# Ensure 'World Wide Web Publishing Service (W3SVC)' is set to 'Disabled' or 'Not Installed

Necessity: The World Wide Web Publishing Service (W3SVC) is the core component of Microsoft Internet Information Services (IIS). A web server exposes a significant attack surface to a network. If the system is not intended to be a web server, this service and its underlying components should be removed to reduce the potential for attack. An unnecessary, running web server can be exploited through software vulnerabilities, misconfigurations, or denial-of-service attacks, potentially leading to system compromise. Auditing and Remediation: The audit script verifies the current status of the W3SVC service, checking if it is installed and its configured start type. The remediation script takes action based on the desired state. It can either set the service startup type to 'Disabled', which prevents it from starting, or it can completely uninstall the IIS 'Web-Server' role from the operating system, which removes the service binaries. Recommended State Rationale: Basic: ['Disabled', 'Not Installed'] - This represents the minimum security baseline, ensuring that an unused web server is not running or configured to run automatically. Disabling the service is a quick and effective control. Moderate: ['Not Installed'] - This state provides a higher level of security by removing the service and its associated files from the system entirely. This significantly reduces the attack surface compared to merely disabling the service, as the underlying code is no longer present to be exploited or maliciously re-enabled. Strict: ['Not Installed'] - This is the most secure configuration. By ensuring the service is not installed, all risks associated with the IIS web server on the machine are eliminated. There is no more secure state for an unneeded service than complete removal.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled', 'Not Installed']` |
| **Moderate** | `['Not Installed']` |
| **Strict** | `['Not Installed']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that checks the status of the 'World Wide Web Publishing Service' (W3SVC). If the service is installed, the script must return its start type (e.g., 'Automatic', 'Disabled'). If the service does not exist, the script must return the string 'Not Installed'. The output should contain only the value, with no extra text or labels.

## Remediation Script Working

PowerShell script to configure the 'World Wide Web Publishing Service' (W3SVC). The script must accept one positional command-line argument representing the desired state ('Disabled' or 'Not Installed'). If the state is 'Disabled', the script must set the service's startup type to Disabled and stop the service if it is running. If the state is 'Not Installed', the script must attempt to uninstall the 'Web-Server' Windows Feature. The script must return `$true` on success and `$false` on failure.

