# Ensure 'Remote Registry (RemoteRegistry)' is set to 'Disabled'

Necessity: The Remote Registry service allows remote users to modify registry settings on the system. Enabling this service exposes a significant attack surface, as an attacker who gains network access could potentially manipulate the registry to install malware, disable security controls, or disrupt system operations. Disabling this service is a critical hardening step that adheres to the principle of least functionality, reducing the avenues available for remote attacks.

Auditing and Remediation: The audit script checks the 'StartType' property of the 'RemoteRegistry' Windows service to determine if it is enabled, disabled, or set to manual start. The remediation script uses the 'Set-Service' cmdlet to change the startup type to the specified state, effectively disabling the service to prevent it from running.

Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This is because the service presents a binary security risk; it is either a potential vulnerability when enabled or secured when disabled. There is no intermediate state that offers a partial security benefit. Unless there is a specific and compelling administrative requirement for remote registry access, which should be documented and tightly controlled, this service should always be disabled to maintain a secure system posture.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'RemoteRegistry' service. The script must return only the current startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument to set the startup type for the 'RemoteRegistry' service. The valid arguments are 'Automatic', 'Manual', or 'Disabled'. The script must return $true upon successful configuration and $false upon failure.

