Operator guide
Run it safely on a production machine.
This guide assumes you are a technician working on a device you are authorized to administer. A first run changes nothing, so you can start with an audit before deciding anything.
Install
Download the setup launcher from the latest release and choose a mode:
| Mode | Use when |
|---|---|
| Everyone on this computer | Standard fleet deployment. Installs per-machine under Program Files. |
| Just me | You cannot install per-machine software. Installs under Local AppData. |
| Portable | One-off remediation on a device you will not enroll. No installer registration. |
The executable is not code-signed and may trigger SmartScreen. Verify your download against the published SHA256SUMS.txt before running it.
Get-FileHash .\OEM-Endpoint-Cleanup-2.2.1-win-x64.msi -Algorithm SHA256A safe run, step by step
- Launch and approve UACElevation is required to read the full inventory.
- Review the automatic auditJSON and HTML reports are written immediately, before any change is possible.
- Pick a profile and select rowsChoose a policy profile and select rows whose decision is Remove.
- Preview the planLeave Uninstall mode unchecked and choose Preview selected to validate without changing the device.
- Execute deliberatelyEnable Uninstall mode, choose Uninstall selected, and approve the confirmation dialog.
- Review the resultCheck the post-execution inventory, exit codes, and reboot indicators in the exported report.
Steps 1–4 are non-destructive. The device is only modified at step 5.
Reading the grid
Rows carry friendly product and status labels plus a color-coded category for quick triage. Hover a category for its meaning, or a product name for its exact technical identifier. Exported reports always retain the original untruncated values.
| Category | What it means |
|---|---|
| Antivirus / Security | Endpoint protection. Audit-only unless the security gate is enabled. |
| OEM Control Panel | Vendor settings and hardware-control surface. Usually preserved. |
| Hardware / Recovery | Firmware, driver, or recovery dependency. Preserved by policy. |
| Trialware | Time-limited bundled software. |
| Consumer App | Games, media, and consumer promotions. |
| Bloatware | Promotional, registration, and welcome utilities. |
| OEM Support / Updates | Vendor support assistants and update managers. |
| Background Component | Telemetry and customer-experience agents. |
| OEM Utility | Other vendor-supplied tooling. |
The two authorization gates
Some software is deliberately harder to remove than a checkbox.
Include security apps
Endpoint protection stays audit-only unless this is explicitly enabled in uninstall mode. Enabling it does not override allowlists, protected-software safeguards, manual-review catalog entries, or command validation. Active Security Center products are guarded independently of catalog metadata.
Include remote tools
Remote-management tools appear in a dedicated investigation panel on the right, not in the main list. Removing one requires all of: uninstall mode, this separate authorization, an eligible policy decision, row selection, and final confirmation. Under Conservative policy an organization blocklist match is additionally required.
ConnectWise and ScreenConnect cannot be removed. They are classified as approved management software and are preserved even with remote-tool removal and an aggressive organization blocklist both enabled.
Policy profiles
| Profile | Automatic eligibility |
|---|---|
Conservative default | Catalog entries marked Safe only |
Balanced | Safe plus cataloged Caution entries, with confirmation |
Aggressive | Safe and Caution; ManualReview remains protected |
No profile makes ManualReview entries eligible. Aggressive widens which cataloged entries are considered, not which safety checks apply. See the policy file reference to set this centrally.
When an item will not remove
If a row is manual-review or skipped, the report records why. These are fail-closed outcomes by design, not bugs.
- Low or tied match confidence — the tool cannot prove which product it is.
- Protected software — it matched an RMM, VPN, backup, driver, or firmware guard.
- No supported backend — it is a service, scheduled task, or registry artifact without a dedicated tested handler.
- Gate not enabled — it is endpoint protection or a remote tool and the matching authorization was off.
- Command validation failed — the vendor uninstall string was not safely executable.
If you believe an item should be cataloged differently, open a catalog request.
After the run
Reports are your evidence. See the report reference for the artifacts, the hash-chained audit log, and exit-code meanings.
There is no automatic rollback. Vendor uninstallers are not transactional. Reinstall removed software from the OEM support portal, the Microsoft Store, or your approved package source. The report records item-specific guidance.