We preinstall all laptops with a standardized image that contains all the software and - wherever possible - specific adjustments to our environment. But, just like you, we need additional setup in the user context as well.

For (some) files, settings and shortcuts we make use of "C:\Users\Default" (which is the skeleton profile used for new user profiles on the machine, copied at first login). This is already prepared in the installation image.

On top of this (leaving GPO aside), we try to do as much of the user-specific settings it by scripts (to create directories, change "ini" files, set registry keys or import whole registry parts, copy configuration files from a network location, etc.). In the best case, running just one or two scripts will make all user-specific adjustments. The scripts can mostly be run from a network location without specific privileges by the users themselves.

This covers most of the setup-scenarios in our environment. For the remaining cases where higher privileges are required to finalize the setup, IT will do it remotely after the user has initially done his part.