Skip to content

Instantly share code, notes, and snippets.

@mark05e
Last active July 16, 2025 06:48
Show Gist options
  • Save mark05e/a79221b4245962a477a49eb281d97388 to your computer and use it in GitHub Desktop.
Save mark05e/a79221b4245962a477a49eb281d97388 to your computer and use it in GitHub Desktop.
# ██████╗ ███████╗███╗ ███╗ ██████╗ ██╗ ██╗███████╗ ██╗ ██╗██████╗
# ██╔══██╗██╔════╝████╗ ████║██╔═══██╗██║ ██║██╔════╝ ██║ ██║██╔══██╗
# ██████╔╝█████╗ ██╔████╔██║██║ ██║██║ ██║█████╗ ███████║██████╔╝
# ██╔══██╗██╔══╝ ██║╚██╔╝██║██║ ██║╚██╗ ██╔╝██╔══╝ ██╔══██║██╔═══╝
# ██║ ██║███████╗██║ ╚═╝ ██║╚██████╔╝ ╚████╔╝ ███████╗ ██║ ██║██║
# ╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═════╝ ╚═══╝ ╚══════╝ ╚═╝ ╚═╝╚═╝
#
# ██████╗ ██╗ ██████╗ █████╗ ████████╗██╗ ██╗ █████╗ ██████╗ ███████╗
# ██╔══██╗██║ ██╔═══██╗██╔══██╗╚══██╔══╝██║ ██║██╔══██╗██╔══██╗██╔════╝
# ██████╔╝██║ ██║ ██║███████║ ██║ ██║ █╗ ██║███████║██████╔╝█████╗
# ██╔══██╗██║ ██║ ██║██╔══██║ ██║ ██║███╗██║██╔══██║██╔══██╗██╔══╝
# ██████╔╝███████╗╚██████╔╝██║ ██║ ██║ ╚███╔███╔╝██║ ██║██║ ██║███████╗
# ╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═╝ ╚═╝ ╚══╝╚══╝ ╚═╝ ╚═╝╚═╝ ╚═╝╚══════╝
#
# Remove HP bloatware / crapware
#
# -- source : https://gist.github.com/mark05e/a79221b4245962a477a49eb281d97388
# -- contrib: francishagyard2, mark05E, erottier, JoachimBerghmans, sikkepitje
# -- ref : https://community.spiceworks.com/topic/2296941-powershell-script-to-remove-windowsapps-folder?page=1#entry-9032247
# -- note : this script could use your improvements. contributions welcome!
# -- todo : Wolf Security improvements ref: https://www.reddit.com/r/SCCM/comments/nru942/hp_wolf_security_how_to_remove_it/
# List of built-in apps to remove
$UninstallPackages = @(
"AD2F1837.HPJumpStarts"
"AD2F1837.HPPCHardwareDiagnosticsWindows"
"AD2F1837.HPPowerManager"
"AD2F1837.HPPrivacySettings"
"AD2F1837.HPSupportAssistant"
"AD2F1837.HPSureShieldAI"
"AD2F1837.HPSystemInformation"
"AD2F1837.HPQuickDrop"
"AD2F1837.HPWorkWell"
"AD2F1837.myHP"
"AD2F1837.HPDesktopSupportUtilities"
"AD2F1837.HPQuickTouch"
"AD2F1837.HPEasyClean"
"AD2F1837.HPSystemInformation"
)
# List of programs to uninstall
$UninstallPrograms = @(
"HP Client Security Manager"
"HP Connection Optimizer"
"HP Documentation"
"HP MAC Address Manager"
"HP Notifications"
"HP Security Update Service"
"HP System Default Settings"
"HP Sure Click"
"HP Sure Click Security Browser"
"HP Sure Run"
"HP Sure Recover"
"HP Sure Sense"
"HP Sure Sense Installer"
"HP Wolf Security"
"HP Wolf Security Application Support for Sure Sense"
"HP Wolf Security Application Support for Windows"
)
$HPidentifier = "AD2F1837"
$InstalledPackages = Get-AppxPackage -AllUsers `
| Where-Object {($UninstallPackages -contains $_.Name) -or ($_.Name -match "^$HPidentifier")}
$ProvisionedPackages = Get-AppxProvisionedPackage -Online `
| Where-Object {($UninstallPackages -contains $_.DisplayName) -or ($_.DisplayName -match "^$HPidentifier")}
$InstalledPrograms = Get-Package | Where-Object {$UninstallPrograms -contains $_.Name}
# Remove appx provisioned packages - AppxProvisionedPackage
ForEach ($ProvPackage in $ProvisionedPackages) {
Write-Host -Object "Attempting to remove provisioned package: [$($ProvPackage.DisplayName)]..."
Try {
$Null = Remove-AppxProvisionedPackage -PackageName $ProvPackage.PackageName -Online -ErrorAction Stop
Write-Host -Object "Successfully removed provisioned package: [$($ProvPackage.DisplayName)]"
}
Catch {Write-Warning -Message "Failed to remove provisioned package: [$($ProvPackage.DisplayName)]"}
}
# Remove appx packages - AppxPackage
ForEach ($AppxPackage in $InstalledPackages) {
Write-Host -Object "Attempting to remove Appx package: [$($AppxPackage.Name)]..."
Try {
$Null = Remove-AppxPackage -Package $AppxPackage.PackageFullName -AllUsers -ErrorAction Stop
Write-Host -Object "Successfully removed Appx package: [$($AppxPackage.Name)]"
}
Catch {Write-Warning -Message "Failed to remove Appx package: [$($AppxPackage.Name)]"}
}
# Remove installed programs
$InstalledPrograms | ForEach-Object {
Write-Host -Object "Attempting to uninstall: [$($_.Name)]..."
Try {
$Null = $_ | Uninstall-Package -AllVersions -Force -ErrorAction Stop
Write-Host -Object "Successfully uninstalled: [$($_.Name)]"
}
Catch {Write-Warning -Message "Failed to uninstall: [$($_.Name)]"}
}
# Fallback attempt 1 to remove HP Wolf Security using msiexec
Try {
MsiExec /x "{0E2E04B0-9EDD-11EB-B38C-10604B96B11E}" /qn /norestart
Write-Host -Object "Fallback to MSI uninistall for HP Wolf Security initiated"
}
Catch {
Write-Warning -Object "Failed to uninstall HP Wolf Security using MSI - Error message: $($_.Exception.Message)"
}
# Fallback attempt 2 to remove HP Wolf Security using msiexec
Try {
MsiExec /x "{4DA839F0-72CF-11EC-B247-3863BB3CB5A8}" /qn /norestart
Write-Host -Object "Fallback to MSI uninistall for HP Wolf 2 Security initiated"
}
Catch {
Write-Warning -Object "Failed to uninstall HP Wolf Security 2 using MSI - Error message: $($_.Exception.Message)"
}
# # Uncomment this section to see what is left behind
# Write-Host "Checking stuff after running script"
# Write-Host "For Get-AppxPackage -AllUsers"
# Get-AppxPackage -AllUsers | where {$_.Name -like "*HP*"}
# Write-Host "For Get-AppxProvisionedPackage -Online"
# Get-AppxProvisionedPackage -Online | where {$_.DisplayName -like "*HP*"}
# Write-Host "For Get-Package"
# Get-Package | select Name, FastPackageReference, ProviderName, Summary | Where {$_.Name -like "*HP*"} | Format-List
# # Feature - Ask for reboot after running the script
# $input = Read-Host "Restart computer now [y/n]"
# switch($input){
# y{Restart-computer -Force -Confirm:$false}
# n{exit}
# default{write-warning "Skipping reboot."}
# }
@mark05e
Copy link
Author

mark05e commented Jul 1, 2021

Will give it a try next time I come across a machine. Added a section to reboot.

@erottier
Copy link

erottier commented Jul 1, 2021

Will give it a try next time I come across a machine. Added a section to reboot.

Nice!
BTW, I have it running successfully on more then 60 machines now.

Wouldn't it be easier to set a $Failed boolean to $True if something failed to install and 'reboot' if the value is true? Or perhaps both systems to be sure?

@mark05e
Copy link
Author

mark05e commented Jul 2, 2021

Sweet! Thank you for trying it out. I will look at what I can do regarding the other features. So just to confirm - all Wolf Security stuff has been removed with the existing code?

@erottier
Copy link

erottier commented Jul 2, 2021

Sweet! Thank you for trying it out. I will look at what I can do regarding the other features. So just to confirm - all Wolf Security stuff has been removed with the existing code?

NP, and yes! :D

And if you STILL (wink) don't believe me that your code works: (note that I show the value of all 3 arrays and paused the window for my benefit)
UninstallHPWolf

@VexedViper
Copy link

Only problem I ran into is the uninstalls don't seem to be silent. I got a pop-up on Support Assistant uninstall asking if I wanted to keep data, and I also got the web page pop-up asking why it was uninstalled.

Is there a way to silent uninstall the programs in the list? Sorry for such a silly question, lol.

@mark05e
Copy link
Author

mark05e commented Aug 27, 2021

@VexedViper - it seems there might be a specialized uninstallation code required, instead of the generic code that is used here. I might not be able to help with that.

@SergeCaron
Copy link

SergeCaron commented Sep 30, 2021

Thank you for a very useful tool.

Care must be taken to remove exclusions inserted in Windows Defender by "HP Wolf Security": these exclusions are NOT removed by the uninstall process. In fact, they are greyed out in the exclusion lists and cannot be removed manually.

After six hours of googling around, I finally found this article on the exclusions added by HP’s bloatware :

"Configure Exclusions and Whitelisting for Third-Party Security Software (bromium.com)" (https://support.bromium.com/s/article/Bromium-and-Third-Party-Software-Interoperability-Guide)

Sure enough, section 1 of this article lists all the files and folder exclusions that we can see in Windows Defender Settings but can’t remove after this “HP Wolf Security” is uninstalled.

Section 2.1 list the executable responsible for adding these exclusions and has this bit of warning “When installed, Sure Click Enterprise will automatically attempt to add exclusions for the following files and directories into Windows Defender…”

It also refers to another article "Controller Management Action: Sure Click Enterprise has not been added to the Windows Defender exclusions (bromium.com)" (https://support.bromium.com/s/article/Controller-Management-Action-Bromium-has-not-been-added-to-the-Windows-Defender-exclusions) where you can learn this executable modifies a Microsoft group policy.

When uninstalling this “HP Wolf Security” software from a freshly installed HP PC, these directories
c:\Program Files\HP
C:\ProgramData\Bromium
C:\Users\Usager\AppData\Local\Bromium
C:\Users\Usager\AppData\LocalLow\Bromium
are left unprotected because the setting s modified by “Br-uxendm.exe” are not undone: this was not part of the “installation” procedure and it not part of the uninstall. (The situation is much worst than that: about 39 executables can be impersonated and there are “Bromium” directories for each user on the workstation…)

The Bromium utility responsible for this mess is “Br-uxendm.exe”: its actual strategy depend on the antivirus program in use. In the case at hand, only Windows Defender is running immediately before this “HP Wolf Security” is installed.

As a temporary bypass, all HP software related to “Wolf” must be uninstalled first. Next, the Windows Defender exclusion parameters are disabled in local group policy. Finally the PC must be restarted.

Total: 9 hours wasted on this issue because HP can’t “get it right”. You can pass this along the food chain: every time you push a customer out of the door, there are no further sales …

Conclusion: use GPEDIT to disable the local policy:

  • Local Computer Policy
    • Computer Configuration
      • Administrative Templates
        • Windows Components
          • Microsoft Defender Antivirus
            • Exclusions
              • disable the path and process lists.

GPEDIT applies these policies even if the "path and process lists" appear as "Not Configured".

Regards,

@xfaustxx
Copy link

@SergeCaron I too have this issue. In my case, these orphaned Defender exclusions like yours are set in local GPO as 'not configured', however I also found them in the registry, and once removed from the registry, this in turn removed them from Defender, so the issue was solved. In case anyone else was looking for a solution.

@JoachimBerghmans
Copy link

Hi @mark05e,

First of all, I've only started using a Github account today so I'm not sure I'm doing everything the correct way.

I have modified your script a little bit. I have written the script so it can be packaged as a Win32 app and be deployed as a Windows app during Autopilot. I've changed the error handling and added a module to write to a log file (this still needs some finetuning).

On my test devices there were still some issues removing HP Connection Optimizer, HP Support Assistant (silently) and HP Wolf.
I've included some extra steps to try and remove those apps if the other attempts fail.

I also added some Windows apps to be removed to the list.

You can find the script here:
https://github.com/JoachimBerghmans/Powershell/blob/main/Autopilot/Remove-Bloatware.ps1

@mark05e
Copy link
Author

mark05e commented Mar 11, 2022

@JoachimBerghmans thank you for sharing your code and the effort put into the enhancements. I used to work at an MSP when I made this and now I do not anymore. Happy that you have found it useful and that you have shared your changes. 🙂

From my understanding of the situation, HP regularly makes new additions to their bloatware and the script changes need to be kept up inorder to meet those changes.

@Bosse-smartsys
Copy link

Thank you @JoachimBerghmans script works like clockwork with Intune!

@josephkray
Copy link

Also battling this currently. Thank you @mark05e and @JoachimBerghmans for these scripts. Very helpful.

@Bosse-smartsys Which way did you get it to work via Intune? I packaged with the Intune tool and deployed as a win32 application but it fails after I sync the machine.

@custa19
Copy link

custa19 commented May 24, 2022

@josephkray It works fine for me in Intune too. No need to deploy as Win32, just run it as a standard script to your clients through intune. These are the settings that worked for me:

PowerShell script - Remove-HPbloatware.ps1
Run this script using the logged on credentials - No
Enforce script signature check - No
Run script in 64 bit PowerShell Host - Yes

If you are not sure how to use powershell scripts in Intune, have a quick look at this documentation, it's pretty straight forward.
https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension

@josephkray
Copy link

Thank you @custa19 , just implemented your way of doing it vs doing the package and it worked perfectly.

Copy link

ghost commented Jun 8, 2022

Thanks a lot mate

@sikkepitje
Copy link

Please add to $UninstallPackages: "AD2F1837.HPQuickTouch"

Add to $UninstallPrograms: "HP Sure Click Security Browser"

@sikkepitje
Copy link

sikkepitje commented Jun 29, 2022

$InstalledPrograms += Get-Package | Where {$_.Name.Contains("HP Wolf Security")} # also uninstall programs like "HP Wolf Security Application Support for Chrome x.y.z.z"

@custa19
Copy link

custa19 commented Jun 29, 2022

$InstalledPrograms += Get-Package | Where {$_.Name.Contains("HP Wolf Security")} # also uninstall programs like "HP Wolf Security Application Support for Chrome x.y.z.z"

When I add this, I get the following:
Method invocation failed because [Microsoft.PackageManagement.Packaging.SoftwareIdentity] does not contain a method named 'op_Addition'.
At line:1 char:1

  • $InstalledPrograms += Get-Package | Where {$_.Name.Contains("HP Wolf ...
  •   + CategoryInfo          : InvalidOperation: (op_Addition:String) [], RuntimeException
      + FullyQualifiedErrorId : MethodNotFound
    
    

@custa19
Copy link

custa19 commented Jun 29, 2022

$InstalledPrograms += Get-Package | Where {$_.Name.Contains("HP Wolf Security")} # also uninstall programs like "HP Wolf Security Application Support for Chrome x.y.z.z"

When I add this, I get the following: Method invocation failed because [Microsoft.PackageManagement.Packaging.SoftwareIdentity] does not contain a method named 'op_Addition'. At line:1 char:1

  • $InstalledPrograms += Get-Package | Where {$_.Name.Contains("HP Wolf ...
  •   + CategoryInfo          : InvalidOperation: (op_Addition:String) [], RuntimeException
      + FullyQualifiedErrorId : MethodNotFound
    

I am now using:
$InstalledPrograms = Get-Package | Where {($UninstallPrograms -contains $_.Name) -or ($_.Name.Contains("HP Wolf Security"))}

seems to work.

@sikkepitje
Copy link

The error can happen when the number of items is only 1. Your solution would be better.

@mark05e
Copy link
Author

mark05e commented Jul 3, 2022

Updated 7/2/2022

@azumukupoe
Copy link

Write-LogEntry: Remove-HPbloatware.ps1:113
Line |
 113 |      Write-LogEntry -Value  "Failed to uninstall HP Wolf Security usin …
     |      ~~~~~~~~~~~~~~
     | The term 'Write-LogEntry' is not recognized as a name of a cmdlet, function, script file, or
     | executable program. Check the spelling of the name, or if a path was included, verify that the path is
     | correct and try again.
Write-LogEntry: Remove-HPbloatware.ps1:122
Line |
 122 |      Write-LogEntry -Value  "Failed to uninstall HP Wolf Security 2 us …
     |      ~~~~~~~~~~~~~~
     | The term 'Write-LogEntry' is not recognized as a name of a cmdlet, function, script file, or
     | executable program. Check the spelling of the name, or if a path was included, verify that the path is
     | correct and try again.

@mark05e
Copy link
Author

mark05e commented Aug 8, 2022

@azumukupoe - Thank You. This has been fixed.

@duaneking
Copy link

FYI; HP is hiding these in drivers from windows update now.

@Ithendyr
Copy link

I use this script with a Pro-Active Remediation on Intune to uninstall HP Bloatwares but got recurred runs.
Tried to uninstall HP Wolf Security but constantly got message "Fallback to MSI uninistall for HP Wolf Security initiated" and applications didn't uninstalled.
2022-11-21 16_30_04-Administrateur _ Windows PowerShell

(This is the list of installed HP programs after the script run)
2022-11-21 16_41_26-Administrateur _ Windows PowerShell


Modified the script on my side to disable the "Fallback attempts" parts and modified the "Remove installed programs" part to add a MSI uninstallation attempt instead of a raw GUID.
First, i've added "HP Wolf Security - Console" to the programs list to uninstall.

# List of programs to uninstall
$UninstallPrograms = @(
    "HP Client Security Manager"
    "HP Connection Optimizer"
    "HP Documentation"
    "HP MAC Address Manager"
    "HP Notifications"
    "HP Security Update Service"
    "HP System Default Settings"
    "HP Sure Click"
    "HP Sure Click Security Browser"
    "HP Sure Run"
    "HP Sure Recover"
    "HP Sure Sense"
    "HP Sure Sense Installer"
    "HP Wolf Security"
    "HP Wolf Security - Console"
    "HP Wolf Security Application Support for Sure Sense"
    "HP Wolf Security Application Support for Windows"
)

Then modified the script. Below you can find the modified part.
I validated the command lines manually but didn't validate the script for now.
2022-11-21 16_46_10-Administrateur _ Windows PowerShell

# Remove installed programs
$InstalledPrograms | ForEach-Object {

    Write-Host -Object "Attempting to uninstall: [$($_.Name)]..."

    Try {
        $Null = $_ | Uninstall-Package -AllVersions -Force -ErrorAction Stop
        Write-Host -Object "Successfully uninstalled: [$($_.Name)]"
    }
    Catch {
		Write-Warning -Message "Failed to uninstall: [$($_.Name)]"
		Write-Host -Object "Attempting to uninstall MSI package: [$($_.Name)]..."
		Try {
			$product = Get-WmiObject win32_product | where { $_.name -like "$($_.Name)" }
			if ($_ -ne $null) {
				msiexec /x $product.IdentifyingNumber /quiet /noreboot
			}
			else { Write-Warning -Message "Can't find MSI package: [$($_.Name)]" }
		}
		Catch { Write-Warning -Message "Failed to uninstall MSI package: [$($_.Name)]" }
	}
}

Finally, the script indicate he have uninstalled "HP Documentation" but still present on computer. Didn't succeed to uninstall it with msiexec. I will search again when i got some time.

@CasperStekelenburg
Copy link

Please do not use win32_product! querying win32_product can be bad: https://gregramsey.net/2012/02/20/win32_product-is-evil/

@mark05e
Copy link
Author

mark05e commented Nov 25, 2022

  	$product = Get-WmiObject win32_product | where { $_.name -like "$($_.Name)" }

@CasperStekelenburg Do you know of an alternative to this? The first few results when I search on how to uninstall MSI, includes Get-WmiObject -Class Win32_Product


EDIT: I have added the changes here. If anyone can test this and provide feedback, that would be appreciated.

Remove-HPbloatware-beta.ps1

@CasperStekelenburg
Copy link

I'd try searching the registry for the uninstallstring or IdentifyingNumber.
I'd search in "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" or "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall"

@insr33
Copy link

insr33 commented Nov 28, 2022

I seem to have problems to reinstall "HP Support assistant" after running the script. "There was an unknown error -2"
I ended up reinstalling a clean win10 to be sure all crap is removed :) The rest is handled with autopilot

@666gene
Copy link

666gene commented Dec 9, 2022

Gonna test this out today on 5 or so machines. looking forward to it THANKS!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment