- Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX,\r
Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset)\r
- Windows Driver Kit 10.0.26100\r
+ - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
+ (wpa.exe) - on the machine PATH\r
+ - ETW collection rights for one ordinary account: Performance Log Users\r
+ membership plus the "Profile system performance" user right, so xperf and\r
+ wpr run WITHOUT elevation\r
\r
Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
Enterprise : https://aka.ms/vs/17/release/vs_enterprise.exe\r
#>\r
\r
+param(\r
+ # Account to be granted non-elevated ETW collection rights (see the "ETW\r
+ # collection rights" step at the bottom). Defaults to the interactive\r
+ # console user, but setup-windows.bat passes it explicitly: with\r
+ # over-the-shoulder elevation THIS script runs as the administrator whose\r
+ # credentials went into the UAC prompt, not as the user who started the\r
+ # batch file, so $env:USERNAME here is the wrong answer.\r
+ #\r
+ # Pass an empty string to skip the group membership (the user right is still\r
+ # granted to the group, so adding an account later is one command).\r
+ [string] $TraceUser = ''\r
+)\r
+\r
$ErrorActionPreference = 'Stop'\r
\r
function Write-Step([string]$Msg) {\r
}\r
}\r
\r
+# ---------------------------------------------------------------------------\r
+# User rights assignment (LSA account rights)\r
+#\r
+# Windows has no built-in cmdlet for "grant this SID this privilege". The two\r
+# ways to script it are secedit (export the whole USER_RIGHTS area to an INF,\r
+# edit one line, re-import) and the LSA API. The API is used here because it is\r
+# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is\r
+# a no-op when it is already held, where a secedit round-trip re-applies every\r
+# user right on the box to fix one of them. The GUI equivalent, for a human, is\r
+# secpol.msc > Local Policies > User Rights Assignment\r
+#\r
+# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's\r
+# Add-Type compiles with the in-box CodeDom compiler.\r
+# ---------------------------------------------------------------------------\r
+function Initialize-LsaRightsType {\r
+ if ('LsaRights' -as [type]) { return }\r
+ Add-Type -TypeDefinition @'\r
+using System;\r
+using System.ComponentModel;\r
+using System.Runtime.InteropServices;\r
+\r
+public static class LsaRights\r
+{\r
+ [StructLayout(LayoutKind.Sequential)]\r
+ private struct LSA_UNICODE_STRING\r
+ {\r
+ public ushort Length;\r
+ public ushort MaximumLength;\r
+ public IntPtr Buffer;\r
+ }\r
+\r
+ [StructLayout(LayoutKind.Sequential)]\r
+ private struct LSA_OBJECT_ATTRIBUTES\r
+ {\r
+ public int Length;\r
+ public IntPtr RootDirectory;\r
+ public IntPtr ObjectName;\r
+ public uint Attributes;\r
+ public IntPtr SecurityDescriptor;\r
+ public IntPtr SecurityQualityOfService;\r
+ }\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaOpenPolicy(IntPtr systemName,\r
+ ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle);\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid,\r
+ LSA_UNICODE_STRING[] userRights, uint countOfRights);\r
+\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid,\r
+ out IntPtr userRights, out uint countOfRights);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern uint LsaClose(IntPtr policyHandle);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern uint LsaFreeMemory(IntPtr buffer);\r
+\r
+ [DllImport("advapi32.dll")]\r
+ private static extern int LsaNtStatusToWinError(uint status);\r
+\r
+ private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001;\r
+ private const uint POLICY_CREATE_ACCOUNT = 0x00000010;\r
+ private const uint POLICY_LOOKUP_NAMES = 0x00000800;\r
+\r
+ // Returned by LsaEnumerateAccountRights when the SID holds no rights at all,\r
+ // which is an empty list rather than an error.\r
+ private const uint STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034;\r
+\r
+ private static IntPtr OpenPolicy()\r
+ {\r
+ LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES();\r
+ attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));\r
+ IntPtr handle;\r
+ uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs,\r
+ POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle);\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ return handle;\r
+ }\r
+\r
+ public static string[] Get(byte[] sid)\r
+ {\r
+ IntPtr policy = OpenPolicy();\r
+ try\r
+ {\r
+ IntPtr rights;\r
+ uint count;\r
+ uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count);\r
+ if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; }\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ try\r
+ {\r
+ string[] result = new string[count];\r
+ int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING));\r
+ for (int i = 0; i < count; i++)\r
+ {\r
+ LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure(\r
+ new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING));\r
+ result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2);\r
+ }\r
+ return result;\r
+ }\r
+ finally { LsaFreeMemory(rights); }\r
+ }\r
+ finally { LsaClose(policy); }\r
+ }\r
+\r
+ public static void Add(byte[] sid, string right)\r
+ {\r
+ IntPtr policy = OpenPolicy();\r
+ try\r
+ {\r
+ LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1];\r
+ rights[0].Buffer = Marshal.StringToHGlobalUni(right);\r
+ // Length counts BYTES and excludes the terminator; MaximumLength includes it.\r
+ rights[0].Length = (ushort)(right.Length * 2);\r
+ rights[0].MaximumLength = (ushort)(right.Length * 2 + 2);\r
+ try\r
+ {\r
+ uint status = LsaAddAccountRights(policy, sid, rights, 1);\r
+ if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
+ }\r
+ finally { Marshal.FreeHGlobal(rights[0].Buffer); }\r
+ }\r
+ finally { LsaClose(policy); }\r
+ }\r
+}\r
+'@\r
+}\r
+\r
+function Get-SidBytes([string]$Sid) {\r
+ $s = New-Object System.Security.Principal.SecurityIdentifier($Sid)\r
+ $bytes = New-Object byte[] $s.BinaryLength\r
+ $s.GetBinaryForm($bytes, 0)\r
+ return ,$bytes\r
+}\r
+\r
+function Get-AccountRight([string]$Sid) {\r
+ Initialize-LsaRightsType\r
+ return [LsaRights]::Get((Get-SidBytes $Sid))\r
+}\r
+\r
+function Grant-AccountRight([string]$Sid, [string]$Right) {\r
+ Initialize-LsaRightsType\r
+ [LsaRights]::Add((Get-SidBytes $Sid), $Right)\r
+}\r
+\r
function Show-VsSetupLogs {\r
# The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
# this script runs elevated, that %TEMP% belongs to the elevated user and is\r
}\r
\r
# ---------------------------------------------------------------------------\r
-# Windows Performance Toolkit (xperf / WPA / wpr) -- ETW CPU + loader profiling,\r
-# used by the perf/ measurement scripts. WPT is an OPTIONAL Windows SDK feature\r
-# that the VS "Windows 11 SDK" component does NOT select, so a fresh box lacks it.\r
-# The Windows ADK bundles WPT and winget owns the (versioned) download URL, so it\r
-# is the most reliable source. Idempotent (skips if xperf is already present in\r
-# either the SDK or ADK location) and non-fatal so it never aborts provisioning.\r
-# Lighter alternative if you don't want the full ADK: install the Windows SDK's\r
-# "Windows Performance Toolkit" optional feature via winsdksetup.exe /features\r
-# OptionId.WindowsPerformanceToolkit.\r
+# Windows Performance Toolkit: xperf, wpr, and Windows Performance Analyzer\r
+# (wpa.exe) -- ETW CPU + loader profiling and the GUI that reads the traces.\r
+#\r
+# WPA is NOT a Visual Studio component and has no relationship to VS's own\r
+# Performance Profiler (a separate, .diagsession-based tool that cannot open an\r
+# .etl). It ships in exactly two places: as an optional FEATURE of the Windows\r
+# SDK ("Windows Performance Toolkit", OptionId.WindowsPerformanceToolkit), and\r
+# in the Windows ADK, which bundles the same toolkit. Whether the SDK install\r
+# that Visual Studio performs happens to select that feature varies with the VS\r
+# and SDK version - when it does, WPT lands in\r
+# %ProgramFiles(x86)%\Windows Kits\10\Windows Performance Toolkit and the SDK\r
+# puts that directory on the machine PATH itself - so this step DETECTS first\r
+# and only falls back to installing the ADK (winget owns the versioned download\r
+# URL, which makes it the reliable source) when nothing is there. That fallback\r
+# is a large download; to install just the toolkit instead, run the standalone\r
+# SDK setup with\r
+# winsdksetup.exe /features OptionId.WindowsPerformanceToolkit /q\r
+#\r
+# There is also a newer WPA in the Microsoft Store (`winget install --id\r
+# 9N0W1B2BXGNZ --source msstore`), which updates independently of the SDK. It is\r
+# not installed here: the Store package needs an interactive, signed-in session,\r
+# which is exactly what this elevated, unattended half does not have.\r
+#\r
+# Idempotent and non-fatal - it never aborts provisioning.\r
# ---------------------------------------------------------------------------\r
-Write-Step 'Windows Performance Toolkit (xperf / WPA)'\r
-$wptRoots = @(\r
- (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
- (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'),\r
- (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit\xperf.exe')\r
+Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)'\r
+$WptDirs = @(\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'),\r
+ (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit'),\r
+ (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit')\r
)\r
-$xperf = $wptRoots | Where-Object { Test-Path $_ } | Select-Object -First 1\r
-if ($xperf) {\r
- Write-Host " OK: WPT already present ($xperf)" -ForegroundColor Green\r
+function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 }\r
+\r
+$WptDir = Find-WptDir\r
+if ($WptDir) {\r
+ Write-Host " OK: WPT already present ($WptDir)" -ForegroundColor Green\r
} else {\r
try {\r
winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity `\r
--accept-source-agreements --accept-package-agreements\r
Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.'\r
+ $WptDir = Find-WptDir\r
} catch {\r
Write-Warning "WPT install failed: $($_.Exception.Message)"\r
Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the'\r
}\r
}\r
\r
+if ($WptDir) {\r
+ # Report what actually landed. wpa.exe is the piece people come looking for\r
+ # and it is the one that is absent if a trimmed toolkit ever shows up.\r
+ foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') {\r
+ $p = Join-Path $WptDir $tool\r
+ if (Test-Path $p) {\r
+ Write-Host " $tool $((Get-Item $p).VersionInfo.ProductVersion)"\r
+ } else {\r
+ Write-Warning "$tool is missing from $WptDir"\r
+ }\r
+ }\r
+\r
+ # The WPT installer normally adds this to the machine PATH itself (and the\r
+ # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for\r
+ # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user\r
+ # one so it also resolves for the non-interactive sshd sessions this box is\r
+ # driven through, which build their environment from the registry PATH.\r
+ # Compared trailing-backslash-insensitively - the installer's own entry has\r
+ # one, and adding a second spelling of the same directory is just noise.\r
+ $m = [Environment]::GetEnvironmentVariable('Path', 'Machine')\r
+ if (-not $m) { $m = '' }\r
+ $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') }\r
+ if ($have) {\r
+ Write-Host " OK: $WptDir already in the machine PATH"\r
+ } else {\r
+ $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir }\r
+ [Environment]::SetEnvironmentVariable('Path', $new, 'Machine')\r
+ Write-Host " Added $WptDir to the machine PATH (restart shells to pick it up)."\r
+ }\r
+}\r
+\r
+# ---------------------------------------------------------------------------\r
+# ETW collection rights for an ordinary account\r
+#\r
+# Out of the box, xperf and wpr only work elevated, and they fail in two\r
+# different ways for a standard user - because two different things are missing:\r
+#\r
+# xperf -on base -> "NT Kernel Logger: Access is denied. (0x5)"\r
+# wpr -start GeneralProfile\r
+# -> "Failed to enable the policy to profile system\r
+# performance." (0xc5585011)\r
+#\r
+# 1. Creating or controlling ANY event tracing session - even a user-mode one\r
+# naming a single provider - is checked against the security descriptor ETW\r
+# keeps per provider GUID under\r
+# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The default grants the\r
+# session-control rights (TRACELOG_CREATE_ONDISK, TRACELOG_CREATE_REALTIME,\r
+# TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM, Administrators, the\r
+# service accounts, and BUILTIN\Performance Log Users - and to nobody else.\r
+# That group is the supported hook; its own description says members "may\r
+# ... enable trace providers, and collect event traces".\r
+#\r
+# 2. Switching on the kernel/system trace provider on top of that needs the\r
+# SeSystemProfilePrivilege user right ("Profile system performance"), held by\r
+# default only by Administrators and NT SERVICE\WdiServiceHost. That is the\r
+# one wpr names in its error, and the one xperf trips over for -on base.\r
+#\r
+# So grant the privilege to the GROUP and then put the account in the group:\r
+# membership alone becomes the switch, and enabling the next account is one\r
+# `net localgroup` away with no policy edit.\r
+#\r
+# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU\r
+# sampling nor walking stacks in your own processes, and it is equivalent to\r
+# handing out administrator.\r
+#\r
+# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership\r
+# are baked into the access token at LOGON, and UAC hands an administrator a\r
+# filtered token that keeps just five harmless privileges - so an admin's\r
+# ordinary shell still cannot trace, however the policy reads. Running as a\r
+# standard user is what makes this work.\r
+#\r
+# For the same reason nothing here takes effect in an already-open session: the\r
+# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
+# this box is one, which is the quick way to check without dropping the desktop.\r
+#\r
+# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
+# user. This step is only about collection.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'ETW collection rights (non-elevated xperf / wpr)'\r
+$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
+try {\r
+ # --- The user right, granted to the group ---\r
+ $existing = Get-AccountRight $PerfLogUsersSid\r
+ if ($existing -contains 'SeSystemProfilePrivilege') {\r
+ Write-Host ' OK: Performance Log Users already holds SeSystemProfilePrivilege'\r
+ } else {\r
+ Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'\r
+ Write-Host ' Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'\r
+ }\r
+\r
+ # --- The membership ---\r
+ # Fall back to the console user when the caller did not name one: with\r
+ # over-the-shoulder elevation that is the person who started\r
+ # setup-windows.bat, which is who wants to trace.\r
+ $target = $TraceUser\r
+ if (-not $target) {\r
+ $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
+ if ($target) { Write-Host " No -TraceUser given; using the console user $target" }\r
+ }\r
+\r
+ if (-not $target) {\r
+ Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
+ Write-Warning 'The user right is in place, so this is the only step left:'\r
+ Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
+ } else {\r
+ # Resolve to a SID first: it validates the name, and it is what the\r
+ # membership check compares, so a member spelled ".\claude" in one place\r
+ # and "LATISLAB\claude" in another is still recognised as the same account.\r
+ $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
+ [System.Security.Principal.SecurityIdentifier])\r
+\r
+ # By SID, never by name: "Performance Log Users" is localised, and\r
+ # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
+ $group = Get-LocalGroup -SID $PerfLogUsersSid\r
+\r
+ # Get-LocalGroupMember throws on a group holding a SID that no longer\r
+ # resolves (a known Windows 10 bug), so a failure to READ the membership\r
+ # must not stop us from writing it - fall through and let the add report.\r
+ $already = $false\r
+ try {\r
+ $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
+ Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
+ } catch {\r
+ Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
+ }\r
+\r
+ if ($already) {\r
+ Write-Host " OK: $target is already in $($group.Name)"\r
+ } else {\r
+ try {\r
+ Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
+ } catch {\r
+ # "already a member" is only reachable when the enumeration above\r
+ # failed, and is not an error. Matched on the type NAME rather\r
+ # than in a typed catch clause: catch types are resolved when the\r
+ # script is PARSED, before the LocalAccounts module has been\r
+ # autoloaded, so naming the type there is a parse error that\r
+ # would take the whole script down.\r
+ if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
+ }\r
+ Write-Host " Added $target to $($group.Name)"\r
+ }\r
+\r
+ Write-Host ''\r
+ Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
+ Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
+ Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
+ Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
+ }\r
+} catch {\r
+ Write-Warning "ETW rights setup failed: $($_.Exception.Message)"\r
+ Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'\r
+ Write-Warning '"Profile system performance" > add Performance Log Users, then'\r
+ Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
+}\r
+\r
# ---------------------------------------------------------------------------\r
Write-Host "`nAll done." -ForegroundColor Green\r
Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'\r
vilimpoc.org / repos / dotfiles / blobdiff