# Ensure 'Remote Procedure Call (RPC) Locator (RpcLocator)' is set to 'Disabled'

Necessity: The 'Remote Procedure Call (RPC) Locator' is a legacy service that manages the RPC name service database. This service is not required for standard Windows operations and is considered obsolete. Leaving it enabled unnecessarily increases the system's attack surface, as any running service can potentially be a vector for exploitation. Disabling it aligns with the security principle of least functionality. Auditing and Remediation: The audit script verifies the current startup type of the 'RpcLocator' service to ensure it is not configured to run. The remediation script modifies the service's configuration to set its startup type to 'Disabled', preventing it from being started by the system or other services. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'Disabled'. This is because the service provides no essential function in modern Windows environments. There is no operational benefit to leaving it enabled, and doing so only introduces unnecessary risk. Security benchmarks like the CIS Benchmarks universally recommend disabling this service. Therefore, there is no variance in the recommendation across different hardening levels; the most secure and only recommended configuration is 'Disabled'.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the Start Mode for the 'RpcLocator' (Remote Procedure Call (RPC) Locator) service. The script must output only the string value of the current start mode (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the Start Mode for the 'RpcLocator' service. The script must accept one positional command-line argument for the desired state (e.g., 'Disabled'). It must return the boolean value $true upon successful configuration and $false otherwise.

