> For the complete documentation index, see [llms.txt](https://wiki.zacheller.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.zacheller.dev/pentest/post-exploitation/cleanup.md).

# Cleanup

The cleanup process covers the requirements for cleaning up systems once the penetration test has been completed, not removing logs, etc. This will include all user accounts and binaries used during the test.

* Remove all executable, scripts and temporary file from a compromised system. If possible use secure delete method for removing the files and folders.
* Return to original values system settings and application configuration parameters if they where modified during the assessment.
* Remove all backdoors and/or rootkits installed.
* Remove any user accounts created for connecting back to compromise systems.