# Ensure 'Windows Error Reporting Service (WerSvc)' is set to 'Disabled'

Necessity: The Windows Error Reporting Service (WerSvc) collects and sends system and application error information to Microsoft. While useful for troubleshooting, this service can inadvertently transmit sensitive data, such as memory dumps, system configurations, and application-specific information. Disabling this service is a critical security measure to prevent potential data leakage and reduce the system's attack surface, which is particularly important in environments handling confidential or proprietary information.

Auditing and Remediation: The audit script checks the current startup type of the 'WerSvc' service using the 'Get-Service' cmdlet. The remediation script utilizes the 'Set-Service' cmdlet to modify this startup type, effectively disabling the service from starting automatically or manually.

Recommended State Rationale: The recommended state for all levels—Basic, Moderate, and Strict—is 'Disabled'. This is because any state other than 'Disabled' ('Manual' or 'Automatic') presents a risk of the service running and transmitting potentially sensitive data. There is no intermediate secure configuration; the service should be completely turned off to ensure data confidentiality. This aligns with security hardening standards like the CIS Benchmarks, which universally recommend disabling this service to mitigate data exfiltration risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'Windows Error Reporting Service (WerSvc)'. The script must output only the string value of the startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'Windows Error Reporting Service (WerSvc)'. The script must accept the desired startup type (e.g., 'Disabled') as a single, positional command-line argument. It must return $true on success and $false on failure.

