# Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled'

Necessity: The Universal Plug and Play (UPnP) service allows devices on a network to automatically discover each other and establish network services. While convenient, UPnP is a significant security risk. It has numerous documented vulnerabilities that can be exploited by malware to open firewall ports, redirect traffic, and expose internal network devices to external threats, effectively bypassing perimeter security. Disabling this service is critical to reducing the system's attack surface and preventing unauthorized network access and control. Auditing and Remediation: The audit script verifies the current startup configuration of the 'upnphost' service. The remediation script modifies this configuration by setting the service's startup type to 'Disabled', preventing it from running automatically or being started manually without administrative intervention. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict security postures is uniformly 'Disabled'. The security risks associated with UPnP far outweigh its benefits in a managed enterprise environment. There is no secure middle ground for this service; it should be disabled by default unless an explicit, vetted operational requirement exists. This single state recommendation aligns with security best practices from organizations like CIS and DISA, which advocate for minimizing services to harden the operating system.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'UPnP Device Host' (upnphost) service. The script must only output the current startup type string (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'UPnP Device Host' (upnphost) service. The script must accept a single positional argument for the desired startup type (e.g., 'Disabled'). It must return `$true` upon successful configuration and `$false` if it fails.

