# Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled'

Necessity: The Remote Registry service allows remote users to connect to and modify the Windows Registry. This presents a significant security risk, as it can be exploited by attackers to manipulate system configurations, disable security controls, install malware, or achieve persistence. Disabling this service significantly reduces the system's attack surface by closing a common vector for lateral movement and remote exploitation. For routine administrative tasks, more secure alternatives like PowerShell Remoting or other management tools should be used. Auditing and Remediation: The audit script checks the current 'Startup Type' of the 'RemoteRegistry' service to determine if it is enabled. The remediation script modifies this setting using the Set-Service cmdlet, changing the startup type to 'Disabled' to prevent the service from being started. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. There is no secure use case for leaving this service enabled on a standard client endpoint or server without specific, justified operational requirements. Its functionality is too powerful and too frequently abused by malicious actors to be left active. This recommendation aligns with established security benchmarks, including those from CIS and DISA STIGs, which universally advise disabling the service to enhance system security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the start-up type for the 'RemoteRegistry' service. The script must output only the current start-up type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the start-up type for the 'RemoteRegistry' service. The script must accept the desired start-up type (e.g., 'Disabled') as a single command-line argument. The script must return `$true` if the operation is successful and `$false` if it fails.

