What to Know Before You Check a Work Laptop
Understanding how to check work laptop security settings starts with one important rule: corporate devices are usually managed by IT through tools such as Microsoft Intune, Jamf, VMware Workspace ONE, or Active Directory policies.
That means some settings may be visible but not changeable.
This guide shows how to review the most important security controls on Windows and macOS laptops, what each setting means, and when to involve your IT or security team.
Start With the Device Management Status
The first step is to confirm whether the laptop is enrolled in a device management platform.
Managed devices often have security baselines enforced centrally, which can affect password requirements, firewall settings, disk encryption, and app permissions.
- Windows: Open Settings and look for Access work or school.
A connected work account often indicates device enrollment.
- macOS: Check System Settings for Profiles, VPN, or Device Management entries.
- Ask IT: If the device is managed, IT can confirm which security settings are enforced and which are user-controlled.
Check the Screen Lock and Sign-In Controls
Screen lock settings help prevent unauthorized access when the laptop is left unattended.
These are among the most important settings to verify because they directly affect physical security.
What to look for
- Automatic lock timeout: The device should lock after a short period of inactivity.
- Password or PIN required on wake: The system should require authentication after sleep or screen lock.
- Windows Hello or Touch ID: Biometric sign-in can improve convenience, but it should be backed by a strong PIN or password.
On Windows, check Settings > Accounts > Sign-in options.
On macOS, review System Settings > Lock Screen and Touch ID & Password.
Verify Password and Authentication Requirements
Password policy is a core part of endpoint security.
Even if the company uses single sign-on through Okta, Microsoft Entra ID, or Google Workspace, the laptop itself should still enforce secure local sign-in behavior.
- Password length and complexity: Enterprise policies often require long passphrases or complex passwords.
- Multi-factor authentication: MFA may be required for email, VPN, and cloud apps even if not for device login.
- Account lockout: Multiple failed attempts should trigger a lockout or delay to reduce brute-force risk.
If the policy looks weak or unclear, do not try to bypass it.
Report the concern to IT so they can confirm whether stronger controls are already enforced centrally.
Review Disk Encryption Settings
Disk encryption protects data if the laptop is lost or stolen.
For modern work devices, encryption is usually mandatory and should be easy to verify.
Windows encryption checks
- Look for BitLocker status in Control Panel or Settings.
- Confirm that the system drive is encrypted.
- Check whether a recovery key has been escrowed to the organization.
macOS encryption checks
- Look for FileVault under System Settings > Privacy & Security.
- Confirm that FileVault is enabled and that the startup disk is protected.
Encryption is one of the most important defenses for laptops that travel between offices, homes, coworking spaces, and airports.
Inspect Firewall and Network Protection Settings
Firewall controls help block unauthorized inbound traffic and reduce exposure on public networks.
They are especially important for remote workers who connect from home Wi-Fi, hotels, and shared networks.
- Windows Defender Firewall: Check that it is enabled for domain, private, and public profiles.
- macOS firewall: Review System Settings > Network > Firewall.
- VPN requirement: Some organizations require a virtual private network for internal resources.
Also check whether the laptop uses DNS filtering, secure web gateways, or web protection features such as Microsoft Defender for Endpoint or CrowdStrike Falcon.
These tools may run silently in the background and provide added network protection.
Review Antivirus and Endpoint Detection Tools
A modern work laptop should have active endpoint protection.
In many companies, the standard is not just antivirus but endpoint detection and response, also known as EDR.
- Windows Security: Confirm that real-time protection is on and definitions are current.
- Third-party EDR: Look for installed tools such as Microsoft Defender for Endpoint, CrowdStrike, SentinelOne, or Sophos.
- Status indicators: The security console should show the device as healthy or protected.
If the protection tool appears disabled, outdated, or missing, contact IT immediately.
Security software is often locked by policy, so a missing agent can indicate a serious problem.
Check for Software Update Policies
Patching is one of the simplest ways to reduce risk.
Security settings should include automatic updates for the operating system, browsers, and approved applications.
Important update categories
- Operating system updates: Windows Update or macOS Software Update should be active.
- Browser updates: Chrome, Edge, and Firefox should update automatically.
- Firmware and driver updates: Managed devices may receive BIOS or firmware updates through IT tools.
Work laptops that miss updates for too long are more exposed to malware, phishing payloads, and exploitation of known vulnerabilities.
Inspect App Permissions and Privacy Controls
Even on a company laptop, apps can request access to the camera, microphone, location, files, and screen recording.
Reviewing permissions helps reduce unnecessary data exposure and prevents over-privileged software.
- Camera and microphone access: Allow only for approved collaboration tools.
- Screen recording permissions: Useful for conferencing tools, but should not be granted broadly.
- File access: Applications should not have unrestricted access unless required for work.
On macOS, privacy permissions are especially visible in System Settings > Privacy & Security.
On Windows, review app permissions under Settings > Privacy & security.
Look for Remote Management and Asset Controls
Organizations often use remote management to track devices, enforce policies, and respond to theft or loss.
These settings are normal for managed endpoints and should be present on business laptops.
- Device location or inventory tracking: Helps IT maintain asset records.
- Remote wipe capability: Protects data if the device is lost or stolen.
- Compliance status: May determine access to email, VPN, or SaaS applications.
If the laptop is not reporting compliance, access to corporate resources may be restricted until the issue is fixed.
Check Browser and Credential Security
Browsers are a common attack surface because they store passwords, session tokens, and sensitive business data.
Review browser security settings carefully, especially if the laptop is used for SaaS applications, internal portals, or finance systems.
- Password manager usage: Prefer an approved enterprise password manager over browser-saved passwords.
- Safe browsing or phishing protection: Keep built-in protections enabled.
- Extension review: Remove unapproved browser extensions that may collect data or inject content.
For SSO environments, ensure the browser session remains protected with MFA, conditional access, and short-lived authentication where possible.
How to Document Security Findings
If you are checking a work laptop as part of a self-audit, onboarding review, or incident response, document what you find so IT can act quickly if needed.
- Record the operating system version.
- Note whether encryption, firewall, and endpoint protection are enabled.
- Capture any error messages or compliance warnings.
- List settings you could not access because they were managed.
Clear documentation helps security teams identify gaps without asking you to repeat the same checks.
When to Contact IT or Security
Contact IT whenever you see a missing security control, an unknown management profile, a disabled antivirus agent, or a device that is out of compliance.
Do the same if you suspect the laptop has been tampered with, stolen, or used by someone else.
Knowing how to check work laptop security settings is useful, but the goal is not to override company policy.
The goal is to confirm that encryption, authentication, updates, network defenses, and endpoint protection are working as intended.