dan-snelson/Microsoft-365-Reset v3.0.0

Microsoft 365 Reset (3.0.0)

on GitHub

22-Oct-2026

• Reviewed MOFA community-script pull requests #26-#41 (merged 21-Oct-2026) against the unified workflow
  • ⚠️ Breaking Change: ⚠️ reset_onenote (and therefore reset_factory) no longer deletes the OneNote container (~/Library/Containers/com.microsoft.onenote.mac), which holds the local sync cache, including notes not yet synced to the cloud; MOFA and the package-era workflow both keep it. Add remove_onenote_data, which requires destructive confirmation in interactive modes, to any policy that relied on the old behavior
  • Reset operations (reset_word, reset_excel, reset_outlook, reset_onenote, reset_onedrive, reset_teams, reset_teams_force, reset_autoupdate) now ask apps to quit (SIGTERM), wait 2 seconds only when something was running, then force-quit (SIGKILL) anything left; reset_factory does the same for all Microsoft apps with one 3-second wait. reset_powerpoint, remove_* operations, and remove_acrobat_addin still force-quit immediately, matching MOFA
  • reset_license / reset_credentials wait 2 seconds after signaling running Office apps, and only when one was running, before removing licensing and keychain items
  • reset_credentials now removes every OneAuthAccount keychain item instead of only the first
  • Repeated keychain deletions stop after 50 items per label, service, or creator and log a WARNING, so a delete that reports success but leaves the item cannot loop forever
  • remove_office now also removes /Applications/Microsoft AutoUpdate.app and ~/Library/Application Support/OneDrive
  • remove_outlook_data now also removes the legacy Outlook 2016 data folder (~/Library/Application Support/Microsoft/Outlook) and Outlook caches, WebKit data, saved state, and cookies
  • remove_skypeforbusiness now also removes Skype for Business application support data, caches, saved state, and cookies
  • remove_webexpt now removes /Library/LaunchAgents/com.webex.pluginagent.plist (previously left in place, so the agent reloaded at the next login) and two more WebEx preference files, stops WebEx Productivity Tools processes by install path, and runs the native uninstaller only when present
  • remove_zoomplugin now targets the paths Zoom's ZoomMacOutlookPlugin.pkg installs: plugin preferences, the per-user install folder, the pre-5.x scripting addition, and the system log; stops the plugin agent and launcher; and runs the native uninstaller only when present. It no longer deletes ~/Library/Preferences/ZoomChat.plist, which belongs to the Zoom app rather than the Outlook plugin
  • remove_office, remove_outlook_data, remove_skypeforbusiness, remove_webexpt, and remove_zoomplugin now flush cached preferences (console user and root only) before deleting preference files, so cfprefsd cannot write them back
  • Auto-repair runs the deep code-signature check once per app instead of twice when a bundle fails verification
  • Auto-repair now logs a WARNING when a package's download size cannot be verified (no Content-Length); the Microsoft signature check still decides whether the package installs
  • GHSA-gw3c-6fvh-7gqm (root-private download staging, Teams backgrounds handled as the user) was already addressed in 2.0.1; no further change
• Addressed findings from a pre-release review
  • reset_factory now requires the destructive-action confirmation in interactive modes (silent is unchanged), because it deletes the Office group container (~/Library/Group Containers/UBF8T346G9.Office), including local Outlook data, Office templates, and custom dictionaries; its picker description no longer says it will not remove personal documents
  • reset_factory now archives classic Teams backgrounds to ~/Teams_Old_Backgrounds before its cleanup deletes ~/Library/Application Support/Microsoft; previously they were deleted before reset_teams could archive them. If the archive fails, reset_factory stops before cleanup and fails (exit 20)
  • remove_defender, remove_zoomplugin, and remove_webexpt run a vendor uninstaller only when it and every parent directory are root-owned and not writable by non-admin users (admin-group write is allowed); otherwise the uninstaller is skipped with a log entry and files are removed directly, and remove_defender fails (exit 20)
  • Repeated keychain deletions now fail the operation (exit 20) when matching items remain, whether the 50-item limit was reached or a delete failed; previously the operation could report success
  • remove_webexpt now also stops webexmta by exact process name, matching MOFA
  • The login-keychain search-list check no longer writes security output to the client log or debug traces
• Reliability fixes
  • Keychain cleanup now reaches the console user's login keychain when root's HOME is not the console user's home folder (for example, a root shell opened from an admin account, or a management agent running with HOME=/var/root). macOS sudo keeps the caller's HOME, so security searched only the System keychain, every lookup reported "not found", and reset_credentials, reset_license, reset_outlook, reset_onedrive, reset_teams, reset_teams_force, and remove_skypeforbusiness silently left sign-in items in place. Console-user commands now run with sudo -H, and a WARNING is logged if the login keychain is still missing from the user's keychain search list
• Documented intentional divergences from current MOFA behavior
  • remove_zoomplugin and remove_skypeforbusiness do not remove Dock entries (MOFA uses a bundled dockutil; this repo adds no third-party dependency)
  • remove_webexpt stops WebEx Productivity Tools processes by install path instead of MOFA's bare pluginagent pattern, so other vendors' plugin agents keep running
  • Auto-repair warns instead of failing when the server reports no Content-Length; MOFA fails the repair. A reported size that does not match the download still fails the repair
• Internal
  • AGENTS.md and .github instructions: runAsUser must keep sudo -H so console-user commands see the console user's HOME
  • scripts/mofa-consult.zsh adds a MOFA Last Changed column and an Upstream Changes Since Local Script section, which list mapped MOFA scripts committed after the last commit of Microsoft-365-Reset.zsh for semantic review; wiring checks alone missed the 21-Oct-2026 MOFA changes. The comparison is skipped with a warning when git history is unavailable
  • scripts/mofa-consult.zsh adds intentional-divergence notes for remove_zoomplugin, remove_skypeforbusiness, and remove_webexpt, and notes that reset_onenote keeps the OneNote container
  • SECURITY.md now states that the auto-repair content-length check applies only when the server reports a size
  • AGENTS.md, SECURITY.md, and .github instructions: reset_factory joins the destructive-confirmation list; exit 20 includes keychain items an operation could not remove
  • scripts/mofa-consult.zsh classifies reset_word, reset_excel, reset_outlook, reset_onenote, and reset_onedrive as intentional divergences (they leave /Library/Managed Preferences to MDM; MOFA removes the app's managed preference files), adds the same note to reset_teams, and updates the reset_factory and remove_webexpt notes
  • scripts/mofa-consult.zsh --report-only now warns and skips the upstream change comparison when the MOFA path has no git history of its own, and notes uncommitted MOFA script changes that it cannot compare

What's Changed

• 3.0.0 by @dan-snelson in #27

Full Changelog: v2.0.1...v3.0.0