# Ensure 'Bluetooth Audio Gateway Service (BTAGService)' is set to 'Disabled'

Necessity: The 'Bluetooth Audio Gateway Service' enables audio functionality for Bluetooth devices. If the system does not require Bluetooth audio gateway capabilities, this service should be disabled to reduce the system's attack surface. Bluetooth protocols have been a target for vulnerabilities, and disabling unnecessary services aligns with the principle of least functionality, minimizing potential vectors for unauthorized access or exploitation. Misconfiguration could leave the system vulnerable to attacks targeting Bluetooth flaws. Auditing and Remediation: The audit script checks the current 'StartType' of the 'BTAGService' using the Get-Service cmdlet. The remediation script uses the Set-Service cmdlet to modify the service's startup type to the value provided as a command-line argument. Recommended State Rationale: The Basic, Moderate, and Strict recommendation is 'Disabled'. This is a binary setting in terms of security; the service is either required for a specific business function or it is not. If it is not explicitly needed, it presents an unnecessary risk and must be disabled. This single recommendation reflects a universal security best practice to eliminate non-essential services, thereby hardening the system against potential threats without a tiered approach.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'BTAGService' service. The script must output only the current startup type string (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'BTAGService' service. The script must accept the desired state (e.g., 'Disabled', 'Automatic') as a single, positional command-line argument. The script must return $true upon successful configuration and $false upon failure.

