Skip to main content
Sign up

Risk Tiers and Safety

The three risk tiers, typed confirmation, restore points, the hard-blocked system paths that no setting can override, and how Dry-Run keeps you safe.

Every removal in UniClean has a risk tier, and the tier decides what UniClean asks of you before it acts. These checks run in the engine, not just in the interface. Because only the Safe tier has been tested by the developer, treat the other tiers as advanced.

SafeExamplesNormal apps, leftovers, caches, temp filesYou mustConfirm the plan with one click
CautionExamplesStartup items, browser extensions, bloatware, shared runtimes, registry keys, scheduled tasksYou mustTick an acknowledgement
High RiskExamplesSecurity software, drivers, services, system componentsYou mustType the exact name, and a Windows restore point is created first
UniClean's three risk tiers and what each one asks of you. The tier is recalculated from the items you actually select.

The three tiers

TierTypical itemsRequired before execution
SafeNormal apps, their leftovers, caches, temp filesOne click
CautionStartup items, browser extensions, bloatware, shared runtimes (such as Visual C++ redistributables, .NET, Java, DirectX, WebView2), registry keys, scheduled tasksAn acknowledgement
High RiskSecurity software, drivers, services, system componentsThe exact name typed in, a Windows restore point, and an extra "I accept full responsibility" screen

The tier of a plan is recalculated from the items you actually select. Selecting a service inside an otherwise Safe app raises the whole group to High Risk.

Typed confirmation and restore points

For a High Risk plan, UniClean will not run until you type the exact name shown, and it has created a Windows restore point. It uses Checkpoint-Computer, may turn on System Protection for the system drive, and reads the new restore point back to confirm it. If creating the restore point fails, the operation stops. You can only continue without one if you enabled that setting and tick a box for that specific operation.

Hard-blocked paths

A blocklist compiled into UniClean refuses certain targets. It is checked when a plan is built and again right before each action. No setting, flag or force mode turns it off. Both the literal path and its canonical path (with symlinks and junctions resolved) are checked, and relative paths, .. and drive roots are rejected.

  • The Windows folder (System32, SysWOW64, WinSxS, drivers), except children of the Windows temp folder.
  • Boot and recovery areas: Boot, EFI, Recovery, System Volume Information, the Recycle Bin internals, Windows upgrade staging folders and Config.Msi.
  • Microsoft Defender, Windows Security, WindowsApps, PowerShell and other built-in Windows component folders, plus parts of ProgramData\Microsoft.
  • Container folders themselves: Program Files, ProgramData, Users, your profile, AppData, Desktop, Documents, Downloads and Start Menu. Things inside them can be removed; the folders cannot.
  • Registry: HKEY_CLASSES_ROOT, SAM, SECURITY, HARDWARE, BCD, most of HKLM\SYSTEM, and Microsoft keys and policies.
  • Core Windows services, any service hosted by svchost.exe or signed as Microsoft, drivers from Microsoft, and scheduled tasks under \Microsoft\.
  • UniClean's own executable, install folder and data folder, which contains the vault.

Dry-Run

Dry-Run is a global setting. Every action returns "simulated", writes an audit entry with the current state of the target, creates no vault item and no restore point. A plan created in Dry-Run always executes as Dry-Run, even if you turn the setting off before confirming.

Illustration
Dry-Run preview: what would be removed
  • Folder: ExampleApp (program files)
  • Registry key: ExampleApp uninstall entry
  • Startup entry: ExampleApp updater
  • Leftover: ExampleApp cache folder
After a Dry-Run: your PC
  • Nothing was deleted
  • No vault item was created
  • No restore point was made
  • Every step is written to the audit log
Illustration: example names, not a real scan. In Dry-Run mode UniClean simulates the plan and logs it without touching anything.

Other safeguards

  • Plans are stored in the engine, are single-use and expire after 30 minutes.
  • The interface can only refer to candidates the engine found itself, never an arbitrary path.
  • Only one removal or restore runs at a time.

Related: Security Software Removal and Advanced Features.

Last updated