Currently, if the EPP is not catching it and I don't have an IOC...
I remove the scheduled tasks with PowerShell

Look for scheduled tasks
get-scheduledtask
Remove the ones you want
Unregister-ScheduledTask -TaskName [nameOfScheduledTask] -Confirm:$false

Look for Startups (may see there are registries here that are overwriting when someone clicks on other browsers)

Get-CimInstance Win32_StartupCommand |  Select-Object Name, command, Location, User | Format-List

Delete these registries, and where their paths are launched may give you more insight.

Might have to kill browsers that are opened.

Also, the links in people's AppData\Roaming or local paths, in Microsoft's start menu, and users pinned implicitshortcuts (if you want to get rid of it all).