# Ensure 'Xbox Live Networking Service (XboxNetApiSvc)' is set to 'Disabled'

Necessity: The 'Xbox Live Networking Service' provides networking capabilities for Xbox Live games and features. In enterprise or business environments, this service is non-essential and provides no operational function. Disabling it reduces the system's attack surface by eliminating unnecessary running code and network listeners, adhering to the principle of least functionality. Leaving it enabled could consume system resources and potentially expose unpatched vulnerabilities in the future.

Auditing and Remediation: The audit script checks the 'StartType' property of the 'XboxNetApiSvc' Windows service to determine if it is enabled to run at startup. The remediation script uses the 'Set-Service' cmdlet to change this 'StartType' property to 'Disabled', preventing the service from starting automatically or manually.

Recommended State Rationale: 
- Basic: ['Disabled'] is the fundamental recommendation as the service is not required for standard business operations. Disabling it is a straightforward step to harden the system.
- Moderate: ['Disabled'] remains the recommendation. There is no intermediate state for a non-essential service that offers a better security posture.
- Strict: ['Disabled'] is the only acceptable state in a strictly hardened environment. Any service not critical to the system's primary function must be disabled to minimize potential security risks.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Disabled']` |
| **Moderate** | `['Disabled']` |
| **Strict** | `['Disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that retrieves the startup type of the 'XboxNetApiSvc' service. The script must only output the current value (e.g., 'Disabled', 'Automatic', 'Manual').

## Remediation Script Working

PowerShell script that sets the startup type for the 'XboxNetApiSvc' service. The script must accept the desired state (e.g., 'Disabled', 'Automatic') as a direct, positional command-line argument. The script must return `$true` upon successful configuration and `$false` if it fails.

