You generally do not validate the OS itself. Instead, you qualify it. You record the version number, verify the installation was successful, and ensure basic security settings are applied (like user access controls).
Why? Because the way you validate a commercial off-the-shelf printer driver should be different from how you validate custom sterilization control software. gamp 5 categories of software
Category 5 carries the highest risk because there is no operational history. You are the developer, so you are responsible for every bug. You generally do not validate the OS itself