How to use HiveSweeper — CosmicForge Labs

Before you start

HiveSweeper is a portable program: a single file, HiveSweeper.exe, that runs from wherever it is saved and does not install. Administrator rights are not needed to look at a PC or to build a script. The current version is on the downloads page. This guide describes version 1.7.1. The screenshots use invented sample data: a made-up PC and made-up applications.

HiveSweeper is signed by Embermont Ltd. Windows SmartScreen may still show a prompt the first time it runs, because SmartScreen also takes a download's reputation into account. If it appears, choose More info, then Run anyway. On managed PCs, IT staff can allow HiveSweeper by its Embermont Ltd publisher certificate.

HiveSweeper reads, and builds a script. It does not change the PC itself. Only running the script with -Execute changes anything.

Remove an application, step by step

Run HiveSweeper.exe. It opens on Home. In the menu on the left, choose Installed apps.
The Desktop apps tab lists everything with an uninstall entry. Type in the filter box to match an app's name or publisher. Show hidden also lists the entries Windows hides.
Select the app and choose Open footprint, or double-click it. This opens everything the app left on the PC. Back to Installed apps returns to the list.
Read the grading (below), then choose Add safe items to Steps. To add others, tick them and choose Add ticked to Steps. On Installed apps, Add uninstall to Steps adds just the app's own uninstaller.
Everything added appears in the Steps panel on the right, grouped into machine-wide steps and per-user-profile steps.
In Steps, choose Export, then PowerShell script (.ps1). The same menu can save the steps as a PDF or a text file.

Before removing a runtime or shared component, check what still needs it. The NEEDED BY column on Installed apps shows how many apps depend on each one, and App dependencies shows which, and why. An uninstall added to Steps is shown in amber when something on this PC still needs the app.

HiveSweeper's Installed apps page listing 28 sample applications with their publisher and version — Installed apps. Select an app, then choose Open footprint.

HiveSweeper showing everything a sample application, Fabrikam Studio, left on the PC, with seven items ticked as safe and others marked Review — The footprint of a sample application. Safe items are ticked for you.

The Steps panel open beside the footprint, listing seven removal steps added from the safe items — After Add safe items to Steps, the Steps panel lists each step.

What the footprint shows

The footprint is split into sections:

On this PC: Machine-wide items, removed once.
For each user profile: AppData folders and per-user registry keys. In the script these repeat for every user profile.
Policies: Collapsed until opened.
Left alone: Items shared with Windows or other software. Shown for reference, never removed.

Each item carries a grade:

Safe: Tied to the app itself: inside its install folder, its own uninstall entry, its own service.
Review: Matched by name. Worth checking before it is added.
Check first: A weak match. Look closely before adding it.

Further down: Review and Check first items, the items for each user profile, and the Policies and Left alone sections.

Run the script

By default the script is a preview. It changes nothing and prints PREVIEW mode (-Execute to apply). Read what it says it would do, then apply it only if it is right.

Preview: powershell -ExecutionPolicy Bypass -File .\steps.ps1
Apply: powershell -ExecutionPolicy Bypass -File .\steps.ps1 -Execute

Each uninstall is checked on the device first. If something on that PC still needs the app (another program loads a file it installed, an installer recorded that it needs it, a program asks for the .NET runtime it provides, or a service depends on its service), the uninstall is skipped there and the summary shows skipped (needed by ...). The other steps still run. Removing a Store package is checked the same way: it is skipped while another installed package needs it.

The check looks at every user profile, not only the machine: users who are signed in always, and users who are signed out when the script runs as an administrator or as SYSTEM. Uninstalls of apps installed for one user are checked too, and a skip names that user.

Either way, a summary table is printed at the end. Exit code 0 means done, or preview only. Exit code 1 means at least one step did not complete.

Who it runs as matters. Run as a standard user, the script makes only the changes that user is allowed to make, processes only that user's profile, and prints a warning saying so. Run as an administrator, or as SYSTEM from Intune or Configuration Manager, it covers machine-wide items and every user profile.

The other pages

Home: A dashboard for this PC: a banner naming anything worth a look (a full drive, firewall or antivirus off, settings that could not be read), then compliance, security, storage, management, power and software tiles. Management includes a VPN line on PCs with VPN profiles; Software lists out-of-date apps, most behind first, with a High, Medium or Low label, once update checks have run. Export snapshot saves a text report, a PDF summary, or the installed-software list as CSV or PDF.
App updates: Check for updates asks winget which installed apps have newer versions. Nothing is installed automatically. Copy all commands copies the winget upgrade commands, or an upgrade can be added to Steps.
App dependencies: Which installed apps need which. Select an app to see Needed by (what depends on it, and would break without it) and Depends on (what it needs), each with the evidence. Links come from what the PC records: shared files programs load, installer records, the .NET runtime a program asks for, services that depend on other services, and the framework packages each Store or packaged app needs. A file that also belongs to another installed product is marked shared: it stays until the last one is removed. Add uninstall to Steps adds an uninstall that is checked on each device before it runs. An app's footprint shows a one-line summary with a link here.
Windows updates: The Windows version and feature upgrades, whether a restart is still needed (including a staged Windows upgrade), update failures with their error codes, and installed patches. Under Updates and what changed, updates installed together are grouped, each with the Windows build before and after, servicing packages, drivers, services added, apps, and errors that first appeared after the restart that finished it. Removed updates are listed too. Save baseline before an update and Compare with now after it to list every registry setting and system file that changed, in Compare builds.
Compliance (beta): Fourteen checks across security, build standard and software, each with what was found, what was expected and how to fix it. The Checklist view tunes the limits and app lists, or loads a checklist from a file or web address. IT staff can lock the checklist by policy.
Store apps: The second tab of Installed apps, listing packaged (AppX and MSIX) apps. Add removal to Steps removes a package for the current user; the step warns if another installed package needs it, and each device is checked before it runs. Right-click for removal for all users (needs administrator) or deprovisioning, so new users do not get the app.
Device: Hardware, firmware, Secure Boot and TPM, storage and Windows. Exports as PDF.
Policies & settings: Group Policy, device-management (MDM and CSP), registry and power settings, each with a plain-English meaning and where it comes from.
Services & tasks: Services, Processes and Scheduled tasks, each with a search box. Right-click to add a step.
Registry: A tree like the Registry Editor. The box above it suggests key paths as you type, or searches the whole registry by name. Right-click a key or value to add a step.
Intune & Config Mgr: Local diagnostics for Intune enrolment and app deployment, and for the Configuration Manager client. The VPN tab shows the Always On VPN device tunnel and user tunnel: profiles, whether each is connected, whether Always On has been switched off, sign-in certificates and their expiry, DNS routing rules, VPN services and recent connection failures. No remote access.
Build catalog: The apps in a standard build, checked against winget for newer versions.
Compare builds (beta): Capture a registry branch, capture it again elsewhere or later, and compare the two. The differences are counted by area: policies, services and drivers, system settings, software, and files.
File details: Choose Browse or drop an .exe or .msi on the page to see its version, publisher, signature and the silent switches the installer supports. It can be added as a step.
Search: Ctrl+K jumps to the search box in the title bar. Type a page, setting, app or service name.

HiveSweeper's Home dashboard for a sample PC, with compliance, security, storage, management, power and software tiles and a note that one thing is worth a look — Home: a dashboard for the PC, with anything worth a look listed under the tiles.

HiveSweeper's App updates page listing five sample applications with a newer version available — App updates after Check for updates. Nothing is installed from this page.

HiveSweeper's App dependencies page for a sample PC: a Visual C++ runtime needed by two sample apps, with the evidence, and the Steps panel warning that the uninstall is needed on this PC — App dependencies, with an uninstall in Steps that warns it is still needed on this PC.

HiveSweeper's Installed apps list for a sample PC with the NEEDED BY column: two runtimes needed by two apps each and one by one app — Installed apps, with how many apps need each one in NEEDED BY.

A sample cumulative update with its footprint: the Windows build before and after, servicing packages, a driver, and a new error that first appeared after the restart — Windows updates, under Updates and what changed: what a sample cumulative update changed.

HiveSweeper's Compliance page for a sample PC: 11 of 13 checks pass and one is not set up, with low free space and a missing required app to fix — Compliance (beta) for a sample PC.

HiveSweeper's VPN tab for a sample PC, with a device tunnel and a user tunnel, their servers, protocols, certificates and recent connections — The VPN tab of Intune & Config Mgr for a sample PC.

HiveSweeper's Registry page, open at a sample application's key with its values listed below — Registry, open at a sample application's key.

HiveSweeper's File details page showing an inspected sample installer with its silent install, uninstall and repair commands — File details for a sample installer, with its silent install, uninstall and repair commands.

Some details, such as TPM, BitLocker and other users' apps, are shown only when HiveSweeper runs as an administrator.

Settings

Settings is at the bottom of the left menu.

Appearance: twelve themes: Light, Dark, Match wallpaper, Windows Light, Windows Dark, CosmicForge, Cyber, Matrix, Synthwave, Amber, Nexus and Daylight.
Banners: Classic or Illustrated layout, dark or light colour, and the manufacturer's logo on Home.
Application settings: allow winget checks, check for app updates when HiveSweeper starts (off by default), the daily Build catalog check, loading pages in the background, and where data is kept.
Window: the native title bar, and Run as administrator.
About: the version, and checking for HiveSweeper updates.

HiveSweeper's Settings page with twelve theme previews and banner layout choices — Settings: themes, banner layouts and updates, each applied straight away.

What it will not do

It never changes the PC by itself. It reads, and builds a script. Only running that script with -Execute applies anything.
It never starts an installer or any other program itself. Commands it suggests are added as steps or copied for you to run.
Protected items are refused twice, once when added as a step and again by the script itself: drive roots, Windows, Program Files, ProgramData, the Users folder, the Default and Public profiles, anything reached through a junction or symbolic link, core Windows services and processes, services hosted by Windows' svchost, and shared Windows registry locations.
Store apps marked as protected system components are never offered for removal.
Items under Left alone are never removed.
Machine-wide changes and other users' profiles need the script run as an administrator or SYSTEM.

Network use

HiveSweeper's own network use is checking for and downloading HiveSweeper updates from GitHub, which install only when they are signed by Embermont Ltd and match the published SHA-256. Winget is used only when asked to check for app updates, or when HiveSweeper starts if Check for app updates when HiveSweeper starts is turned on (it is off by default). Those checks can be switched off in Settings. A Compliance checklist is fetched from the internet only when a web address is entered for it.

Downloads About HiveSweeper