# Ensure 'Bluetooth Support Service (bthserv)' is set to 'Disabled'

The Bluetooth Support Service enables the discovery and association of remote Bluetooth devices. Disabling this service is crucial for reducing the system's attack surface. An unnecessary open wireless communication protocol like Bluetooth can be exploited by attackers within physical proximity to gain unauthorized access, execute malicious code, or exfiltrate data. If Bluetooth functionality is not required for a specific business purpose, the service should be disabled to prevent these potential security breaches. The audit script verifies the current startup type of the 'bthserv' service, while the remediation script sets it to the desired state. For this control, the recommended state is consistently 'Disabled' across all security levels (Basic, Moderate, and Strict) because there is no secure alternative if the service is not explicitly required. Enabling it in any form (Manual or Automatic) introduces a security risk that is unnecessary for systems not utilizing Bluetooth peripherals.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'Bluetooth Support Service' (bthserv). The script must output only the string value of the startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single string argument specifying the desired startup type for the 'Bluetooth Support Service' (bthserv). The script must apply this configuration and output '$true' on success or '$false' on failure.

