dotfiles: let the group read the kernel logger ACL it was granted

[dotfiles] / setup-windows-with-uac.ps1

diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1
index a546a0a7dc9d2cf44dccdea995f0665b6503903e..8e8e7977ec8ff3b35cc3d1513f1c9d3de1d889b4 100644 (file)
--- a/setup-windows-with-uac.ps1
+++ b/setup-windows-with-uac.ps1
@@ -248,7 +248,12 @@ public static class EtwAcl
 # TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger\r
 # specifically; the rest are what any controller needs to create a session,\r
 # write it to disk and enable providers on it.\r
-$EtwControllerRights = 0x0FE1\r
+#\r
+# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and\r
+# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the\r
+# group cannot read the descriptor back, which makes EventAccessQuery useless as\r
+# a check on whether the grant landed: it answers "access denied" either way.\r
+$EtwControllerRights = 0x120FE1\r
 \r
 function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {\r
     Initialize-EtwAclType\r
@@ -400,8 +405,12 @@ try {
 # For the same reason 1 and 2 do not take effect in an already-open session: the\r
 # account has to sign out and back in. Any NEW logon does it - an ssh login into\r
 # this box is one, which is the quick way to check without dropping the desktop.\r
-# The ACE in 3 is machine state, read when a session is started, so that one\r
-# applies immediately.\r
+# The ACE in 3 is machine state rather than token state, so a logon does nothing\r
+# for it. ETW reads these descriptors into a cache, so a REBOOT is what is\r
+# expected to put the change into effect: with the ACE written and readable in\r
+# the descriptor, xperf -on base was still answering "Access is denied" from a\r
+# fresh shell on the running system. So on a first run, plan on both - a new\r
+# logon for 1 and 2, a reboot for 3.\r
 #\r
 # Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
 # user. This step is only about collection.\r
@@ -422,9 +431,13 @@ try {
     }\r
 \r
     # --- The kernel logger's own descriptor ---\r
-    # Idempotent: adding the ACE for a SID that already has it rewrites the same\r
-    # entry. Kept in its own try so that a failure here still leaves the group\r
+    # Safe to repeat: a second ACE for the same SID unions to the same access.\r
+    # Kept in its own try so that a failure here still leaves the group\r
     # membership below to be done - user-mode sessions work without it.\r
+    #\r
+    # ETW reads these descriptors out of the registry into a cache, so a REBOOT\r
+    # is what puts a change here into effect - not a new logon, which is what the\r
+    # group membership and the privilege need. Both, on a first run.\r
     try {\r
         Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights\r
         Write-Host ("    Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights)\r
@@ -489,7 +502,8 @@ try {
         }\r
 \r
         Write-Host ''\r
-        Write-Host "    $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
+        Write-Host "    $target must sign out and back in for the group and the privilege," -ForegroundColor Yellow\r
+        Write-Host '    and the box must be REBOOTED for the kernel logger ACE (ETW caches it).' -ForegroundColor Yellow\r
         Write-Host '    Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
         Write-Host '        whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
         Write-Host '        xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r