• package: tis-cis-guide-disable-services
• name: CIS Guide disable services
• version: 10
• categories: Security
• maintainer: WAPT Team, Tranquil IT, Kévin Guérineau
• locale: all
• target_os: windows
• architecture: all
• signature_date: 2026-08-04T16:34:05.000000
• size: 9.67 Ko

package           : tis-cis-guide-disable-services
version           : 10
architecture      : all
section           : base
priority          : optional
name              : CIS Guide disable services
categories        : Security
maintainer        : WAPT Team, Tranquil IT, Kévin Guérineau
description       : Disable services in compliance with the CIS recommendations guide
depends           : 
conflicts         : 
maturity          : PROD
locale            : all
target_os         : windows
min_wapt_version  : 2.3
sources           : 
installed_size    : 
impacted_process  : 
description_fr    : Désactiver les services selon le guide des recommandations du CIS
description_pl    : Wyłączenie usług zgodnie z przewodnikiem zaleceń CIS
description_de    : Deaktivierung von Diensten in Übereinstimmung mit den CIS-Empfehlungen
description_es    : Desactivar servicios de acuerdo con la guía de recomendaciones del CIS
description_pt    : Desativar serviços em conformidade com o guia de recomendações do CIS
description_it    : Disattivare i servizi in conformità con la guida alle raccomandazioni del CIS.
description_nl    : Services uitschakelen in overeenstemming met de CIS-aanbevelingsgids
description_ru    : Отключение служб в соответствии с руководством по рекомендациям CIS
audit_schedule    : 
editor            : 
keywords          : 
licence           : 
homepage          : 
package_uuid      : 95297ee4-3803-47d0-99fd-a710404d74b8
valid_from        : 
valid_until       : 
forced_install_on : 
changelog         : 
min_os_version    : 
max_os_version    : 
icon_sha256sum    : 9420721210f5d9c50c9e35c9fdbf0a088b30e165df8311c5f2176ce60e122475
signer            : Tranquil IT
signer_fingerprint: 8c5127a75392be9cc9afd0dbae1222a673072c308c14d88ab246e23832e8c6bb
signature_date    : 2026-08-04T16:34:05.000000
signed_attributes : package,version,architecture,section,priority,name,categories,maintainer,description,depends,conflicts,maturity,locale,target_os,min_wapt_version,sources,installed_size,impacted_process,description_fr,description_pl,description_de,description_es,description_pt,description_it,description_nl,description_ru,audit_schedule,editor,keywords,licence,homepage,package_uuid,valid_from,valid_until,forced_install_on,changelog,min_os_version,max_os_version,icon_sha256sum,signer,signer_fingerprint,signature_date,signed_attributes
signature         : SHGk24Nw8SLFxeuzsdaQfiOrWtLbJsXBamMOMJByPDLi+bTLyWJ4bq8+VpkMF7wF9/fjGGpa2oKQYQsOfHXDajRLZqJPUDJpQVUqN2Kq3VG2k8B27M7MnjyVoSCWPvQ/1cSmvRairUUmSn1UC0Ua1y1b1i/B6BBcQolb+YLbCgtCAFeKRdh009ZCjM/aDXjVntoFNYhtCl1yKAqucYXP0i8ar0e6N/lpJc6ZOP5zuCM//tnaQ2sW6oscFPLRIycTUH4vQOdnApTuJzp6E1YG2eH3BMLF3+XE0NYZTvFJ7Vs6v2cjZrQgX8OU75ztICIN3LJ4ja0hwY8rl3Fxt0yDHQ==

# -*- coding: utf-8 -*-
from setuphelpers import *

services_to_disabled = {
    "BTAGService":{"description":"Bluetooth Audio Gateway Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "bthserv":{"description":"Bluetooth Support Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    #"Browser":{"description":"Computer Browser","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "MapsBroker":{"description":"Downloaded Maps Manager","service_default_startup":"auto","service_recommended_startup":"Disabled","registry_default_value":2,"registry_recommended_value":4},
    "lfsvc":{"description":"Geolocation Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "IISADMIN":{"description":"IIS Admin Service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "irmon":{"description":"Infrared monitor service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    # "SharedAccess":{"description":"Internet Connection Sharing (ICS)","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "lltdsvc":{"description":"Link-Layer Topology Discovery Mapper","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    # "LxssManager":{"description":"LxssManager","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "FTPSVC":{"description":"Microsoft FTP Service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "MSiSCSI":{"description":"Microsoft iSCSI Initiator Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "sshd":{"description":"OpenSSH SSH Server","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "PNRPsvc":{"description":"Peer Name Resolution Protocol","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "p2psvc":{"description":"Peer Networking Grouping","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "p2pimsvc":{"description":"Peer Networking Identity Manager","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "PNRPAutoReg":{"description":"PNRP Machine Name Publication Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "Spooler":{"description":"Print Spooler","service_default_startup":"auto","service_recommended_startup":"Disabled","registry_default_value":2,"registry_recommended_value":4},
    "wercplsupport":{"description":"Problem Reports and Solutions Control Panel Support","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "RasAuto":{"description":"Remote Access Auto Connection Manager","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "SessionEnv":{"description":"Remote Desktop Configuration","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "UmRdpService":{"description":"Remote Desktop Services UserMode Port Redirector","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "RpcLocator":{"description":"Remote Procedure Call (RPC) Locator","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "RemoteRegistry":{"description":"Remote Registry","service_default_startup":"Disabled","service_recommended_startup":"Disabled","registry_default_value":4,"registry_recommended_value":4},
    "RemoteAccess":{"description":"Routing and Remote Access","service_default_startup":"Disabled","service_recommended_startup":"Disabled","registry_default_value":4,"registry_recommended_value":4},
    "LanmanServer":{"description":"Server","service_default_startup":"auto","service_recommended_startup":"Disabled","registry_default_value":2,"registry_recommended_value":4},
    "simptcp":{"description":"Simple TCP/IP Services","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "SNMP":{"description":"SNMP Service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "sacsvr":{"description":"Special Administration Console Helper","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "SSDPSRV":{"description":"SSDP Discovery","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "upnphost":{"description":"UPnP Device Host","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "WMSvc":{"description":"Web Management Service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "WerSvc":{"description":"Windows Error Reporting Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "Wecsvc":{"description":"Windows Event Collector","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "WMPNetworkSvc":{"description":"Windows Media Player Network Sharing Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "icssvc":{"description":"Windows Mobile Hotspot Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "WpnService":{"description":"Windows Push Notifications System Service","service_default_startup":"auto","service_recommended_startup":"Disabled","registry_default_value":2,"registry_recommended_value":4},
    "PushToInstall":{"description":"Windows PushToInstall Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "WinRM":{"description":"Windows Remote Management (WS-Management)","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "W3SVC":{"description":"World Wide Web Publishing Service","service_default_startup":None,"service_recommended_startup":"Disabled","registry_default_value":None,"registry_recommended_value":4},
    "XboxGipSvc":{"description":"Xbox Accessory Management Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "XblAuthManager":{"description":"Xbox Live Auth Manager","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "XblGameSave":{"description":"XblGameSave","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "XboxNetApiSvc":{"description":"Xbox Live Networking Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "TermService":{"description":"Remote Desktop Services","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
    "GameInputSvc":{"description":"GameInput Service","service_default_startup":"demand","service_recommended_startup":"Disabled","registry_default_value":3,"registry_recommended_value":4},
}

def install():
    for service in services_to_disabled:
        if service_installed(service):                
            print(f"Disable {services_to_disabled[service]['description']} ({service})")
            if service_is_running(service):
                try:
                    service_stop(service)
                except:
                    print(f"Unable to stop {service}, please restart your computer")
            run(rf'sc config "{service}" start= {services_to_disabled[service]["service_recommended_startup"].lower()}')
            registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Services',service,services_to_disabled[service]['registry_recommended_value'])


def uninstall():
    for service in services_to_disabled:
        if service_installed(service):
            print(f"Set default value for {services_to_disabled[service]['description']} ({service})")
            if services_to_disabled[service]['service_default_startup'] is not None:
                run(rf'sc config "{service}" start= {services_to_disabled[service]["service_default_startup"].lower()}')
                registry_set(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Services',service,services_to_disabled[service]['registry_default_value'])


def audit():
    error = False
    service_in_fault = []
    for service in services_to_disabled:
        if service_installed(service):
            current_value = registry_readstring(HKEY_LOCAL_MACHINE,r'SYSTEM\CurrentControlSet\Services',service)
            expected_value = str(services_to_disabled[service]['registry_recommended_value'])
            if current_value != expected_value:
                print(f"Service {service} isn't in correct value : {current_value} expected {expected_value}")
                service_in_fault.append(service)
                error = True

    if error:
        WAPT.write_audit_data_if_changed("CIS disable services", 'Service in fault', parameter_in_fault, keep_days=365)
        return "ERROR"
    else:
        WAPT.write_audit_data_if_changed("CIS disable services", 'Service in fault', "OK", keep_days=365)
        return "OK"

# -*- coding: utf-8 -*-
from setuphelpers import *

def update_package():
    commit_count = params.get("commit_count",0)

    control.version = commit_count
    control.save_control_to_wapt()

a0494d0cce1b6435aeaf8b4970da325139eb88cca4fbab265e59bb1594ce4bb4 : WAPT/README.md
492c89d1c629ebd2425590cf93d67ac28cf71c45abfac01b2268baa5d19b4dd3 : WAPT/README_fr.md
38d056ab130f7bf7c481c12636a4e9959de36561d3dfcbe54c6e3571bc0c1dc3 : WAPT/certificate.crt
cd212af5923fb0b625fac9131194e1e5f827cd2698662816314d119642561d94 : WAPT/control
9420721210f5d9c50c9e35c9fdbf0a088b30e165df8311c5f2176ce60e122475 : WAPT/icon.png
018e10770e3c58bc18ba94bed7583591b48eb9f7264dd075c04b650381d1e4f8 : luti.json
9657bfd98f29630fc75d36d468e27d01e9d9d60bd4fcc56b4073ad895da14dea : setup.py
0506431355ece6d296efc398fc457515203e9532b5caa24d3e4c3d28dd277059 : update_package.py