Cleaning a 10-PC Office Fleet Without Visiting Every Desk

Why desk-by-desk cleanup fails at fleet scale

The arithmetic is brutal: a careful manual pass over one machine — temp files, update caches, browser caches, leftover installers — runs 30 to 40 minutes. Multiply by ten and you have burned a working day, and you will burn it again next month, because manual cleanup does not repeat, it decays. Worse, every machine ends up differently clean: the accountant's PC keeps a 2019 installer folder, the sales laptop hoards a gigabyte of browser cache, and nobody notices until a disk fills. Consistency is the actual product of fleet cleaning, and walking desks produces the opposite.

The fix is to stop seeing the office as ten separate machines and start seeing one fleet with one baseline. Windows Pro machines on a domain can be driven by Group Policy or Intune, but a ten-seat workgroup needs neither: a single PowerShell script, distributed once or pulled from a share and run at night by Task Scheduler, covers what 90 percent of offices actually need. The script encodes the decisions once — what to clean, what to skip, how old a file must be — and applies them identically everywhere.

• Windows Update cache: stop wuauserv, clear C:\Windows\SoftwareDistribution\Download, start the service again
• Temp folders: %TEMP% and C:\Windows\Temp, keeping files newer than seven days to avoid breaking running setups
• Delivery Optimization cache, which grows quietly on every machine that shares updates over the LAN
• Error reporting dumps and old crash files from C:\ProgramData\Microsoft\Windows\WER
• Recycle Bin via the Clear-RecycleBin cmdlet, after a one-week warning to the team
• Thumbnail caches and DirectX shader caches, rebuilt on demand and always safe to drop

What belongs in the script and what never does

Everything above is machine-wide and safe under the SYSTEM account, which is what a scheduled task gives you. Per-user data is where central cleaning must get careful: the cache of a running browser corrupts sessions, files inside Documents are not yours to judge, and anything belonging to an open application stays untouched. If per-user caches matter, schedule the user-side part at logon so it runs in the user's own context, or enumerate profiles and touch only files older than the threshold.

Two disciplines keep the fleet safe. Age thresholds — never delete a temp file younger than a few days, because someone's running installer may be using it — and off-hours execution, so nothing is yanked from under a working employee. Log every run to a shared folder or the Event Log: the day a cleanup causes a problem, you will want to know exactly what ran and when.

The rhythm that keeps every desk quiet

A monthly overnight pass is enough for a typical office: update caches and temp folders rarely grow faster than that. Stagger the start times by a few minutes so ten machines do not hammer the same share and the same WAN link at once, and put application updates in the same window — winget upgrade --all quietly lifts the whole fleet's browsers and tools to current versions. Once a quarter, spend an hour on the two worst machines by hand and note what the script missed; fold those findings back into the script instead of making them permanent manual work.

There will always be stragglers — the box running a legacy billing app nobody dares touch, the director's laptop full of personal files. Those deserve an individual look rather than blanket rules, and a one-off pass with Kleaner PRO on those two or three machines closes the gap the script cannot. The goal is not to make cleaning invisible; it is to make it boring, scheduled, and identical on every desk except the ones that genuinely earned special treatment.

Questions and Answers

Read next