# Ensure 'SNMP Service (SNMP)' is set to 'Disabled' or 'Not Installed'

The Simple Network Management Protocol (SNMP) is a legacy protocol used for network device management. Versions 1 and 2c are notoriously insecure, transmitting data, including authentication credentials (community strings), in cleartext. This exposes the system to information disclosure, unauthorized access, and potential denial-of-service attacks. Disabling or removing the SNMP service is critical to mitigate these vulnerabilities unless it is explicitly required and configured securely with SNMPv3.

The audit script verifies the status of the 'SNMP' service, returning its startup type ('Disabled', 'Automatic', etc.) or 'Not Installed' if the feature is not present. The remediation script configures the service's startup type to the desired state, typically 'Disabled', to prevent it from running.

The recommended states are justified as follows:
- **Basic & Moderate:** ['Disabled', 'Not Installed']. This is the baseline recommendation from security benchmarks like CIS. Disabling the service prevents it from starting automatically, which effectively mitigates the risk for most systems where it is not actively used. This state is sufficient for both basic and moderate hardening.
- **Strict:** ['Not Installed']. The most secure configuration is to have the service completely uninstalled. A disabled service could be maliciously or accidentally re-enabled. Removing the feature entirely eliminates the attack surface, ensuring the system cannot be exploited via SNMP vulnerabilities.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Disabled', 'Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that checks the startup type of the 'SNMP' service. If the service is not installed, the script must return the string 'Not Installed'. If it is installed, it must return its startup type (e.g., 'Disabled', 'Automatic'). The output must only be the status string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional string argument specifying the desired state (e.g., 'Disabled'). The script must set the startup type of the 'SNMP' service to this value. If the service is not installed, the script should consider the action successful as the desired state is met. The script must return the boolean value $true on success and $false on failure.

