# Ensure 'Remote Procedure Call (RPC) Locator (RpcLocator)' is set to 'Disabled'

Necessity: The 'Remote Procedure Call (RPC) Locator' is a legacy service that manages the RPC name service database. This functionality is obsolete in modern Windows environments. Leaving this service enabled unnecessarily increases the system's attack surface, as it could be potentially leveraged by an attacker for network reconnaissance or other malicious purposes. Risk of misconfiguration is an exposed, unnecessary service that could contain undiscovered vulnerabilities. Auditing and Remediation: The audit script verifies the startup type of the 'RpcLocator' service to ensure it is not configured to run. The remediation script alters the service's configuration to set its startup type to 'Disabled', preventing it from starting. Recommended State Rationale: The recommendation for all levels (Basic, Moderate, and Strict) is 'Disabled'. This is because the service provides no essential function on modern systems and its disablement is a universal security best practice recommended by benchmarks like CIS. There are no operational benefits to having it enabled, and therefore, the only secure configuration is to disable it entirely across all hardening levels.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the StartType of the 'RpcLocator' (Remote Procedure Call (RPC) Locator) service. The script must return only the string value of the StartType (e.g., 'Disabled', 'Manual').

## Remediation Script Working

PowerShell script that sets the StartType of the 'RpcLocator' service. The script must accept a single positional command-line argument for the desired state (e.g., 'Disabled'). The script must return $true on success and $false on failure.

