# Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled

Necessity: The Windows Event Collector (Wecsvc) service manages persistent subscriptions to events from remote sources that support the WS-Management protocol. If the system is not designated as a central event log collector, this service is unnecessary. Disabling unused services is a critical security best practice as it reduces the system's attack surface, minimizes resource consumption, and limits potential vectors for malware or attackers to exploit.

Auditing and Remediation: The audit script checks the configured startup type for the 'Wecsvc' service to determine if it is enabled or disabled. The remediation script directly modifies the service's startup type to the desired state, typically 'Disabled', to enforce the security policy.

Recommended State Rationale: The recommendation is consistently 'Disabled' across all levels because the service provides a very specific function. 
- Basic: Recommends 'Disabled' as per security hardening baselines (e.g., CIS Benchmarks) for systems not acting as event collectors. This is the fundamental step to reduce the attack surface. 
- Moderate: The state remains 'Disabled'. There is no intermediate secure configuration for this service; it is either needed for its specific role or it is not. 
- Strict: In a high-security environment, disabling all non-essential services is paramount. The 'Wecsvc' service is considered non-essential for the vast majority of endpoints and servers, making 'Disabled' the only acceptable state for a strictly hardened system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'Windows Event Collector (Wecsvc)' service. The script must only output the current startup type (e.g., 'Disabled', 'Manual', 'Automatic').

## Remediation Script Working

PowerShell script that sets the startup type for the 'Windows Event Collector (Wecsvc)' service. The script must accept a single command-line argument for the desired startup type (e.g., 'Disabled'). The script must return `$true` upon successful configuration and `$false` upon failure.

