# Ensure 'Windows PushToInstall Service (PushToInstall)' is set to 'Disabled'

The 'Windows PushToInstall Service' allows the Microsoft Store to remotely initiate the installation of applications on your devices. Disabling this service is crucial for security as it reduces the system's attack surface by preventing a potential vector for unauthorized or malicious software installations. An attacker or a compromised Microsoft account could otherwise potentially push unwanted applications to a device. The audit script verifies the current startup type of the 'PushToInstall' service, while the remediation script directly modifies this setting. A state of 'Disabled' is recommended for all security levels (Basic, Moderate, and Strict) because the functionality is non-essential for core operating system tasks and its deactivation provides a clear security benefit with minimal impact on typical enterprise users. There is no more secure configuration than disabling it entirely.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'PushToInstall' service. The script must only output the current startup type string (e.g., 'Disabled', 'Auto', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'PushToInstall' service. The script must accept one positional argument: the desired startup type (e.g., 'Disabled', 'Automatic', 'Manual'). The script must return $true upon successful configuration and $false if it fails.

