# Ensure 'Internet Connection Sharing (ICS)  (SharedAccess)' is set to 'Disabled'

Necessity: The 'Internet Connection Sharing (ICS)' service allows a computer to act as a router and Network Address Translation (NAT) device, sharing its network connection with other devices. When enabled on a corporate endpoint, it can create an unauthorized network bridge, bypassing perimeter security controls like firewalls and intrusion detection systems. This creates a significant vulnerability by potentially exposing the internal corporate network to untrusted external networks, leading to unauthorized access and data breaches.

Auditing and Remediation: The audit script checks the startup type of the 'SharedAccess' Windows service to determine if it is enabled. The remediation script modifies the service's configuration to set its startup type to 'Disabled' and ensures the service is stopped, effectively preventing it from being used.

Recommended State Rationale: The recommendation for Basic, Moderate, and Strict levels is uniformly 'Disabled'. This is because enabling ICS on any endpoint in a managed environment is considered a high-risk configuration. There is no secure middle ground; the service either presents a security risk by being enabled or the risk is mitigated by being disabled. Therefore, security benchmarks like CIS universally recommend disabling this service unless there is an explicit and heavily scrutinized business requirement for it.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the startup type of the 'SharedAccess' service. The script must return only the current startup type string (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single positional argument for the desired startup type (e.g., 'Disabled'). The script must first stop the 'SharedAccess' service if it is running, then set its startup type to the provided value. It must return `$true` upon successful configuration and `$false` if it fails.

