# Ensure 'SNMP Service (SNMP)' is set to 'Disabled' or 'Not Installed'

Necessity: The Simple Network Management Protocol (SNMP) is a legacy protocol with significant security weaknesses, particularly in versions 1 and 2c. It uses clear-text community strings for authentication, making it highly susceptible to eavesdropping and unauthorized access. Attackers can exploit SNMP to gather detailed system information, map networks, and, if write access is misconfigured, alter system settings or trigger a denial-of-service. Disabling or removing the service is crucial to reduce the system's attack surface. Auditing and Remediation: The audit script verifies the current state of the SNMP service, checking if it is installed and what its startup type is. The remediation script provides the means to either set the service's startup type to 'Disabled', preventing it from running, or to completely uninstall the feature from the operating system. Recommended State Rationale: Basic: ['Disabled', 'Not Installed'] - This state meets the minimum security requirement by ensuring the vulnerable service does not run. Disabling the service is a quick and effective mitigation. Moderate: ['Not Installed'] - This state is more secure than simply disabling the service. It ensures the service's binaries are not present on the system, preventing a local or remote attacker from re-enabling and exploiting it. Strict: ['Not Installed'] - This is the most secure configuration. By completely removing the SNMP feature, it is eliminated as a potential attack vector, ensuring it cannot be leveraged for reconnaissance or exploitation under any circumstances.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to check the status of the 'SNMP' service. If the service is not installed, the script must return the string 'Not Installed'. If it is installed, it must return its current StartType (e.g., 'Disabled', 'Automatic'). The script should output only the resulting value, without any labels or extra text.

## Remediation Script Working

PowerShell script that configures the 'SNMP' service. The script must accept one positional command-line argument representing the desired state ('Disabled' or 'Not Installed'). If the state is 'Disabled', it must set the service's StartType accordingly. If 'Not Installed', it must uninstall the feature. The script must return $true on success and $false on failure.

