# Ensure 'Windows Event Collector (Wecsvc)' is set to 'Disabled

The Windows Event Collector (Wecsvc) service manages persistent subscriptions to events from remote sources that support the WS-Management protocol. This is used in enterprise environments to centralize event log collection. If the system is not actively used as an event collector, this service provides an unnecessary attack surface. Disabling it adheres to the principle of least functionality, reducing the potential for misuse or exploitation. The audit script checks the 'StartType' of the 'Wecsvc' service. The remediation script modifies this 'StartType' to the user-provided value. The recommended state for all security levels is 'Disabled' because if the feature is not explicitly required for centralized logging, the service should not be running. There is no intermediate secure state; it is either needed and enabled, or not needed and disabled for maximum security.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the startup type of the 'Windows Event Collector (Wecsvc)' service. The script must output only the current string value (e.g., 'Disabled', 'Manual', 'Automatic') without any labels or additional text.

## Remediation Script Working

PowerShell script that accepts a single command-line argument specifying the desired startup type for the 'Windows Event Collector (Wecsvc)' service (e.g., 'Disabled'). The script must apply this setting and output '$true' on success or '$false' on failure.

