# Ensure 'Routing and Remote Access (RemoteAccess)' is set to 'Disabled'

Necessity: The Routing and Remote Access service (RRAS) allows a computer to function as a network router, providing services like NAT, VPN, and dial-up remote access. If this functionality is not explicitly required, the service provides an unnecessary and significant attack surface. A misconfigured or vulnerable RRAS could allow an attacker to gain unauthorized network access, bypass network segmentation controls, or pivot to other systems. Disabling it adheres to the principle of least functionality, reducing the system's exposure to potential threats. Auditing and Remediation: The audit script verifies the current startup type of the 'RemoteAccess' service. The remediation script modifies this startup type to the desired state, ensuring the service does not run unless explicitly changed. Recommended State Rationale: Basic, Moderate, and Strict are all set to 'Disabled'. For this service, the security posture is binary; it is either required for a specific business function or it is not. If not required, it must be disabled to minimize the attack surface. There is no intermediate 'moderately secure' state for an unnecessary network routing service. This aligns with security benchmarks like CIS, which universally recommend disabling this service on systems where it is not performing a dedicated routing function.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the StartType property of the 'RemoteAccess' service. The script must only output the current value (e.g., 'Disabled', 'Automatic').

## Remediation Script Working

PowerShell script that sets the StartType for the 'RemoteAccess' service. The script must accept the desired state (e.g., 'Disabled') as a single command-line argument. It must return $true on success and $false on failure.

