# Ensure 'Windows Error Reporting Service (WerSvc)' is set to 'Disabled'

Necessity: The Windows Error Reporting Service (WerSvc) collects and sends system and application error information to Microsoft. While useful for troubleshooting, this data can contain sensitive information, such as memory dumps, system state, and application data. Disabling this service prevents the potential exfiltration of sensitive organizational data to an external party, reducing the risk of data leakage and protecting proprietary information. Auditing and Remediation: The audit script queries the current startup type of the 'WerSvc' service object. The remediation script modifies this property using the 'Set-Service' cmdlet to change the startup type to the desired state, effectively disabling it. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This is a binary security control; either the service is enabled and poses a data leakage risk, or it is disabled, mitigating that risk. There is no intermediate state that offers partial protection. Therefore, security benchmarks like CIS recommend disabling it entirely in secure environments to enforce a strict no-external-reporting policy.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'Windows Error Reporting Service (WerSvc)'. The script must only output the current value, such as 'Disabled', 'Automatic', or 'Manual', with no extra text or labels.

## Remediation Script Working

PowerShell script that sets the startup type for the 'Windows Error Reporting Service (WerSvc)'. The script must accept the desired state (e.g., 'Disabled') as a direct, positional command-line argument. It must return $true on success and $false on failure.

