# Ensure 'Remote Desktop Services (TermService)' is set to 'Disabled'

Necessity: The Remote Desktop Protocol (RDP) is a primary vector for external and internal attacks. Adversaries frequently scan for and target exposed RDP services to gain initial access to networks, perform lateral movement, and deploy ransomware. Leaving the Remote Desktop Services enabled when not explicitly required creates a significant and unnecessary security risk. Misconfiguration can lead to brute-force password attacks, credential theft, and exploitation of RDP-related vulnerabilities.\n\nAuditing and Remediation: The audit script checks the startup configuration of the 'TermService' service to determine if it is enabled. The remediation script modifies the service's startup type to 'Disabled', preventing it from being started automatically or manually, thereby closing the potential attack vector.\n\nRecommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary security control; the service should be disabled unless there is a compelling and documented business requirement. \n- Basic: Recommends 'Disabled' as the default secure state, adhering to the principle of least functionality.\n- Moderate: Reinforces the 'Disabled' state, as any other configuration ('Manual' or 'Automatic') presents an unacceptable risk for systems that do not require remote desktop access.\n- Strict: Mandates the 'Disabled' state as the only acceptable configuration to ensure the attack surface is minimized to the greatest extent possible.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the current start type of the 'Remote Desktop Services' (TermService) service. The script must output only the string value of the start type (e.g., 'Disabled', 'Automatic', 'Manual'), with no extra text or labels.

## Remediation Script Working

PowerShell script that sets the startup type for the 'Remote Desktop Services' (TermService) service. The script must accept one positional command-line argument for the desired startup type (e.g., 'Disabled'). The script must return `$true` on success and `$false` on failure.

