Chapter 14 — Device lifecycle
Lesson map
Lesson 14 published. Map, example, EX053.
flowchart TD
N0["Learning outcomes"]
N1["14.1 New PCs"]
N2["14.2 Reassigning"]
N3["14.3 Leavers"]
N4["14.4 Disposal"]
N5["Joiner setup"]
N6["Broken, lost and mobile devices"]
N7["Inventory updates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX053"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["14.1 New PCs"]
N2["14.2 Reassigning"]
N3["14.3 Leavers"]
N4["14.4 Disposal"]
N5["Joiner setup"]
N6["Broken, lost and mobile devices"]
N7["Inventory updates"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX053"]
[Learning outcomes]
|
v
[14.1 New PCs]
|
v
[14.2 Reassigning]
|
v
[14.3 Leavers]
|
v
[14.4 Disposal]
|
v
[Joiner setup]
|
v
[Broken, lost and mobile devices]
|
v
[Inventory updates]
|
v
[Worked example] --> [Exercise EX053]
Learning outcomes
You will (1) set up new PCs consistently; (2) reassign PCs; (3) dispose securely.
14.1 New PCs
New PCs are enrolled in the management tool on first start, receiving settings, apps and encryption automatically. Enrolling on first start means a new PC receives the baseline settings, Defender, BitLocker and approved software before anyone uses it. This avoids the old pattern of PCs set up by hand with whatever settings the person chose. Nadia checks each new PC in the console after enrolment and adds it to the inventory with its serial number and user. Lena receives a monthly list of newly enrolled PCs, so she can confirm that each one belongs to a current member of staff.
14.2 Reassigning
When a PC moves to a new user, it is reset and re-enrolled rather than just handed over. Handing over a PC without resetting it can leave the previous user's files, saved passwords and permissions on it. Resetting and re-enrolling gives the new user a clean PC with the current baseline. Nadia updates the inventory with the new user's name. The previous user's files are kept on the file server, so nothing is lost. Because settings and software arrive automatically, a reset PC is ready for its new user the same day, with no setup done by hand.
14.3 Leavers
A leaver's account is disabled on their last day and their PC is collected. Disabling the account on the last day stops a former employee from reaching email or files afterwards. Collecting the PC ensures client data does not leave with them. Nadia also checks shared vaults in the password manager and changes any passwords the leaver knew, such as for a client portal. Lena tells Nadia about leavers in advance. The supplier confirms each leaver step on a short checklist, and Lena signs it, so a missed account or portal password is noticed straight away.
14.4 Disposal
Old drives are wiped using the manufacturer's secure erase or destroyed, with a certificate, following NIST SP 800-88. Old drives can hold client records for years after a PC stops working. Secure erase or destruction makes the data unrecoverable, and the certificate shows auditors what happened to each drive. When two old PCs were disposed of, the recycler's certificate listed their serial numbers, which Nadia matched against the inventory before closing their records. The certificates are filed with the inventory records of the disposed PCs, so an auditor can trace each drive from purchase to destruction.
Joiner setup
A joiner's PC is prepared before their first day: enrolled, encrypted and updated, with their standard account created. On day one Nadia helps them set up MFA and the password manager. Doing this in person avoids rushed setups that skip steps.
The joiner checklist is a single page and is signed off by Nadia and the new starter.
The checklist also confirms that the joiner has read the short security note and knows how to report a suspicious email, so good habits start on day one rather than after the first mistake.
Broken, lost and mobile devices
Broken PCs under warranty are sent for repair only after the drive is removed or encryption confirmed, since repair shops handle many devices. Lost devices are reported and recorded as in chapter 12. Phones that read work email are enrolled in app protection: work email and files live inside managed apps that can be wiped without touching personal photos or messages. This lets staff use their own phones while giving the firm control of its data. Before a leaver's account is disabled, their manager confirms which files should move to shared folders, so client work is not lost with the account.
Inventory updates
Every joiner, move and leaver changes the inventory: who has a PC, its serial number and its status. If these updates are missed, the inventory slowly stops matching reality, and checks based on it give wrong answers. Nadia adds the inventory update to the joiner and leaver checklists so it happens at the same time as the account change. A monthly comparison with the management tool catches anything missed. At the end of the placement, the inventory matches the management tool exactly for all thirty PCs, which Nadia records with the date as evidence.
Synthetic case. Events are synthetic.
Errors and limits
Handing a PC to a new user without reset leaves the previous user's files and settings.
Exercises
- EX053 — Enrolment benefit. What does automatic enrolment give? Rubric: 3 = consistent settings and encryption;; 2 = consistency;; 1 = vague;; 0 = none.
- EX054 — Reassignment. Why reset a PC before reassigning? Rubric: 3 = remove previous data;; 2 = clean;; 1 = vague;; 0 = none.
- EX055 — Disposal proof. What proves secure disposal? Rubric: 3 = certificate with serials;; 2 = certificate;; 1 = vague;; 0 = none.
- EX056 — Leaver timing. When should a leaver's account be disabled? Rubric: 3 = last day;; 2 = soon;; 1 = later;; 0 = none.
Synthesis
Consistent setup, reset and disposal keep data safe through a device's life.
Continue studying — chapter 14 of 18
← Chapter 13 (draft) · Course chapter index · Chapter 15 (draft) →