# Ensure 'Internet Connection Sharing (ICS)  (SharedAccess)' is set to 'Disabled'

Necessity: The Internet Connection Sharing (ICS) service allows a computer to act as a network address translation (NAT) gateway, sharing its network connection with other devices. When enabled on a corporate workstation, it can create an unauthorized network bridge, effectively bypassing perimeter firewalls and other network security controls. This turns the workstation into an unmanaged router, potentially exposing the internal network to external threats, facilitating data exfiltration, or allowing attackers to pivot into the network. Disabling this service is critical to prevent the creation of such insecure, ad-hoc networks.

Auditing and Remediation: The audit script verifies the current configuration by querying the startup type of the 'SharedAccess' service. The remediation script alters this configuration by setting the startup type to the value provided as an argument, ensuring the service does not start automatically or manually.

Recommended State Rationale: The recommendation is consistently 'Disabled' across all security levels (Basic, Moderate, and Strict) because the functionality provided by ICS is almost never appropriate for a managed endpoint in a corporate environment. Any state other than 'Disabled' presents an unnecessary and significant security risk. There is no legitimate 'less secure' use case for this service on a standard user workstation; therefore, the only acceptable configuration from a security standpoint is to ensure it is completely disabled.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'SharedAccess' service. The script must output only the string value of the current startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single command-line argument representing the desired startup type for the 'SharedAccess' service (e.g., 'Disabled'). The script must use this argument to configure the service's startup type and must return '$true' upon successful completion or '$false' if it fails.

