I’d enrol the laptops at least into Microsoft Endpoint Manager (InTune) so you can apply device management policies and monitor activity; potentially doing for the server too.