# Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled'

Necessity: The Geolocation Service (lfsvc) tracks the device's physical location, which can be a significant privacy risk if compromised or misused. Disabling this service is crucial for environments where location tracking is not a business requirement. It minimizes the attack surface by preventing applications and potential malware from accessing sensitive location data, thereby protecting user privacy and enhancing corporate security. The risk of leaving it enabled on non-mobile or corporate devices is the unauthorized leakage or tracking of location information. Auditing and Remediation: The audit script queries the Windows Service Controller to determine the current 'StartType' of the 'lfsvc' service. The remediation script uses the 'Set-Service' cmdlet to change the 'StartType' to the value provided as an argument, effectively disabling the service from starting automatically. Recommended State Rationale: The recommendation is consistently 'Disabled' across all hardening levels because the security and privacy benefits are binary. Basic: Recommends 'Disabled' as a fundamental privacy-enhancing measure for any system not explicitly requiring location services. Moderate: Reinforces the 'Disabled' state, as there is no middle ground for a service of this nature. It is either needed or it is not. Strict: Mandates the 'Disabled' state. In a high-security environment, all non-essential services that could potentially leak data must be disabled to adhere to the principle of least functionality.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'Geolocation Service (lfsvc)'. The script must output only the string value of the startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'Geolocation Service (lfsvc)'. The script must accept one positional command-line argument for the desired state (e.g., 'Disabled', 'Automatic'). It must return $true upon successful configuration and $false upon failure.

