On a Nexus device it’s not as hard as it sounds (using the Unified Android Toolkit).
You can do all this from an out-of-the-box device..
1. Enable usb debugging and oem unlock (if needed) on your device. This is done through the developer options but first you have to enable developer options. Go to settings, about and click build number 7 times until you are told you are now a developer. Then go back to settings and developer options should now show. In developer options tick usb debugging and allow oem unlock (if needed).
2. Install drivers from the main menu (option 3), make sure the usb cable is unplugged before starting. After the driver installation has finished plug the device back in, pull down the top left notification screen and change usb mode to PTP (usually the correct mode for communication with a Nexus device). You should now get a pop up on your device after a few seconds asking to allow a connection to your pc. Tick allways and ok. Your device should now be ready to go.
3. Unlock bootloader from the main menu (option 3) which will wipe your device but will allow custom images to be booted/flashed.
4. Download/flash the latest build from the main menu (options 9,1). Just select the build you want to flash, follow the instructions and everything should go fine. If you are already on the latest build or you don’t want to update then you can skip this stage.
If you have a device with forced encryption (Nexus 5X, 6, 6P, 9) and want to decrypt it during the update, or have already decrypted and want to keep your device decrypted then go back to the build selection screen and choose the build you want to flash to BEFORE you start downloading/flashing the image. You do not have to decrypt the device before flashing a new stock image as you can do this as part of the flash process. This will ensure you have the “no-encryption” boot image downloaded so it can be flashed during the update process (if you don’t choose to flash this then the stock image will be flashed and your device will be encrypted at boot). During the flash process choose to flash the no-encryption boot image, then choose NOT to format userdata (if it’s already decrypted) or choose to format userdata if your device is encrypted and you want to decrypt (the device will be wiped and decrypted on the next boot).
Note: Before starting the next stage make sure you selected the build that your device is using. If you are on Android 6 and need to flash a modified boot image then this is important or the wrong image may be flashed.
5. Root the device and flash custom recovery. If you are a PRO user you can do all this together (as well as rename the stock recovery restore files if present on your system) using option 8 from the main menu (or option 3 from the root/unroot screen). If you are not a pro user you can root using options 4,1 from the main menu, then flash a custom recovery using option 6.
Note: Remember that with Android 6 whenever your device reboots to Android the usb mode will be reset to ‘charging only’. You will need to change this back to PTP (or whatever mode works with your device) to continue Toolkit communications.