# Ensure 'Windows PushToInstall Service (PushToInstall)' is set to 'Disabled'

Necessity: The 'Windows PushToInstall Service' allows the Microsoft Store to remotely initiate app installations on a device. Disabling this service is crucial for security as it prevents a potential attack vector where a compromised Microsoft account could be used to push malicious applications to associated devices without direct user interaction on the target machine. This reduces the system's attack surface by eliminating a remote installation channel. Auditing and Remediation: The audit script checks the current 'StartType' of the 'PushToInstall' service to see if it is enabled. The remediation script directly modifies the service's configuration, setting its 'StartType' to 'Disabled' to prevent it from running. Recommended State Rationale: The recommendation for all security levels (Basic, Moderate, and Strict) is 'Disabled'. This is because the service provides a non-essential convenience feature that carries a significant security risk in managed environments. There is no intermediate configuration that provides partial functionality without also introducing the risk of remote, unapproved software installation. Therefore, complete disablement is the only recommended state to ensure system integrity and security, aligning with best practices and benchmarks like those from CIS.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to retrieve the 'StartType' of the 'PushToInstall' service. The script must return only the string value of the StartType (e.g., 'Disabled', 'Automatic').

## Remediation Script Working

PowerShell script that takes a single positional string argument specifying the desired 'StartType' (e.g., 'Disabled'). The script must use this argument to configure the 'StartType' for the 'PushToInstall' service and return '$true' upon successful completion or '$false' if it fails.

