# Ensure 'Windows Mobile Hotspot Service (icssvc)' is set to 'Disabled'

Necessity: The Windows Mobile Hotspot Service allows a computer to share its network connection, effectively turning it into a wireless access point. In a corporate environment, this can create an unauthorized network path that bypasses perimeter security controls like firewalls and network access control (NAC). An attacker could exploit this to gain unauthorized access to the internal network or exfiltrate data. Disabling this service is crucial to reduce the system's attack surface and prevent the creation of rogue wireless networks. Auditing and Remediation: The audit script checks the 'StartupType' property of the 'icssvc' service to determine its current configuration. The remediation script uses the 'Set-Service' cmdlet to modify this startup type, effectively disabling the service from starting automatically or manually. Recommended State Rationale: The recommended state for all security levels (Basic, Moderate, and Strict) is 'Disabled'. This service provides functionality that is rarely required in a managed enterprise environment and introduces significant security risks. There is no secure scenario where this service should be enabled on a typical corporate endpoint. Therefore, the only acceptable configuration is to disable it entirely to enforce a strong security posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'icssvc' (Windows Mobile Hotspot Service). The script must output only the string representing the current startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument for the desired startup type (e.g., 'Disabled'). The script must configure the 'icssvc' (Windows Mobile Hotspot Service) with the provided startup type and output '$true' on success or '$false' on failure.

