# Ensure 'Bluetooth Support Service (bthserv)' is set to 'Disabled'

Necessity: The Bluetooth Support Service enables the discovery and association of remote Bluetooth devices. If Bluetooth is not required for business purposes, disabling this service reduces the system's attack surface. Wireless protocols like Bluetooth can be exploited by attackers within physical proximity to gain unauthorized access, spread malware, or conduct denial-of-service attacks. Disabling unnecessary services adheres to the principle of least functionality, a fundamental security best practice. Auditing and Remediation: The audit script verifies the current configuration of the 'bthserv' service by checking its startup type. The remediation script uses the 'Set-Service' cmdlet to modify the startup type to the user-specified state, effectively disabling it from starting automatically. Recommended State Rationale: The recommended state for all hardening levels (Basic, Moderate, and Strict) is 'Disabled'. This is a binary control; the service is either required or it is not. If the system has no operational need for Bluetooth connectivity (e.g., for keyboards, mice, or other peripherals), the service should be disabled to eliminate the associated security risk entirely. There is no intermediate 'moderate' setting; enabling the service introduces a risk that should only be accepted if functionally necessary.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the startup type of the 'Bluetooth Support Service (bthserv)'. The script must output only the string representing the current startup type (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument specifying the desired startup type for the 'Bluetooth Support Service (bthserv)'. The script must apply this setting and output '$true' on success or '$false' on failure.

