# Ensure 'World Wide Web Publishing Service (W3SVC)' is set to 'Disabled' or 'Not Installed

Necessity: The World Wide Web Publishing Service (W3SVC) is a core component of Microsoft Internet Information Services (IIS). If the system is not intended to function as a web server, this service is unnecessary and exposes a significant attack surface. Active web services can be targeted by a wide range of attacks, including denial-of-service, code execution vulnerabilities, and web application attacks. Disabling or uninstalling W3SVC on non-web servers is a critical hardening step to reduce the system's exposure to network-based threats.

Auditing and Remediation: The audit script checks if the W3SVC service is installed and, if so, retrieves its configured start type. The remediation script modifies the service's configuration, setting its start type to 'Disabled' to ensure it does not run automatically, thereby securing the system from potential web-based vulnerabilities.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is uniformly 'Disabled' or 'Not Installed'. This is because the security principle is binary: a system should either be an authorized web server or it should not be running web services at all. There is no intermediate level of security for an unnecessary, high-risk service. For any system not explicitly designated as a web server, the service must be disabled to eliminate the attack surface entirely, making this the only appropriate recommendation across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Disabled', 'Not Installed']` |
| **Strict** | `['Disabled', 'Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check the status of the 'World Wide Web Publishing Service' (W3SVC). If the service is not installed, the script must return the string 'Not Installed'. If the service is installed, the script must return its start type (e.g., 'Disabled', 'Automatic', 'Manual'). The script must only output the current state string, with no additional text or formatting.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired start type (e.g., 'Disabled'). The script must attempt to set the 'World Wide Web Publishing Service' (W3SVC) start type to the provided value. This action should only be performed if the service is installed. The script must return $true on successful configuration or if the service is not installed, and $false if it fails to apply the setting.

