In the last few months I swapped out eight administrative computers. I provisioned them at home, made sure Windows was up to date, and also loaded the latest version of MLS and set it up with the correct unit name, but did not do a Send/Receive.
Then I made an appointment with the ward clerk or one of his assistants. I told the clerk to make a current MLS backup just prior to our appointment, to copy anything off of the existing computer they wanted to keep, and to put it all on a flash drive.
At the appointed time we met, I made sure the backup had been made, and we swapped out the equipment.
While we swapped out the equipment, I called for a security reset. They are open in the evening on Tuesday, Wednesday, and Thursday. (You can look up the exact hours at the Help Center.)
We fired up the new computer, set up and tested a printer, started MLS, restored the backup (which forces a new log in by someone who was on the backup), and did a Send/Receive to make sure everything was working. I saved the old computer for a few weeks before I wiped the drive and sent it to recycling.
The visit took between 30 minutes and an hour. In meetinghouses with multiple units, I usually was able to do two units or more in an evening. Some preferred activity night, others preferred a more quiet Thursday evening.
Having the clerk or an assistant there solved all of the access problems, including the fact that I have no keys to any of the clerks offices in other buildings in our stake. I do have an out of unit login on most of the stake administrative computer MLS programs, but with the clerk or assistant there, I did not need it. And because he was there, the clerk was able to let the other clerks and leaders know of the change and fend off any "I didn't know about it" difficulties. In reality, the change was transparent to most of them since they were already using MLS and Windows 10.
The Church provisioning tool loads Chrome. I sometimes helped clerks load Firefox if that was their preference. Most of them did that on their own. The FM Group sent me a couple of computers with an older provisioning tool, so I downloaded the current provisioning tool from the Church website and used it in those cases. You may wish to check this, because Sophos has gone away. There is no need to let an older provisioning tool load it. Hopefully a newer provisioning tool does not.
The longest part of the process was bringing Windows 10 up to date after the computer was provisioned. I did this at home. I intentionally went in and asked for Windows updates. The process usually took a day or longer. I ran most of the computers overnight at one point. Windows did a lot of restarts and I did a lot of restarts.
I used the same keyboard, mouse, power supply, and a spare monitor to set up all eight computers. That way, I only had to pull the CPU out, get it ready, and then put it back in the box. (Be sure to clearly label the box with the correct unit. You will do this anyway to update your inventory.) After they were all ready to go, I delivered them all.