Skip to content

Tanium Package Repository

Custom Tanium packages, with the PowerShell source and the console settings needed to recreate each one.

A package runs a script on targeted endpoints as an action. Output goes to the action log on each endpoint, not to Interact. Use a package when the work changes something on the endpoint, or when it takes longer than a sensor is allowed to run.

Package What it does Platform Updated
Edge MSI Standardization Makes the Enterprise MSI the only managed copy of Edge, removes the stale Store (AppX) registration even when locked, and clears stale registry entries. Windows 2026-09-18
Find File by Name Searches drives or folders for a file name or wildcard. Returns every matching path and its last modified date. Windows 2026-09-18
Local Admin Removal Removes domain accounts in the AD admin OU from the local Administrators group on managed endpoints. Two scripts, two packages. Windows 2026-08-10
Remove File Deletes one file. The operator retypes the file name to confirm, and system folders, boot files, and the Tanium Client folder are refused. Windows 2026-10-08
Remove Folder Deletes one folder and its contents. The operator retypes the folder name to confirm, and system folders, profile roots, and the Tanium Client folder are refused. Windows 2026-10-08
Remove Legacy Python Removes Python 3.10, 3.11, and 3.12 from all-users installs, every user profile (signed in or not), and custom folders at the root of the system drive, including registry keys and PATH entries. Newer Python is not touched. Windows 2026-10-17
Remove Store Apps Removes Microsoft Store apps for all users and new users. The operator confirms the app count, and apps Windows depends on are refused. Optional setting stops suggested apps from installing. Windows 2026-10-08
Remove VS Code User Install Removes the per-user copy of VS Code (User installer or Store version). One package for signed-in users, run in the user's session, and one for signed-out profiles, cleaned offline. Windows 2026-10-14
Remove Zoom User Install Removes the per-user copy of Zoom from every profile, signed in or not, including its uninstall entry and shortcuts. Skips users with Zoom open unless told to close it. When a system-wide Zoom is installed, user data folders are kept and only the per-user program files go. Windows 2026-10-20
Set Time Zone Sets endpoints to a common U.S. time zone picked from a drop-down. The Windows package also turns automatic time zone on or off. Separate packages for Windows and for Linux and macOS. Windows, Linux, macOS 2026-09-23

Conventions used here

  • Naming: <prefix> - <what it does>, for example BF - Find File by Name. Keep the prefix consistent so custom content sorts together and stays separate from Tanium's default content.
  • Command line: every package calls PowerShell through cmd.exe so parameters are passed the same way each time: 
    cmd.exe /d /c powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -File <script>.ps1 -Param1 "$1" -Param2 "$2"
  • Parameters arrive URL-encoded. Tanium passes *.pst to the script as %2a%2epst. Every script that takes a parameter decodes it before use.
  • Command timeout is set higher than the script's own internal limit, so the script can report its own status before Tanium stops it.
  • Validate input. A blank or wildcard-only parameter should be rejected by the script, not acted on.

Before deploying

  1. Test the script locally on one machine, running as Administrator.
  2. Deploy to a single endpoint through Tanium and read the action log. Running as SYSTEM from the client's download folder is not the same as running it yourself.
  3. For large target groups, use the action's Distribute over option to spread the start times.