WIN-027 · Script
Unapproved Remote Access Tool Removal
Finds remote access tools that are not on your approved list and, in Remove mode, uninstalls them silently.
What it does
Looks for common remote access tools in three places:
- installed programs (uninstall registry keys), matched by display name with -ToolPatterns
- Windows services, matched by service or display name with -ServicePatterns
- running processes from a portable copy (report only, never stopped or deleted)
Default lists cover AnyDesk, TeamViewer, ScreenConnect / ConnectWise Control clients, Splashtop, RustDesk, UltraVNC, TightVNC, RealVNC, LogMeIn, Chrome Remote Desktop, Remote Utilities, Supremo, Zoho Assist, NoMachine and AeroAdmin.
Anything that matches -AllowList is treated as approved and left alone. The allow list is checked against the display name, registry key name, uninstall command, install folder and service names, so you can approve one specific instance, for example your own ScreenConnect client by its instance ID (the text in brackets in "ScreenConnect Client (1a2b3c4d5e6f7a8b)").
Report mode (default) changes nothing and lists every unapproved tool and the silent uninstall command it would run. Remove mode stops the tool's services, then runs a silent uninstall: msiexec /x {ProductCode} /qn for Windows Installer products, otherwise the QuietUninstallString, Inno Setup silent switches, or a known silent switch for that vendor. Tools without a known silent method are reported and, with -DisableServices, have their services stopped and disabled instead.
A CSV of findings is written to -ReportDir on every run. Runs silently as SYSTEM from any RMM or Intune. No prompts, no user interaction.
Requirements
Windows PowerShell 5.1+, run as SYSTEM or local admin
How to run it
- Run as: SYSTEM or a local administrator
- Run from: any RMM or MDM, Intune, a Group Policy startup script, a scheduled task, or an elevated PowerShell window
- Script type: PowerShell, 64-bit
- User interaction: none; the script never prompts
- Timeout: 10 minutes (30 for Windows Update installs)
Settings
| Name | What it does | Options | Default |
|---|---|---|---|
| Mode | Report (default) = read-only. Remove = uninstall unapproved tools. | Report, Remove | Report |
| ToolPatterns | Display name patterns of installed programs to treat as remote access tools. Wildcards allowed. Example: 'AnyDesk*','TeamViewer*'. | AnyDesk*, TeamViewer*, ScreenConnect Client*, ConnectWise Control Client*, Splashtop*, RustDesk*, UltraVNC*, TightVNC*, RealVNC*, VNC Server*, VNC Viewer*, LogMeIn*, Chrome Remote Desktop Host*, Remote Utilities*, Supremo*, Zoho Assist*, NoMachine*, AeroAdmin* | |
| ServicePatterns | Service name or service display name patterns to treat as remote access tools. Wildcards allowed. | AnyDesk*, TeamViewer*, ScreenConnect Client*, SplashtopRemoteService, SSUService, RustDesk*, uvnc_service, tvnserver, vncserver, LMIGuardianSvc, LogMeIn, chromoting, RManService, SupremoService, ZohoAssist*, nxservice | |
| ExtraPatterns | More patterns, checked against both program and service names. Example: '*Ammyy*'. | (none) | |
| AllowList | Approved tools. Plain text is matched anywhere (contains); text with * is a wildcard match. Examples: '1a2b3c4d5e6f7a8b' (your ScreenConnect instance ID), 'Splashtop Streamer', 'TeamViewer Host*'. | (none) | |
| DisableServices | In Remove mode, stop and disable the services of tools that cannot be uninstalled silently. | False | |
| TimeoutMinutes | Minutes to wait for each uninstaller. Default 10. | 10 | |
| ReportDir | Folder for the CSV report. Default C:\ProgramData\Runbookia\Reports. | C:\ProgramData\Runbookia\Reports |
Exit codes
- 0 = No unapproved tools found, or all removed
- 1 = Unapproved tools found (Report), or some remain after Remove
- 2 = Script error
Testing steps
- Run it first with the mode set to Report on one test device. Nothing is changed in that mode.
- Read the log and confirm the planned changes are what you expect.
- Run your chosen settings on the same test target and confirm the result.
- Check the exit code: 0 = OK, 1 = needs attention, 2 = error (see log), 9 = this copy is past its Valid until date.
- Roll out to a small group next, then everyone.
Rollback steps
Reinstall the approved tool from the vendor and add it to -AllowList before the next run. Services disabled with -DisableServices can be turned back on with Set-Service -Name <service> -StartupType Automatic; Start-Service <service>. The CSV report in the Reports folder lists every tool and action.
Version and change log
| Version | Date | Changes |
|---|---|---|
| 1.0.0 | November 2026 | First release. |