# Ensure 'Simple TCP/IP Services (simptcp)' is set to 'Disabled' or 'Not Installed'

Necessity: The Simple TCP/IP Services are a collection of legacy, optional services (like Echo, Discard, and Quote of the Day) that are unauthenticated and rarely used in modern environments. These services can be exploited for network reconnaissance and used in denial-of-service (DoS) amplification attacks. Leaving them enabled unnecessarily increases the system's attack surface and exposes it to well-known vulnerabilities.

Auditing and Remediation: The audit script verifies whether the 'Simple TCIP/IP Services' optional Windows feature is installed, and if so, whether the 'simptcp' service is disabled. The remediation script takes action to either disable the service or, more securely, to uninstall the feature entirely from the operating system.

Recommended State Rationale:
- Basic: ['Disabled', 'Not Installed'] - This represents the minimum acceptable security posture. Disabling the service prevents it from starting automatically, which mitigates the most immediate risk of it being actively exploited. This is a sufficient baseline for compliance.
- Moderate: ['Not Installed'] - A more robust security stance is to uninstall the feature completely. This aligns with the principle of least functionality. While disabling the service is effective, removing the underlying binaries ensures it cannot be started accidentally or maliciously.
- Strict: ['Not Installed'] - For any high-security environment, complete removal of unnecessary and insecure legacy components is mandatory. There is no security advantage to keeping the feature installed but disabled. Uninstalling it is the most definitive way to eliminate the associated risk.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that checks the status of the 'Simple TCP/IP Services' feature. First, it must use `Get-WindowsOptionalFeature -Online -FeatureName SimpleTCPServices`. If the 'State' property of the result is 'Disabled', the script must return the string 'Not Installed'. If the 'State' is 'Enabled', the script must then use `Get-Service -Name simptcp` to check the service's startup type. If the `StartType` is 'Disabled', it must return 'Disabled'; otherwise, it must return 'Enabled'. The script's output must exclusively be one of these three strings with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired state ('Disabled' or 'Not Installed'). If the argument is 'Disabled', the script must use `Set-Service -Name simptcp -StartupType Disabled` and `Stop-Service -Name simptcp -Force` to configure the service. If the argument is 'Not Installed', the script must use `Disable-WindowsOptionalFeature -Online -FeatureName SimpleTCPServices -NoRestart` to remove the feature. The script must return `$true` on success and `$false` on failure, including if the service or feature does not exist to be changed.

