Windows Hotpatch Monitoring Service

README.md

Windows Hotpatching Monitoring Service (hpatchmon)

These are some quick notes from my Windows 11 Workstation PC.

Files :

• hpatchmonTask.cmd
• hpatchmon.dll

Services:

The service is off by default [June, 2025]

Scheduled Task:

At startup:

%systemroot%\system32\cmd.exe /d /c %systemroot%\system32\hpatchmonTask.cmd

(see below for the contents of the cmd file)

hpatchmon.dll

Classes:

• HotpatchMonitor
  • Cleanup
  • Initialize
  • InternalHandler
  • IsHotpatchLCUInstalled
  • RegisterStopCallback
  • ReportSvcStatus
  • ServiceMain - Start looking here
  • SetServiceToAutoStart
  • StopService
  • SvcHandler
  • SvcInitialize

hpatchmonTask.cmd

@echo off
setlocal enabledelayedexpansion

REM Initialize service name
set serviceName=hpatchmon

REM Initialize hotpatch registry key and pattern to match subkeys for findstr

call :checkSecureSystemIsRunning
if %errorlevel% neq 0 goto end

call :checkHotPatchAreRegistered
if %errorlevel% neq 0 goto end

call :checkServiceInstalled
if %errorlevel% neq 0 goto end

call :checkServiceAutoStart
if %errorlevel% neq 0 goto end

call :checkServiceRunning
if %errorlevel% neq 0 goto end

goto end


REM -----------------------------------------------------------------------------
REM Function: checkSecureSystemIsRunning
REM Description: This function checks if the "Secure System" process is running.
REM              It uses the tasklist command to list all running processes and
REM              filters the output to find the "Secure System" process.
REM              If the process is not found, it prints a message and exits with
REM              an error code 1. If the process is found, it prints a message
REM              and exits with a success code 0.
REM -----------------------------------------------------------------------------
:checkSecureSystemIsRunning
tasklist /FI "IMAGENAME eq Secure System" /v /FO list | findstr /i "Image Name:   Secure System" > nul
if %errorlevel% neq 0 (
	echo Secure System is not running, exiting.
	exit /b 1
)
echo Secure System is running.
exit /b 0

REM -----------------------------------------------------------------------------
REM Function: checkHotPatchAreRegistered
REM Description: This function checks if hotpatches are registered in the system.
REM              It queries the registry subkeys key under parent registry key 
REM 		     "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\HotPatch".
REM 			 If the parent registry  key does not exist or the subkey count 
REM              is zero (error level not equal to 0), it prints a message 
REM              indicating that hotpatches are not registered and exits with a 
REM              status code of 1.
REM -----------------------------------------------------------------------------
:checkHotPatchAreRegistered
set subkeyCount=0
set hotPatchKey="HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\HotPatch"
reg query %hotPatchKey% > nul 2>&1
if %errorlevel% neq 0 (
	echo Hotpatches are not registered.
	exit /b 1
)

for /f "tokens=*" %%i in ('reg query %hotPatchKey% /s ^| findstr /r /c:"HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\HotPatch*"') do (
	set /a subkeyCount+=1
)

if %subkeyCount% equ 0 (
	echo No hotpatches are registered.
	exit /b 1
)

echo A total of %subkeyCount% hotpatches are registered.
exit /b 0

REM -----------------------------------------------------------------------------
REM Function: checkServiceInstalled
REM Description: This function checks if a specified service is installed on the system.
REM              It uses the 'sc qc' command to query the service configuration.
REM              If the service is not installed (error level 1060), it outputs a message
REM              and exits with code 1. If the service is installed, it exits with code 0.
REM -----------------------------------------------------------------------------
:checkServiceInstalled
sc qc %serviceName% > nul 2>&1
if %errorlevel% equ 1060 (
	echo The service:%serviceName% is not installed.
	exit /b 1
)
exit /b 0

REM -----------------------------------------------------------------------------
REM Function: checkServiceAutoStart
REM Description: This function checks if a specified service is set to start 
REM              automatically. If the service is not set to auto start, it 
REM              configures the service to start automatically.
REM Parameters:
REM   %serviceName% - The name of the service to check and configure.
REM -----------------------------------------------------------------------------
:checkServiceAutoStart
sc qc %serviceName% | findstr /i "AUTO_START" > nul
if %errorlevel% neq 0 (
	echo The service:%serviceName% is not set to auto start. Configuring it now...
	sc config %serviceName% start= auto > nul 2>&1
	if !errorlevel! neq 0 (
		echo could not configure service:%serviceName% to auto start.
		exit /b 1	
	)
	echo The service:%serviceName% has been configured to auto start.
) else (
	echo The service:%serviceName% is already set to auto start.
)
exit /b 0

REM -----------------------------------------------------------------------------
REM Function: checkServiceRunning
REM Description: This function checks if a specified service is running. If the
REM              service is not running, it starts the service.
REM Parameters:
REM   %serviceName% - The name of the service to check and start.
REM -----------------------------------------------------------------------------
:checkServiceRunning
SC QUERY %serviceName% | FINDSTR /i "RUNNING" > nul
if %errorlevel% equ 0 (
	echo service:%serviceName% is running
	exit /b 0
)

SC start %serviceName% > nul 2>&1
if %errorlevel% equ 0 (
	echo service:%serviceName% started successfully
) else (
	echo could not start service:%serviceName%
	exit /b 1
)
exit /b 0

:end
endlocal