Endpoint Hardware Purchasing Standard
This document defines the hardware specification a laptop or desktop must meet before DTC buys it — for our own staff and for client endpoints under a managed services agreement. It is the authoritative reference for what goes on a quote, what must be read off a quote before it is approved, and which line items must never appear on one.
It covers the specification. It does not cover the ordering workflow (see Procurement Ordering Process) or the build design process for imaging and CBCT machines (see CBCT & Laptop Design Process).
Baseline — every managed endpoint
These are not negotiable. A quote that misses any of them goes back to the Sales Engineer.
| Requirement | Specification | Why |
|---|---|---|
| Operating system | Windows 11 Pro (never Home) | Home cannot domain-join, cannot take most GPO/Intune policy, and cannot run BitLocker under management |
| TPM | TPM 2.0, firmware or discrete | Required by Windows 11 and by Windows Hello for Business. See Identity and biometrics below |
| Drive encryption | BitLocker-capable, managed | Every endpoint that leaves a building is encrypted |
| Biometric | Fingerprint reader or IR camera (Windows Hello face) | The unlock gesture. Not the same thing as WHfB — see below |
| Memory | 16 GB minimum, and see Memory is permanent below | 8 GB endpoints generate tickets for their whole life |
| Storage | NVMe SSD. No spinning disks, no SATA SSDs, no hybrid drives | |
| Warranty | 3 years onsite minimum, matched to the expected service life | A 1-year warranty on a 4-year machine is an unfunded liability |
| Vendor security software | None. See Security software on the quote |
Endpoint classes
| Class | Who it is for | CPU | Memory | Storage | Display |
|---|---|---|---|---|---|
| Standard | Front desk, clinical operatory, general admin | Current-gen mainstream (Core Ultra 5 / Ryzen 5 PRO class) | 16 GB | 512 GB | FHD / WUXGA |
| Performance | Imaging, CBCT, CAD, anyone waiting on a machine | Current-gen upper (Core Ultra 7 / Ryzen 7–9 PRO class) | 32–64 GB | 1–2 TB | FHD / WUXGA minimum, higher where the software benefits |
| Executive | Officers and roles where the machine is used in front of clients | Current-gen upper (Core Ultra 7 / Ryzen 9 PRO class) | 64 GB | 2 TB | High-DPI, touch. Weight and build quality count as requirements, not extras |
Class does not change the baseline above. It changes the numbers.
Identity and biometrics
Windows Hello for Business is not a hardware feature and cannot be bought. It is a credential deployment against Entra ID or Active Directory, and it works on any TPM 2.0 machine with a PIN and no biometric hardware at all. What the hardware buys is the gesture — a fingerprint reader or an IR camera so the user is not typing a PIN forty times a day.
So a requirement written as "Windows Hello for Business or a fingerprint reader" is asking for two different things, and both should be specified:
- TPM 2.0 — the hard requirement. Implied on any machine quoted with Windows 11, but state it.
- A biometric — fingerprint reader, IR camera, or both. Prefer both on Executive-class: face for sitting down at the desk, fingerprint for when the camera shutter is closed.
- Dell ControlVault — a separate secure processor that stores fingerprint templates off the main SoC. Present on Dell Pro 7 Series palmrests, not on every Dell Pro Premium palmrest. Its absence is not disqualifying; Windows will fall back to TPM-backed template storage. It is a difference to notice rather than assume.
- Smart card reader and NFC — bundled into the same Dell palmrest module as the fingerprint reader on some lines and absent on others. DTC has no standing requirement for either today; if a client does, it must be named on the request, because it cannot be added after the fact.
Presence detection (walk-away lock, wake-on-approach) comes with the IR camera modules on current Dell commercial lines. Worth having, worth nothing if the policy that uses it is not deployed.
Memory is permanent
Current thin-and-light commercial laptops — the whole Dell Pro and Dell Pro Premium range included — solder their memory. A quote reading 64 GB LPDDR5x, dual-channel (onboard) means 64 GB for the life of the machine. There is no upgrade path, no SO-DIMM slot, and no second chance.
Buy the memory the machine will need in year four, not the memory it needs on day one. This is the single spec where under-buying is unrecoverable.
Storage — read the NAND type, not just the capacity
Two 2 TB NVMe drives on two quotes from the same vendor on the same day are not the same part.
- TLC / "Performance SSD" — three bits per cell. What DTC buys.
- QLC — four bits per cell. Cheaper per GB, materially lower write endurance, and slower once the SLC cache is exhausted on a sustained write. On a 64 GB machine — which hibernates and pages proportionally to its memory — the endurance gap is the part that matters, not the benchmark.
Prefer TLC. Where a configuration only offers QLC, say so on the quote and accept it deliberately.
"SED Ready" is not a BitLocker requirement and should not be read as one. Since 2019 Windows defaults BitLocker to software encryption even on self-encrypting drives, after multiple vendor SED firmware implementations were found to be broken. Hardware encryption is off by default and we do not turn it on. The line is not a reason to pick one drive over another; the NAND type is.
Manageability
Intel vPro is not one thing. Two different Dell line items exist and the difference is real:
- vPro Enterprise — full Intel AMT: out-of-band power control and KVM over the network, independent of the OS. This is the one worth paying for on a machine that will be remote.
- vPro Essentials — remote management without full AMT/KVM.
The CPU can be vPro-capable while the platform module quoted is the lesser tier. If the quote says only "Intel vPro Enabled," ask the Sales Engineer which tier the platform SKU is before approving.
AMD PRO platforms provide manageability through DASH rather than AMT. Functional, but it is a different tool and our tooling and runbooks are written against Intel AMT. Prefer Intel on anything where out-of-band access is part of the reason for buying.
Wi-Fi silicon is a support consideration. Intel Wi-Fi adapters have the longest driver support history on our fleet and the fewest driver-regression tickets. A MediaTek or Realtek adapter in a business laptop is not a fault, but it is a variable, and it usually arrives bundled with the AMD platform rather than as a separate choice.
Security software on the quote
DTC uses Blackpoint MDR as its EDR and Microsoft Defender Antivirus as its anti-malware engine. Both are deployed by us, under our policy, through our tooling.
Vendor-bundled endpoint security — CrowdStrike, Norton, McAfee, Dell Trusted Device add-ons, whatever the OEM is reselling this quarter — must be removed from the configuration before the quote is approved, not merely left uninstalled. Two reasons:
- It is money for nothing. We will never deploy it, so it is line-item cost with zero delivered value.
- It is an active hazard. A second EDR on a managed endpoint fights the first one: duplicated kernel filters, mutual quarantine, and a support call that takes hours to diagnose because nobody knew it was there.
This applies whether or not the bundle looks free. If it is on the quote it will eventually be on the machine.
Find My Dell / Absolute is a different case — device location and remote wipe, no endpoint agent conflict. Acceptable on Executive-class and travelling machines where the loss risk justifies it.
Battery and display, on machines that travel
Neither is a checkbox, and both are where quotes diverge most quietly:
- Battery is quoted in watt-hours (
3-cell, 70 Wh). A 60 Wh and a 70 Wh configuration of nominally the same laptop differ by about 15% of capacity before any display difference is counted. - Panel type changes the draw. Higher-resolution and OLED panels are not automatically worse — tandem OLED is markedly more efficient than single-stack — but a WQXGA panel has more pixels to light than a WUXGA one. Runtime is a function of both numbers and cannot be read off either alone. Where runtime is a real requirement, get it from the vendor's own rating for that exact configuration rather than inferring it.
Quote review checklist
Before any laptop or desktop quote is approved, read these lines off it explicitly. Every one of them has been the thing that was wrong on a quote that otherwise looked right.
- OS — Windows 11 Pro?
- Memory — the number, and whether it is onboard/soldered. Is this the year-four number?
- Storage — capacity and NAND type. TLC or QLC?
- Biometric — fingerprint, IR camera, or both? ControlVault present?
- Palmrest extras — smart card, NFC. Required by anyone on this deployment?
- Manageability — vPro Enterprise, vPro Essentials, or AMD DASH?
- Wi-Fi — which vendor's silicon?
- Battery — watt-hours, against the display resolution and panel type.
- Warranty — length, onsite vs mail-in, and does it match the intended service life?
- Vendor security software — anything bundled? It comes off.
- Ports — count of USB-C and USB-A against what the user actually docks.
- Expiry — Dell eQuotes carry both a quote expiry and a shorter pricing-validity window in the terms. Check both.
Open items
- Smart card and NFC: DTC has no recorded position on whether these are required on our own endpoints. Until someone decides, they are neither required nor prohibited, and a quote that omits them is not out of compliance with this page.
- Standard service life by class is not defined here because DTC has not settled one. Warranty length is currently chosen against an intended life that lives in nobody's document. It should.