# Ensure 'Web Management Service (WMSvc)' is set to 'Disabled' or 'Not Installed'

The Web Management Service (WMSvc) is used for remote management of Internet Information Services (IIS). If this service is not required for administrative purposes, it should be disabled or uninstalled to reduce the system's attack surface. An unnecessary running service can provide an entry point for attackers to exploit potential vulnerabilities. Misconfiguration could allow unauthorized remote administration of the web server, leading to data breaches or system compromise. The audit script checks the startup type of the 'WMSvc' service, handling the case where it is not installed. The remediation script uses the 'Set-Service' cmdlet to change the startup type to the desired state. The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Disabled' or 'Not Installed' because there is no secure intermediate configuration; if the service is not explicitly required for remote IIS management, it poses an unnecessary security risk and should be completely inactive.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Disabled', 'Not Installed']` |
| **Strict** | `['Disabled', 'Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to determine the status of the 'Web Management Service (WMSvc)'. If the service does not exist, the script must output 'Not Installed'. Otherwise, it must output the service's current start type (e.g., 'Disabled', 'Automatic'). The script should return only the status string, with no extra text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument to configure the 'Web Management Service (WMSvc)'. If the service is installed, the script must set its start type to the value provided in the argument. If the service is not installed, the script should take no action but still be considered successful. The script must output '$true' on success and '$false' on failure.

