# Ensure 'Remote Desktop Services (TermService)' is set to 'Disabled'

Necessity: Remote Desktop Services (RDP) is a primary vector for remote attacks, including brute-force password guessing, credential theft, and exploitation of vulnerabilities. If RDP is not explicitly required for business operations, disabling it is a critical security measure to significantly reduce the system's attack surface and prevent unauthorized remote access.

Auditing and Remediation: The audit script checks the startup configuration of the 'TermService' to determine if it is enabled or disabled. The remediation script directly modifies the service's startup type using the 'Set-Service' cmdlet, ensuring the service does not start automatically on system boot.

Recommended State Rationale: 
- Basic: ['Disabled']. This is the fundamental recommendation. Services that provide remote access should be disabled by default to adhere to the principle of least functionality.
- Moderate: ['Disabled']. There is no 'moderate' state for a high-risk service like RDP. If it is not needed, it must be disabled. If it is needed, its security should be managed through other controls like firewalls, VPNs, and strong authentication, not by leaving the service in a 'Manual' state.
- Strict: ['Disabled']. In a strict security environment, any non-essential service, especially one as frequently targeted as RDP, must be disabled to minimize potential compromise.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to retrieve the startup type of the 'TermService' (Remote Desktop Services). The script must only return the current startup type string (e.g., 'Disabled', 'Automatic', 'Manual') with no additional text or labels.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument for the desired startup type (e.g., 'Disabled'). The script must set the startup type for the 'TermService' (Remote Desktop Services) to the provided value. The script must return $true on success and $false on failure.

