diff --git a/.fixtures.yml b/.fixtures.yml
index 5c936af3..4585a4e3 100644
--- a/.fixtures.yml
+++ b/.fixtures.yml
@@ -24,9 +24,7 @@ fixtures:
     augeasproviders_sysctl: https://github.com/simp/augeasproviders_sysctl.git
     authselect: https://github.com/voxpupuli/puppet-authselect.git
     autofs: https://github.com/simp/pupmod-simp-autofs.git
-    chkrootkit: https://github.com/simp/pupmod-simp-chkrootkit.git
     chrony: https://github.com/simp/pupmod-voxpupuli-chrony.git
-    clamav: https://github.com/simp/pupmod-simp-clamav.git
     concat: https://github.com/simp/puppetlabs-concat.git
     cron: https://github.com/simp/pupmod-simp-cron.git
     cron_core: https://github.com/simp/pupmod-puppetlabs-cron_core.git
@@ -71,7 +69,6 @@ fixtures:
     simp_apache: https://github.com/simp/pupmod-simp-apache.git
     simp_banners: https://github.com/simp/pupmod-simp-simp_banners.git
     simp_firewalld: https://github.com/simp/pupmod-simp-simp_firewalld.git
-    simp_openldap: https://github.com/simp/pupmod-simp-simp_openldap.git
     simp_options: https://github.com/simp/pupmod-simp-simp_options.git
     simp_rsyslog: https://github.com/simp/pupmod-simp-simp_rsyslog.git
     simp_ds389: https://github.com/simp/pupmod-simp-simp_ds389.git
@@ -82,7 +79,6 @@ fixtures:
     stunnel: https://github.com/simp/pupmod-simp-stunnel.git
     systemd: https://github.com/simp/puppet-systemd.git
     sudo: https://github.com/simp/pupmod-simp-sudo.git
-    sudosh: https://github.com/simp/pupmod-simp-sudosh.git
     svckill: https://github.com/simp/pupmod-simp-svckill.git
     swap: https://github.com/simp/pupmod-simp-swap.git
     tcpwrappers: https://github.com/simp/pupmod-simp-tcpwrappers.git
diff --git a/AGENTS.md b/AGENTS.md
index 67ad9238..7b70dcf5 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -128,8 +128,7 @@ subdirectory:
     whether the key combination (and the logged-in users) is logged.
   - `simp::admin` (admin/auditor group access and default sudo rules),
     `simp::base_apps` (common apps such as irqbalance), `simp::server` (the SIMP
-    server role), `simp::nsswitch`, `simp::version`, and `simp::base_services`
-    (**deprecated**, slated for removal).
+    server role), `simp::nsswitch`, and `simp::version`.
 - **`kmod_blacklist/`** — `lock_modules`.
 - **`mountpoints/`** — `proc`, `tmp` (secure mount options).
 - **`pam_limits/`** — `max_logins` (simultaneous-login restriction).
@@ -139,11 +138,10 @@ subdirectory:
 - **`sudoers/`** — `aliases` (SIMP site sudoers aliases).
 - **`yum/`** — `schedule` (sets up a cron-based YUM update schedule via
   `simp::yum::schedule`), plus a set of `yum/repo/*` repo-definition classes
-  (`internet_simp`, `internet_simp_dependencies`, `internet_simp_server`,
-  `local_os_updates`, `local_simp`).
+  (`internet_simp`, `local_os_updates`, `local_simp`).
 
-There are roughly **39 classes** in total across `manifests/` (18 top-level
-`manifests/*.pp` plus ~21 subclasses under the subdirectories above). Summarize
+There are roughly **35 classes** in total across `manifests/` (17 top-level
+`manifests/*.pp` plus ~18 subclasses under the subdirectories above). Summarize
 by role rather than enumerating each one when working here.
 
 ### Gotchas / non-obvious details
@@ -166,10 +164,6 @@ by role rather than enumerating each one when working here.
 - **Bolt-awareness.** The `$facts['puppet_vardir']}/simp` directory and the
   filebucket are skipped under `simplib::in_bolt()` because the vardir would be
   on the Bolt host, not the target (`init.pp`).
-- **`simp::base_services` is deprecated** and will be removed in a future
-  version (`manifests/base_services.pp`); do not build new logic on it.
-- **`enable_data_includes` is deprecated and has no effect** (`init.pp`);
-  it is slated for removal in the next major release.
 - **one_shot finalization is destructive and asynchronous.** It runs a script in
   the background that can remove PKI and the puppet package
   (`one_shot/finalize.pp`); it is not part of a normal run and should not
@@ -182,18 +176,17 @@ by role rather than enumerating each one when working here.
 
 Like every SIMP module, `simp` routes cross-cutting feature toggles through the
 `simp_options::*` namespace via `simplib::lookup(..., { 'default_value' => ...
-})`, so a site can flip a capability once and have it propagate. There are **15**
+})`, so a site can flip a capability once and have it propagate. There are **13**
 distinct `simp_options::*` seams consumed across the manifests:
 
-`simp_options::auditd`, `simp_options::authselect`, `simp_options::clamav`,
-`simp_options::fips`, `simp_options::firewall`, `simp_options::ldap`,
-`simp_options::ntp::servers`, `simp_options::package_ensure`,
-`simp_options::pam`, `simp_options::puppet::ca`, `simp_options::puppet::ca_port`,
-`simp_options::puppet::server`, `simp_options::sssd`, `simp_options::stunnel`,
-`simp_options::trusted_nets`.
+`simp_options::auditd`, `simp_options::authselect`, `simp_options::fips`,
+`simp_options::firewall`, `simp_options::ldap`, `simp_options::ntp::servers`,
+`simp_options::package_ensure`, `simp_options::pam`, `simp_options::puppet::ca`,
+`simp_options::puppet::ca_port`, `simp_options::puppet::server`,
+`simp_options::sssd`, `simp_options::stunnel`, `simp_options::trusted_nets`.
 
-In `simp::init` specifically, `$rsync_stunnel`, `$pam`, `$ldap`, and `$sssd`
-default off the `simp_options::stunnel` / `::pam` / `::ldap` / `::sssd` seams
+In `simp::init` specifically, `$rsync_stunnel`, `$pam`, and `$sssd`
+default off the `simp_options::stunnel` / `::pam` / `::sssd` seams
 (`init.pp`). Keep new toggles flowing through
 `simplib::lookup('simp_options::*', { 'default_value' => ... })` with an
 explicit default rather than assuming `simp_options` is included.
@@ -201,7 +194,7 @@ explicit default rather than assuming `simp_options` is included.
 ## Dependencies
 
 This is a **meta-module: it depends on essentially the entire SIMP stack.**
-`metadata.json` declares **43** dependencies — do not transcribe them all when
+`metadata.json` declares **38** dependencies — do not transcribe them all when
 editing; treat the dependency list as "the whole SIMP ecosystem." A
 representative handful:
 
@@ -240,12 +233,12 @@ EL-only in practice.
   (not part of a normal run).
 - `manifests/*.pp` and the `kmod_blacklist/`, `mountpoints/`, `pam_limits/`,
   `server/`, `sssd/`, `sudoers/`, `yum/` subdirectories — the individual
-  baseline classes (~39 classes total).
+  baseline classes (~35 classes total).
 - `data/common.yaml` — the `scenario_map`, class lists, nsswitch defaults, and
   merge behaviours. **This is where "what a SIMP system includes" lives.**
 - `data/os/`, `hiera.yaml` — module data hierarchy (v5): OS name+major → OS name
   → kernel → common.
-- `metadata.json` — the 43 dependencies, OS matrix, and Puppet requirement.
+- `metadata.json` — the 38 dependencies, OS matrix, and Puppet requirement.
 - `spec/classes/`, `spec/defines/` — rspec-puppet unit tests.
 - `spec/acceptance/suites/` — beaker suites (`default`, `base_apps`); nodesets
   under `spec/acceptance/nodesets/` (**30** files: a `vagrant` set —
diff --git a/CHANGELOG b/CHANGELOG
index a396372a..a7a2314b 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -11,6 +11,33 @@
   `simp_options::ntp::servers`, or client kickstarts will silently skip the
   initial time sync (clock skew there can break PKI certificate validation
   during bootstrap)
+- BREAKING CHANGE: Removed support for the `simp_options::clamav` catalyst
+  (deprecated since 2019) along with the `simp::server::clamav` parameter,
+  the clamav rsync share, and the `simp/clamav` dependency. To manage ClamAV,
+  include the `clamav` class directly in your class list
+- BREAKING CHANGE: Removed sudosh support from `simp::admin`
+  (`pupmod-simp-sudosh` is archived). `simp::admin::logged_shell` now only
+  accepts `tlog`; sites setting `sudosh` will fail catalog compilation and
+  must migrate to `tlog`
+- Dropped dependencies on the archived `simp/chkrootkit` and
+  `simp/simp_openldap` modules (neither was referenced by any manifest)
+- BREAKING CHANGE: Removed the unused `simp::ldap` and
+  `simp::scenario::base::ldap` parameters. The `simp_options::ldap` catalyst
+  is still honored by `simp::sssd::client`
+- BREAKING CHANGE: Removed parameters and classes previously deprecated for
+  removal at the next major release:
+  - `simp::enable_data_includes` (no-op)
+  - `simp::puppetdb::read_database_ssl`
+    (use `simp::puppetdb::read_database_jdbc_ssl_properties`)
+  - `simp::yum::repo::internet_simp_server` and
+    `simp::yum::repo::internet_simp_dependencies`
+    (use `simp::yum::repo::internet_simp`)
+  - `simp::server::kickstart::manage_runpuppet`
+    (runpuppet was replaced by `simp_client_bootstrap`)
+  - `simp::base_services` (include `simp::base_apps` instead; also removed
+    from the scenario class lists)
+  - `simp::base_apps::manage_elinks_config` (unused)
+  - `simp::sysctl::kernel__exec_shield` (unused; sysctl no longer exists)
 
 * Tue Jul 28 2026 Steven Pritchard <steve@sicura.us> - 8.1.0
 - (#353) Fix `simp::sysctl::ipv6` (and the other `simp::sysctl` IPv6 settings)
diff --git a/REFERENCE.md b/REFERENCE.md
index dcbb3cf0..62be8365 100644
--- a/REFERENCE.md
+++ b/REFERENCE.md
@@ -9,7 +9,6 @@
 * [`simp`](#simp): This class provides an entry point to configuring your systems to
 * [`simp::admin`](#simp--admin): Set up a host of common administrative functions including
 * [`simp::base_apps`](#simp--base_apps): This is a set of applications that you will want on most systems
-* [`simp::base_services`](#simp--base_services): Deprecated - This class will be removed in a future version of SIMP.
 * [`simp::ctrl_alt_del`](#simp--ctrl_alt_del): Manage the state of pressing ``ctrl-alt-del``
 * [`simp::kmod_blacklist`](#simp--kmod_blacklist): This class provides a default set of blacklist entries per the SCAP
 * [`simp::kmod_blacklist::lock_modules`](#simp--kmod_blacklist--lock_modules): This class toggles the ability to load any further kernel modules
@@ -39,8 +38,6 @@
 * [`simp::sysctl`](#simp--sysctl): Sets sysctl settings that are useful from a general 'modern system'
 * [`simp::version`](#simp--version): Places SIMP version related information on the filesystem
 * [`simp::yum::repo::internet_simp`](#simp--yum--repo--internet_simp): Configure yum to use the internet public repository for SIMP
-* [`simp::yum::repo::internet_simp_dependencies`](#simp--yum--repo--internet_simp_dependencies): DEPRECATED Configure yum to use the internet public repositories for SIMP dependencies
-* [`simp::yum::repo::internet_simp_server`](#simp--yum--repo--internet_simp_server): DEPRECATED Configure yum to use the internet public repository for SIMP servers
 * [`simp::yum::repo::local_os_updates`](#simp--yum--repo--local_os_updates): Configure yum to use a (SIMP-managed) OS Updates repository for
 network-isolated environments.
 * [`simp::yum::repo::local_simp`](#simp--yum--repo--local_simp): Set up the local SIMP repositiories for network-isolated
@@ -85,7 +82,6 @@ The following parameters are available in the `simp` class:
 
 * [`scenario_map`](#-simp--scenario_map)
 * [`scenario`](#-simp--scenario)
-* [`enable_data_includes`](#-simp--enable_data_includes)
 * [`classes`](#-simp--classes)
 * [`mail_server`](#-simp--mail_server)
 * [`rsync_stunnel`](#-simp--rsync_stunnel)
@@ -105,7 +101,6 @@ The following parameters are available in the `simp` class:
 * [`manage_rc_local`](#-simp--manage_rc_local)
 * [`pam`](#-simp--pam)
 * [`sssd`](#-simp--sssd)
-* [`ldap`](#-simp--ldap)
 * [`stock_sssd`](#-simp--stock_sssd)
 * [`classification_warning`](#-simp--classification_warning)
 * [`vardir_owner`](#-simp--vardir_owner)
@@ -134,16 +129,6 @@ The SIMP 'scenario' that you wish to apply to your system
 
 Default value: `'simp'`
 
-##### <a name="-simp--enable_data_includes"></a>`enable_data_includes`
-
-Data type: `Boolean`
-
-**Deprecated** - Has no effect
-
-* Will be removed in the next major release
-
-Default value: `true`
-
 ##### <a name="-simp--classes"></a>`classes`
 
 Data type: `Array`
@@ -332,14 +317,6 @@ Enable management of SSSD resources via SIMP modules
 
 Default value: `simplib::lookup('simp_options::sssd', { 'default_value' => true })`
 
-##### <a name="-simp--ldap"></a>`ldap`
-
-Data type: `Boolean`
-
-Enable management of LDAP resources via SIMP modules
-
-Default value: `simplib::lookup('simp_options::ldap', { 'default_value' => false })`
-
 ##### <a name="-simp--stock_sssd"></a>`stock_sssd`
 
 Data type: `Boolean`
@@ -502,10 +479,13 @@ Default value: `true`
 
 ##### <a name="-simp--admin--logged_shell"></a>`logged_shell`
 
-Data type: `Enum['sudosh','tlog']`
+Data type: `Enum['tlog']`
 
 The name of the logged shell to use
 
+* ``sudosh`` support was removed when the ``simp/sudosh`` module was
+  archived; ``tlog`` is the only supported logged shell
+
 Default value: `'tlog'`
 
 ##### <a name="-simp--admin--default_admin_sudo_cmnds"></a>`default_admin_sudo_cmnds`
@@ -615,7 +595,6 @@ The following parameters are available in the `simp::base_apps` class:
 
 * [`ensure`](#-simp--base_apps--ensure)
 * [`extra_apps`](#-simp--base_apps--extra_apps)
-* [`manage_elinks_config`](#-simp--base_apps--manage_elinks_config)
 
 ##### <a name="-simp--base_apps--ensure"></a>`ensure`
 
@@ -636,19 +615,6 @@ A list of other applications that you wish to install
 
 Default value: `undef`
 
-##### <a name="-simp--base_apps--manage_elinks_config"></a>`manage_elinks_config`
-
-Data type: `Optional[Boolean]`
-
-DEPRECATED: This functionality is not required for normal operation of the
-system and should be moved to external management.
-
-Default value: `undef`
-
-### <a name="simp--base_services"></a>`simp::base_services`
-
-Deprecated - This class will be removed in a future version of SIMP.
-
 ### <a name="simp--ctrl_alt_del"></a>`simp::ctrl_alt_del`
 
 Manage the state of pressing ``ctrl-alt-del``
@@ -1619,7 +1585,6 @@ The following parameters are available in the `simp::puppetdb` class:
 * [`read_database_username`](#-simp--puppetdb--read_database_username)
 * [`read_database_password`](#-simp--puppetdb--read_database_password)
 * [`read_database_name`](#-simp--puppetdb--read_database_name)
-* [`read_database_ssl`](#-simp--puppetdb--read_database_ssl)
 * [`read_database_jdbc_ssl_properties`](#-simp--puppetdb--read_database_jdbc_ssl_properties)
 * [`manage_firewall`](#-simp--puppetdb--manage_firewall)
 * [`manage_puppetserver`](#-simp--puppetdb--manage_puppetserver)
@@ -1769,17 +1734,6 @@ Data type: `String`
 
 Default value: `'simp_puppetdb'`
 
-##### <a name="-simp--puppetdb--read_database_ssl"></a>`read_database_ssl`
-
-Data type: `Optional[Boolean]`
-
-This parameter has been deprecated, because its corresponding
-``puppetdb::server`` parameter has been replaced with
-``puppetdb::server::read_database_jdbc_ssl_properties``.
-Use $read_database_jdbc_ssl_properties = '?ssl=true' instead.
-
-Default value: `undef`
-
 ##### <a name="-simp--puppetdb--read_database_jdbc_ssl_properties"></a>`read_database_jdbc_ssl_properties`
 
 Data type: `String`
@@ -2049,7 +2003,6 @@ The following parameters are available in the `simp::scenario::base` class:
 * [`manage_rc_local`](#-simp--scenario--base--manage_rc_local)
 * [`pam`](#-simp--scenario--base--pam)
 * [`sssd`](#-simp--scenario--base--sssd)
-* [`ldap`](#-simp--scenario--base--ldap)
 * [`stock_sssd`](#-simp--scenario--base--stock_sssd)
 
 ##### <a name="-simp--scenario--base--mail_server"></a>`mail_server`
@@ -2178,14 +2131,6 @@ Enable management of SSSD resources via SIMP modules
 
 Default value: `$simp::sssd`
 
-##### <a name="-simp--scenario--base--ldap"></a>`ldap`
-
-Data type: `Boolean`
-
-Enable management of LDAP resources via SIMP modules
-
-Default value: `$simp::ldap`
-
 ##### <a name="-simp--scenario--base--stock_sssd"></a>`stock_sssd`
 
 Data type: `Boolean`
@@ -2235,7 +2180,6 @@ The following parameters are available in the `simp::server` class:
 
 * [`allow_simp_user`](#-simp--server--allow_simp_user)
 * [`pam`](#-simp--server--pam)
-* [`clamav`](#-simp--server--clamav)
 * [`auditd`](#-simp--server--auditd)
 * [`scenario`](#-simp--server--scenario)
 * [`classes`](#-simp--server--classes)
@@ -2257,19 +2201,6 @@ Enable SIMP management of the PAM stack
 
 Default value: `simplib::lookup('simp_options::pam', { 'default_value' => false })`
 
-##### <a name="-simp--server--clamav"></a>`clamav`
-
-Data type: `Boolean`
-
-Deprecated. Enable SIMP management of Antivirus
-
-This parameter and the simp_options::clamav catalyst are deprecated and
-both will be removed in a future SIMP release. Once removed, if you want
-to manage ClamAV, you will have to manually include the `clamav` class
-from the `simp-clamav` module in the server's class list.
-
-Default value: `simplib::lookup('simp_options::clamav', { 'default_value' => false })`
-
 ##### <a name="-simp--server--auditd"></a>`auditd`
 
 Data type: `Boolean`
@@ -2321,7 +2252,6 @@ The following parameters are available in the `simp::server::kickstart` class:
 * [`trusted_nets`](#-simp--server--kickstart--trusted_nets)
 * [`manage_dhcp`](#-simp--server--kickstart--manage_dhcp)
 * [`manage_tftpboot`](#-simp--server--kickstart--manage_tftpboot)
-* [`manage_runpuppet`](#-simp--server--kickstart--manage_runpuppet)
 * [`manage_simp_client_bootstrap`](#-simp--server--kickstart--manage_simp_client_bootstrap)
 * [`sslverifyclient`](#-simp--server--kickstart--sslverifyclient)
 
@@ -2358,20 +2288,6 @@ If true, have this node act as a TFTP server.
 
 Default value: `true`
 
-##### <a name="-simp--server--kickstart--manage_runpuppet"></a>`manage_runpuppet`
-
-Data type: `Boolean`
-
-Deprecated  The runpuppet script has been replaced by the
-simp_client_bootstrap script.  The runpuppet script did
-not work well on CentOS 7 and will not work on CentOS 8.
-Remember to update your kickstart scripts to call the correct
-script. See the bootstrap scripts in simp-core under build/distributions
-for examples.
-This parameter will be removed in later versions.
-
-Default value: `false`
-
 ##### <a name="-simp--server--kickstart--manage_simp_client_bootstrap"></a>`manage_simp_client_bootstrap`
 
 Data type: `Boolean`
@@ -3109,7 +3025,6 @@ The following parameters are available in the `simp::sysctl` class:
 * [`kernel__core_pipe_limit`](#-simp--sysctl--kernel__core_pipe_limit)
 * [`kernel__core_uses_pid`](#-simp--sysctl--kernel__core_uses_pid)
 * [`kernel__dmesg_restrict`](#-simp--sysctl--kernel__dmesg_restrict)
-* [`kernel__exec_shield`](#-simp--sysctl--kernel__exec_shield)
 * [`kernel__panic`](#-simp--sysctl--kernel__panic)
 * [`kernel__randomize_va_space`](#-simp--sysctl--kernel__randomize_va_space)
 * [`kernel__sysrq`](#-simp--sysctl--kernel__sysrq)
@@ -3359,14 +3274,6 @@ Data type: `Integer[0,1]`
 
 
 
-Default value: `1`
-
-##### <a name="-simp--sysctl--kernel__exec_shield"></a>`kernel__exec_shield`
-
-Data type: `Integer[0,1]`
-
-**DEPRECATED BY VENDOR WILL BE REMOVED IN NEXT RELEASE**
-
 Default value: `1`
 
 ##### <a name="-simp--sysctl--kernel__panic"></a>`kernel__panic`
@@ -3796,50 +3703,6 @@ Type of release you want:
 
 Default value: `'releases'`
 
-### <a name="simp--yum--repo--internet_simp_dependencies"></a>`simp::yum::repo::internet_simp_dependencies`
-
-The packagecloud yum repository that used to be configured by this class is
-no longer maintained. As an interim workaround, this class now uses
-``simp::yum::repo::internet_simp`` to configure the correct repositories. You
-should switch to using ``simp::yum::repo::internet_simp directly``, as this
-class will be removed in a future release.
-
-#### Parameters
-
-The following parameters are available in the `simp::yum::repo::internet_simp_dependencies` class:
-
-* [`simp_release_slug`](#-simp--yum--repo--internet_simp_dependencies--simp_release_slug)
-
-##### <a name="-simp--yum--repo--internet_simp_dependencies--simp_release_slug"></a>`simp_release_slug`
-
-Data type: `Optional[String]`
-
-The unique release URL "slug" of SIMP for the target release.
-
-Default value: `undef`
-
-### <a name="simp--yum--repo--internet_simp_server"></a>`simp::yum::repo::internet_simp_server`
-
-The packagecloud yum repository that used to be configured by this class is
-no longer maintained. As an interim workaround, this class now uses
-``simp::yum::repo::internet_simp`` to configure the correct repository. You
-should switch to using ``simp::yum::repo::internet_simp directly``, as this
-class will be removed in a future release.
-
-#### Parameters
-
-The following parameters are available in the `simp::yum::repo::internet_simp_server` class:
-
-* [`simp_release_slug`](#-simp--yum--repo--internet_simp_server--simp_release_slug)
-
-##### <a name="-simp--yum--repo--internet_simp_server--simp_release_slug"></a>`simp_release_slug`
-
-Data type: `Optional[String]`
-
-The unique release URL "slug" of SIMP for the target release.
-
-Default value: `undef`
-
 ### <a name="simp--yum--repo--local_os_updates"></a>`simp::yum::repo::local_os_updates`
 
 Generally, this is used by the ISO installation's SIMP agents.
diff --git a/data/os/Linux.yaml b/data/os/Linux.yaml
index 936a1f55..697981ae 100644
--- a/data/os/Linux.yaml
+++ b/data/os/Linux.yaml
@@ -34,7 +34,6 @@ simp::scenario_map:
     - resolv
     - simp::admin
     - simp::base_apps
-    - simp::base_services
     - simp::kmod_blacklist
     - simp::mountpoints
     - simp::nsswitch
@@ -64,7 +63,6 @@ simp::scenario_map:
     - resolv
     - simp::admin
     - simp::base_apps
-    - simp::base_services
     - simp::kmod_blacklist
     - simp::mountpoints
     - simp::nsswitch
@@ -98,7 +96,6 @@ simp::scenario_map:
     - resolv
     - simp::admin
     - simp::base_apps
-    - simp::base_services
     - simp::kmod_blacklist
     - simp::mountpoints
     - simp::nsswitch
@@ -130,7 +127,6 @@ simp::server::data:
   - resolv
   - simp::admin
   - simp::base_apps
-  - simp::base_services
   - simp::kmod_blacklist
   - simp::mountpoints
   - simp::nsswitch
diff --git a/manifests/admin.pp b/manifests/admin.pp
index b18b4b3a..eb771727 100644
--- a/manifests/admin.pp
+++ b/manifests/admin.pp
@@ -37,6 +37,9 @@
 # @param logged_shell
 #   The name of the logged shell to use
 #
+#   * ``sudosh`` support was removed when the ``simp/sudosh`` module was
+#     archived; ``tlog`` is the only supported logged shell
+#
 # @param default_admin_sudo_cmnds
 #   The set of commands that ``$admin_group`` should be able to run by default
 #
@@ -101,7 +104,7 @@
   Simplib::Netlist      $admins_allowed_from       = ['ALL'],
   Simplib::Netlist      $auditors_allowed_from     = simplib::lookup('simp_options::trusted_nets', { 'default_value' => ['127.0.0.1'] }),
   Boolean               $force_logged_shell        = true,
-  Enum['sudosh','tlog'] $logged_shell              = 'tlog',
+  Enum['tlog']          $logged_shell              = 'tlog',
   Array[String[2]]      $default_admin_sudo_cmnds  = ['/bin/su - root'],
   Hash                  $admin_sudo_options        = { 'role' => 'unconfined_r' },
   Hash                  $auditor_sudo_options      = {},
@@ -144,30 +147,12 @@
   }
 
   if $force_logged_shell {
-    # We restrict this so we don't need a fallback
-    if $logged_shell == 'sudosh' {
-      include 'sudosh'
-
-      $_shell_cmd = ['/usr/bin/sudosh']
-    }
-    else {
-      # TODO: This should be removed when SIMP-5169 is resolved
-      file { '/etc/profile.d/sudosh2.sh': ensure => 'absent' }
-    }
+    include 'tlog::rec_session'
 
-    if $logged_shell == 'tlog' {
-      include 'tlog::rec_session'
+    $_shell_cmd = $default_admin_sudo_cmnds
 
-      $_shell_cmd = $default_admin_sudo_cmnds
-    }
-    else {
-      # TODO: This should be removed when SIMP-5169 is resolved
-      tidy { 'Tlog profile.d files':
-        path    => '/etc/profile.d',
-        matches => ['00-simp-tlog.*'],
-        recurse => 1,
-      }
-    }
+    # TODO: This should be removed when SIMP-5169 is resolved
+    file { '/etc/profile.d/sudosh2.sh': ensure => 'absent' }
   }
   else {
     $_shell_cmd = $default_admin_sudo_cmnds
@@ -198,8 +183,8 @@
     }
   }
 
-  # The following two are especially important if you're using sudosh.
-  # They allow you to recover from destroying the certs in your environment.
+  # The following allows you to recover from destroying the certs in your
+  # environment.
   sudo::user_specification { 'admin run puppet':
     user_list => ["%${admin_group}"],
     runas     => $admin_runas,
diff --git a/manifests/base_apps.pp b/manifests/base_apps.pp
index cee08a12..a1182a91 100644
--- a/manifests/base_apps.pp
+++ b/manifests/base_apps.pp
@@ -13,16 +13,11 @@
 # @param extra_apps
 #   A list of other applications that you wish to install
 #
-# @param manage_elinks_config
-#   DEPRECATED: This functionality is not required for normal operation of the
-#   system and should be moved to external management.
-#
 # @author Trevor Vaughan <tvaughan@onyxpoint.com>
 #
 class simp::base_apps (
-  Simp::PackageEnsure       $ensure               = simplib::lookup('simp_options::package_ensure', { 'default_value' => 'installed' }),
-  Optional[Array[String,1]] $extra_apps           = undef,
-  Optional[Boolean]         $manage_elinks_config = undef
+  Simp::PackageEnsure       $ensure     = simplib::lookup('simp_options::package_ensure', { 'default_value' => 'installed' }),
+  Optional[Array[String,1]] $extra_apps = undef
 ) {
   simplib::module_metadata::assert($module_name, { 'blacklist' => ['Windows'] })
 
diff --git a/manifests/base_services.pp b/manifests/base_services.pp
deleted file mode 100644
index 4e42ac0d..00000000
--- a/manifests/base_services.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-# @summary Deprecated - This class will be removed in a future version of SIMP.
-#
-# @author Trevor Vaughan <tvaughan@onyxpoint.com>
-#
-class simp::base_services {
-  simplib::module_metadata::assert($module_name, { 'blacklist' => ['Windows'] })
-
-  # to ensure api compatbility
-  include 'simp::base_apps'
-}
diff --git a/manifests/init.pp b/manifests/init.pp
index 5f6c85c1..b5d69ada 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -19,11 +19,6 @@
 #   * Please see the module data for the exact class list that is included in
 #     each scenario
 #
-# @param enable_data_includes
-#   **Deprecated** - Has no effect
-#
-#   * Will be removed in the next major release
-#
 # @param classes
 #   A list of classes that you wish to include in your SIMP stack in addition
 #   to the ``scenario`` selected above.
@@ -116,9 +111,6 @@
 # @param sssd
 #   Enable management of SSSD resources via SIMP modules
 #
-# @param ldap
-#   Enable management of LDAP resources via SIMP modules
-#
 # @param stock_sssd
 #   Add a default setup that will successfully connect to the SIMP LDAP server,
 #   if enabled, and will otherwise provide a functional SSSD stack for the
@@ -150,7 +142,6 @@
   Stdlib::Filemode                $vardir_mode,
   Hash                            $scenario_map,
   String                          $scenario                   = 'simp',
-  Boolean                         $enable_data_includes       = true,
   Array                           $classes                    = [],
   Variant[Boolean,Enum['remote']] $mail_server                = false,
   Variant[Boolean,Simplib::Host]  $rsync_stunnel              = simplib::lookup('simp_options::stunnel', { 'default_value' => true }),
@@ -169,7 +160,6 @@
   Boolean                         $manage_root_perms          = true,
   Boolean                         $manage_rc_local            = true,
   Boolean                         $pam                        = simplib::lookup('simp_options::pam', { 'default_value' => false }),
-  Boolean                         $ldap                       = simplib::lookup('simp_options::ldap', { 'default_value' => false }),
   Boolean                         $sssd                       = simplib::lookup('simp_options::sssd', { 'default_value' => true }),
   Boolean                         $stock_sssd                 = true,
   Boolean                         $classification_warning     = true
diff --git a/manifests/puppetdb.pp b/manifests/puppetdb.pp
index cb063c7a..4e25ac9a 100644
--- a/manifests/puppetdb.pp
+++ b/manifests/puppetdb.pp
@@ -35,12 +35,6 @@
 # @param read_database_username
 # @param read_database_password
 # @param read_database_name
-# @param read_database_ssl
-#   This parameter has been deprecated, because its corresponding
-#   ``puppetdb::server`` parameter has been replaced with
-#   ``puppetdb::server::read_database_jdbc_ssl_properties``.
-#   Use $read_database_jdbc_ssl_properties = '?ssl=true' instead.
-#
 # @param read_database_jdbc_ssl_properties
 # @param manage_firewall
 # @param manage_puppetserver
@@ -74,7 +68,6 @@
   String                              $read_database_username            = 'simp_puppetdb',
   String                              $read_database_password            = simplib::passgen('simp_read_puppetdb'),
   String                              $read_database_name                = 'simp_puppetdb',
-  Optional[Boolean]                   $read_database_ssl                 = undef,
   String                              $read_database_jdbc_ssl_properties = '?ssl=true',
   Boolean                             $manage_firewall                   = true,
   Boolean                             $manage_puppetserver               = true,
@@ -91,20 +84,7 @@
 ) {
   simplib::module_metadata::assert($module_name, { 'blacklist' => ['Windows'] })
 
-  if $read_database_ssl !~ Undef {
-    if $read_database_ssl {
-      warning('$read_database_ssl is deprecated and will be removed in the next major release. Please use $read_database_jdbc_ssl_properties = "?ssl=true" instead.')
-      $_read_database_jdbc_ssl_properties = '?ssl=true'
-    }
-    else {
-      warning('$read_database_ssl is deprecated and will be removed in the next major release. Please use $read_database_jdbc_ssl_properties = "" instead.')
-
-      $_read_database_jdbc_ssl_properties = '' # lint:ignore:empty_string_assignment
-    }
-  }
-  else {
-    $_read_database_jdbc_ssl_properties = $read_database_jdbc_ssl_properties
-  }
+  $_read_database_jdbc_ssl_properties = $read_database_jdbc_ssl_properties
 
   $_simp_manage_firewall = ($manage_firewall and $firewall)
 
diff --git a/manifests/scenario/base.pp b/manifests/scenario/base.pp
index 4cdfa1de..dd4cab66 100644
--- a/manifests/scenario/base.pp
+++ b/manifests/scenario/base.pp
@@ -65,9 +65,6 @@
 # @param sssd
 #   Enable management of SSSD resources via SIMP modules
 #
-# @param ldap
-#   Enable management of LDAP resources via SIMP modules
-#
 # @param stock_sssd
 #   Add a default setup that will successfully connect to the SIMP LDAP server,
 #   if enabled, and will otherwise provide a functional SSSD stack for the
@@ -90,7 +87,6 @@
   Boolean                         $manage_root_perms          = $simp::manage_root_perms,
   Boolean                         $manage_rc_local            = $simp::manage_rc_local,
   Boolean                         $pam                        = $simp::pam,
-  Boolean                         $ldap                       = $simp::ldap,
   Boolean                         $sssd                       = $simp::sssd,
   Boolean                         $stock_sssd                 = $simp::stock_sssd
 ) inherits simp {
diff --git a/manifests/server.pp b/manifests/server.pp
index fa6ef26d..3158dd15 100644
--- a/manifests/server.pp
+++ b/manifests/server.pp
@@ -7,14 +7,6 @@
 # @param pam
 #   Enable SIMP management of the PAM stack
 #
-# @param clamav
-#   Deprecated. Enable SIMP management of Antivirus
-#
-#   This parameter and the simp_options::clamav catalyst are deprecated and
-#   both will be removed in a future SIMP release. Once removed, if you want
-#   to manage ClamAV, you will have to manually include the `clamav` class
-#   from the `simp-clamav` module in the server's class list.
-#
 # @param auditd
 #   Enable SIMP management of auditing
 #
@@ -37,7 +29,6 @@
   Hash[String, Array] $scenario_map,
   Boolean             $allow_simp_user = false,
   Boolean             $pam             = simplib::lookup('simp_options::pam', { 'default_value' => false }),
-  Boolean             $clamav          = simplib::lookup('simp_options::clamav', { 'default_value' => false }),
   Boolean             $auditd          = simplib::lookup('simp_options::auditd', { 'default_value' => false }),
   String              $scenario        = simplib::lookup('simp::scenario', { 'default_value' => 'simp' }),
   Array[String]       $classes         = []
@@ -62,10 +53,6 @@
     fail("ERROR - Invalid scenario '${scenario}' for the given scenario map.")
   }
 
-  # This setting will be removed from future releases of simp.
-  # See the simp-clamav module for information on how manage ClamAV
-  if $clamav { include 'clamav' }
-
   if $auditd { include 'auditd' }
 
   if $allow_simp_user {
diff --git a/manifests/server/kickstart.pp b/manifests/server/kickstart.pp
index 0e8d2018..65798cd4 100644
--- a/manifests/server/kickstart.pp
+++ b/manifests/server/kickstart.pp
@@ -21,15 +21,6 @@
 # @param manage_tftpboot
 #   If true, have this node act as a TFTP server.
 #
-# @param manage_runpuppet
-#   Deprecated  The runpuppet script has been replaced by the
-#   simp_client_bootstrap script.  The runpuppet script did
-#   not work well on CentOS 7 and will not work on CentOS 8.
-#   Remember to update your kickstart scripts to call the correct
-#   script. See the bootstrap scripts in simp-core under build/distributions
-#   for examples.
-#   This parameter will be removed in later versions.
-#
 # @param manage_simp_client_bootstrap
 #   If true, generate the simp_client_bootstrap sysv init
 #   script and simp_client_bootstrap.service systemd
@@ -46,7 +37,6 @@
   Stdlib::Absolutepath   $data_dir                     = '/var/www',
   Boolean                $manage_dhcp                  = true,
   Boolean                $manage_tftpboot              = true,
-  Boolean                $manage_runpuppet             = false,
   Boolean                $manage_simp_client_bootstrap = true,
   Enum['require','none'] $sslverifyclient              = 'none'
 ) {
@@ -54,9 +44,6 @@
 
   if $manage_dhcp { include 'dhcp::dhcpd' }
   if $manage_tftpboot { include 'tftpboot' }
-  if $manage_runpuppet {
-    deprecation('simp::server::manage_runpuppet','simp::server::manage_runpuppet has been deprecated.  Use simp::server::manage_simp_client_bootstrap instead')
-  }
 
   if $manage_simp_client_bootstrap {
     contain 'simp::server::kickstart::simp_client_bootstrap'
diff --git a/manifests/server/rsync_shares.pp b/manifests/server/rsync_shares.pp
index 13ee112b..988ca440 100644
--- a/manifests/server/rsync_shares.pp
+++ b/manifests/server/rsync_shares.pp
@@ -63,14 +63,6 @@
         $_globals_dir   = 'rsync/Global'
         $_global_shares = $rsync_environments[$_env]['rsync']['global']['shares']
 
-        if 'clamav' in $_global_shares {
-          rsync::server::section { "clamav_${_env}":
-            comment     => "ClamAV Virus Database Updates for Environment ${_env}",
-            path        => "${rsync_base}/${_env}/${_globals_dir}/clamav",
-            hosts_allow => $_trusted_nets,
-          }
-        }
-
         if 'mcafee' in $_global_shares {
           rsync::server::section { "mcafee_${_env}":
             comment     => "McAfee DAT files for Environment ${_env}",
diff --git a/manifests/sysctl.pp b/manifests/sysctl.pp
index 7445e439..f7dfa582 100644
--- a/manifests/sysctl.pp
+++ b/manifests/sysctl.pp
@@ -41,9 +41,6 @@
 # @param kernel__core_uses_pid
 # @param kernel__dmesg_restrict
 #
-# @param kernel__exec_shield
-#   **DEPRECATED BY VENDOR WILL BE REMOVED IN NEXT RELEASE**
-#
 # @param kernel__panic
 # @param kernel__randomize_va_space
 # @param kernel__sysrq
@@ -136,7 +133,6 @@
   Integer[0]           $kernel__core_pipe_limit                        = 0,
   Integer[0,1]         $kernel__core_uses_pid                          = 1,
   Integer[0,1]         $kernel__dmesg_restrict                         = 1,          # CCE-27366-4
-  Integer[0,1]         $kernel__exec_shield                            = 1,          # CCE-27007-4
   Integer[0]           $kernel__panic                                  = 10,
   Integer[0,2]         $kernel__randomize_va_space                     = 2,          # CCE-26999-3
   Integer[0]           $kernel__sysrq                                  = 0,
diff --git a/manifests/yum/repo/internet_simp_dependencies.pp b/manifests/yum/repo/internet_simp_dependencies.pp
deleted file mode 100644
index 10ad20b2..00000000
--- a/manifests/yum/repo/internet_simp_dependencies.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-# @summary DEPRECATED Configure yum to use the internet public repositories for SIMP dependencies
-#
-# The packagecloud yum repository that used to be configured by this class is
-# no longer maintained. As an interim workaround, this class now uses
-# ``simp::yum::repo::internet_simp`` to configure the correct repositories. You
-# should switch to using ``simp::yum::repo::internet_simp directly``, as this
-# class will be removed in a future release.
-#
-# @param simp_release_slug
-#   The unique release URL "slug" of SIMP for the target release.
-#
-class simp::yum::repo::internet_simp_dependencies (
-  Optional[String] $simp_release_slug = undef
-) {
-  simplib::module_metadata::assert($module_name, { 'blacklist' => ['Windows'] })
-
-  # TODO remove this class and the function called when the version
-  # of this module is bumped to 5.0.0.
-  warning('simp::yum::repo::internet_simp_dependencies is deprecated and will be removed in the next major release. Please use simp::yum::repo::internet_simp directly instead.')
-
-  $_release_slug = simp::yum::repo::sanitize_simp_release_slug( $simp_release_slug )
-  yumrepo { "simp-project_${_release_slug}_Dependencies": ensure => absent }
-
-  include 'simp::yum::repo::internet_simp'
-}
diff --git a/manifests/yum/repo/internet_simp_server.pp b/manifests/yum/repo/internet_simp_server.pp
deleted file mode 100644
index 70edaa08..00000000
--- a/manifests/yum/repo/internet_simp_server.pp
+++ /dev/null
@@ -1,27 +0,0 @@
-# @summary DEPRECATED Configure yum to use the internet public repository for SIMP servers
-#
-# The packagecloud yum repository that used to be configured by this class is
-# no longer maintained. As an interim workaround, this class now uses
-# ``simp::yum::repo::internet_simp`` to configure the correct repository. You
-# should switch to using ``simp::yum::repo::internet_simp directly``, as this
-# class will be removed in a future release.
-#
-# @param simp_release_slug
-#
-#   The unique release URL "slug" of SIMP for the target release.
-#
-class simp::yum::repo::internet_simp_server (
-  Optional[String] $simp_release_slug  = undef
-) {
-  simplib::module_metadata::assert($module_name, { 'blacklist' => ['Windows'] })
-
-  # TODO remove this class and the function called when the version
-  # of this module is bumped to 5.0.0.
-  #
-  warning('simp::yum::repo::internet_simp_server is deprecated and will be removed in the next major release. Please use simp::yum::repo::internet_simp directly instead.')
-
-  $_release_slug = simp::yum::repo::sanitize_simp_release_slug( $simp_release_slug )
-  yumrepo { "simp-project_${_release_slug}": ensure => absent }
-
-  include 'simp::yum::repo::internet_simp'
-}
diff --git a/metadata.json b/metadata.json
index a4a9dd8e..e93db6cb 100644
--- a/metadata.json
+++ b/metadata.json
@@ -55,14 +55,6 @@
       "name": "simp/auditd",
       "version_requirement": ">= 8.5.0 < 11.0.0"
     },
-    {
-      "name": "simp/chkrootkit",
-      "version_requirement": ">= 0.1.0 < 1.0.0"
-    },
-    {
-      "name": "simp/clamav",
-      "version_requirement": ">= 6.0.0 < 8.0.0"
-    },
     {
       "name": "simp/cron",
       "version_requirement": ">= 0.1.0 < 2.0.0"
@@ -119,10 +111,6 @@
       "name": "simp/simp_apache",
       "version_requirement": ">= 7.0.0 < 9.0.0"
     },
-    {
-      "name": "simp/simp_openldap",
-      "version_requirement": ">= 6.0.0 < 7.0.0"
-    },
     {
       "name": "simp/simp_options",
       "version_requirement": ">= 1.6.1 < 3.0.0"
@@ -151,10 +139,6 @@
       "name": "simp/sudo",
       "version_requirement": ">= 5.1.1 < 7.0.0"
     },
-    {
-      "name": "simp/sudosh",
-      "version_requirement": ">= 6.1.0 < 7.0.0"
-    },
     {
       "name": "simp/svckill",
       "version_requirement": ">= 3.6.1 < 5.0.0"
diff --git a/spec/acceptance/suites/base_apps/base_spec.rb b/spec/acceptance/suites/base_apps/base_spec.rb
index 0f6b1681..5e7d4403 100644
--- a/spec/acceptance/suites/base_apps/base_spec.rb
+++ b/spec/acceptance/suites/base_apps/base_spec.rb
@@ -1,6 +1,6 @@
 require 'spec_helper_acceptance'
 
-test_name 'simp::base_apps and simp::base_services class'
+test_name 'simp::base_apps class'
 
 describe 'simp::base_apps class' do
   let(:hieradata) do
@@ -15,7 +15,6 @@
   let(:manifest) do
     <<~EOS
       include 'simp::base_apps'
-      include 'simp::base_services'
     EOS
   end
 
diff --git a/spec/acceptance/suites/default/05_shell_logger_spec.rb b/spec/acceptance/suites/default/05_shell_logger_spec.rb
index 6a97360b..261e4868 100644
--- a/spec/acceptance/suites/default/05_shell_logger_spec.rb
+++ b/spec/acceptance/suites/default/05_shell_logger_spec.rb
@@ -24,65 +24,9 @@
           it 'has tlog installed' do
             expect(host.check_for_package('tlog')).to be true
           end
-        end
-
-        os_major = fact_on(host, 'os.release.major')
-
-        if os_major == '7'
-          context 'switching to sudosh' do
-            let(:hieradata)  do
-              YAML.load_file(File.expand_path('files/default_hiera.yaml', __dir__)).merge(
-                'simp::admin::logged_shell' => 'sudosh',
-              )
-            end
-
-            it 'switches to sudosh via hiera' do
-              set_hieradata_on(host, hieradata)
-            end
-
-            it 'runs puppet' do
-              apply_manifest_on(host, manifest, catch_changes: false)
-            end
-
-            it 'is idempotent' do
-              apply_manifest_on(host, manifest, catch_changes: true)
-            end
-
-            it 'has sudosh2 installed' do
-              expect(host.check_for_package('sudosh2')).to be true
-            end
-
-            it 'does not have any tlog profile scripts installed' do
-              expect(on(host, 'ls /etc/profile.d/00-simp-tlog.*', accept_all_exit_codes: true).stdout.strip).to be_empty
-            end
-          end
-
-          context 'switching back to tlog' do
-            let(:hieradata)  do
-              YAML.load_file(File.expand_path('files/default_hiera.yaml', __dir__)).merge(
-                'simp::admin::logged_shell' => 'tlog',
-              )
-            end
-
-            it 'switches back to tlog via hiera' do
-              set_hieradata_on(host, hieradata)
-            end
-
-            it 'runs puppet' do
-              apply_manifest_on(host, manifest, catch_changes: false)
-            end
-
-            it 'is idempotent' do
-              apply_manifest_on(host, manifest, catch_changes: true)
-            end
-
-            it 'has tlog installed' do
-              expect(host.check_for_package('sudosh2')).to be true
-            end
 
-            it 'does not have any sudosh profile scripts installed' do
-              expect(on(host, 'ls /etc/profile.d/sudosh*', accept_all_exit_codes: true).stdout.strip).to be_empty
-            end
+          it 'does not have any sudosh profile scripts installed' do
+            expect(on(host, 'ls /etc/profile.d/sudosh*', accept_all_exit_codes: true).stdout.strip).to be_empty
           end
         end
       end
diff --git a/spec/acceptance/suites/default/files/default_hiera.yaml b/spec/acceptance/suites/default/files/default_hiera.yaml
index 886c397e..75e01309 100644
--- a/spec/acceptance/suites/default/files/default_hiera.yaml
+++ b/spec/acceptance/suites/default/files/default_hiera.yaml
@@ -12,7 +12,6 @@ simp_options::ldap::root_hash: '{SSHA}foobarbaz!!!!'
 simp::scenario: simp
 simp_options::ldap: false
 simp_options::rsync: false
-simp_options::clamav: false
 simp_options::pki: true
 simp_options::pki::source: '/etc/pki/simp-testing/pki'
 simp_options::trusted_nets: ['0.0.0.0/0']
diff --git a/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb b/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb
index ebe3965c..2c4c72a9 100644
--- a/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb
+++ b/spec/acceptance/suites/scenario_one_shot/00_simp_spec.rb
@@ -53,7 +53,6 @@ def wait_for_finalize(host, timeout = 500)
 
       # Disable network stuff
       simp_options::rsync: false
-      simp_options::clamav: false
       simp_options::ldap: false
 
       # Enable everything else
diff --git a/spec/classes/00_classes/admin_spec.rb b/spec/classes/00_classes/admin_spec.rb
index 8e1509ad..893124b3 100644
--- a/spec/classes/00_classes/admin_spec.rb
+++ b/spec/classes/00_classes/admin_spec.rb
@@ -87,7 +87,6 @@
               end
 
               it { is_expected.to create_class('tlog::rec_session') }
-              it { is_expected.not_to create_class('sudosh') }
 
               it {
                 is_expected.to create_sudo__user_specification('admin global').with(
@@ -98,25 +97,6 @@
               }
             end
 
-            context 'when setting sudosh as the logged shell' do
-              let(:params) do
-                {
-                  logged_shell: 'sudosh',
-                }
-              end
-
-              it { is_expected.to create_class('sudosh') }
-              it { is_expected.not_to create_class('tlog::rec_session') }
-
-              it {
-                is_expected.to create_sudo__user_specification('admin global').with(
-                  user_list: ['%administrators'],
-                  cmnd: ['/usr/bin/sudosh'],
-                  passwd: false,
-                )
-              }
-            end
-
             context 'with admin and auditor settings' do
               let(:params) do
                 {
diff --git a/spec/classes/00_classes/base_services_spec.rb b/spec/classes/00_classes/base_services_spec.rb
deleted file mode 100644
index 2c19c9d1..00000000
--- a/spec/classes/00_classes/base_services_spec.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-require 'spec_helper'
-
-describe 'simp::base_services' do
-  context 'supported operating systems' do
-    on_supported_os.each do |os, os_facts|
-      context "on #{os}" do
-        let(:facts) { os_facts }
-
-        if os_facts[:kernel] == 'windows'
-          it { expect { is_expected.to compile.with_all_deps }.to raise_error(%r{'windows .+' is not supported}) }
-        else
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to create_class('simp::base_apps') }
-        end
-      end
-    end
-  end
-end
diff --git a/spec/classes/00_classes/puppetdb_spec.rb b/spec/classes/00_classes/puppetdb_spec.rb
index e9550307..b8725da5 100644
--- a/spec/classes/00_classes/puppetdb_spec.rb
+++ b/spec/classes/00_classes/puppetdb_spec.rb
@@ -139,22 +139,6 @@
             }
           end
 
-          context 'with read_database_ssl = true' do
-            let(:hieradata) { 'simp__puppetdb' }
-            let(:params) { { read_database_ssl: true } }
-
-            it { is_expected.to compile.with_all_deps }
-            it { is_expected.to contain_class('puppetdb').with_read_database_jdbc_ssl_properties('?ssl=true') }
-          end
-
-          context 'with read_database_ssl = false' do
-            let(:hieradata) { 'simp__puppetdb' }
-            let(:params) { { read_database_ssl: false } }
-
-            it { is_expected.to compile.with_all_deps }
-            it { is_expected.to contain_class('puppetdb').with_read_database_jdbc_ssl_properties('') }
-          end
-
           context 'with use_puppet_ssl_certs => false' do
             let(:hieradata) { 'simp__puppetdb' }
             let(:params) do
diff --git a/spec/classes/00_classes/yum/repo/internet_simp_dependencies_spec.rb b/spec/classes/00_classes/yum/repo/internet_simp_dependencies_spec.rb
deleted file mode 100644
index 06c38b3e..00000000
--- a/spec/classes/00_classes/yum/repo/internet_simp_dependencies_spec.rb
+++ /dev/null
@@ -1,65 +0,0 @@
-require 'spec_helper'
-
-describe 'simp::yum::repo::internet_simp_dependencies' do
-  let(:metadata_json) do
-    metadata_file = File.expand_path(File.join(__dir__, '..', '..', '..', '..', '..', 'metadata.json'))
-    File.read(metadata_file, encoding: 'utf-8')
-  end
-
-  on_supported_os.each do |os, os_facts|
-    before(:each) do
-      metadata = metadata_json
-      Puppet::Parser::Functions.newfunction(:load_module_metadata, type: :rvalue) { |_args| JSON.parse(metadata) }
-    end
-
-    context "on #{os}" do
-      let(:facts) { os_facts }
-
-      if os_facts[:kernel] == 'windows'
-        it { expect { is_expected.to compile.with_all_deps }.to raise_error(%r{'windows .+' is not supported}) }
-      else
-        context 'when the `simp_release_slug` parameter is specified' do
-          let(:params) { { simp_release_slug: '5_X' } }
-
-          let(:pre_condition) do
-            "function simplib::simp_version() { '5.3.0' }"
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to contain_yumrepo('simp-project_5_X_Dependencies').with_ensure('absent') }
-          it { is_expected.to create_class('simp::yum::repo::internet_simp') }
-        end
-
-        context 'when `simp_release_slug` is undef' do
-          ['4.0.0', 'unknown', ''].each do |version|
-            context "when `simplib::simp_version() returns an unsupported value (#{version})" do
-              let(:params) { {} }
-
-              let(:pre_condition) do
-                "function simplib::simp_version() { '#{version}' }"
-              end
-
-              it do
-                is_expected.to raise_error(%r{SIMP})
-              end
-            end
-          end
-
-          ['6.0.0', '6.1.0-0'].each do |version|
-            describe "when `simplib::simp_version() is valid (#{version})" do
-              let(:params) { {} }
-
-              let(:pre_condition) do
-                "function simplib::simp_version() { '#{version}' }"
-              end
-
-              it { is_expected.to compile.with_all_deps }
-              it { is_expected.to contain_yumrepo('simp-project_6_X_Dependencies').with_ensure('absent') }
-              it { is_expected.to create_class('simp::yum::repo::internet_simp') }
-            end
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/spec/classes/00_classes/yum/repo/internet_simp_server_spec.rb b/spec/classes/00_classes/yum/repo/internet_simp_server_spec.rb
deleted file mode 100644
index da5c7cea..00000000
--- a/spec/classes/00_classes/yum/repo/internet_simp_server_spec.rb
+++ /dev/null
@@ -1,65 +0,0 @@
-require 'spec_helper'
-
-describe 'simp::yum::repo::internet_simp_server' do
-  let(:metadata_json) do
-    metadata_file = File.expand_path(File.join(__dir__, '..', '..', '..', '..', '..', 'metadata.json'))
-    File.read(metadata_file, encoding: 'utf-8')
-  end
-
-  on_supported_os.each do |os, os_facts|
-    before(:each) do
-      metadata = metadata_json
-      Puppet::Parser::Functions.newfunction(:load_module_metadata, type: :rvalue) { |_args| JSON.parse(metadata) }
-    end
-
-    context "on #{os}" do
-      let(:facts) { os_facts }
-
-      if os_facts[:kernel] == 'windows'
-        it { expect { is_expected.to compile.with_all_deps }.to raise_error(%r{'windows .+' is not supported}) }
-      else
-        context 'when the `simp_release_slug` parameter is specified' do
-          let(:params) { { simp_release_slug: '5_X' } }
-
-          let(:pre_condition) do
-            "function simplib::simp_version() { '5.3.0' }"
-          end
-
-          it { is_expected.to compile.with_all_deps }
-          it { is_expected.to contain_yumrepo('simp-project_5_X').with_ensure('absent') }
-          it { is_expected.to create_class('simp::yum::repo::internet_simp') }
-        end
-
-        context 'when `simp_release_slug` is undef' do
-          ['4.0.0', 'unknown', ''].each do |version|
-            context "when `simplib::simp_version() returns an unsupported value (#{version})" do
-              let(:params) { {} }
-
-              let(:pre_condition) do
-                "function simplib::simp_version() { '#{version}' }"
-              end
-
-              it do
-                is_expected.to raise_error(%r{SIMP})
-              end
-            end
-          end
-
-          ['6.0.0', '6.1.0-0'].each do |version|
-            describe "when `simplib::simp_version() is valid (#{version})" do
-              let(:params) { {} }
-
-              let(:pre_condition) do
-                "function simplib::simp_version() { '#{version}' }"
-              end
-
-              it { is_expected.to compile.with_all_deps }
-              it { is_expected.to contain_yumrepo('simp-project_6_X').with_ensure('absent') }
-              it { is_expected.to create_class('simp::yum::repo::internet_simp') }
-            end
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/spec/classes/10_classes/server/rsync_shares_spec.rb b/spec/classes/10_classes/server/rsync_shares_spec.rb
index 3f872e49..d29947f9 100644
--- a/spec/classes/10_classes/server/rsync_shares_spec.rb
+++ b/spec/classes/10_classes/server/rsync_shares_spec.rb
@@ -42,7 +42,7 @@
 
           it { is_expected.to compile.with_all_deps }
           it { is_expected.to create_class('simp::server::rsync_shares') }
-          it { is_expected.to create_rsync__server__section("clamav_#{environment}") }
+          it { is_expected.not_to create_rsync__server__section("clamav_#{environment}") }
           it { is_expected.to create_rsync__server__section("mcafee_#{environment}") }
           it { is_expected.to create_rsync__server__section("jenkins_plugins_#{environment}") }
           it { is_expected.to create_rsync__server__section("bind_dns_default_#{environment}_RedHat_7") }
@@ -89,7 +89,7 @@
 
             it { is_expected.to compile.with_all_deps }
             it { is_expected.to create_class('simp::server::rsync_shares') }
-            it { is_expected.to create_rsync__server__section("clamav_#{environment}") }
+            it { is_expected.not_to create_rsync__server__section("clamav_#{environment}") }
             it { is_expected.not_to create_rsync__server__section("mcafee_#{environment}") }
             it { is_expected.not_to create_rsync__server__section("jenkins_plugins_#{environment}") }
             it { is_expected.to create_rsync__server__section("bind_dns_default_#{environment}_RedHat_7") }
diff --git a/spec/classes/10_classes/server_spec.rb b/spec/classes/10_classes/server_spec.rb
index f5c6f41a..3735ec6a 100644
--- a/spec/classes/10_classes/server_spec.rb
+++ b/spec/classes/10_classes/server_spec.rb
@@ -68,7 +68,6 @@
               'timezone',
               'simp::admin',
               'simp::base_apps',
-              'simp::base_services',
               'simp::kmod_blacklist',
               'simp::mountpoints',
               'simp::prelink',
diff --git a/spec/classes/20_classes/init_spec.rb b/spec/classes/20_classes/init_spec.rb
index 00272aab..56c95ff6 100644
--- a/spec/classes/20_classes/init_spec.rb
+++ b/spec/classes/20_classes/init_spec.rb
@@ -171,7 +171,6 @@ def self.unsupported_os_with_facts
               'timezone',
               'simp::admin',
               'simp::base_apps',
-              'simp::base_services',
               'simp::kmod_blacklist',
               'simp::mountpoints',
               'simp::prelink',
@@ -349,18 +348,8 @@ def server_facts_hash
               )
             end
 
-            context 'ldap => true' do
-              let(:params) { { ldap: true } }
-
-              it { is_expected.to compile.with_all_deps }
-              it { is_expected.not_to contain_class('simp_openldap::client') }
-            end
-            context 'ldap => false' do
-              let(:params) { { ldap: false } }
-
-              it { is_expected.to compile.with_all_deps }
-              it { is_expected.not_to contain_class('simp_openldap::client') }
-            end
+            it { is_expected.to compile.with_all_deps }
+            it { is_expected.not_to contain_class('simp_openldap::client') }
           end
         end
       end