🗑️ Uninstall Unused Apps (6 Months)

Intune Remediation · Detects and removes Win32 apps not launched in over 6 months

Uses EstimatedLastUsed from the Uninstall registry key — this data is written by Windows but not every installer populates it. Apps with no last-used date are skipped to avoid nuking something critical. Test in a pilot group first.

Heads up: Intune Remediations are two-script pairs — a detect script that exits 0 (compliant) or 1 (non-compliant), and a remediate script that fixes it. Intune only runs the remediation script if detection exits 1.

Detection Script

Detect apps unused for 6+ months detection

Exits 1 (non-compliant) if any qualifying unused apps are found. Exits 0 if the device is clean.

# Detect Win32 apps not used in 6+ months
$cutoff   = (Get-Date).AddMonths(-6)
$regPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
$stale = Get-ItemProperty $regPaths -ErrorAction SilentlyContinue |
    Where-Object {
        $_.DisplayName -and
        $_.EstimatedLastUsed -and
        [datetime]::ParseExact($_.EstimatedLastUsed,'yyyyMMdd',$null) -lt $cutoff
    }
if ($stale) {
    Write-Output "Non-compliant: $($stale.Count) unused app(s) found"
    exit 1
}
Write-Output "Compliant: no unused apps found"
exit 0

Remediation Script

Uninstall stale apps silently remediation

Runs the app's own uninstall string silently. Skips anything missing a DisplayName or UninstallString.

# Uninstall Win32 apps not used in 6+ months
$cutoff   = (Get-Date).AddMonths(-6)
$regPaths = @(
    "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*",
    "HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*"
)
$stale = Get-ItemProperty $regPaths -ErrorAction SilentlyContinue |
    Where-Object {
        $_.DisplayName -and
        $_.UninstallString -and
        $_.EstimatedLastUsed -and
        [datetime]::ParseExact($_.EstimatedLastUsed,'yyyyMMdd',$null) -lt $cutoff
    }
foreach ($app in $stale) {
    Write-Output "Removing: $($app.DisplayName)"
    $uninstall = $app.UninstallString -replace 'MsiExec.exe','MsiExec.exe'
    if ($app.UninstallString -match 'MsiExec') {
        $guid = $app.UninstallString -replace '.*(\{[^}]+\}).*','$1'
        Start-Process msiexec.exe -ArgumentList "/x $guid /qn /norestart" -Wait
    } else {
        Start-Process cmd.exe -ArgumentList "/c `"$($app.UninstallString)`" /S /silent /quiet" -Wait -ErrorAction SilentlyContinue
    }
}

Intune Remediation Settings

Run this script using the logged on credentials No

Enforce script signature check No

Run script in 64-bit PowerShell host Yes

Schedule (recommended) Weekly