# Ensure 'Bluetooth Audio Gateway Service (BTAGService)' is set to 'Disabled'

Necessity: The 'Bluetooth Audio Gateway Service' enables the computer to function as an audio gateway for Bluetooth devices. If this functionality is not required, the service presents an unnecessary attack surface. Bluetooth protocols have known vulnerabilities that could be exploited to compromise the system. Disabling this service mitigates these risks by adhering to the principle of least functionality, reducing the potential vectors for attack.

Auditing and Remediation: The audit script checks the current 'Startup Type' of the 'BTAGService' service object to determine if it is enabled. The remediation script modifies this 'Startup Type' to the desired state, effectively disabling the service from starting automatically or manually.

Recommended State Rationale: The recommendation for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. This is because if the Bluetooth audio gateway functionality is not a specific business requirement, the service should be disabled to enhance security. There is no intermediate state that offers a security benefit; the service is either required for a functional purpose or it is a liability. For any secure environment, non-essential services should be disabled to minimize the attack surface.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'Bluetooth Audio Gateway Service' (BTAGService). The script must only output the current value (e.g., 'Disabled', 'Automatic', 'Manual') and nothing else.

## Remediation Script Working

PowerShell script that sets the startup type for the 'Bluetooth Audio Gateway Service' (BTAGService). The script must accept a single positional command-line argument representing the desired startup type (e.g., 'Disabled'). The script must return $true upon successful configuration and $false if it fails.

