Device settings, power & privacy

The housekeeping settings that separate a finished build from a raw enrolment: power behaviour, locale and time, and the privacy defaults Windows will not set for you.

Why this matters

Nobody raises a ticket titled "the build is wrong". They raise tickets saying the @ key types quotation marks, the clock is an hour out, the laptop slept halfway through a long-running job, or a password failed three times because NumLock was off and the digits went nowhere. Individually, each is a trivial fix. Collectively, they are what a new starter experiences in their first hour on a device — and they set the tone for how the whole IT function is judged.

Worse, some of these failures are invisible. A machine with Fast Startup enabled reports weeks of uptime because "shut down" never truly shut anything down, so boot-time behaviour and the eternal "turn it off and on again" advice quietly stop working. These settings are unglamorous, which is precisely why they get skipped: no compliance report ever demands NumLock, so it never makes anyone's project plan.

What a good build does

Decolla treats this housekeeping as first-class catalogue items, not a script somebody once wrote and forgot. The section resolves power behaviour as a single canonical power-plan item — never sleeping on mains, with hibernate and Fast Startup handled alongside it, so the individual settings cannot contradict one another. It pins the time zone deterministically through the configureTimeZone CSP with UK locale and NTP time alongside, rather than trusting Windows to guess. And it sets an explicit privacy posture: the advertising ID disabled machine-wide and the diagnostic-data level chosen deliberately, while still allowing apps to use device location where the business actually wants that.

Every item appears in the written plan before anything runs, with its delivery mechanism and reversibility class stated per item, and each can be rolled back individually — rollback covering Decolla's own changes. None of this is exotic; a competent admin could configure all of it by hand. The point is that it arrives curated, tested, consistent and itemised, instead of living as tribal knowledge in one engineer's head.

Where it bites people

Fast Startup versus "but I restarted it". With HiberbootEnabled=1, shutting down actually hibernates the kernel session. A user who dutifully shuts down every night can still show weeks of uptime, and fixes that only apply at a genuine boot — driver resets, pending state changes — never take effect. The trap is that restart bypasses Fast Startup but shut down does not, so "turn it off and on again" behaves differently depending on which button the user pressed. Setting HiberbootEnabled=0 makes the two paths behave the same and makes helpdesk advice true again.

Automatic time zone versus your own privacy baseline. Windows' "set time zone automatically" depends on location services. A privacy-conscious baseline that switches location off quietly strands new devices on whatever the image default happens to be — calendar invites land an hour out and log timestamps mislead anyone doing incident work. Pinning the zone via CSP removes that dependency entirely, so the location decision can be made on its own merits rather than held hostage by the clock.

What's in this section (15 items)

Reversibility: auto reverses when unassigned · reverse reversible with a documented step · irreversible flagged before you approve the plan.