From 990b147c473fbf01c591d209b237aaed0f05c8a1 Mon Sep 17 00:00:00 2001 From: Kevin Simmons Date: Sun, 4 Oct 2026 15:09:41 -0500 Subject: [PATCH] Update Clear-TempFiles and Clear-RecycleBinFiles functions - Temp files: Only delete items older than 3 days (safer) - Recycle bin: Purge all user trash cans via BitBucket registry keys - Updated menu text to reflect 3-day age filter --- PCRemediation/Invoke-PCRemediation.ps1 | 78 ++++++++++++++++++++++---- 1 file changed, 66 insertions(+), 12 deletions(-) diff --git a/PCRemediation/Invoke-PCRemediation.ps1 b/PCRemediation/Invoke-PCRemediation.ps1 index d734ca4..c1c1596 100644 --- a/PCRemediation/Invoke-PCRemediation.ps1 +++ b/PCRemediation/Invoke-PCRemediation.ps1 @@ -208,7 +208,7 @@ function Show-Menu { if (-not $Silent) { Write-Host "`nSelect Remediation Action:" -ForegroundColor Yellow Write-Host "1. Clear Windows Update Download Cache" -ForegroundColor White - Write-Host "2. Purge System & User Temp Files" -ForegroundColor White + Write-Host "2. Purge System & User Temp Files (3+ days old)" -ForegroundColor White Write-Host "3. Clear Windows Error Reporting (WER) Dumps" -ForegroundColor White Write-Host "4. Flush DNS Cache & Reset Network Interfaces" -ForegroundColor White Write-Host "5. Restart Automatic Services That Are Stopped" -ForegroundColor White @@ -241,22 +241,55 @@ function Clear-WindowsUpdateCache { } function Clear-TempFiles { - param ([string]$TargetComputer = $env:COMPUTERNAME, [Microsoft.Management.Infrastructure.CimSession]$CimSession = $null) - Write-ColorOutput "`nPurging Temporary Files..." "Yellow" "Info" $TargetComputer + param ([string]$TargetComputer = $env:COMPUTERNAME, [Microsoft.Management.Infrastructure.CimSession]$CimSession = $null, [int]$MaxAgeDays = 3) + Write-ColorOutput "`nPurging Temporary Files (older than $MaxAgeDays days)..." "Yellow" "Info" $TargetComputer try { if (-not $CimSession -and $TargetComputer -eq $env:COMPUTERNAME) { $tempPaths = @( - "$env:SystemRoot\Temp\*", - "$env:LOCALAPPDATA\Temp\*", - "C:\Users\*\AppData\Local\Temp\*" + "$env:SystemRoot\Temp", + "$env:LOCALAPPDATA\Temp" ) foreach ($path in $tempPaths) { - Remove-Item -Path $path -Recurse -Force -ErrorAction Stop + if (Test-Path $path) { + Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue | + Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-$MaxAgeDays) } | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } + } + + $userTempPaths = Get-ChildItem -Path "C:\Users" -Directory -ErrorAction SilentlyContinue | + ForEach-Object { "$($_.FullName)\AppData\Local\Temp" } + foreach ($path in $userTempPaths) { + if (Test-Path $path) { + Get-ChildItem -Path $path -Recurse -Force -ErrorAction SilentlyContinue | + Where-Object { $_.LastWriteTime -lt (Get-Date).AddDays(-$MaxAgeDays) } | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } } } else { + $scriptBlock = @" +`$tempPaths = @("$env:SystemRoot\Temp", "$env:LOCALAPPDATA\Temp") +`$maxAge = (Get-Date).AddDays(-$MaxAgeDays) +foreach (`$path in `$tempPaths) { + if (Test-Path `$path) { + Get-ChildItem -Path `$path -Recurse -Force -ErrorAction SilentlyContinue | + Where-Object { `$_.LastWriteTime -lt `$maxAge } | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } +} +`$userTempPaths = Get-ChildItem -Path "C:\Users" -Directory -ErrorAction SilentlyContinue | + ForEach-Object { "`$($_.FullName)\AppData\Local\Temp" } +foreach (`$path in `$userTempPaths) { + if (Test-Path `$path) { + Get-ChildItem -Path `$path -Recurse -Force -ErrorAction SilentlyContinue | + Where-Object { `$_.LastWriteTime -lt `$maxAge } | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } +} +"@ Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ - CommandLine = 'cmd.exe /c del /f /s /q %systemroot%\Temp\* & del /f /s /q %TEMP%\*' + CommandLine = "powershell.exe -Command `$scriptBlock" } | Out-Null } Write-ColorOutput "System and user temporary files purged." "Green" "Good" $TargetComputer @@ -335,17 +368,38 @@ function Repair-StoppedAutomaticServices { function Clear-RecycleBinFiles { param ([string]$TargetComputer = $env:COMPUTERNAME, [Microsoft.Management.Infrastructure.CimSession]$CimSession = $null) - Write-ColorOutput "`nEmptying Recycle Bin..." "Yellow" "Info" $TargetComputer + Write-ColorOutput "`nEmptying Recycle Bin (All Users)..." "Yellow" "Info" $TargetComputer try { if (-not $CimSession -and $TargetComputer -eq $env:COMPUTERNAME) { + $sids = Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" -ErrorAction SilentlyContinue | + ForEach-Object { $_.PSChildName } + foreach ($sid in $sids) { + $path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\$sid" + if (Test-Path $path) { + Get-ChildItem -Path $path -Recurse -ErrorAction SilentlyContinue | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } + } Clear-RecycleBin -Force -ErrorAction SilentlyContinue } else { + $scriptBlock = @" +`$sids = Get-ChildItem -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume" -ErrorAction SilentlyContinue | + ForEach-Object { `$_.PSChildName } +foreach (`$sid in `$sids) { + `$path = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\$sid" + if (Test-Path `$path) { + Get-ChildItem -Path `$path -Recurse -ErrorAction SilentlyContinue | + Remove-Item -Recurse -Force -ErrorAction SilentlyContinue + } +} +Clear-RecycleBin -Force -ErrorAction SilentlyContinue +"@ Invoke-CimMethod -CimSession $CimSession -ClassName Win32_Process -MethodName Create -Arguments @{ - CommandLine = 'powershell.exe -Command "Clear-RecycleBin -Force -ErrorAction SilentlyContinue"' + CommandLine = "powershell.exe -Command `$scriptBlock" } | Out-Null } - Write-ColorOutput "Recycle Bin emptied." "Green" "Good" $TargetComputer + Write-ColorOutput "Recycle Bin emptied for all users." "Green" "Good" $TargetComputer } catch { Write-ColorOutput "Failed to empty Recycle Bin: $_" "Red" "Critical" $TargetComputer } @@ -381,7 +435,7 @@ function Run-AllRemediations { try { Clear-WindowsUpdateCache -TargetComputer $TargetComputer -CimSession $cimSession - Clear-TempFiles -TargetComputer $TargetComputer -CimSession $cimSession + Clear-TempFiles -TargetComputer $TargetComputer -CimSession $cimSession -MaxAgeDays 3 Clear-WerDumps -TargetComputer $TargetComputer -CimSession $cimSession Reset-NetworkStack -TargetComputer $TargetComputer -CimSession $cimSession Repair-StoppedAutomaticServices -TargetComputer $TargetComputer -CimSession $cimSession