Windows - Software - Uninstall GoTo Applications

What the GoTo suite remover does

This Automox Worklet™ uninstalls the GoTo product family from Windows endpoints. The regex match used by the script (GoTo|GoToMeeting|GoTo Opener) catches every product LogMeIn ships under the GoTo brand, including GoTo Meeting, GoTo Connect, GoTo Resolve, GoTo Webinar, GoTo Training, GoToAssist, and the GoTo Opener helper that bootstraps the others.

The Worklet inspects three locations where a GoTo install can hide. It reads the 64-bit uninstall registry at HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall and the 32-bit redirected hive at HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall for system-wide installs. It reads HKCU:\Software\Microsoft\Windows\CurrentVersion\Uninstall for per-user installs done without elevation. It then walks every directory under C:\Users (skipping Public and Default) for residual GoTo folders in AppData\Local\GoTo and AppData\Roaming\GoTo.

Each detected install is uninstalled with its own UninstallString. The Worklet rewrites MSI strings to force /X (uninstall) plus /qn /norestart, and shells EXE installers with /S /quiet /norestart so the GoTo branded uninstaller never prompts an end user. Exit codes from each call are logged so failed removals surface in the Automox activity log instead of leaving a half-uninstalled GoTo client behind.

Why remove the GoTo suite from managed Windows endpoints

Remote access and screen-sharing clients are high-value attack surface. The GoTo suite (formerly LogMeIn) was the subject of a confirmed 2022 breach in which threat actors accessed customer engineering and source-code backups, and remote-control products in general have been abused for ransomware staging. Standardizing on a single sanctioned tool and removing every other remote access client closes a lateral-movement path that endpoint detection alone cannot. Cleaning up legacy GoToMeeting installs after a switch to Zoom, Teams, or Webex also recovers user-profile disk space and removes auto-launch helpers that slow login.

GoTo Opener and the wider GoToMeeting family register installs in three places: HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall for system-wide builds, the matching HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Uninstall hive for per-user installs, and AppData\Local\GoTo* directories for the auto-update helper. This Worklet clears all three on every Windows endpoint in scope in a single policy run, so the same evidence an auditor wants (no GoTo product in Programs and Features, no GoTo folder under any user) is produced fleet-wide rather than just for the laptops the help desk got around to.

How GoTo removal works

1. Evaluation phase: The script applies the regex GoTo|GoToMeeting|GoTo Opener against DisplayName values in HKLM 64-bit, HKLM WOW6432Node, and HKCU uninstall keys. It then iterates each user folder under C:\Users (excluding Public and Default) and checks for AppData\Local\GoTo and AppData\Roaming\GoTo. Any match writes a status message and exits 2 (non-compliant). A clean endpoint exits 0 with the message "No GoTo applications detected (System + All Users clean)."

2. Remediation phase: For every match in HKLM and HKCU, the Worklet reads the UninstallString. MSI strings are rewritten from /I to /X and run as cmd.exe /c msiexec ... /qn /norestart for an unattended uninstall. EXE strings are wrapped in cmd.exe /c "<UninstallString>" /S /quiet /norestart for vendors that ship a custom uninstaller. Each Start-Process call uses -Wait -PassThru so the Worklet logs SUCCESS or FAILURE with the exit code per app. The script finishes by removing AppData\Local\GoTo and AppData\Roaming\GoTo from every user profile with Remove-Item -Recurse -Force, then exits 0.

GoTo removal requirements

• Windows 8.1 or later, including Windows 10, Windows 11, and Windows Server editions

• PowerShell 3.0 or later (Get-ItemProperty with comma-separated registry paths is the minimum)

• SYSTEM or local administrator context (the default Automox agent context meets this); HKCU removal only acts on the currently logged-on hive, which is acceptable because the AppData sweep covers offline users

• No restart needed; the Worklet passes /norestart to both MSI and EXE uninstallers

• No script parameters required; the regex and registry paths are fixed in evaluation.ps1 and remediation.ps1

• Run the Worklet on a recurring weekly policy if end users have permission to install GoTo Opener themselves, since the Opener helper can reinstall the rest of the suite on first launch

Expected state after GoTo removal

On the next evaluation, the endpoint exits 0 with "No GoTo applications detected (System + All Users clean)." Programs and Features (or Settings, Apps, Installed apps on Windows 11) shows no GoTo, GoToMeeting, GoTo Connect, GoTo Resolve, or GoTo Opener entry. The HKLM and WOW6432Node uninstall keys no longer have a subkey whose DisplayName matches the GoTo regex. The HKCU uninstall key for the active user is also clear. C:\Users\<user>\AppData\Local\GoTo and C:\Users\<user>\AppData\Roaming\GoTo are absent from every non-system profile.

For audit evidence, capture the Automox activity log for the policy run. The log contains a SUCCESS or FAILURE line per app per scope (System, Current User) plus a per-user AppData removal line. Validate manually with Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object { $_.DisplayName -match 'GoTo' } and confirm the result is empty. A failed exit code in the log usually means a per-user MSI registered an UninstallString that points at an installer cache the SYSTEM account cannot reach; rerun the policy from a user-context FixNow if the affected user is logged in, or pair this Worklet with a follow-up MSI cleanup script.