Build sequence
- Start from current vendor media, not from a previous image
- Apply all available OS updates before anything else
- Remove vendor bloatware and unused built-in applications
Golden Image Build Checklist
A golden image goes stale from the moment it is captured, and a six-month-old image means every new device spends its first hours downloading patches on an unprotected build. The refresh cadence matters more than the build quality.
What you get
- A build sequence covering hardening, agents, and validation
- A refresh cadence with triggers for an out-of-cycle rebuild
- A version register tracking what is in each image
- Validation steps before an image is released
How to use this template
- 1
Refresh quarterly at minimum. An image more than a quarter old means new devices spend their first session applying months of patches, often before the EDR agent has fully registered. Rebuild on a schedule rather than when someone notices.
- 2
Capture before domain join and user profile creation. Images captured after joining or after a profile exists carry machine-specific state that causes duplicate identifiers and odd failures on deployed devices.
- 3
Validate on real hardware before release. An image that works in a virtual machine can fail on the actual laptop model because of drivers and firmware. Test on each hardware model in the fleet before releasing it.
What's inside
Here's a preview. Unlock the free download to get all 4 sections (3 more below).
Related templates
More free templates IT teams use alongside this one.
Security Operations
Get templateEndpoint Hardening Checklist
Hardening guides run to hundreds of settings, most of which nobody verifies afterwards. This baseline is the subset that materially reduces risk, with the deviation register that makes exceptions visible rather than silent.
Network & Infrastructure
Get templateServer Build Checklist
Servers built ad hoc are the ones missing from monitoring and backup, discovered during an incident or an audit. This checklist exists so that every build ends in the same known state regardless of who did it.
Security Operations
Get templatePatch Schedule Template
Patching breaks things, which is why teams delay it, which is why they get breached through something with a patch available for six months. This schedule is built around deployment rings, so a bad patch hits a pilot group of twenty people rather than the whole company.
Frequently asked questions
How often should a golden image be rebuilt?
+
Quarterly at minimum, and out of cycle after a critical OS vulnerability, a major agent version change, an OS feature update, or the introduction of new hardware. Stale images mean new devices start life unpatched.
What should be in a golden image?
+
Current OS with all updates, the hardening baseline applied through policy, management and EDR agents, VPN, and the standard application set. Role-specific software should be deployed afterwards rather than baked in.
Why capture an image before domain join?
+
Because joining creates machine-specific state and identifiers. Capturing afterwards propagates those to every deployed device, causing duplicate identifiers and intermittent failures that are difficult to diagnose later.