# Ensure 'Remote Desktop Configuration (SessionEnv)' is set to 'Disabled'

The 'Remote Desktop Configuration' (SessionEnv) service is responsible for all Remote Desktop Services and Remote Desktop configuration and session maintenance activities. Disabling this service is crucial for systems that do not require Remote Desktop access, as it reduces the system's attack surface. An enabled service could potentially be exploited by an attacker to gain unauthorized access or manipulate session settings. The audit script verifies the current startup type of the 'SessionEnv' service, while the remediation script sets it to the desired state. For all security levels (Basic, Moderate, and Strict), the recommended state is 'Disabled'. This follows the principle of least functionality; if a service is not explicitly required for the system's function, it should be disabled to minimize potential security vulnerabilities.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'Remote Desktop Configuration' (SessionEnv) service. The script must output only the string value of the current startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired startup type for the 'Remote Desktop Configuration' (SessionEnv) service. The script must apply this setting and output '$true' on success or '$false' on failure.

