I have installed Ubuntu on at least thirty machines in the last decade, and the first twenty minutes of any install are the same: I run through a list of tweaks that turn a fresh Ubuntu install into something I actually want to use. None of them are exotic. None of them require a third-party PPA (Personal Package Archive, a user-maintained software repository for Ubuntu) or a custom kernel. They are the boring, practical things that make Ubuntu feel less like a fresh-out-of-the-box demo and more like a workstation I can live in for a year. This is the list, in the order I run it.
1. Disable the Ubuntu report (whoops, scratch that, keep it on)
Ubuntu sends an anonymous system report to Canonical (the company that maintains Ubuntu) by default. The first time I did a clean install, I disabled it. The fifth time, I left it on. The reason I left it on is that the report is genuinely useful for Canonical, and the privacy cost is the kind of data you would not blink at if it were a phone app. If you have a specific reason to disable it, open Settings, Privacy, and turn off “Problem Reporting.” Otherwise, leave it.
The tweak I would actually flag here is the location services toggle, which is on by default and sends a coarse location to a few system services. Turn that off in the same Privacy pane. Location services have no upside on a workstation, and the data they send is not as anonymous as the problem-reporting data.
2. Install the restricted extras
Ubuntu does not ship MP3 playback, H.264 video, or common fonts by default, because of licensing. The fix is one package.
sudo apt install ubuntu-restricted-extras
This pulls in the MP3 codec, the H.264 codec, the Microsoft core fonts, and a handful of other small things that Ubuntu cannot ship on the install media. The package prompts for an EULA (End User License Agreement) for the Microsoft fonts; tab to OK and accept it. The whole install takes about three minutes on a fresh Ubuntu 24.04.
3. Switch the desktop to a different environment (sometimes)
Ubuntu’s default desktop environment is GNOME (a Linux desktop environment that focuses on a clean, modern, mouse-driven workflow). GNOME is fine. I use it most of the time. On machines where I am doing a lot of keyboard-driven work, I switch to the Xfce spin (a lighter-weight desktop environment that uses fewer system resources). The Xfce spin is officially supported and is on the Ubuntu download page; you do not need a third-party repo.
The reason I sometimes switch is that GNOME’s resource usage on a 4GB machine is borderline. Xfce is half the memory footprint and feels faster on a low-end machine. On a modern laptop with 16GB or more, GNOME is the right choice and the resource argument is gone. The switch is a reinstall, not a config change, so it is the most expensive item on this list.
4. Set up Timeshift for system snapshots
Timeshift is a system-restore tool that takes scheduled snapshots of your filesystem. If you install a bad driver or run sudo rm -rf (the Unix command to recursively force-delete files) on the wrong directory, you can roll back to a previous snapshot. I have used Timeshift to recover from at least three self-inflicted incidents in the last two years, including the one where I removed a critical config file and the one where a kernel update broke my Wi-Fi.
sudo apt install timeshift
Open Timeshift, pick the BTRFS (a modern copy-on-write Linux filesystem that supports cheap, atomic snapshots) snapshot type if your filesystem is BTRFS (Ubuntu 24.04 uses BTRFS by default on new installs), pick a schedule (I use weekly), and let it run. The first snapshot is a few hundred megabytes. The snapshots are rotated automatically.
5. Configure the firewall
Ubuntu ships with UFW (Uncomplicated Firewall), which is a frontend for iptables (the Linux kernel’s built-in packet-filtering system). UFW is off by default. Turn it on.
sudo ufw enable
sudo ufw default deny incoming
sudo ufw allow ssh
The third line is critical: if you enable UFW without allowing SSH on a remote machine, you lock yourself out. On a desktop, you do not need the SSH rule, but it is harmless to leave it. UFW is the kind of thing you set once and forget about. The default deny policy is what makes the firewall useful; without it, UFW is a no-op.
6. Install a password manager and a backup tool
Ubuntu does not ship a password manager. I use KeePassXC (a free, open-source password manager that stores credentials in an encrypted local database). The database is a single file that syncs to whatever I tell it to sync to (in my case, a Syncthing folder, which is a continuous file-syncing tool that runs on multiple devices). The point is that the database is local, encrypted, and not dependent on a cloud service.
For backups, I use Déjà Dup (Ubuntu’s built-in backup tool, which wraps the duplicity command-line backup engine). The default target is a local external drive, and the default schedule is weekly. I changed the schedule to daily and the target to a Syncthing folder on my NAS (Network Attached Storage, a small always-on file server on my local network). If the laptop dies, I can restore the full home directory to a fresh install in about 30 minutes.
7. Disable the guest session (if this is a shared machine)
The guest session is on by default, and it lets anyone boot the machine and get a temporary desktop without a password. On a personal machine, this is a small privacy leak. On a shared machine, it is a security hole. Disable it.
Edit /etc/lightdm/lightdm.conf (the configuration file for LightDM, Ubuntu’s display manager, which is the login screen that appears before your desktop loads) and add the line allow-guest=false. Restart LightDM with sudo systemctl restart lightdm. The guest session is gone.
Trade-offs
The list above is not free in time. The whole sequence takes about 30 minutes on a fresh install if you have the commands memorized, and about an hour if you do not. Most of the items are one-time; the recurring cost is Timeshift snapshots (a few hundred MB per week) and Déjà Dup backups (size depends on your home directory).
The four tweaks that have paid for themselves the most in my testing:
- Restricted extras. The MP3 and H.264 codecs are not optional in 2026. The first time you try to play a YouTube download or a video from a USB stick and the player shows a black screen, you will wish you had run this first.
- Timeshift. The recovery from a broken kernel or a misconfigured display driver is a single reboot. I have used it at least three times in the last two years.
- UFW. The default Ubuntu install does not have a firewall, which is a strange default for a desktop OS. Enabling UFW with the deny-incoming policy is a 30-second fix that closes a real attack surface.
- The Microsoft EULA prompt. It is interactive, and if you do not tab to OK and accept it, the install hangs forever in unattended scripts. Pre-accepting it with
debconf-set-selectionssaves 10 minutes of confused debugging the first time you script a fleet install.
In my case, the trade-off is worth it because the tweaked Ubuntu install survives at least a year of daily use without me wanting to reinstall. Your math will be different if you install Ubuntu rarely, or if you are using a managed IT setup where your employer has its own baseline image. The tweaks are also stackable: if you already have a baseline image, you can pre-bake most of these into a custom ISO (a bootable disk image that contains the operating system and your pre-configured settings) and skip the per-machine work.
The migration took about 30 minutes. The thing that was harder than expected was remembering that apt install ubuntu-restricted-extras prompts for the Microsoft EULA, and that the prompt is interactive; in a fully scripted install you need to pre-accept the EULA with echo ttf-mscorefonts-installer msttcorefonts/accepted-mscorefonts-eula select true | sudo debconf-set-selections. The thing that was easier than expected was Timeshift; the default config is sensible and the BTRFS integration is well done.
If you install Ubuntu on a personal machine, this list is a clear win. If you install Ubuntu on a managed fleet, you probably already have a custom ISO that includes most of these. If you are switching from Windows, the list is also a good starting point: the restricted-extras package, the firewall, and the backup tool are the three that matter most.
Bottom line
Run the seven tweaks above in order, accept the EULA, enable the firewall, install Timeshift, and disable the guest session. The whole sequence is about 30 minutes. The result is an Ubuntu install that is good for daily use, has working media codecs, takes snapshots you can roll back to, and is not wide open to the network. The list is not the only way to set up Ubuntu, but it is the way I have settled on after a decade of installs.