Use this checklist before purchasing, configuring, or replacing a clinic workstation. The goal is a repeatable build that the clinic can support, recover, and hand to another employee without rebuilding the process from memory.
Decide the deployment model before opening the box
Confirm who owns the computer, who signs into Windows, whether the device will be Microsoft Entra registered or joined, how it will be managed, which account performs administration, where recovery credentials are stored, and whether an existing Windows profile must be migrated.
Compare Microsoft Entra registered and joined clinic computers before deployment.
Six phases of a reliable clinic computer deployment
Define the role
Record the assigned employee, room, duties, clinical systems, shared resources, peripherals, support requirements, and whether the computer is dedicated or shared.
Confirm purchasing requirements
Verify Windows edition, processor, memory, storage, warranty, docking needs, monitor count, ports, and compatibility with EHR, imaging, printer, scanner, and vendor software.
Choose identity and administration
Decide the Windows sign-in model, Microsoft Entra state, employee permissions, routine-support account, emergency recovery path, MFA, and licensing before applications are installed.
Build and secure
Update BIOS, firmware, drivers, and Windows; name the device consistently; enable appropriate encryption and endpoint protection; remove unwanted software; and configure approved remote support.
Connect clinic workflows
Install approved applications and connect email, shared files, printers, scanners, label devices, signature pads, cameras, microphones, phones, browser profiles, and vendor portals.
Test, document, and hand off
Test the actual employee workflow, restart behavior, normal and recovery sign-in, support access, and restricted-data boundaries; then complete the build record and acceptance.
Before replacing an existing computer
- Inventory desktop and local folders, browser profiles, bookmarks, saved credentials, application settings, email archives, printers, scanners, mapped locations, shortcuts, and vendor utilities.
- Identify which copy of each file is authoritative: local storage, OneDrive, Google Drive, Shared Drive, network storage, or an application database.
- Record scanner destinations, shared-folder permissions, device address books, and any workflow tied to the old computer name or user profile.
- Confirm the employee’s password and MFA before relying on the first sign-in to the replacement computer.
- Keep the old workstation available until the new build has passed acceptance and the clinic approves retirement.
Identity, administrator, and recovery checklist
| Decision | What to establish | What to verify |
|---|---|---|
| Windows sign-in | Local, Microsoft Entra joined, or another documented model. | The intended employee can sign in after a restart and MFA works where required. |
| Routine support | A clinic-controlled administrative path separate from the employee’s daily account. | Support can elevate, install approved software, and troubleshoot after restart. |
| Break-glass recovery | A secured, uniquely named local recovery administrator or managed equivalent. | The credential is stored under clinic control, retrieval is limited, and emergency sign-in has been tested. |
| Employee permissions | Standard-user access unless elevation has a documented business need. | Required applications work without granting unnecessary local-administrator rights. |
| Encryption recovery | A clinic-controlled location for recovery information where encryption is used. | The recovery record matches the physical device and authorized staff can retrieve it. |
A break-glass account is not a daily support account
Emergency recovery access should be unique, strongly protected, clinic-controlled, documented, and tested. It should not become the convenient password used for routine troubleshooting. Where the clinic has suitable management capabilities, a managed local-administrator password process may replace a static recovery password.
Validate the actual clinic workflow
Identity and communications
Windows sign-in, MFA, email, calendar, Teams or Chat, browser profile, password manager, and approved shared accounts.
Clinical and business applications
EHR, practice-management, billing, imaging, dictation, scheduling, fax, clearinghouse, and vendor portals used by the assigned role.
Documents and shared files
OneDrive, Google Drive, Shared Drives, network folders, templates, mapped locations, permissions, and restricted folders.
Printers and scanners
Printing, duplex settings, labels, scan destinations, file naming, address books, shared-folder credentials, and document-access boundaries.
Audio, video, and peripherals
Monitors, docking station, webcam, microphone, speakers, headset, signature pad, card reader, phone integration, and specialty devices.
Support and recovery
Remote-support identifier, restart behavior, cached sign-in where appropriate, administrative elevation, break-glass access, and escalation contacts.
Minimum deployment record
- Computer name and asset tag
- Serial number and model
- Assigned user, room, and role
- Purchase and warranty dates
- Windows edition and update status
- Microsoft Entra or local join state
- Encryption and recovery location
- Routine-support and recovery accounts
- Installed applications and versions
- Printers and scanners tested
- Remote-support identifier
- Shared resources and permissions
- Outstanding vendor dependencies
- Acceptance date and approver
Common deployment mistakes
- Buying Windows Home when the intended organizational join or management features require a business edition.
- Letting the first employee who opens the box become the permanent administrator.
- Adding a work account and assuming the computer is Microsoft Entra joined.
- Joining an existing computer without planning for a second Windows profile.
- Copying files but forgetting scanner destinations, browser data, application settings, or local databases.
- Using one identical local administrator password on every workstation.
- Removing the old computer before printing, scanning, shared files, and clinical applications are accepted.
- Finishing the build without a record another technician or clinic owner can understand.
Frequently asked questions
Should a clinic computer be Entra joined or only registered?
Decide this before deployment. Clinic-owned computers intended for standardized organizational sign-in and lifecycle management are commonly joined. Registration may be appropriate when an existing local or personal Windows sign-in is intentionally retained.
Will joining Microsoft Entra preserve the old Windows profile?
Do not assume it will. The organizational sign-in can create a separate Windows profile, so files, browser data, application settings, printers, scanners, and saved access should be inventoried and migrated deliberately.
Should the employee be a local administrator?
Usually not for routine work. Use a documented clinic-controlled support model and a separate tested recovery path rather than granting everyday administrative rights without a specific need.
When is a new clinic computer ready for use?
Only after the actual employee workflow has been tested: sign-in, MFA, email, clinical applications, shared files, printing, scanning, peripherals, restart behavior, support access, and recovery documentation.
Related ClinicsIT guidance
Practical note: Windows edition, Microsoft licensing, device management, encryption, clinical software, and vendor requirements vary. Verify the clinic’s actual environment before purchasing hardware, changing sign-in, or removing a working recovery path.
Need a repeatable clinic workstation build?
ClinicsIT can inventory the current environment, define the identity and support model, deploy the computer, validate clinical workflows, and leave the clinic with a usable build record.
Request a Clinic Workstation Review