# Ensure 'Xbox Live Networking Service (XboxNetApiSvc)' is set to 'Disabled'

Necessity: The 'Xbox Live Networking Service' provides networking services for Xbox Live social and gaming features. If the system is not used for Xbox gaming, this service is unnecessary and increases the system's attack surface. Disabling non-essential services is a critical security best practice, as it reduces the number of running processes that could potentially be exploited by an attacker. The risk of leaving it enabled on a non-gaming system is an unnecessarily exposed service that could contain vulnerabilities or be used in an attack chain.

Auditing and Remediation: The audit script verifies the current startup configuration of the 'XboxNetApiSvc' service to determine if it is enabled or disabled. The remediation script modifies the service's configuration to set its startup type to 'Disabled', preventing it from running automatically.

Recommended State Rationale: The recommendation for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. This is because the service provides a very specific functionality that is not required for standard business or server operations. There is no security benefit to having it enabled in any capacity on a system not used for its intended purpose. Therefore, the single, most secure state is to disable it entirely, aligning with the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the 'StartType' property of the 'XboxNetApiSvc' service. The script must output only the string value of the StartType (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type of the 'XboxNetApiSvc' service. The script must accept one positional command-line argument representing the desired startup type (e.g., 'Disabled'). It must return `$true` on success and `$false` on failure.

