System Restore,
command prompt, and reset options without a separate installer.
📍 Path: Search → 'Create a recovery drive' → follow wizard (requires 16GB+ USB drive)
▶ Status: Recommended
 PHASE 11: ESSENTIAL SOFTWARE INSTALLATION
Productivity

Software Purpose Notes

Microsoft 365 / LibreOffice Office suite M365 subscription or free LibreOffice

Obsidian / Notion Notes and knowledge Obsidian is local-first; Notion is cloud

base

7-Zip Archive management Free, open-source — replace WinRAR

Everything (voidtools) Instant file search Indexes entire drive in seconds

ShareX Screenshots & screen Free, powerful, open-source

recording

PowerToys Windows power user From Microsoft — FancyZones, Run, etc.

utilities

Security

Software Purpose

Bitwarden Password manager — free, open-source

Malwarebytes (free) On-demand malware scanner alongside Windows Defender

Mullvad / ProtonVPN Encrypted internet traffic — essential on public Wi-Fi

Microsoft Authenticator / TOTP two-factor authentication codes

Authy

Media and Utilities

Software Purpose

VLC Media Player Video/audio playback — plays everything

HandBrake Video conversion — free, GPU-accelerated

GIMP / Photopea Image editing — GIMP local, Photopea browser-based

CrystalDiskInfo Drive health monitoring — S.M.A.R.T. data

HWiNFO64 Hardware monitoring — temps, voltages, clocks

WizTree Disk space visualization — fastest on the market

 Revo Uninstaller Complete software removal with registry cleanup

PHASE 12: NETWORKING AND WI-FI SETTINGS

12.1 Set Network Profile Correctly

What it does: Marks your network as Private (trusted) or Public (untrusted), which determines firewall
behavior.
Why it matters: Misclassifying your home network as Public blocks features; marking a coffee shop
network as Private is a security risk.
📍 Path: Settings → Network & Internet → Wi-Fi → click your network → Network profile type
▶ Status: Required
• Home/office network = Private
• All other networks (café, hotel, airport) = Public

12.2 DNS Server Configuration

What it does: Changes the DNS resolver from your ISP's default to a faster, more private alternative.
Why it matters: ISP DNS servers are often slower, may log all your queries, and can inject ads or
redirect failed lookups.
📍 Path: Settings → Network & Internet → Wi-Fi → Hardware Properties → DNS server assignment → Edit →
Manual
▶ Status: Recommended
• Cloudflare: [Link] / [Link] (fastest, strong privacy policy)
• Google: [Link] / [Link] (reliable, Google logs queries)
• Quad9: [Link] (blocks known malicious domains)

12.3 Random Hardware Addresses (Wi-Fi Privacy)

What it does: Randomizes your Wi-Fi MAC address per network, preventing tracking by network
operators.
Why it matters: Your real MAC address can be used to track your physical presence across Wi-Fi
networks and by third-party analytics.
📍 Path: Settings → Network & Internet → Wi-Fi → Hardware properties → Random hardware addresses
▶ Status: Optional
Trade-offs: May occasionally cause issues with networks that whitelist MAC addresses (some
corporate/school networks).
 PHASE 13: FILE EXPLORER AND USABILITY TWEAKS

13.1 Show File Extensions

What it does: Displays the actual file extension (.exe, .pdf, .jpg) for all files.
Why it matters: Hidden extensions are a classic malware trick — '[Link]' looks like '[Link]'
with extensions hidden. This is a basic but critical security measure.
📍 Path: File Explorer → View → Show → File name extensions
▶ Status: Required

13.2 Show Hidden Files

What it does: Makes hidden files and folders visible in File Explorer.
Why it matters: Essential for developers and power users who need to access AppData, .ssh folders,
dotfiles, and configuration directories.
📍 Path: File Explorer → View → Show → Hidden items
▶ Status: Recommended

13.3 Restore Classic Context Menu

What it does: Makes right-click show the full context menu instead of the simplified Windows 11
version.
Why it matters: The Windows 11 default context menu hides many useful options (Copy as path, Open
with, Send to) behind 'Show more options.'
📍 Path: Registry: HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32
▶ Status: Optional
Trade-offs: Personal preference — the simplified menu is intentional in Windows 11's design.
reg add "HKCU\Software\Classes\CLSID\{86ca1aa0-34aa-4e8b-a509-50c905bae2a2}\InprocServer32" /f /ve

13.4 Taskbar Customization

What it does: Removes clutter from the taskbar for a cleaner, more focused workspace.
Why it matters: The default taskbar includes Widgets, Search, and Task View buttons that many users
never use, consuming screen real estate.
📍 Path: Settings → Personalization → Taskbar
▶ Status: Optional
• Remove: Search bar (use Win key instead), Task View button, Widgets
• Keep: System tray, notification area
 PHASE 14: DEVELOPER WORKSTATION SETUP

14.1 Windows Terminal

What it does: Microsoft's modern, GPU-accelerated terminal emulator supporting multiple shells, tabs,
and panes.
Why it matters: The legacy Windows Console ([Link]/conhost) lacks Unicode support, split panes,
and modern keyboard shortcuts. Windows Terminal is the foundation of a developer workflow.
📍 Path: Microsoft Store → 'Windows Terminal' OR: winget install [Link]
▶ Status: Required

14.2 PowerShell 7
What it does: The cross-platform, open-source PowerShell — newer, faster, and more capable than
Windows PowerShell 5.1.
Why it matters: PowerShell 7 has better error handling, JSON support, foreach-object -parallel, and is
actively maintained. Windows PowerShell 5.1 is in maintenance mode.
▶ Status: Recommended
winget install [Link]

14.3 WSL2 (Windows Subsystem for Linux)

What it does: Runs a real Linux kernel inside Windows, providing a full Linux command-line
environment with near-native performance.
Why it matters: Most backend development, DevOps tooling, and open-source software targets Linux.
WSL2 gives you Linux tools without dual-booting or a VM performance penalty.
📍 Path: PowerShell (Admin): wsl --install
▶ Status: Required
wsl --install
wsl --set-default-version 2
wsl --update
Default: Ubuntu 24.04 LTS. Configure Windows Terminal to use WSL2 as the default profile.

14.4 Package Managers

Winget (built-in): Windows Package Manager — use for installing Windows apps from the command
line.
winget install --id [Link]
winget install --id [Link]
winget install --id [Link].3.12
winget install --id [Link]
Scoop (optional): Installs apps to user directory without admin rights — great for portable developer
tools.
▶ Status: Optional

14.5 Git Configuration

What it does: Configures the Git version control system with your identity, preferred editor, and SSH
authentication.
Why it matters: Git is the foundation of all modern software development workflows. Correct
configuration from day one prevents commit attribution errors and authentication headaches.
▶ Status: Required
git config --global [Link] "Your Name"
git config --global [Link] "you@[Link]"
git config --global [Link] "code --wait"
git config --global [Link] main

SSH Key Setup: Generate an ED25519 key and add to GitHub/GitLab:

ssh-keygen -t ed25519 -C "you@[Link]"
ssh-add ~/.ssh/id_ed25519
cat ~/.ssh/id_ed25519.pub | clip # then paste into GitHub Settings → SSH Keys

14.6 VS Code
What it does: A lightweight, extensible code editor with deep Git integration, debuggers, and language
support.
Why it matters: VS Code has become the standard editor for most programming languages. Setting it
up properly from day one (especially the WSL extension) saves significant time.
▶ Status: Required
winget install [Link]

Essential extensions to install:

• GitLens — enhanced Git integration
• Prettier — code formatting
• Remote - WSL — edit WSL files from VS Code
• Docker — container management
• Language packs for your primary languages (Python, C++, Java, Rust, etc.)

14.7 WSL2 Ubuntu Setup

Run these commands inside your WSL2 Ubuntu terminal:

sudo apt update && sudo apt upgrade -y

 sudo apt install build-essential curl wget git zsh
sh -c "$(curl -fsSL [Link]

Install nvm for [Link] version management inside WSL:

curl -o- [Link] | bash
nvm install --lts
▶ Status: Required

14.8 Docker Desktop

What it does: Runs Docker containers on Windows using WSL2 as the backend.
Why it matters: Containers are essential for modern development, enabling reproducible
environments, microservices, and running databases without native installs.
▶ Status: Recommended
winget install [Link]
Enable WSL2 backend in Docker Desktop Settings → Resources. Test with: docker run hello-world

PHASE 15: COMMON MISTAKES TO AVOID

15.1 Installing Drivers from Random Sites
❌ Downloading GPU or chipset drivers from third-party 'driver update' sites.
✅ Always download directly from NVIDIA, AMD, Intel, or your laptop OEM's official support page.
Third-party driver sites frequently bundle malware.

15.2 Disabling Windows Update Entirely

❌ Using registry hacks or tools to permanently disable Windows Update.
✅ Use Active Hours and update scheduling to control when updates install, not whether they install. A
permanently unpatched system is critically vulnerable.

15.3 Skipping BitLocker Key Backup

❌ Enabling BitLocker but not saving the recovery key.
✅ A TPM reset, Windows update error, or motherboard replacement can trigger BitLocker recovery
mode. Without the key, data is permanently inaccessible.

15.4 Installing 'System Optimizer' Software

❌ Using tools like CCleaner, Advanced SystemCare, or Registry Cleaners.
✅ Registry cleaners can break applications and provide no meaningful benefit on modern Windows.
Use Windows' built-in Disk Cleanup and Storage Sense instead.
15.5 Running as Administrator by Default
❌ Using an administrator account for all daily work.
✅ Create a standard user account for daily use. Any malware running under your session inherits your
permissions. Standard user = limited blast radius.

15.6 Using Pirated Software

❌ Downloading cracked software from torrents or warez sites.
✅ Cracked software is one of the most common malware delivery mechanisms. Use free/open-source
alternatives, student licenses, or legitimate subscriptions.

15.7 Not Creating Restore Points Before Major Changes

❌ Installing drivers or making system changes without a restore point.
✅ A bad driver or update can destabilize Windows. Create a restore point before any major change —
it takes 30 seconds and can save hours of recovery work.
 QUICK-START CHECKLISTS

✅ 30-MINUTE ESSENTIAL SETUP CHECKLIST

Priority tasks for a secure, functional system — do these before anything else.

☐ Connect to internet and run Windows Update (restart when prompted, then run again)
☐ Install GPU drivers from NVIDIA/AMD/Intel official site
☐ Verify Windows Security is fully green (Settings → Privacy & Security → Windows Security)
☐ Enable BitLocker and save recovery key to Microsoft account AND print a copy
☐ Disable Advertising ID (Settings → Privacy & Security → General)
☐ Set Diagnostic data to 'Required only' (Settings → Privacy & Security → Diagnostics & Feedback)
☐ Audit Location, Camera, and Microphone permissions (Settings → Privacy & Security)
☐ Show file name extensions in File Explorer (View → Show → File name extensions)
☐ Disable non-essential Startup apps (Task Manager → Startup apps tab)
☐ Install your browser of choice and enable DNS over HTTPS
☐ Install a password manager (Bitwarden recommended) and start using it
☐ Enable 2FA on your Microsoft account ([Link] → Security)
☐ Create a System Restore Point (Search → 'Create a restore point' → Create)
☐ Set up OneDrive backup for Documents, Desktop, Pictures
☐ Rename your PC (Settings → System → About → Rename this PC)
☐ Set home network profile to Private (Settings → Network & Internet → Wi-Fi)
☐ Install 7-Zip

✅ 2-HOUR POWER-USER SETUP CHECKLIST

Everything in the 30-minute checklist, plus:

Drivers & Firmware

☐ Install chipset drivers (AMD Chipset Software or Intel DSA)
☐ Install Wi-Fi, Bluetooth, and audio drivers from OEM support page
☐ Install touchpad drivers (laptops)
☐ Check for BIOS/firmware update via OEM app
☐ Open Device Manager — resolve any yellow warning icons
Security
☐ Enable Core Isolation / Memory Integrity (Windows Security → Device Security)
 ☐ Enable Controlled Folder Access / Ransomware Protection
☐ Verify Secure Boot is On (run msinfo32)
☐ Block all inbound connections on Public network profile
☐ Disable SMBv1 (Admin PowerShell: Set-SmbServerConfiguration -EnableSMB1Protocol $false)
Privacy
☐ Fully audit all app permissions (location, camera, mic, contacts, notifications)
☐ Disable Activity History sync to Microsoft
☐ Disable Delivery Optimization uploading to internet PCs
☐ Disable Tailored experiences and inking/typing improvement
Storage & Power
☐ Configure Storage Sense (monthly cleanup, 30-day Recycle Bin)
☐ Set default save locations if you have a secondary drive
☐ Check drive health with CrystalDiskInfo
☐ Configure power plan and screen/sleep timers
☐ Enable battery charge limit via OEM app (laptops)
Performance
☐ Enable Game Mode and Hardware-Accelerated GPU Scheduling
☐ Enable Variable Refresh Rate (if compatible monitor)
☐ Configure Active Hours for Windows Update
Backup
☐ Configure File History to an external drive
☐ Create a Windows system image backup
☐ Create a recovery drive (16GB+ USB)
☐ Verify OneDrive sync is working correctly
Software & Tweaks
☐ Install: VLC, Everything, PowerToys, ShareX, CrystalDiskInfo, HWiNFO64
☐ Install Malwarebytes free for on-demand scans
☐ Set up browser: uBlock Origin, password manager extension, HTTPS-only mode
☐ Show hidden files in File Explorer
☐ Pin frequently used folders to File Explorer Quick Access

✅ DEVELOPER WORKSTATION CHECKLIST (CS Student)

Everything in the Power-User checklist, plus:

Core Developer Tools

☐ Install Windows Terminal (winget install [Link])
☐ Install PowerShell 7 (winget install [Link])
 ☐ Install WSL2 (Admin PowerShell: wsl --install, then restart)
☐ Set WSL2 default version: wsl --set-default-version 2 && wsl --update
☐ Install Git (winget install [Link])
☐ Configure Git: name, email, defaultBranch main, editor = code --wait
☐ Generate SSH key (ssh-keygen -t ed25519) and add to GitHub/GitLab
☐ Install VS Code (winget install [Link])
☐ Install VS Code extensions: GitLens, Prettier, Remote-WSL, language packs
WSL2 Ubuntu Setup
☐ sudo apt update && sudo apt upgrade -y
☐ sudo apt install build-essential curl wget git zsh
☐ Install Oh My Zsh for improved shell experience
☐ Install nvm inside WSL for [Link] version management
☐ Install pyenv inside WSL for Python version management
☐ Test VS Code in WSL: cd to a project folder and run 'code .'
Language Runtimes (Windows-side)
☐ Python: winget install [Link].3.12
☐ [Link] via nvm-windows: winget install [Link]
☐ Java OpenJDK 21: winget install [Link].21
☐ Rust: winget install [Link]
Containerization
☐ Install Docker Desktop (winget install [Link])
☐ Enable WSL2 backend in Docker Desktop Settings → Resources
☐ Test: docker run hello-world
Developer Environment Polish
☐ Install a Nerd Font (JetBrains Mono NF or Cascadia Code NF)
☐ Configure Windows Terminal: default profile = WSL2, set font and color scheme
☐ Create ~/.ssh/config with shortcuts for frequently accessed servers
☐ Install GitHub CLI: winget install [Link]
☐ Install Postman or Bruno for API testing
☐ Install DBeaver for database management
☐ Configure PATH environment variables for all installed runtimes
☐ Start a dotfiles repository to track your shell and editor configuration

Guide current as of Windows 11 24H2 (Build 26100). Settings paths may vary slightly in future Windows versions.