Reference

Policy, reports, and deployment.

Everything you need to deploy the tool through an RMM and ingest its output centrally.

Policy file

Organization policy is optional. Without a policy file the tool runs in its safest configuration: the Conservative profile with dry-run enabled. Place the file at:

C:\ProgramData\OemCleanup\policy.json

A malformed policy file fails closed to conservative dry-run behavior rather than being partially applied.

{
  "profile": "Conservative",
  "dryRun": true,
  "force": false,
  "allowSecurityProductRemoval": false,
  "allowRemoteManagementRemoval": false,
  "processTimeoutSeconds": 900,
  "allowList": ["ConnectWise*", "*ScreenConnect*", "Lenovo Vantage", "*SupportAssist*"],
  "blockList": ["WildTangent Games"],
  "reportDirectory": "C:\\ProgramData\\OemCleanup\\Reports"
}

Field	Type	Default	Meaning
`profile`	string	`Conservative`	`Conservative`, `Balanced`, or `Aggressive`
`dryRun`	bool	`true`	When true, no process is ever started
`force`	bool	`false`	Suppresses the final confirmation for an already-authorized action
`allowSecurityProductRemoval`	bool	`false`	Enables the endpoint-protection gate
`allowRemoteManagementRemoval`	bool	`false`	Enables the remote-tool gate
`processTimeoutSeconds`	int	`900`	Per-uninstaller bound, clamped to 30–3600
`allowList`	string[]	empty	Wildcard patterns that are never removed
`blockList`	string[]	empty	Wildcard patterns promoted toward eligibility
`reportDirectory`	string	see above	Output location

Treat policy.json as privileged. Anyone who can write it can set force: true and suppress the confirmation prompt for authorized actions. Restrict its ACL to administrators.

Allow and block lists

Wildcards * and ? are supported in both lists. The allowlist always wins over the blocklist.

A blocklist entry can promote a cataloged Caution item to removal eligibility, but it cannot bypass:

protected-software patterns (RMM, VPN, backup, encryption, drivers, firmware)
the endpoint-protection authorization gate
ManualReview classification
an unsupported or unimplemented removal backend

Report artifacts

Reports are written on every run, including audit-only runs where nothing is removed.

File	Purpose
`*.json`	Machine-readable schema 2.2 for RMM/MSP ingestion
`*.html`	Human-readable device, inventory, decision, and execution report
`*.jsonl`	Hash-chained audit events
`*-execution.jsonl`	Commands, results, errors, exit codes, reboot flags, post-execution inventory

Each JSONL event embeds the hash of the previous event, forming a chain. Whole-log SHA-256 checksums are recorded in the report, so removing or editing an event is detectable.

Reports contain hostname, user context, serial number, BIOS version, and full software inventory. Restrict report directory ACLs and control RMM ingestion access accordingly.

Exit codes

Code	Meaning
`0`	Success
`1603`	Fatal error during installation (vendor failure)
`3010`	Success, reboot required
`1641`	Success, reboot initiated
timeout	Reported as a distinct outcome, not as an installer failure

Failed uninstallers preserve bounded diagnostic output in the result, so reports show the vendor or Windows deployment error rather than only a code.

Unattended deployment

Standard Windows Installer properties apply.

All users (elevated):

msiexec.exe /i .\OEM-Endpoint-Cleanup-2.2.1-win-x64.msi /qn /norestart ALLUSERS=1 MSIINSTALLPERUSER=""

Current user:

msiexec.exe /i .\OEM-Endpoint-Cleanup-2.2.1-win-x64.msi /qn /norestart ALLUSERS=2 MSIINSTALLPERUSER=1

Push policy.json as part of the same deployment so every technician runs the same profile, allowlist, and report directory rather than relying on per-run UI choices.

Suggested rollout

Ring testDeploy to a small ring covering each OEM model you support.
Collect dry-run reportsRun in dry-run and gather the JSON reports centrally.
Review per modelCheck catalog matches and decisions before enabling uninstall mode.
Widen graduallyExpand the ring only once a model's results are stable.

OEM product names, installer technology, and supported silent flags vary by model and release, so ring testing matters more here than for typical software.