In most small companies every laptop is unique. One still runs Windows 10, another has Office 2019, a third has a browser two years out of date, and between them they run three different VPN client versions. Not because anyone planned it that way — because every machine was configured by hand at some point, in a hurry, "just so the person can start working".
That works while the company has five people. At 20 it starts to cost. At 40 it costs a lot — the cost is just scattered and nobody counts it. Every new setup is 3–5 hours of IT work. Every incident is a guessing game because "Ania's machine behaves differently from Marek's". Every OS migration is a project because nobody knows what's really on each machine.
Standardising workstations — colloquially the "system image" or "golden image" — is how you climb out of that swamp once and for all. It's not a conference topic. It's one of those areas where boring work, done properly, gives a very measurable return.
What a "system image" means in practice
In a small company, a "system image" doesn't need to mean an enterprise-grade solution with SCCM and a full-time Microsoft engineer. It means a few very concrete things:
- One consciously chosen Windows version for all office staff (today: Windows 11 Pro, the LTSC edition for shop-floor workstations).
- The same list of installed applications on every "standard" laptop: office suite, browser, VPN client, antivirus, chat, ERP client.
- The same security settings: BitLocker on, local user without admin rights, password policies, MFA on the Microsoft 365 account.
- The same network settings: office WiFi, printers, network drives — deployed automatically, no clicking around each machine.
The point isn't for everyone to have the same desktop and wallpaper. The point is that starting from the twenty-first laptop in your company, you know exactly what's inside — without opening it.
What it really costs when you skip this
At one of our clients — a 22-person distributor of industrial packaging — we counted this precisely before proposing a change. It came out like this:
- New laptop setup: 4 hours on average of the sole IT admin's time (unboxing, Windows install from USB, drivers, Office, the Comarch Optima client, VPN, printers, mail).
- 5 new hires in the last year + 3 hardware replacements after failures = 8 fresh setups.
- 32 hours of pure IT time per year on this one task alone. On top of that, his time on every incident where "something works differently", because two laptops have different driver versions for the network printer.
After rolling out a Windows image with automated configuration (Autopilot + Intune, on the Microsoft 365 Business Premium plan they already had), the setup time for a new laptop dropped from 4 hours to about 40 minutes — of which 30 minutes is the machine doing the work by itself, with the IT admin glancing at it twice. The employee gets the laptop in the box, signs in with their work account, and has a working environment half an hour later.
Savings: roughly 25 hours of IT time per year on deployments alone. On top of that, incomparably fewer "it doesn't work on my machine" tickets, because everyone has exactly the same thing.
How to approach this in an SME
You don't need a big project. You need to sit down for one afternoon, decide a few things, and then do them properly on one "reference" machine.
Step 1 — Define role profiles. A typical company has 2–3 profiles: office worker (Office, browser, mail, ERP), warehouse worker (scanner, WMS, browser), shop-floor workstation (dedicated software, minimum apps). Each profile has its own app set.
Step 2 — Pick one Windows version and one office suite. For most SMEs that's Windows 11 Pro and Microsoft 365 Apps. Don't mix Office 2019 with Microsoft 365 — the first is going away, the second updates itself.
Step 3 — Write down the "standard" apps for each profile. Name, version, install method, licence. It's a boring Excel table, but it saves you every time a new machine needs to be built.
Step 4 — Decide how you deploy the image. In a small company there are two paths: Windows Autopilot with Intune (if you have Microsoft 365 Business Premium — nothing more to buy) or a classic WIM image on a USB stick with a minimal app list, the rest installed by the user. Autopilot pays back from about 15–20 workstations upwards.
Step 5 — Write the security rules down once. User without local admin rights, BitLocker on by default, MFA enforced on the Microsoft 365 account, lock screen after 10 minutes. You configure all of that once in Intune and it applies to every new laptop.
What not to do
- Don't clone a disk after a year of use. A clone of a working machine is a clone of all the accumulated junk on it — plus the risk that an installed antivirus with a per-machine licence gets cloned along with the licence.
- Don't buy hardware from five different vendors if you don't have to. One business-line laptop model (Lenovo ThinkPad, HP EliteBook, Dell Latitude — pick one) cuts driver zoo and hardware issues by an order of magnitude.
- Don't leave the configuration in one person's head. The whole point of standardisation is that any new machine can be built without calling Paweł.
- Don't try to reimage every existing laptop at once. Roll the standard out only for new hires and for post-failure replacements. Over 2–3 years the whole fleet turns over naturally.
What next
A golden image isn't a quarterly project. It's a decision: "from today, new laptops in this company look the same". The rest falls into place over a year, through the natural replacement cycle.
If every laptop in your company is a surprise, and your IT admin is going grey by the third new setup this week, it's worth doing it differently. The first call is free and takes half an hour.
Standardising workstations is the cheapest IT optimisation we know. It costs one afternoon of decisions and one month of discipline.