# Ensure 'Routing and Remote Access (RemoteAccess)' is set to 'Disabled'

Necessity: The 'Routing and Remote Access' service provides services for routing, VPN gateway, and dial-up remote access. If the system is not intended to function as a router or a remote access server, this service presents a significant and unnecessary attack surface. An enabled and improperly configured service could allow unauthorized remote access to the internal network, leading to potential data breaches, malware propagation, and system compromise. Disabling this service is a critical step in minimizing the network exposure of the system.\n\nAuditing and Remediation: The audit script verifies the current startup type of the 'RemoteAccess' service to ensure it is not configured to run. The remediation script changes the startup type to 'Disabled', preventing the service from being started automatically or manually.\n\nRecommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Disabled'. This follows the principle of least functionality, a core security concept. There is no secure state for this service other than being disabled unless its functionality is explicitly required for the system's role (e.g., a dedicated VPN server). For any general-purpose workstation or server, enabling this service introduces a risk that far outweighs any potential benefit, hence the uniform recommendation across all security hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'RemoteAccess' service. The script must only output the string value of the startup type (e.g., 'Disabled', 'Automatic', 'Manual'). If the service is not found, the script should output 'Not Found'.

## Remediation Script Working

PowerShell script that accepts one positional command-line argument (e.g., 'Disabled') to set the startup type for the 'RemoteAccess' service. The script must apply the setting and output $true on success or $false on failure.

