Clean up an old PC with an AI assistant, and give it a safe toolbox

1What you end up with

• A list of every program on the PC, reviewed line by line, and a clear verdict for each: remove, update, keep, or watch.
• Old and unsupported software gone in one reviewed pass, with a log of every removal. On a PC that has collected programs for years, expect to recover tens or hundreds of gigabytes.
• A single tools folder on a second drive holding everything the assistant installs, each tool verified, with its settings and caches kept in that folder rather than your user profile.
• An inventory and a history log recording what was installed, from where, its fingerprint, and how to check it for updates and security advisories.
• An owner's manual: for each change, what was done, why, how to check it, and how to undo it.

2Ground rules

Agree on these with the assistant before it touches anything, and write them where it will read them in every session (its memory or instructions file).

• Nothing new on the system drive. Tools go in one folder on another drive, such as D:\Tools. If an installer can't be redirected, the assistant says so and asks.
• Check before installing. Search the whole PC for an existing copy first. A quick look at the command path misses most installs.
• Official sources only, each download checked against the publisher's SHA-256 fingerprint, twice where the project publishes its own checksum list.
• Portable over installers: no registry changes, no admin prompts, easy to delete.
• Private by default. Turn off usage reporting in every tool. Share nothing unless you get clear value back.
• Recycle, don't delete. Folders go to the Recycle Bin so you can still recover them.
• The owner decides anything involving admin rights, sign-ins, license terms, payments, or permanent deletion.

3Take inventory

Find-InstalledApps.ps1 reads the same three places Settings > Apps uses, optionally adds Microsoft Store apps, and saves a dated spreadsheet with blank Review and Notes columns. Each later run also writes a list of what was added or removed since the previous snapshot. It only reads; it changes nothing.

.\Find-InstalledApps.ps1 -OutputFolder D:\pc-apps -IncludeStoreApps
.\Find-InstalledApps.ps1 -Search 7-Zip, ffmpeg, tesseract

The search form is the "already installed?" check: it looks in the Apps list, Store apps, the command path, Program Files, per-user program folders and common package-manager folders.

Two more read-only checks are worth running with the list. First, see which old programs run background services, or listen on your network, with Get-NetTCPConnection -State Listen. Second, measure what's using the disk. A quick disk-usage tool, run by folder, shows whether games, caches, or old backups dominate.

4Decide what goes

Have the assistant sort the list into groups and explain anything unfamiliar in a sentence. You make every call.

5Remove in one pass

Remove-Apps.ps1 takes patterns matched against the names in Settings > Apps, from the command line or a text file with comments explaining each choice. It shows exactly what matched, waits for Enter, uses each program's gentlest uninstall method, logs every result, and finally lists anything still installed.

# remove-list.txt - one pattern per line
^Adobe Flash Player          # discontinued 2020
^Java 8 Update               # years of unpatched holes
^Microsoft Silverlight
^Suite Manager               # goes last, see -RemoveLast

.\Remove-Apps.ps1 -MatchFile .\remove-list.txt -RemoveLast '^Suite Manager' -WhatIf
.\Remove-Apps.ps1 -MatchFile .\remove-list.txt -RemoveLast '^Suite Manager'

• Run it first with -WhatIf. It prints the list and changes nothing.
• Run the real pass from an elevated PowerShell: one admin prompt, then Enter. Some uninstallers still open their own windows; accept them, and choose "restart later".
• MSI packages are removed with msiexec /x and a detailed log each. Two installs with the same name but different versions are both removed.
• -StoreMatch removes Store apps for the current user, with no admin needed.
• If an uninstaller file has gone missing, the program is reported as an orphan. With -CleanOrphans, its leftover Apps-list entry is backed up to a .reg file and then cleared.

When a pass doesn't finish

• Suite managers deadlock. Some suites route every uninstall through their own manager app, which may insist on updating itself first and then fail because "another installer is running", meaning the uninstaller that launched it. Cancel, close the manager, let the rest finish, then use the vendor's own cleaner tool for that suite.
• Folders stay locked after a restart. A leftover File Explorer add-in can keep a vendor folder open. Find it by checking which process has a DLL from that folder loaded, unregister it with regsvr32 /u, restart Explorer, then recycle the folder.
• Run it again. The script is safe to re-run. It only acts on what's still installed.

6Install tools carefully

Most command-line tools ship a portable build on GitHub. Install-PortableTool.ps1 installs one the same careful way every time:

1. Checks the PC and the tools folder for an existing copy. Same version: nothing to do. Newer release: recorded as an update.
2. Downloads the release file from the project's own GitHub release.
3. Verifies SHA-256 against GitHub's published digest and the project's checksum list. On any mismatch it deletes the file and stops; in testing, a deliberately corrupted download was refused.
4. Unpacks it into its own folder. No installer runs and nothing goes into the registry.
5. Checks the program's code signature, and with -ExpectedSigner requires it. Zip files are never signed; the program inside is.
6. Writes a small launcher that sets environment variables first, so the tool's config, caches and sign-ins stay in the tools folder and its telemetry stays off.
7. Adds an entry to inventory.json and a line to history.log.

.\Install-PortableTool.ps1 -ToolsRoot D:\Tools -Repo cli/cli -Name gh `
    -AssetPattern 'windows_amd64\.zip$' -ChecksumAssetPattern 'checksums\.txt$' `
    -ExpectedSigner 'GitHub' -Command gh -Exe 'bin\gh.exe' `
    -Environment @{ GH_CONFIG_DIR = 'D:\Tools\gh\config'; GH_TELEMETRY = '0' }

Tools that don't come as a zip

• Windows Installer (.msi): msiexec /a file.msi /qn TARGETDIR=D:\Tools\app unpacks the files without installing or registering anything. It works well for large office suites used for unattended document conversion.
• Many .exe installers (NSIS-based ones especially) can simply be opened with 7-Zip and their contents copied out.
• Inno Setup installers can't be unpacked that way. Many allow a just-for-you install with /CURRENTUSER /DIR=; run them while someone is at the PC in case a prompt appears.
• Language package managers (npm, pip via uv, Go, Rust) can live entirely in the tools folder. Point their prefix, cache and home settings there in the launcher.

7Lock the tools folder

Secondary drives often give every account on the PC permission to change files. That matters more than it used to, because some AI coding apps create separate local Windows accounts for their sandboxes, and those accounts count as "authenticated users". Code running inside such a sandbox could then edit a tool you run as yourself.

icacls D:\Tools /inheritance:r /grant:r "%USERNAME%:(OI)(CI)F" "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"

That leaves only you, Windows and administrators. Undo it with icacls D:\Tools /reset /T. Do the same for any folder holding secrets, such as service passwords or encryption keys. It doesn't protect against anything running as you; for that, give AI tools their own Windows account or their own machine.

8Privacy defaults

Many developer tools report usage by default. Turn it off in the tool's own settings and in its launcher, so it stays off if the settings get reset. DO_NOT_TRACK=1 covers some tools on its own.

Some contact with outside services is just how a tool works: a vulnerability scanner downloads its database, a package manager reaches its registry. Note those in the manual rather than fighting them.

9Keep records

• inventory.json: for each tool, its version, source, download URL, SHA-256, signature, install path, launcher, where releases appear and where security advisories are published. Tools that were already on the PC go in an external section so they're watched too.
• history.log: one dated line per install, update, removal, sign-in or setting change.
• An owner's manual: a section per change covering what, why, how to check, and how to undo. Write it for the person who has to fix things in a year.
• A monthly check: a short script reads the inventory, compares each tool with its latest release, lists new security advisories since the last check, and confirms that any tool you wrote yourself still matches its recorded fingerprint. Run a container vulnerability scan on the same day if you run Docker.
• A security to-do list with priorities, plus a watch list for the things you chose to keep despite a risk.

10What stays with you

An assistant can do nearly all of this, but some steps should always be yours:

• Clicking Yes on admin prompts, and choosing when to restart.
• Sign-ins and license terms. Accepting an agreement is your decision, even when you tell the assistant to go ahead.
• Secrets. Paste API keys into Windows Credential Manager yourself (for example with cmdkey /generic:name /user:api /pass); never send them in chat or email. A password manager is a good place for the copy you keep.
• Permanent deletion. The assistant recycles; you empty the Recycle Bin when you're satisfied.
• Irreplaceable data. Old phone backups and virtual machine disks may be the only copies. Mark them off-limits for every cleanup.

11Lessons and pitfalls

• Checking only the command path misses most installs. Check the Apps list, Program Files and per-user folders too.
• Match whole words when searching names. A tool called cli must not match every "Client".
• Don't make your user folder a Git repository. AI coding tools snapshot the repository they work in, so they may copy gigabytes of personal files into hidden Git storage, and tools start popping up sign-in windows. Keep projects in their own folders.
• Saved Git sign-ins mean a push won't ask. If you'd rather not get surprise sign-in windows, git config --global credential.interactive false stops them, and you sign in on purpose when you need to.
• npm may block packages' install scripts. Many tools work fine without them. Test before allowing.
• Checksum lists sometimes omit the Windows file, and some installers are signed with expired certificates. Fall back to GitHub's own digest and say so in the inventory.
• Moving a data folder? Look for links inside it first. A folder can contain a link to an external drive that isn't plugged in, and recreating that link may need admin rights.
• Removed Store apps don't free space at once. Windows cleans up their files later.
• After a restart on a PC with lots of RAM, Windows may enlarge the page file by tens of gigabytes. A fixed size of 8–16 GB on the system drive is usually plenty.
• Docker Desktop may not start at sign-in, leaving self-hosted services down after every restart. Check its startup setting.
• Windows PowerShell 5.1 quirks: $PSScriptRoot is empty in parameter defaults, lists passed with -File arrive as one string, and JSON arrays don't enumerate in pipelines. Test scripts in 5.1, not only in 7.

12Order of operations

1. Agree the ground rules; create and lock the tools folder.
2. Take an inventory snapshot; check listening ports and disk usage.
3. Review the list together; write the removal list with a reason per line.
4. Reinstall anything you need from what's being removed (for example tools inside an old runtime).
5. Dry run, then the real removal pass; vendor cleaner tools for stubborn suites.
6. Restart; clear locked leftovers; take a new snapshot to confirm.
7. Install tools into the tools folder, verified, with telemetry off.
8. Updates that need admin: drivers, disk utilities, database tools.
9. Write the manual, the inventory and the security list; schedule the monthly check.
10. Empty the Recycle Bin when you're sure.

13The scripts

Free to use under the MIT license, for Windows PowerShell 5.1 and PowerShell 7. Read them before running them; they're short and commented.

Make them yours with an AI assistant

You don't have to adapt these by hand. Paste a script, or this whole page, into an AI assistant and describe your setup: your drive letters, the programs you want gone, the tools you want installed. The scripts and their comments show the assistant what you're trying to do and the safety steps to keep, so it can produce a version that fits your PC and walk you through your first run. Read what it gives you before running it, and keep the -WhatIf dry run in the plan.

If Windows blocks a downloaded script, check it first, then run Unblock-File .\script.ps1, or start PowerShell with -ExecutionPolicy Bypass for that one run.