# Ensure 'Remote Desktop Configuration (SessionEnv)' is set to 'Disabled'

The 'Remote Desktop Configuration' (SessionEnv) service is responsible for activities related to Remote Desktop Services configuration. If Remote Desktop is not used on the system, this service provides no essential function and should be disabled to reduce the system's attack surface. Minimizing the number of running services is a fundamental security best practice, as it limits potential vectors for exploitation. The audit script checks the current startup type of the 'SessionEnv' service. The remediation script sets its startup type to the desired state. The recommended state for all security levels (Basic, Moderate, and Strict) is 'Disabled', as there is no intermediate secure configuration for an unnecessary service. If the service is not required for business operations, it should be disabled to enforce the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the startup type of the 'Remote Desktop Configuration' (SessionEnv) service. The script must output only the string value representing the current state (e.g., 'Disabled', 'Automatic', 'Manual'), with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument for the desired startup type (e.g., 'Disabled'). The script must configure the 'SessionEnv' service with the provided state and output the boolean value `$true` upon success or `$false` upon failure.

