PCs bought one by one: the traps for an SME
Updated on 7 November 2026.
The scenario we come across most often
The business starts with one laptop, the boss's. A year later an assistant is hired: a second PC is bought on special offer. Then a third for the sales rep, a fourth second-hand, a fifth in a hurry the day one of them breaks down. Each one is set up by its user, or by the shop, or by a nephew who is good with computers.
The result, five years later:
- three brands, two versions of Windows, PCs running Windows Home because it was the cheapest;
- each PC is tied to its user's personal Microsoft account, sometimes a private Gmail or Hotmail address;
- Office bought case by case, sometimes in an edition reserved for private use;
- everyone is an administrator of their own PC, and documents sit on the desktop, on a USB stick or in each person's private OneDrive;
- nobody really knows what is backed up.
None of this prevents day-to-day work. That is exactly the trap: the problems only appear the day something goes wrong.
Trap 1: Windows Home instead of Windows Pro
Most PCs sold in consumer shops come with Windows 11 Home. For private use it is enough. For a business, it lacks precisely the tools that make it possible to manage several PCs properly.
| Feature | Windows 11 Home | Windows 11 Pro | Why it matters in an SME |
|---|---|---|---|
| Disk encryption | Simplified « device encryption », depending on the hardware, recovery key sent to the user's Microsoft account | Full BitLocker, recovery key stored where the business decides | A stolen laptop must not become a data breach |
| Joining a company directory (Microsoft Entra ID or a domain) | No | Yes | Business accounts, central management, controlled departure of an employee |
| Group Policy (rules imposed on all PCs) | No | Yes | Enforce the same security settings everywhere |
| Remote Desktop (incoming connections) | No (client only) | Yes | Work remotely on the office PC, through a VPN |
| Update management for business | Limited | Yes | Decide when updates are installed |
Microsoft states it plainly in its documentation: joining Microsoft Entra ID is possible for all Windows 10 and 11 PCs except Home editions. And a Microsoft 365 Business Premium subscription, which gives access to central PC management, does not upgrade a Home PC for free: a Pro licence is needed first.
Good news: you can move from Home to Pro without reinstalling or losing data, from Settings > System > Activation, by buying the upgrade in the Microsoft Store or entering a Pro key. For comparison, a full Windows 11 Pro licence is listed at 259 euros in the Microsoft Store. Beware of keys sold for a few euros on little-known websites: their origin is not always clear, and a revoked licence leaves you with an unactivated PC.
Trap 2: PCs tied to employees' private accounts
During setup, Windows Home requires a Microsoft account. The employee enters their own, personal one. From then on, many things become attached to it without anyone noticing:
- the Office licence bought with that account;
- the OneDrive to which Windows offers, often during setup, to back up the Documents, Desktop and Pictures folders;
- the encryption recovery key: when a PC is set up with a Microsoft account, Windows turns on device encryption on compatible machines and attaches the recovery key to that account.
The day this employee leaves the business, or simply forgets their password, the business may lose access to work documents, to a licence it paid for, or even to the content of the disk: without the recovery key, an encrypted disk is unreadable. We explain this mechanism in our article on the Microsoft account.
The rule: a business PC is set up with a business account, never with an employee's private account. And the recovery key of every encrypted PC is known to the business and kept in a safe place.
Trap 3: everyone is an administrator
On a PC set up « at home », the user is an administrator. They can install any software, and malware they launch by mistake can do the same, with the same rights. In a small team, there is often also a shared account and a single password for everything (PC, email, NAS, accounting).
The rule: each person has their own account, of the « standard user » type for everyday work; a separate administrator account, with a different password, is used only to install and configure.
At ExsIT, this is the first thing we do on every PC we deliver, and experience confirms it: when a program wants to change the PC, Windows asks for the administrator password, and this simple stop has already prevented many problems. We also see the downside: three years later, the customer calls us because nobody can find that password, even though it was handed over at delivery. An administrator password is only useful if it is kept somewhere the business will find it again: in the shared vault of a business password manager, or in a sealed envelope in the safe, with a note in the inventory saying where it is (never the password itself in the spreadsheet). If your IT provider also keeps it, make sure it is with your written consent. Two-factor authentication protects email and online access, and a password manager avoids one password for everything.
Trap 4: believing you need an extra antivirus
For many managers, IT security means antivirus, and a paid antivirus seems bound to be better than the one in Windows. Our experience says rather the opposite: add-on antivirus suites regularly block a business application, access to a website or a printer, raise false alarms, and end up being disabled « just to get some work done ».
The antivirus built into Windows, Microsoft Defender, is present on Home and Pro alike, and it holds its own. In the real-world protection test by the independent lab AV-Comparatives (February to May 2026, 20 products), it is one of the seven products that received the top award, with 99 % of attacks blocked and no false alarms according to the report's figures.
An extra antivirus therefore usually adds little, and two antivirus programs active at the same time get in each other's way. What really protects you are the rules in this article: a standard account for everyday work, updates installed, two-factor authentication and a tested backup. Simply keep Defender switched on (real-time protection and cloud-delivered protection), and check now and then in Windows Security that it still is.
Trap 5: licences bought at random
Office is the typical example. Office Home 2024 is reserved for non-commercial use; it is Office Home & Business 2024 that includes Outlook and the right to use Office for business. An SME that bought the first one to save time is not compliant.
The same logic applies to other software that is free for individuals but paid for businesses (remote control, antivirus, PDF tools…): the « free » version installed one day by an employee is not necessarily allowed in a business.
Finally, the Windows supplied with a PC (a so-called OEM licence) stays tied to that PC: it cannot be moved to another device the day the PC is replaced.
The rule: a list of the business's licences, with the invoice, the edition and the PC or person concerned. With five people, a Microsoft 365 business subscription is often simpler to track than five separate purchases, because the licences are attached to business accounts.
Trap 6: data everywhere, backups nowhere
The Windows desktop, a USB stick, a PC's disk, an employee's private OneDrive, attachments in the mailbox: in a small fleet, business documents are scattered. And everyone thinks « it's in the cloud, so it's backed up ».
Synchronisation is not a backup: a file deleted or encrypted by ransomware is deleted or encrypted everywhere. The rule is 3-2-1: three copies, on two different media, one of them off-site, and a restore test from time to time. Our backup guide explains how to set it up.
Trap 7: PCs that no longer receive patches
Windows 10 has not been supported since October 2025. Microsoft sells extended security updates (ESU) to businesses, and has extended a programme for consumers until 12 October 2027, free in the European Economic Area on condition of signing in with a Microsoft account, on a PC that is neither joined to a domain nor managed by a business management solution. In other words: the free route relies precisely on the personal account and the lack of management that an SME should avoid.
Add to this PCs that are never restarted (updates wait), software that is never updated (PDF reader, browser, Java) and second-hand PCs for which nobody knows whether they can move to Windows 11.
The rule: know, for each PC, which version of Windows it runs and whether it still receives patches; replace or upgrade those that no longer do. If you need to replace hardware, our comparison new or refurbished helps you choose.
Trap 8: no inventory
How many PCs, which brand, bought when, still under warranty or not, with which Windows, used by whom? In most small businesses, nobody can answer without walking round the offices. Yet without an inventory, it is impossible to know what needs protecting, updating or replacing.
The rule: a spreadsheet is enough to start with. One line per device (PC, laptop, NAS, printer, router, business phone), with the user, purchase date, end of warranty, Windows edition, encryption status and where the recovery key is kept.
Trap 9: the shop's network and improvised access
The operator's router with its original password, a single Wi-Fi for staff, customers and the camera, a NAS reachable from the Internet « to fetch a file at the weekend », remote control software installed once for a repair: every shortcut opens a door. We described these doors and how to check them in our article on external access audits.
The rule: a separate guest Wi-Fi, the router's administration password changed, nothing open on the Internet without a reason, and remote access that goes through a VPN with two-factor authentication.
Trap 10: the domain name and key accounts in someone else's name
This is the trap people talk about least and that costs the most. On Microsoft's help forums, the calls for help follow one another and all look alike: « the only administrator of our Microsoft 365 has left the company », « the former IT provider created the account and no longer answers ». Without an administrator, nobody can create an account, reset a password or cancel a subscription any more, and recovery goes through a verification procedure with Microsoft that can take days.
The same goes for the domain name (yourcompany.be), which carries the website and all email addresses. For a .be, the code needed to change provider is sent by DNS Belgium to the email address of the registered holder, and a contact address that is no longer valid can even lead to losing the registration. If the domain was registered by the web designer, in their name or with their address, they hold the key.
The rule: the domain name, the Microsoft 365 (or Google Workspace) subscription, the website hosting, the router and online banking are in the business's name, with a business contact address that does not depend on a single person. Microsoft recommends at least two global administrators (and no more than four): if one is locked out or leaves, the other can act. An IT provider may have administrative access, but never be the only one.
The plan to take back control
| Step | What you do | Indicative time for 5 PCs |
|---|---|---|
| 1. Inventory | List devices, Windows editions, accounts used, licences, where the data is | Half a day |
| 2. Accounts | Create business accounts, move PCs off private accounts, remove everyday administrator rights, store the administrator password where the business will find it | Half a day to a day |
| 3. Encryption | Check the encryption of every laptop and collect the recovery keys in a business vault | One to two hours |
| 4. Data and backup | Gather documents in a business space, set up a 3-2-1 backup and test a restore | One day |
| 5. Upgrades | Upgrade to Pro the PCs you keep, replace those that no longer receive patches | Depends on the fleet |
| 6. Purchasing rule | From now on: Windows Pro, business warranty, setup with a business account, entry in the inventory | One decision |
| 7. Key accounts | Check that the domain name, Microsoft 365, hosting and router are in the business's name, with two administrators | One to two hours |
The last step pays off most. The next PC is bought with Windows Pro from the start (the price gap at purchase is generally smaller than an upgrade afterwards), and it is set up with a business account before being handed to its user.
For the person who « looks after IT »
In many small businesses, one person more curious than the others ends up managing the Wi-Fi, the new PCs and the forgotten passwords. They have another job and this work is in no job description. The risk is not that they do it badly: it is that everything depends on their memory, and the day they leave or fall ill, nobody knows anything any more.
Your first task: an access binder
One document, on paper or digital, kept in a safe place and known to the manager: the list of devices (the inventory from trap 8), the providers to call (IT provider, telecom operator, accounting software vendor, alarm installer), and where the passwords and recovery keys are kept. The passwords themselves go into a password manager, not into this document.
Simple tools, free or nearly free
| Tool | What it is for | Cost |
|---|---|---|
| Team password manager (for example Bitwarden) | A shared vault for the business's logins, a different password for each service | Free for two people, 4 dollars per user per month beyond that (Teams plan) |
| Windows Security (built in) | Check at a glance that antivirus, firewall and updates are green | Free |
The winget upgrade --all command (built into Windows) |
Update installed software in one go (browser, PDF reader…) | Free |
| Safeonweb@work (Centre for Cybersecurity Belgium) | Threat alerts, self-assessment questionnaire, policy templates | Free for Belgian organisations |
| Have I Been Pwned, domain search | Be alerted when a business address appears in a data breach | Free as long as fewer than ten addresses on the domain are affected |
| Cybersecurity guide for SMEs (CCB and Cyber Security Coalition) | The basic measures explained simply | Free |
A one-hour monthly routine
- Open Windows Security on each PC: everything should be green.
- Check that Windows Update has not been waiting days for a restart.
- Run
winget upgrade --allwith the administrator account. - Restore a file from the backup, to make sure it really works.
- Review the accounts: a departure, an intern, a former provider still active?
- Update the inventory.
When to call a specialist, without hesitating
- Suspected intrusion or ransomware (renamed files, ransom message, strange behaviour of the mailbox): unplug the PC from the network (cable and Wi-Fi), if possible without switching it off, delete nothing, pay nothing, and call. The first hours count.
- Personal data breach: the GDPR in principle requires notifying the Data Protection Authority within 72 hours; better to get advice straight away.
- Anything involving the domain name, email and Microsoft 365: a badly done DNS setting or account migration cuts off email for the whole business.
- The firewall, the router, the VPN and any access from outside: a door opened by mistake is exactly what the robots are looking for (see our article on external access audits).
- Setting up the backup and restoring after a disaster.
- Disk encryption and migrating recovery keys.
- Buying a server, a NAS or network equipment.
This split of roles is often the most economical formula: the person of goodwill handles day-to-day matters and acts as the link, the specialist steps in on what is risky or rare.
In practice: three options
| Option | What it costs | The risk |
|---|---|---|
| Do nothing | Nothing, today | An employee leaving, a theft or a breakdown causes data loss or locks a PC; a non-compliant licence surfaces during an audit |
| Do it yourself | Two to three days of work, the Pro upgrades and possibly a Microsoft 365 business subscription | Getting the account migration wrong (and losing access to a OneDrive or a recovery key), or stopping halfway |
| Get support | A few days of service, partly fundable in Wallonia through the cybersecurity cheque | The lowest: complete inventory, prepared migration, written rules for the future |
Support in Belgium. In Wallonia, the « cybersecurity » business cheque covers 75 % of the cost excluding VAT of a diagnosis or support provided by an accredited provider, up to 50,000 euros per business over three years; it covers advice, not the purchase of hardware or licences. Brussels and Flanders have their own schemes supporting cybersecurity consultancy.
Example (illustrative case): a five-person surveying firm. Inventory: five PCs of three brands, three of them on Windows Home, all tied to employees' private Microsoft accounts; an Office Home used for invoicing; plans stored on the boss's PC and in a colleague's private OneDrive; no tested backup. Actions: Microsoft 365 business accounts for everyone, Pro upgrade for the two recent PCs, replacement of the oldest, BitLocker encryption with keys stored in the business space, documents gathered in a shared space with external backup, administrator rights removed. When a colleague left six months later, her departure took ten minutes: disable the account, reassign the PC.
For your IT person
- Edition and version:
winver, Settings > System > About, orGet-ComputerInfo | Select-Object WindowsProductName, OsVersion. - Encryption:
manage-bde -statusorGet-BitLockerVolume; Settings > Privacy & security > Device encryption on Home. Keys attached to a Microsoft account: account.microsoft.com/devices/recoverykey; to an Entra ID account: aka.ms/aadrecoverykey. Export the keys before any account migration. - Entra ID and Intune: Entra ID join is impossible on Home; Windows Autopilot does not list the Home edition. Microsoft 365 Business Premium activates Windows Pro to its business edition by subscription, but only from a valid Pro licence.
- Moving to Pro: Settings > System > Activation > Upgrade your edition of Windows; purchase in the Microsoft Store or a Pro key. No in-place return from Pro to Home: only a reinstall allows it.
- Local administrators:
net localgroup Administrators(orAdministrateursdepending on the language) to list the accounts concerned; a separate administration account, with a unique password per PC (Windows LAPS if the PCs are managed). - Known folders to OneDrive: if documents are redirected to a private OneDrive, bring them back into the business space before changing accounts.
- Microsoft 365: two to four global administrators, including a non-personal emergency account with a long password, stored offline; check in the admin centre that no former employee or provider still holds this role.
- .be domain name: check the holder and contact address with DNS Belgium (WHOIS tool); the transfer code is sent to that address.
- Windows 10: consumer ESU programme extended until 12 October 2027 (free in the EEA with a Microsoft account, PC neither domain-joined nor MDM-managed); business ESU is paid, per device.
Test yourself
Sources
AV-Comparatives. (2026, June 15). Consumer Real-World Protection Test February-May 2026. https://av-comparatives.org/consumer-real-world-protection-test-february-may-2026/
Axis Intelligence. (2026). Antivirus statistics 2026. https://axis-intelligence.com/antivirus-statistics/
Bitwarden. (n.d.). Password Manager plans. Bitwarden Help Center. https://bitwarden.com/help/password-manager-plans/
BleepingComputer. (2026, June 25). Microsoft quietly extends free Windows 10 ESU support to October 2027. https://www.bleepingcomputer.com/news/microsoft/microsoft-quietly-extends-free-windows-10-esu-support-to-october-2027/
Centre for Cybersecurity Belgium, & Cyber Security Coalition. (n.d.). Cybersécurité : guide pour les PME [Cybersecurity guide for SMEs]. https://cybersecuritycoalition.be/wp-content/uploads/cybersecurity-guide-sme_FR.pdf
DNS Belgium. (n.d.). Transfer code. https://www.dnsbelgium.be/en/transfer-code
European Cybersecurity Competence Centre. (2023, November 28). Safeonweb@work initiative. https://cybersecurity-centre.europa.eu/news/safeonwebwork-initiative-2023-11-28_de
Have I Been Pwned. (n.d.). How can I minimise the subscription cost of domain searches? https://support.haveibeenpwned.com/hc/en-au/articles/7707041970703
Microsoft. (n.d.-a). Device Encryption in Windows. Microsoft Support. https://support.microsoft.com/en-us/help/4502379
Microsoft. (n.d.-b). Microsoft Entra joined devices. Microsoft Learn. https://learn.microsoft.com/entra/identity/devices/concept-directory-join
Microsoft. (n.d.-c). Microsoft Entra join a new Windows device during the out of box experience. Microsoft Learn. https://learn.microsoft.com/en-us/entra/identity/devices/device-join-out-of-box
Microsoft. (n.d.-d). Windows 11 Professionnel. Microsoft Store. https://www.microsoft.com/fr-fr/d/windows-11-professionnel/dg7gmgf0d8h4
Microsoft. (n.d.-e). Explore administrator roles in Microsoft 365. Microsoft Learn. https://learn.microsoft.com/en-us/training/modules/manage-roles-groups-microsoft-365/4-explore-admin-roles-microsoft-365
Microsoft. (n.d.-f). upgrade command (winget). Microsoft Learn. https://learn.microsoft.com/windows/package-manager/winget/upgrade
Microsoft Q&A. (2026a). No admin access. Microsoft Learn. https://learn.microsoft.com/en-us/answers/questions/5820347/no-admin-access
Microsoft Q&A. (2026b). OS upgrade from Home to Pro version. Microsoft Learn. https://learn.microsoft.com/en-us/answers/questions/5805160/os-upgrade-from-home-to-pro-version
O365HQ. (2026). Windows 11 Home to Pro upgrade for Microsoft 365 Business tenants. https://o365hq.com/blog/windows-11-home-to-pro-upgrade-for-microsoft-365-business-the-49-dollar-offer
Public Service of Wallonia. (n.d.). Être accompagné par un expert pour sécuriser les données de mon entreprise : chèque « cybersécurité ». Wallonie.be. https://www.wallonie.be/fr/demarches/etre-accompagne-par-un-expert-pour-securiser-les-donnees-de-mon-entreprise-cheque-cybersecurite
Windows Central. (2024). Microsoft Office 2024 gets you new versions of Word, Excel, PowerPoint, and more, no subscription required. https://www.windowscentral.com/software-apps/microsoft-office-2024-gets-you-new-versions-of-word-excel-powerpoint-and-more-no-subscription-required
Windows Central. (n.d.). Windows 11 Home vs. Pro: What's the difference? https://www.windowscentral.com/software-apps/windows-11/windows-11-home-vs-pro-whats-the-difference
Wolters Kluwer. (2025, May 26). Subventions publiques pour la cybersécurité : saisissez l'opportunité de mieux sécuriser votre PME. https://www.wolterskluwer.com/fr-be/expert-insights/government-grants-for-cybersecurity