- Windows Driver Kit 10.0.26100\r
- Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
(wpa.exe) - on the machine PATH\r
- - ETW collection rights for one ordinary account: Performance Log Users\r
- membership plus the "Profile system performance" user right, so xperf and\r
- wpr run WITHOUT elevation\r
+ - Performance Log Users membership for one ordinary account, so it can run\r
+ user-mode ETW sessions (xperf -start ... -on <provider>) without elevation.\r
+ Kernel traces are NOT covered - the NT Kernel Logger is admin-only; see the\r
+ step for what was measured.\r
\r
Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
#>\r
\r
param(\r
- # Account to be granted non-elevated ETW collection rights (see the "ETW\r
- # collection rights" step at the bottom). Defaults to the interactive\r
- # console user, but setup-windows.bat passes it explicitly: with\r
- # over-the-shoulder elevation THIS script runs as the administrator whose\r
- # credentials went into the UAC prompt, not as the user who started the\r
- # batch file, so $env:USERNAME here is the wrong answer.\r
+ # Account to put in Performance Log Users (see the "ETW session control"\r
+ # step, which runs first). Defaults to the interactive console user, but\r
+ # setup-windows.bat passes it explicitly: with over-the-shoulder elevation\r
+ # THIS script runs as the administrator whose credentials went into the UAC\r
+ # prompt, not as the user who started the batch file, so $env:USERNAME here\r
+ # is the wrong answer.\r
#\r
- # Pass an empty string to skip the group membership (the user right is still\r
- # granted to the group, so adding an account later is one command).\r
+ # Pass an empty string to skip it; adding an account later is one\r
+ # `net localgroup` away.\r
[string] $TraceUser = '',\r
\r
- # Do the ETW rights step and nothing else. That step is seconds of registry\r
- # and LSA work with no downloads, where a full run is dominated by the three\r
- # Visual Studio passes, which take minutes even when they have nothing to do.\r
- # It is why the ETW step runs FIRST: -EtwRightsOnly is then just an early\r
- # exit rather than a set of guards down the rest of the script.\r
+ # Do the ETW step and nothing else. It is a group membership and no\r
+ # downloads, where a full run is dominated by the three Visual Studio\r
+ # passes, which take minutes even when they have nothing to do. It is why\r
+ # that step runs FIRST: -EtwRightsOnly is then just an early exit rather\r
+ # than a set of guards down the rest of the script.\r
[switch] $EtwRightsOnly\r
)\r
\r
}\r
}\r
\r
-# ---------------------------------------------------------------------------\r
-# User rights assignment (LSA account rights)\r
-#\r
-# Windows has no built-in cmdlet for "grant this SID this privilege". The two\r
-# ways to script it are secedit (export the whole USER_RIGHTS area to an INF,\r
-# edit one line, re-import) and the LSA API. The API is used here because it is\r
-# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is\r
-# a no-op when it is already held, where a secedit round-trip re-applies every\r
-# user right on the box to fix one of them. The GUI equivalent, for a human, is\r
-# secpol.msc > Local Policies > User Rights Assignment\r
-#\r
-# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's\r
-# Add-Type compiles with the in-box CodeDom compiler.\r
-# ---------------------------------------------------------------------------\r
-function Initialize-LsaRightsType {\r
- if ('LsaRights' -as [type]) { return }\r
- Add-Type -TypeDefinition @'\r
-using System;\r
-using System.ComponentModel;\r
-using System.Runtime.InteropServices;\r
-\r
-public static class LsaRights\r
-{\r
- [StructLayout(LayoutKind.Sequential)]\r
- private struct LSA_UNICODE_STRING\r
- {\r
- public ushort Length;\r
- public ushort MaximumLength;\r
- public IntPtr Buffer;\r
- }\r
-\r
- [StructLayout(LayoutKind.Sequential)]\r
- private struct LSA_OBJECT_ATTRIBUTES\r
- {\r
- public int Length;\r
- public IntPtr RootDirectory;\r
- public IntPtr ObjectName;\r
- public uint Attributes;\r
- public IntPtr SecurityDescriptor;\r
- public IntPtr SecurityQualityOfService;\r
- }\r
-\r
- [DllImport("advapi32.dll", SetLastError = true)]\r
- private static extern uint LsaOpenPolicy(IntPtr systemName,\r
- ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle);\r
-\r
- [DllImport("advapi32.dll", SetLastError = true)]\r
- private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid,\r
- LSA_UNICODE_STRING[] userRights, uint countOfRights);\r
-\r
- [DllImport("advapi32.dll", SetLastError = true)]\r
- private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid,\r
- out IntPtr userRights, out uint countOfRights);\r
-\r
- [DllImport("advapi32.dll")]\r
- private static extern uint LsaClose(IntPtr policyHandle);\r
-\r
- [DllImport("advapi32.dll")]\r
- private static extern uint LsaFreeMemory(IntPtr buffer);\r
-\r
- [DllImport("advapi32.dll")]\r
- private static extern int LsaNtStatusToWinError(uint status);\r
-\r
- private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001;\r
- private const uint POLICY_CREATE_ACCOUNT = 0x00000010;\r
- private const uint POLICY_LOOKUP_NAMES = 0x00000800;\r
-\r
- // Returned by LsaEnumerateAccountRights when the SID holds no rights at all,\r
- // which is an empty list rather than an error.\r
- private const uint STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034;\r
-\r
- private static IntPtr OpenPolicy()\r
- {\r
- LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES();\r
- attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));\r
- IntPtr handle;\r
- uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs,\r
- POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle);\r
- if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
- return handle;\r
- }\r
-\r
- public static string[] Get(byte[] sid)\r
- {\r
- IntPtr policy = OpenPolicy();\r
- try\r
- {\r
- IntPtr rights;\r
- uint count;\r
- uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count);\r
- if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; }\r
- if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
- try\r
- {\r
- string[] result = new string[count];\r
- int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING));\r
- for (int i = 0; i < count; i++)\r
- {\r
- LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure(\r
- new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING));\r
- result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2);\r
- }\r
- return result;\r
- }\r
- finally { LsaFreeMemory(rights); }\r
- }\r
- finally { LsaClose(policy); }\r
- }\r
-\r
- public static void Add(byte[] sid, string right)\r
- {\r
- IntPtr policy = OpenPolicy();\r
- try\r
- {\r
- LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1];\r
- rights[0].Buffer = Marshal.StringToHGlobalUni(right);\r
- // Length counts BYTES and excludes the terminator; MaximumLength includes it.\r
- rights[0].Length = (ushort)(right.Length * 2);\r
- rights[0].MaximumLength = (ushort)(right.Length * 2 + 2);\r
- try\r
- {\r
- uint status = LsaAddAccountRights(policy, sid, rights, 1);\r
- if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
- }\r
- finally { Marshal.FreeHGlobal(rights[0].Buffer); }\r
- }\r
- finally { LsaClose(policy); }\r
- }\r
-}\r
-'@\r
-}\r
-\r
-function Get-SidBytes([string]$Sid) {\r
- $s = New-Object System.Security.Principal.SecurityIdentifier($Sid)\r
- $bytes = New-Object byte[] $s.BinaryLength\r
- $s.GetBinaryForm($bytes, 0)\r
- return ,$bytes\r
-}\r
-\r
-function Get-AccountRight([string]$Sid) {\r
- Initialize-LsaRightsType\r
- return [LsaRights]::Get((Get-SidBytes $Sid))\r
-}\r
-\r
-function Grant-AccountRight([string]$Sid, [string]$Right) {\r
- Initialize-LsaRightsType\r
- [LsaRights]::Add((Get-SidBytes $Sid), $Right)\r
-}\r
-\r
-# ---------------------------------------------------------------------------\r
-# ETW provider-GUID access control\r
-#\r
-# ETW keeps a security descriptor per provider GUID under\r
-# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, and EventAccessControl is\r
-# the documented way to edit one. Editing the registry value directly would work\r
-# too - it is a self-relative SD in a REG_BINARY - but the API takes the SID and\r
-# the rights mask and leaves the descriptor's shape to Windows.\r
-# ---------------------------------------------------------------------------\r
-function Initialize-EtwAclType {\r
- if ('EtwAcl' -as [type]) { return }\r
- Add-Type -TypeDefinition @'\r
-using System;\r
-using System.Runtime.InteropServices;\r
-\r
-public static class EtwAcl\r
-{\r
- // ULONG EventAccessControl(LPGUID, ULONG Operation, PSID, ULONG Rights, BOOLEAN AllowOrDeny)\r
- [DllImport("advapi32.dll", SetLastError = true)]\r
- public static extern uint EventAccessControl(ref Guid guid, uint operation, byte[] sid,\r
- uint rights, [MarshalAs(UnmanagedType.U1)] bool allowOrDeny);\r
-\r
- // ULONG EventAccessQuery(LPGUID, PSECURITY_DESCRIPTOR, PULONG BufferSize)\r
- [DllImport("advapi32.dll", SetLastError = true)]\r
- public static extern uint EventAccessQuery(ref Guid guid, byte[] buffer, ref uint bufferSize);\r
-}\r
-'@\r
-}\r
-\r
-# The rights a session controller needs, from evntrace.h:\r
-# 0x0001 WMIGUID_QUERY 0x0100 TRACELOG_ACCESS_KERNEL_LOGGER\r
-# 0x0020 TRACELOG_CREATE_REALTIME 0x0200 TRACELOG_LOG_EVENT\r
-# 0x0040 TRACELOG_CREATE_ONDISK 0x0400 TRACELOG_ACCESS_REALTIME\r
-# 0x0080 TRACELOG_GUID_ENABLE 0x0800 TRACELOG_REGISTER_GUIDS\r
-# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger\r
-# specifically; the rest are what any controller needs to create a session,\r
-# write it to disk and enable providers on it.\r
-$EtwControllerRights = 0x0FE1\r
-\r
-function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {\r
- Initialize-EtwAclType\r
- $g = [Guid]$Guid\r
- # Operation 2 = EventSecurityAddDACL: add one ACE and leave every existing\r
- # one in place. EventSecuritySetDACL (0) would REPLACE the descriptor, which\r
- # on the kernel logger means removing the entries Windows itself relies on.\r
- $rc = [EtwAcl]::EventAccessControl([ref]$g, 2, (Get-SidBytes $Sid), $Rights, $true)\r
- if ($rc -ne 0) { throw (New-Object System.ComponentModel.Win32Exception([int]$rc)) }\r
-}\r
-\r
-function Get-EtwGuidSddl([string]$Guid) {\r
- Initialize-EtwAclType\r
- $g = [Guid]$Guid\r
- $size = [uint32]0\r
- [void][EtwAcl]::EventAccessQuery([ref]$g, $null, [ref]$size)\r
- if ($size -eq 0) { return $null }\r
- $buf = New-Object byte[] $size\r
- if ([EtwAcl]::EventAccessQuery([ref]$g, $buf, [ref]$size) -ne 0) { return $null }\r
- return (New-Object System.Security.AccessControl.RawSecurityDescriptor($buf, 0)).GetSddlForm('Access')\r
-}\r
-\r
function Show-VsSetupLogs {\r
# The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
# this script runs elevated, that %TEMP% belongs to the elevated user and is\r
try {\r
\r
# ---------------------------------------------------------------------------\r
-# ETW collection rights for an ordinary account\r
+# ETW session control for an ordinary account\r
#\r
-# Out of the box, xperf and wpr only work elevated. THREE separate things stand\r
-# in a standard user's way, and each has its own error:\r
+# Creating or controlling an event tracing session - even a user-mode one naming\r
+# a single provider - is checked against the security descriptor ETW keeps per\r
+# provider GUID under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The\r
+# default grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
+# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM,\r
+# Administrators, the service accounts and BUILTIN\Performance Log Users, and to\r
+# nobody else. Its own description says members "may ... enable trace providers,\r
+# and collect event traces", and that is what membership buys:\r
#\r
-# xperf -on base -> "NT Kernel Logger: Access is denied. (0x5)"\r
-# wpr -start GeneralProfile\r
-# -> "Failed to enable the policy to profile system\r
-# performance." (0xc5585011)\r
+# xperf -start MySession -on Microsoft-Windows-Kernel-Process -f trace.etl\r
+# xperf -stop MySession\r
#\r
-# 1. Creating or controlling ANY event tracing session - even a user-mode one\r
-# naming a single provider - is checked against the security descriptor ETW\r
-# keeps per provider GUID under\r
-# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The DEFAULT descriptor\r
-# grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
-# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to\r
-# SYSTEM, Administrators, the service accounts, and BUILTIN\Performance Log\r
-# Users - and to nobody else. That group is the supported hook; its own\r
-# description says members "may ... enable trace providers, and collect event\r
-# traces".\r
+# runs unelevated for a member and is "Access is denied. (0x5)" for everyone\r
+# else. Enough to trace your own application's providers without a UAC prompt.\r
#\r
-# 2. Switching on the kernel/system trace provider on top of that needs the\r
-# SeSystemProfilePrivilege user right ("Profile system performance"), held by\r
-# default only by Administrators and NT SERVICE\WdiServiceHost. That is the\r
-# one wpr names in its error.\r
+# Membership is read into the access token at LOGON, so the account has to sign\r
+# out and back in. Any NEW logon does it - an ssh login into this box is one,\r
+# which is the quick way to check without dropping the desktop.\r
#\r
-# 3. The kernel logger is not covered by that default descriptor. Its own GUID -\r
-# SystemTraceControlGuid, the session both `xperf -on` and wpr drive - carries\r
-# an explicit descriptor that does not mention Performance Log Users, so 1 and\r
-# 2 are not enough by themselves. Measured on this box with both in place: a\r
-# user-mode session starts (exit 0) and the account holds the privilege, and\r
-# `xperf -on base` still answers "NT Kernel Logger: Access is denied" while\r
-# wpr's error changes from the policy message above to a bare 0x80070005.\r
-# Even READING that descriptor comes back access-denied, which is the tell. So\r
-# add an ACE for the group with EventAccessControl; TRACELOG_ACCESS_KERNEL_LOGGER\r
-# is the right that names this particular session.\r
+# WHAT THIS DOES NOT BUY: system-wide kernel traces. `xperf -on base` and\r
+# `wpr -start` drive the NT Kernel Logger, which is reserved for Administrators\r
+# and LocalSystem - Microsoft documents Performance Log Users access as\r
+# explicitly NOT extending to it. Measured here, so that nobody repeats it: with\r
+# the account in the group, SeSystemProfilePrivilege ("Profile system\r
+# performance") granted to that group, and an explicit ACE giving the group\r
+# TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid - all three in place,\r
+# across a reboot - xperf still answered\r
#\r
-# The privilege and the ACE both go to the GROUP, and the account then goes into\r
-# the group: membership alone becomes the switch, and enabling the next account\r
-# is one `net localgroup` away with no policy or registry edit.\r
+# xperf: error: NT Kernel Logger: Access is denied. (0x5).\r
#\r
-# What this costs, stated plainly: a member of that group can capture\r
-# system-wide kernel traces - process, image, file and registry activity across\r
-# every account on the box, paths and command lines included. That is what the\r
-# group is for, and it is the price of collecting a trace without a UAC prompt.\r
+# It is not a check an ACE overrides. Those two grants were dropped again rather\r
+# than left on the box earning nothing, and CPU sampling and whole-system traces\r
+# are elevated work: run xperf, wpr or VTune from an Administrator prompt.\r
#\r
-# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU\r
-# sampling nor walking stacks in your own processes, and it is equivalent to\r
-# handing out administrator.\r
-#\r
-# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership\r
-# are baked into the access token at LOGON, and UAC hands an administrator a\r
-# filtered token that keeps just five harmless privileges - so an admin's\r
-# ordinary shell still cannot trace, however the policy reads. Running as a\r
-# standard user is what makes this work.\r
-#\r
-# For the same reason 1 and 2 do not take effect in an already-open session: the\r
-# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
-# this box is one, which is the quick way to check without dropping the desktop.\r
-# The ACE in 3 is machine state, read when a session is started, so that one\r
-# applies immediately.\r
-#\r
-# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
-# user. This step is only about collection.\r
+# Analysis needs none of this either way - wpa.exe opens an existing .etl as a\r
+# plain user.\r
# ---------------------------------------------------------------------------\r
-Write-Step 'ETW collection rights (non-elevated xperf / wpr)'\r
+Write-Step 'ETW session control (non-elevated user-mode tracing)'\r
$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
-# SystemTraceControlGuid: the NT Kernel Logger / system session that xperf -on\r
-# and wpr both drive. Fixed by contract, from evntrace.h.\r
-$SystemTraceControlGuid = '9e814aad-3204-11d2-9a82-006008a86939'\r
try {\r
- # --- The user right, granted to the group ---\r
- $existing = Get-AccountRight $PerfLogUsersSid\r
- if ($existing -contains 'SeSystemProfilePrivilege') {\r
- Write-Host ' OK: Performance Log Users already holds SeSystemProfilePrivilege'\r
- } else {\r
- Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'\r
- Write-Host ' Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'\r
- }\r
-\r
- # --- The kernel logger's own descriptor ---\r
- # Idempotent: adding the ACE for a SID that already has it rewrites the same\r
- # entry. Kept in its own try so that a failure here still leaves the group\r
- # membership below to be done - user-mode sessions work without it.\r
- try {\r
- Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights\r
- Write-Host (" Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights)\r
- $sddl = Get-EtwGuidSddl $SystemTraceControlGuid\r
- if ($sddl) { Write-Host " kernel logger DACL is now $sddl" -ForegroundColor DarkGray }\r
- } catch {\r
- Write-Warning "Could not add the ACE on SystemTraceControlGuid: $($_.Exception.Message)"\r
- Write-Warning 'xperf -on will keep answering "NT Kernel Logger: Access is denied."'\r
- }\r
-\r
- # --- The membership ---\r
# Fall back to the console user when the caller did not name one: with\r
# over-the-shoulder elevation that is the person who started\r
# setup-windows.bat, which is who wants to trace.\r
\r
if (-not $target) {\r
Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
- Write-Warning 'The user right is in place, so this is the only step left:'\r
+ Write-Warning 'To do it later:'\r
Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
} else {\r
# Resolve to a SID first: it validates the name, and it is what the\r
Write-Host ''\r
Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
- Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
- Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
+ Write-Host ' xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl' -ForegroundColor Yellow\r
+ Write-Host ' xperf -stop T' -ForegroundColor Yellow\r
}\r
} catch {\r
- Write-Warning "ETW rights setup failed: $($_.Exception.Message)"\r
- Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'\r
- Write-Warning '"Profile system performance" > add Performance Log Users, then'\r
+ Write-Warning "Performance Log Users membership failed: $($_.Exception.Message)"\r
+ Write-Warning 'Do it by hand with:'\r
Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
}\r
\r
}\r
\r
\r
+# ---------------------------------------------------------------------------\r
+# Intel VTune Profiler - reported, not installed\r
+#\r
+# Deliberately NOT automated, unlike everything above. The offline installer is\r
+# a ~750 MB download from a URL carrying a per-release GUID\r
+# (registrationcenter-download.intel.com/akdlm/IRC_NAS/<guid>/intel-vtune-<ver>_offline.exe)\r
+# with no "latest" redirect behind it, so every new build means editing a\r
+# hard-coded link in here - and it is only worth having on Intel silicon, since\r
+# hardware event-based sampling reads Intel PMU counters. Not a good trade for a\r
+# script that has to keep working unattended on any box.\r
+#\r
+# So this step only reports. To install it, take the Windows offline installer\r
+# from\r
+# https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html\r
+# and run it elevated; it installs unattended with\r
+# intel-vtune-<version>_offline.exe -a --silent --cli --eula accept\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'Intel VTune Profiler (status only)'\r
+$UninstallKeys = @(\r
+ 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+ 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+)\r
+$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |\r
+ Where-Object { $_.DisplayName -match 'VTune' } |\r
+ Select-Object -First 1\r
+if ($vtune) {\r
+ Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green\r
+ # The oneAPI layout keeps a `latest` junction beside the versioned directory,\r
+ # so this path stays right across upgrades.\r
+ $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe'\r
+ if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" }\r
+} else {\r
+ Write-Host ' Not installed.' -ForegroundColor Yellow\r
+ Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow\r
+ $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer\r
+ if ($cpu -and $cpu -notmatch 'Intel') {\r
+ Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow\r
+ }\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
Write-Host "`nAll done." -ForegroundColor Green\r
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'\r
vilimpoc.org / repos / dotfiles / blobdiff