# Ensure 'Windows Remote Management (WS Management) (WinRM)' is set to 'Disabled'

The Windows Remote Management (WinRM) service is the Microsoft implementation of the WS-Management Protocol, enabling remote management of servers and clients. While essential for certain administrative tasks, it can also be a significant attack vector if not properly secured. Threat actors can exploit WinRM to move laterally across a network and execute code remotely. Disabling the service when it is not explicitly required is a critical step in reducing the system's attack surface. The audit script verifies the current startup type of the 'WinRM' service. The remediation script changes this startup type to the value provided as an argument. The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This follows the principle of least functionality; the service should be disabled by default and only enabled when there is a clear, documented, and secured operational requirement. There is no intermediate security state for this service; it is either needed and enabled, or not needed and disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the startup type of the 'WinRM' service. The script must be designed to return only the current string value of the 'StartType' property (e.g., 'Disabled', 'Automatic', 'Manual'), with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument to set the startup type for the 'Windows Remote Management (WS-Management)' service (service name 'WinRM'). The script must use this argument to configure the service's startup type and must return '$true' upon successful configuration or '$false' if the operation fails.

