Every tool we run on a client machine, what each one does, and how it reports back to the checklist. Last updated 14 Aug 2026.
One command opens a menu of every tool NGT uses on a client's computer: backups, health checks, malware scans, app updates, cleanup, migration. You pick a number, the tool runs, and it checks its own step off on the Support Hub checklist so you are not doing the same work twice.
The tools are always fetched fresh, so there is nothing to install and nothing to keep updated. Whatever is on the menu today is the current version.
Open Terminal (Spotlight, type "Terminal", Enter) and type:
Open PowerShell. Regular is fine, since tools that need admin raise their own UAC prompt.
Same address on both platforms. It works out which one you are on and serves the right menu.
If a client's network blocks the short domain, the long form always works: tuneup.niceguytechnology.com (with curl … | bash or irm … | iex as above).
curl and irm against the short domain.
This is the one thing to get right. Everything else is automatic.
The project code ties this toolkit session to one client's checklist. With it, tools check their own steps off and write findings (battery health, drive SMART, free space) straight into the Hub. Without it, the tools still run and do the full job, but nothing reaches the checklist and you tick every box by hand.
Open the project's checklist in the Support Hub. The code is shown at the top of the runner. It looks like 742-Ab12.
The toolkit asks once, as the first thing it does. Type it and press Enter. You will see:
That line stays on screen above the menu the whole time. If it says "Hub reporting OFF", nothing you run is checking itself off. Press c to enter the code at any point.
Pressing Enter without typing anything skips it, which is fine for a machine that has no checklist (an office machine, a quick favour).
The code is saved on the machine for 24 hours. Reopen the window later and the toolkit picks it back up by itself:
If that checklist has since been completed, the code stops working and you get the normal prompt again. That is the system telling you the truth, not a bug.
It is also written out in plain words, so you never have to go hunting:
C:\ProgramData\NGT\project-code.txt~/Library/Application Support/project-code.txtIt lists the code, the checklist, the client, and when it was saved.
Numbers follow the order you actually work in, top to bottom.
| # | Tool | What it does | Checks itself off? |
|---|---|---|---|
| 1 | Start Time Machine backup | First it sizes the backup and tells you which fleet drive to fetch, ranked by free space and health, skipping any drive already claimed by another tech or formatted wrong for Time Machine. Then it adds our drive as a destination and starts a backup scoped to our drive only, never touching the client's own setup. Non-blocking. | Yes |
| 2 | Tuneup setup | Reports the system profile, battery health, drive SMART and a Disk Utility First Aid check. Installs TeamViewer QuickSupport and sets the desktop click fix. Also finds Time Machine local snapshots (invisible in Finder, often tens of GB, and usually what "purgeable" space really is) and offers to reclaim them. On a disk under 15% free it also shows what is actually using the space, read-only. | Yes + also fills in "Note free disk space" |
| 3 | Keyboard test | Opens our own tester page (no ads on a client machine) and records any dead keys. | Yes |
| 4 | Check Time Machine backup | Confirms our backup finished, logs the drive's free space, records the backup against that drive in the inventory, and releases the drive so it can be recommended again. | Yes |
| 5 | Install Malwarebytes | Silent install, for a Mac that arrived without it. Check Applications first and skip if it is already there. | Yes |
| 6 | KnockKnock scan | Lists everything set to launch automatically and flags unsigned items. Needs Full Disk Access for Terminal; the tool walks you through granting it. | Yes |
| 7 | Remove unwanted apps | Flash plus the remote-access tools: AnyDesk, UltraViewer, ScreenConnect, Splashtop, Zoho Assist, GoTo, LogMeIn, DWAgent. | Yes |
| 8 | Update apps | Browsers, Office, and the common apps. Quits each app right before updating it so the new version is live immediately. | Yes |
| 9 | Clean up installers | Trashes leftover .dmg/.pkg/.exe/.ipa files. Recoverable. Do this before emptying the Trash. | Yes |
| 10 | Deep clean | App caches, old logs and crash reports, month-old Mail attachment copies, abandoned downloads. Offers to empty the Trash. | Yes |
| 11 | System refresh | Rebuilds the "Open With" database, resets QuickLook, flushes DNS, removes ghost background services and broken login items. | No step for it. Lands in the project history |
| 12 | App audit | Finds apps that physically cannot launch (PowerPC, 32-bit, broken bundle) and offers to trash them. Writes a report to the Desktop. | No. "Double check applications" means a human opened the real apps |
| 13 | Watchman Monitoring | NGT+ members only. Installs the agent, confirms it is actually running, and sets the Time Machine warning threshold to 28 days instead of Watchman's 7. Safe to run on a Mac that already has the agent — that is how an existing member's Mac gets the 28 days. | Yes + also "Check Watchman Monitoring" |
| 14 | New NGT+ member setup | Malwarebytes and Watchman in one pass, each skipped if already present. | Yes, via the two tools it runs |
| 15 | Browser notifications | Sets Firefox to block new requests automatically, and opens Chrome, Edge and Safari to the right spot for you to click. | Yes |
| 16 | Remove Time Machine backup | Handoff step. Unpairs NGT's drive only, leaving the client's own setup exactly as it was. | Yes |
| 17 | Fleet drive audit | Office job, not about the client's Mac. Plug in our own external drives and log space, format and health to Airtable. Also records the backups already sitting on each drive, so the recommendation in option 1 knows what is there and how old it is. Offers to eject the drives when it finishes. | n/a. Writes to the drive inventory |
| 18 | Migration check | Run on BOTH machines. Counts files and folder sizes on the old Mac before a transfer, then diffs the new Mac against them afterwards, so "did Migration Assistant move it all" stops being a matter of opening a few folders and hoping. | Yes, a separate step for each half |
| 19 | FileVault | Reads whether FileVault is really on and writes On or Off to the Mac's Tech DB record. If it is on, paste the recovery key and it files itself — on macOS 26 and newer you can reveal the existing key at System Settings > Privacy & Security > FileVault > Show, or in the Passwords app. It never turns FileVault on, never generates a key, and changes nothing on the Mac. | Yes |
| c | Set the project code | Point this session's reports at a checklist. | |
| q | Quit |
Six sections. Items 0 to 11 are the daily tuneup, in the order you work.
| # | Tool | What it does | Checks itself off? |
|---|---|---|---|
| Tuneup, in the order you work | |||
| 0 | Desktop snapshot | A picture of the desktop as the machine arrived, filed to the project's photos in the Hub. The window minimizes itself for the shot and comes back after. Nothing on the client's machine changes. The menu offers this once per project when you enter the code, so you normally never pick it by hand. A copy is also kept on the PC under C:\ProgramData\NGT\Tuneup-Report\. | No step the run shows in the project's toolkit history |
| 1 | Backup C: drive | First it sizes the backup and tells you which fleet drive to fetch, ranked by free space and health, skipping any drive already claimed or not formatted NTFS. Then a full image, filed under NGT-Backups\<Client>\ and verified. The drive is claimed while you have it and released at the end, and the backup is recorded against it. Do this at intake. | Yes |
| 2 | Health check | Drive SMART, battery wear, BitLocker status and recovery key presence. Also checks security software (is real-time protection on, is there an expired third-party suite), detects the Ninite agent, and reports whether a reboot is already pending. | Yes + also fills in "Note free disk space", "Check security software", "Verify Ninite agent", "Verify PC is on Windows 11" (only if the version matches) and "Update Tech DB record with final specs" (only if the device write lands); auto-skips the Windows 10 call and "Clean inside of PC" when they do not apply |
| 3 | Keyboard test | Private Edge window with our tester page. Records dead keys. | Yes |
| 4 | Security scan | AdwCleaner, then Microsoft Safety Scanner (quick), then the Autoruns persistence pass, in one run. | Yes + the Autoruns review step |
| 4f | Security scan (FULL) | Same, but MSERT sweeps the whole disk. Takes hours. Only when something is actually suspected. | Yes |
| 5 | Install Malwarebytes | Silent install, for a PC that arrived without it. Use 22 for the license key. | Yes |
| 6 | Updates & repair | Offers Windows Update first (press Enter to run it), then DISM RestoreHealth, SFC and DISM component cleanup in that order, then manufacturer updates. Also offers the search index rebuild (see Escalations). | Yes + also "Windows Update", "Reclaim disk space" and "System updates from PC manufacturer" |
| 7 | Remove unwanted apps | Scans for remote-access tools and lets you pick what to remove, then sweeps the services, tasks and Run keys the vendor uninstaller leaves behind. | Yes |
| 8 | TeamViewer QuickSupport | Downloads our branded build to the Desktop and launches it. Still pin it to Start and the taskbar by hand. | Yes |
| 9 | Update apps | winget, Office delta updates, and Microsoft Store apps. Removes Skype. | Yes |
| 10 | Deep clean | Temp files, Windows Update cache, crash dumps, browser caches. Also reclaims the two things Disk Cleanup used to be run by hand for: the Delivery Optimization cache and the previous Windows installation. Turns Storage Sense on. Windows.old is only offered once its 10-day rollback window has closed. | Yes |
| 11 | Optimize drive | Works out what the drive actually is: TRIM on an SSD, defragment on a hard disk. Skips anything it cannot identify rather than guessing. Run it after the deep clean. | Yes |
| 12 | Startup programs report | Lists everything that launches at boot, with its command and location. What to disable is your call. | Yes |
| 13 | Browser notifications | Sets Firefox automatically. Opens Chrome and Edge and copies the settings URL to your clipboard. Then lists every Chrome/Edge extension and the default search engine so you can spot anything the client does not recognise. | Yes + also "Clean up browsers" |
| 14 | Install Watchman Monitoring | NGT+ members only. Installs the agent, then confirms it is actually running. | Yes + also "Check Watchman Monitoring" |
| 15 | New NGT+ member setup | Malwarebytes and Watchman in one pass. | Yes, via the two tools it runs |
| 16 | Remove bench traces | Removes our own downloads: AdwCleaner, MSERT, the RKill log, the MBAM folder. | Yes |
| Restore & Migration | |||
| 17 | Restore from backup | Mounts a client's C: image so you can pull files out of it. | No step for it |
| 18 | Export apps (old PC) | winget app list to the client's backup folder. | No |
| 19 | Export taskbar (old PC) | Pinned taskbar layout to the client's backup folder. | No |
| 20 | Export default apps (old PC) | Records the default browser, PDF reader, photo viewer and so on. | No |
| 21 | Export desktop look (old PC) | Wallpaper image and desktop icon positions. | No |
| 22 | Old PC: full migration prep | Runs 13, 14, 15 and 16 back to back. Asks for the drive and client folder once. | No |
| 23 | Import apps (new PC) | Installs the old PC's app list. | No |
| 24 | Migrate files (new PC) | Copies Desktop, Documents, Pictures, Music, Videos, Downloads. Then finds app data worth moving (Outlook signatures and .pst, Sticky Notes, Thunderbird, Quicken, Word templates) and lets you pick. Never a wholesale AppData copy. Public folders: checks C:\Users\Public for real files (shared photos, scans) and offers them as their own step, leaving all-users installer shortcuts behind. Bookmarks: it lists every Chrome/Edge profile found on the old PC with a count, always drops an importable HTML copy on the Desktop, and copies straight into the browser only with the browser closed, reading the count back afterwards. OneDrive-redirected folders are still skipped by default, but if you opt in it now scans the backup first and tells you how many files are really in there versus cloud-only stubs, then copies only what is really there — into a labeled backup folder, or straight into the real folders when the client is done with OneDrive. | Yes + each folder it actually copied, and the app-data steps |
| 25 | Import taskbar (new PC) | Recreates the pinned taskbar. Run after Import apps. | No |
| 26 | Import desktop look (new PC) | Sets the wallpaper and icon positions. Run after Migrate files. | No |
| 27 | Malwarebytes license | Looks up a client's key and copies it to the clipboard. | No |
| 28 | Show default apps (new PC) | Shows the old PC's list so you can re-apply it by hand. Windows blocks scripted changes here, so this is view-and-retype. | No. The re-applying is the work |
| 29 | New PC: full migration setup | Runs 18 through 23 back to back. Asks for the drive and client folder once. | No |
| Printers | |||
| 30 | Printer diagnostics | Read-only. Collects a full spooler, driver and policy report and files it straight to the project's PC Tuneup record. | No step. The report lands on the project |
| 31 | Printer spooler guard | Installs a desktop "Restart Printer" button plus an auto-heal task. This leaves a permanent change on the client's machine, so it is recorded in the project history. | No step. Recorded in history |
| Office / inventory (not about the client's PC) | |||
| 32 | Fleet drive audit | Office job. Plug in our own external drives and log space, format and health to Airtable. Also records the backups already on each drive so option 1 can recommend properly, clears the shadow copies that stop a drive ejecting, and offers to eject them when it finishes. | n/a. Writes to the drive inventory |
| c | Set the project code | Point this session's reports at a checklist. | |
| q | Quit | ||
Three things worth knowing so the checklist never surprises you.
Both backup tools (Mac 1, PC 1) size the backup first and then tell you which fleet drive to fetch, before you go to the shelf. They rank on free space and drive health, and they leave out:
It also shows drives that would fit once backups older than 30 days are cleared, naming the client and age of each, so you know what you would be deleting.
These are not toolkit options. The Hub notices you doing the thing and ticks the step, so you are not recording work you just did:
C:\ProgramData\NGT\deletions.log: everything the cleanup tools removed. This is what you open if a client asks what was deleted.C:\ProgramData\NGT\Tuneup-Report\: reports from individual tools.C:\ProgramData\NGT\session.json and C:\ProgramData\NGT\project-code.txt: the saved project code.C:\ProgramData\NGT\Tools\: our own downloads. Option 16 removes these before handoff.~/Library/Logs/NGT/deletions.log: same purpose as the Windows one.~/Library/Application Support/project-code.txt: the saved project code.~/Library/Logs/NGT/: the App audit report (option 12) lands here once it files to the Hub, so nothing is left on the client's Desktop. If a run could not file, it says so and leaves the report on the Desktop for you to deal with.Three things that are deliberately not part of a standard tuneup. Each one costs the client time or risk, so none of them runs unless it is actually needed.
The standard security scan runs a quick MSERT. The full sweep covers the whole disk and takes hours. Use it when something is genuinely suspected, not by default.
Escalation only. It is not a standing step in the tuneup any more. Reach for it when an infection is actively blocking your tools, and clean up its log afterwards with option 16.
Option 6 asks about it at the end. Pressing Enter skips it, which is the right answer unless someone has approved it. If you do run it, tell the client their computer will be busy in the background for a while.
No project code is set, so nothing is checking itself off. Press c and enter the code from the checklist. Everything you already ran will need ticking by hand.
The tool already retried several times. The work it did is still done. Only the reporting failed. Tick that step by hand and carry on. If it keeps happening, check the machine's internet connection first.
For about 30 seconds after we push an update, some tools return "not found" while the change spreads. Wait half a minute and pick the option again. If it is still failing after a couple of minutes, that is a real problem worth reporting.
macOS will not let Terminal read the files KnockKnock scans until you grant it. The tool prints the exact steps. Grant it in System Settings, then run option 6 again.
Codes stop working once a checklist is marked complete. Check you are looking at the right project, and that the checklist is still open in the Hub.
You almost certainly do not need it again, because reopening the toolkit resumes the session by itself for 24 hours. If you do need to read it, it is written in plain words at C:\ProgramData\NGT\project-code.txt or ~/Library/Application Support/project-code.txt.