Windows 11 · Lesson 09

Installed Software & Unwanted Applications

Inventory installed software, identify what the scenario requires, investigate unknown applications, and remove unnecessary exposure without breaking legitimate dependencies.

Strong software review is evidence-driven. A known application can still be unnecessary, and an unfamiliar application can still be legitimate. Purpose, publisher, version, path, dependencies, and scenario need all matter.

Lesson Snapshot

Software categories5

Inventory fields8

Primary principleEvidence before uninstall

Main goalRequired software only

Learning objectives

What software review should help you do

Build a reliable inventory of installed Windows software before uninstalling anything.

Distinguish required software, unnecessary software, unsupported software, risky software, and unknown applications that need investigation.

Recognize why an unfamiliar application is not automatically malicious.

Evaluate application purpose, publisher, version, install path, startup behavior, services, and scenario requirements together.

Use Windows Settings, Control Panel, Task Manager, services, and PowerShell to investigate software safely.

Remove or disable software only when evidence supports the decision, then verify that required Windows functions still work.

Core concept

Software should exist for a reason

Every installed application adds code, dependencies, update requirements, and sometimes services or network exposure. Keep what is required and investigate what is not understood.

Removal warning

Uninstall can remove more than the visible app

Applications may provide shared runtimes, drivers, plugins, services, file associations, or other components required elsewhere.

Check dependencies and preserve evidence before destructive software changes.

Software classification

Five useful categories for installed applications

Required software

Explicitly required by the scenario or necessary for a required service, workflow, or competition task.

Response

Keep it available and harden its surrounding configuration rather than removing it.

Unnecessary software

Legitimate software that is not required and adds avoidable attack surface, background activity, or maintenance burden.

Response

Consider removing it if the scenario permits and no dependency exists.

Unsupported / outdated software

Software that is old, unmaintained, or significantly behind supported versions may carry elevated security risk.

Response

Investigate whether it is required, whether an update is available, and whether removal or replacement is appropriate.

Risky or unauthorized software

Software that conflicts with the scenario, violates policy, creates remote access, credential risk, or other unnecessary exposure.

Response

Document evidence and remove or remediate if the environment clearly does not require it.

Unknown software

An unfamiliar application with unclear purpose or ownership.

Response

Investigate publisher, path, version, services, startup entries, network use, and scenario purpose before acting.

Software inventory

Record context before you decide

Application name

Record the exact product name rather than relying on a shortened label or icon.

Publisher

A known publisher can provide context, but publisher name alone is not proof that software is safe or required.

Version

Version helps determine whether the software is current, outdated, or unsupported.

Install date

Can help establish when the software appeared and whether that timing matters to troubleshooting or forensics.

Install path

Location can help distinguish normal Program Files installations from unusual user-profile or temporary-directory locations.

Startup behavior

Check whether the software launches at sign-in or automatically starts background components.

Services and tasks

Many applications install services or scheduled tasks that may continue running even when the main application is not open.

Scenario purpose

The most important question is whether the software supports a function the scenario requires.

Windows review tools

Build an application inventory from multiple views

Installed apps

Settings → Apps → Installed apps

Primary Windows 11 view for application inventory, version information, modification options, and uninstall actions.

Programs and Features

Control Panel → Programs → Programs and Features

Legacy application inventory that can still be useful for desktop software and installed components.

Task Manager

Task Manager → Processes / Startup apps

Helps connect installed applications with active processes and automatic startup behavior.

Services

services.msc

Useful when an application installs a background service that may continue operating without the main user interface.

PowerShell inventory

Inspect software without changing it

Store / packaged apps

Get-AppxPackage | Select-Object Name, PackageFullName

Lists installed AppX packages for inspection in an authorized practice environment.

Installed MSI-style products

Get-ItemProperty "HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

Provides a useful installed-software inventory from a common uninstall registry location.

32-bit applications on 64-bit Windows

Get-ItemProperty "HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*" | Select-Object DisplayName, DisplayVersion, Publisher, InstallDate

Shows many 32-bit desktop applications installed on 64-bit Windows.

Startup entries

Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location, User

Helps connect installed software with automatic login-time execution.

Risk signals

Indicators that software deserves closer review

Remote access capability

Remote-control tools, remote shells, or unattended-access software deserve careful review if the scenario does not require them.

Credential exposure

Software that stores, reveals, weakens, or bypasses authentication controls can create significant risk.

Unsupported version

Outdated software may contain known vulnerabilities or depend on insecure legacy components.

Unexpected persistence

Software that installs startup entries, services, or scheduled tasks without a clear required purpose deserves investigation.

Unusual install path

Programs running from temporary folders or user-profile locations can be legitimate, but the context deserves closer review.

No clear business or scenario need

Even legitimate software increases attack surface if the system does not need it.

Evidence questions

Ask before changing or removing software

Is this application explicitly required by the scenario?

Which user or workflow depends on it?

Who published it and what version is installed?

Where is it installed?

Does it add a service, startup item, scheduled task, driver, browser extension, or firewall rule?

Does it provide remote access or elevated capability?

Is the version supported and reasonably current?

Would uninstalling it break another required program or file type?

Could the software or its artifacts matter to a forensic question?

What should be tested after removal or update?

Dependency check

Software rarely exists in isolation

Does another required application call or depend on this program?

Does the software install a Windows service?

Does it add a scheduled task?

Does it provide a device driver?

Does it register file associations required by the scenario?

Does it open or require a firewall rule?

Does it provide a browser extension or plugin needed for a required workflow?

Does a forensic question depend on its logs, files, history, or install date?

Decision choices

Five possible outcomes from software review

Keep

Use when software is required, supported enough for the scenario, and not creating an unjustified risk.

Update

Use when the application is required but the installed version has a clear patch or support problem and the update can be verified safely.

Disable automatic behavior

Use when the application is legitimate but its startup component or background helper is unnecessary.

Uninstall

Use when software is clearly unnecessary, unauthorized, unsupported beyond acceptable use, or creates unjustified exposure.

Investigate

Use when purpose, ownership, dependency, or risk is still unclear.

Decision cases

Software decisions in context

Required application is outdated

The scenario requires a media-management application, but the installed version is old and a supported update is available.

The software cannot simply be removed because it is required. The security problem is the outdated version.

Response

Update only if the change can be completed and verified safely, then confirm the required application still works.

Unnecessary remote-access tool

A remote-control application is installed, launches automatically, and the scenario does not require it.

The software adds powerful remote capability without a justified purpose.

Response

Document the application and related startup/service artifacts, then remove it if no dependency or forensic need remains.

Unknown utility in Program Files

A utility with an unfamiliar name is installed by a known vendor and appears tied to a required hardware package.

Unfamiliarity alone is weak evidence. Removing it may break device functionality.

Response

Investigate vendor documentation, related processes, driver dependencies, and scenario need before deciding.

Legitimate application with unnecessary updater

A required application is installed, but its background updater launches for every user and is not needed during competition.

The application is required, but the automatic helper may be unnecessary.

Response

Keep the application, disable only the unnecessary automatic updater if safe, and verify the application still functions.

Safe uninstall process

Remove software without leaving the system in an unknown state

Document the software

Record name, publisher, version, path, install date, related service/startup/task entries, and why removal is justified.

Check dependencies

Confirm no required application, service, driver, file type, user workflow, or forensic question depends on it.

Use the normal uninstall method

Prefer Settings or the application's supported uninstaller instead of manually deleting program files.

Review leftovers

Check whether services, startup entries, scheduled tasks, folders, firewall rules, or browser components remain.

Verify required functions

Test the workflows most likely to have depended on the software.

Record the result

Document what was removed, what remained, and whether any follow-up investigation is needed.

Software as forensic evidence

Preserve context before cleanup

Install date

Can help determine when an application first appeared relative to suspicious activity.

Application logs

May show usage, remote sessions, update activity, authentication, or errors.

Recent files and configuration

Application-specific settings may help explain how the software was used.

Services and tasks

Automatic components can show persistence or background activity connected to the application.

Uninstall history

Evidence that software was removed can matter when reconstructing a timeline.

User ownership

Per-user installations and profile paths can help identify which account interacted with the software.

Fictional defensive lab

Remove unnecessary remote-access software without breaking required apps

Step 01

Read the fictional scenario

The workstation must keep a required browser, office suite, and media-management application. Remote-control software is not required. A forensic question asks when an unfamiliar tool appeared.

Step 02

Inventory software

The system contains the required applications, an old remote-control tool, a legitimate hardware utility, and an unfamiliar user-profile application.

Step 03

Classify

The browser and office suite are required. The media tool is required but outdated. The remote-control application is unnecessary. The hardware utility needs to remain. The user-profile application needs investigation.

Step 04

Preserve evidence

Record install date, path, publisher, startup behavior, and any related forensic artifacts before uninstalling the unnecessary remote-access software.

Step 05

Apply controlled changes

Remove only the clearly unnecessary remote-access tool, update the required media application only if time and compatibility allow, and leave the unknown application for further investigation.

Step 06

Verify

Confirm required applications still launch, networking and file associations remain healthy, no unwanted remote service remains, and forensic notes are complete.

Troubleshooting

When a software change breaks something

A required file type no longer opens

Was the removed program the registered handler? Is another required application available? Can the file association be restored safely?

A service remains after uninstall

Did the supported uninstaller complete? Does the service path still exist? Is it shared by another component? Check before removing leftovers.

Software reappears

Is an updater, deployment tool, scheduled task, package manager, or another user reinstalling it?

A required application stops working after another uninstall

Did the removed software provide a shared runtime, driver, plugin, or dependency? Review install history and recent changes.

Common mistakes

Software-review habits that create avoidable problems

Unfamiliar means malicious

Legitimate vendor tools, drivers, runtimes, and support utilities can have unfamiliar names.

Deleting program folders manually

Manual deletion can leave services, tasks, registry entries, drivers, and broken dependencies behind.

Removing software before preserving evidence

Install dates, logs, configuration, and related artifacts may matter to a forensic question.

Updating everything automatically

A newer version can still create compatibility or restart risk during a timed competition.

Ignoring bundled background components

An application may install services, startup items, tasks, firewall rules, or browser extensions that remain after the main program is closed.

No post-uninstall testing

Required applications, file types, devices, or workflows may depend on shared components.

Reflection

Test your software-review reasoning

Question 1

Why is an unfamiliar application not automatically malicious?

Question 2

What information should be recorded before uninstalling suspicious or unnecessary software?

Question 3

Why can removing one application break another required program?

Question 4

When is disabling a startup helper better than uninstalling the whole application?

Question 5

What makes remote-access software especially important to review?

Question 6

What should be verified after uninstalling or updating software?

Verification checklist

Confirm the final software state

Re-open Installed apps and confirm the intended software state.

Confirm required applications still launch.

Confirm file associations used by the scenario still work.

Confirm required browser, media, office, or specialty tools remain available.

Review Services for leftover application services.

Review Startup apps for leftover automatic launch entries.

Review Task Scheduler later for remaining application tasks when appropriate.

Confirm Windows Defender remains healthy.

Confirm firewall rules were not unintentionally changed.

Confirm no required device or driver function was lost.

Document removed, updated, deferred, and unknown applications.

Competition checklist

Before leaving Installed Software

Inventory installed applications before uninstalling anything.

Record name, publisher, version, install date, and path for suspicious or important software.

Compare software with scenario-required applications.

Review startup behavior, services, tasks, and firewall impact.

Separate Required, Unnecessary, Unsupported, Risky, and Unknown software.

Investigate unknown software before destructive action.

Preserve relevant forensic artifacts before removal.

Use supported uninstall methods.

Review leftover services and startup items after uninstall.

Verify required applications and file associations.

Document updates, removals, deferred items, and unresolved software.

Next Windows lesson

Files, Folders & Share Permissions

Next, learn how NTFS permissions, share permissions, ownership, inheritance, least privilege, and effective access work together on Windows 11.

Open Lesson 10 →

Back to Windows 11 CyberPatriot Hub

← Previous Lesson Next Lesson →