# Ensure 'Windows Mobile Hotspot Service (icssvc)' is set to 'Disabled'

Necessity: The Windows Mobile Hotspot Service allows a computer to share its network connection, effectively turning it into a wireless access point. If enabled, it can create an unauthorized backdoor into a secure corporate network, bypassing firewalls, proxies, and other perimeter security controls. This exposes the internal network to potential attacks and creates an unmonitored data exfiltration path, posing a significant security risk. Disabling this service is critical to maintaining network integrity and reducing the system's attack surface. Auditing and Remediation: The audit script queries the Windows Service Control Manager to determine the current startup type of the 'icssvc' service. The remediation script modifies this setting using the 'Set-Service' cmdlet to change the startup type to the value provided as an argument, ensuring it does not start automatically. Recommended State Rationale: The recommended state for all levels (Basic, Moderate, and Strict) is 'Disabled'. In a managed enterprise environment, there is rarely a legitimate business need for an endpoint to function as a wireless hotspot. The security risks associated with this functionality far outweigh any potential benefits. Therefore, to enforce the principle of least privilege and maintain a hardened security posture, the service should be disabled under all circumstances.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'icssvc' service. The script must only output the current startup type string (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'icssvc' service. The script must accept a single positional command-line argument for the desired state (e.g., 'Disabled'). The script must return $true upon successful configuration and $false on failure.

