# Ensure 'Windows Remote Management (WS Management) (WinRM)' is set to 'Disabled'

Necessity: The Windows Remote Management (WinRM) service is the Microsoft implementation of the WS-Management Protocol, which allows for remote management and execution of scripts on a system. If enabled, it creates a listener that can be exploited by attackers to move laterally across a network, execute malicious code, and escalate privileges. Disabling this service significantly reduces the remote attack surface of the operating system, especially for client endpoints where remote administration is not a standard requirement. Auditing and Remediation: The audit script checks the configured startup type of the 'WinRM' service to determine if it is enabled. The remediation script modifies the service's startup type to 'Disabled', preventing it from starting automatically or manually, thereby securing the management endpoint. Recommended State Rationale: The recommendation is consistently 'Disabled' across all security levels (Basic, Moderate, and Strict). This is a binary security control; the service is either a necessary, audited component of an enterprise management solution, or it is an unnecessary risk. For a general security hardening baseline, disabling it is the most effective way to mitigate the associated threats. There is no 'moderately secure' state for this service; enabling it in any capacity (Manual or Automatic) exposes the system to potential compromise if not properly secured with strong authentication, encryption, and network segmentation.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'Windows Remote Management (WS-Management)' service. The script must only output the current startup type string (e.g., 'Disabled', 'Manual', 'Automatic') and nothing else. Use the command `(Get-Service -Name WinRM).StartType` to get the value.

## Remediation Script Working

PowerShell script that sets the startup type for the 'Windows Remote Management (WS-Management)' service. The script must accept a single positional command-line argument for the desired state (e.g., 'Disabled'). The script must return `$true` upon successful configuration and `$false` upon failure. Use a try/catch block around the `Set-Service -Name WinRM -StartupType $args[0]` command to handle success and failure.

