OEM Endpoint Cleanup

OEM Endpoint Cleanup 2.2.1

Prove what is on the machine before you remove anything.

An audit-first Windows utility for MSPs. It inventories OEM bloatware and bundled antivirus trials, scores every match with evidence, evaluates each one against policy, and writes tamper-evident reports — all in dry-run by default.

Download setup launcher Read the operator guide View on GitHub

Audit before action

Every run starts as a read-only inventory and writes JSON and HTML reports immediately, before any change is possible.

Evidence-scored matching

Matches carry a 0–100 confidence score and readable rationale. Low-confidence and tied candidates fail closed to manual review.

Your tools stay put

RMM, remote access, VPN, backup, encryption, drivers, and firmware are protected independently of any blocklist you write.

Defensible records

Hash-chained JSONL audit events and RMM-ingestible JSON give you an evidence trail per device, not just a success message.

The interface

Triage a device at a glance

OEM and optional software sits on the left; remote-management and potentially unwanted tools are routed to a separate investigation panel so they are never removed casually.

OEM Endpoint Cleanup main window showing categorized inventory, policy profile selector, and dry-run controls
The preview is captured before inventory begins and contains no hostname, serial number, or customer device data.

Quick start

From download to a defensible report

A first run changes nothing. You get a complete inventory and a written report before deciding whether to remove a single item.

  1. InstallRun the setup launcher and pick per-machine, per-user, or portable.
  2. Launch and approve UACElevation is required to read the full inventory.
  3. Review the automatic auditJSON and HTML reports are written before you touch anything.
  4. Preview a planSelect rows marked Remove and choose Preview selected with uninstall mode off.
  5. Execute deliberatelyEnable uninstall mode, choose Uninstall selected, and confirm.
msiexec.exe /i .\OEM-Endpoint-Cleanup-2.2.1-win-x64.msi /qn /norestart ALLUSERS=1 MSIINSTALLPERUSER=""

Deploying through an RMM? The unattended MSI properties and the per-device report schema are documented in the reference.

Coverage

What the catalog recognizes

Filter the list to check whether a vendor or software class is covered before you deploy.

  • Dell, Alienware, HP, ASUS, Acer, Lenovo, MSI, Samsung, Toshiba/Dynabook, Microsoft Surface, LG, Gigabyte, Razer, and Fujitsu hardware brands
  • Antivirus and browser-security trials preloaded by the manufacturer
  • Support assistants and OEM update managers
  • Registration, warranty, welcome, and promotional utilities
  • Telemetry and customer-experience agents
  • Consumer games, cloud-storage promotions, and selected AppX packages
  • OEM services and scheduled tasks, surfaced for audit and manual review

No coverage entry matches that search.

Preserved by policy: hardware-control suites, hotkeys, recovery tools, BIOS/firmware dependencies, drivers, audio/network/chipset components, RMM agents, remote-access tools, VPN clients, BitLocker tooling, and backup agents. ConnectWise and ScreenConnect are classified as approved management software and cannot be promoted to removal.

Next steps

Go deeper

Operator guide

Safe usage, policy profiles, the two authorization gates, and how to read a report.

Reference

Policy file schema, report artifacts, exit codes, and unattended deployment.

Developer docs

Architecture, trust boundaries, the security model, and how to build and test.