# Ensure 'Simple TCP/IP Services (simptcp)' is set to 'Disabled' or 'Not Installed'

The Simple TCP/IP Services protocol suite includes legacy services like Echo, Discard, and Quote of the Day, which are unauthenticated and rarely used in modern networks. These services can be exploited for reconnaissance to gather information about a network or used as amplifiers in Distributed Denial of Service (DDoS) attacks. Disabling or removing them is crucial for reducing the system's attack surface and mitigating unnecessary security risks. The audit script verifies the current status of the 'simptcp' service or feature, while the remediation script either disables the service or uninstalls the feature to enforce the security policy. The Basic recommendation allows for the service to be disabled, which is an effective mitigation. The Moderate and Strict recommendations advise uninstalling the feature entirely, which is the most secure state as it removes the underlying component from the system, adhering to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that inspects the 'simptcp' service. The script should first check if the 'Simple-TCPIP' Windows feature is installed. If not, it should return 'Not Installed'. If the feature is installed, it should return the StartMode of the 'simptcp' service (e.g., 'Disabled', 'Auto start'). The script must only output the resulting string value.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired state ('Disabled' or 'Not Installed'). If the state is 'Disabled', the script must set the 'simptcp' service StartMode to 'Disabled' and stop the service if it is running. If the state is 'Not Installed', the script must uninstall the 'Simple-TCPIP' Windows feature. The script must return `$true` upon successful completion or if the system is already in the desired state, and `$false` on failure.

