# Ensure 'Geolocation Service (lfsvc)' is set to 'Disabled'

Necessity: The Geolocation Service (lfsvc) tracks the system's physical location using GPS, Wi-Fi triangulation, and other methods. While useful for location-aware applications, it poses a significant privacy risk. If compromised, an attacker or malicious application could access sensitive location data, leading to unauthorized tracking or physical security threats. Disabling this service adheres to the principle of least functionality, reducing the system's attack surface and preventing potential data leakage.

Auditing and Remediation: The audit script queries the Windows Service Controller to check the 'StartType' property of the 'lfsvc' service. The remediation script uses the 'Set-Service' cmdlet to change this 'StartType' property to the specified value, effectively disabling the service from starting automatically or manually.

Recommended State Rationale: The recommendation is consistently 'Disabled' across all hardening levels because the risk associated with geolocation data is binary; either it is accessible or it is not. 
- Basic: Recommends 'Disabled' as the default secure state. Most enterprise workstations do not require geolocation, and disabling it is a fundamental privacy and security measure. 
- Moderate: Maintains the 'Disabled' state. There is no effective intermediate security posture for this service; enabling it in any form ('Manual' or 'Automatic') reintroduces the privacy risk. 
- Strict: Enforces the 'Disabled' state. In a high-security environment, minimizing data exposure is paramount, and disabling all non-essential services like geolocation is a mandatory step.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type for the 'Geolocation Service' (lfsvc). The script must output only the startup type string (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'Geolocation Service' (lfsvc). The script must accept a single positional command-line argument for the desired startup type (e.g., 'Disabled'). It must return '$true' on success and '$false' on failure.

