# Ensure 'UPnP Device Host (upnphost)' is set to 'Disabled'

Necessity: The Universal Plug and Play (UPnP) protocol allows networked devices to automatically discover each other and establish functional network services. While convenient for home networks, it poses a significant security risk in an enterprise environment. Vulnerabilities in UPnP have been exploited by malware to bypass firewalls, open ports, and expose internal systems to external threats. Disabling the 'UPnP Device Host' service reduces the system's attack surface by preventing it from participating in potentially insecure, automatic network configuration activities.

Auditing and Remediation: The audit script checks the current startup type of the 'upnphost' service to determine its operational state. The remediation script modifies this startup type, typically to 'Disabled', to prevent the service from running automatically or being started manually.

Recommended State Rationale: 
- Basic: 'Disabled'. Disabling this service is the fundamental security recommendation, as it is not required for typical enterprise operations and introduces unnecessary risk.
- Moderate: 'Disabled'. There is no secure middle ground for this service. A moderate security posture maintains the same recommendation as basic hardening.
- Strict: 'Disabled'. For a strict security environment, it is critical that UPnP is disabled to prevent any possibility of exploitation. Therefore, the recommendation remains consistent across all levels of hardening.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'UPnP Device Host' service (service name 'upnphost'). The script must only output the string representing the current state (e.g., 'Disabled', 'Automatic').

## Remediation Script Working

PowerShell script that accepts one positional command-line argument specifying the desired startup type for the 'UPnP Device Host' service (service name 'upnphost'). The script must apply the new setting and output the boolean value $true upon success or $false upon failure.

