#\r
# Pass an empty string to skip the group membership (the user right is still\r
# granted to the group, so adding an account later is one command).\r
- [string] $TraceUser = ''\r
+ [string] $TraceUser = '',\r
+\r
+ # Do the ETW rights step and nothing else. That step is seconds of registry\r
+ # and LSA work with no downloads, where a full run is dominated by the three\r
+ # Visual Studio passes, which take minutes even when they have nothing to do.\r
+ # It is why the ETW step runs FIRST: -EtwRightsOnly is then just an early\r
+ # exit rather than a set of guards down the rest of the script.\r
+ [switch] $EtwRightsOnly\r
)\r
\r
$ErrorActionPreference = 'Stop'\r
[LsaRights]::Add((Get-SidBytes $Sid), $Right)\r
}\r
\r
+# ---------------------------------------------------------------------------\r
+# ETW provider-GUID access control\r
+#\r
+# ETW keeps a security descriptor per provider GUID under\r
+# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, and EventAccessControl is\r
+# the documented way to edit one. Editing the registry value directly would work\r
+# too - it is a self-relative SD in a REG_BINARY - but the API takes the SID and\r
+# the rights mask and leaves the descriptor's shape to Windows.\r
+# ---------------------------------------------------------------------------\r
+function Initialize-EtwAclType {\r
+ if ('EtwAcl' -as [type]) { return }\r
+ Add-Type -TypeDefinition @'\r
+using System;\r
+using System.Runtime.InteropServices;\r
+\r
+public static class EtwAcl\r
+{\r
+ // ULONG EventAccessControl(LPGUID, ULONG Operation, PSID, ULONG Rights, BOOLEAN AllowOrDeny)\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ public static extern uint EventAccessControl(ref Guid guid, uint operation, byte[] sid,\r
+ uint rights, [MarshalAs(UnmanagedType.U1)] bool allowOrDeny);\r
+\r
+ // ULONG EventAccessQuery(LPGUID, PSECURITY_DESCRIPTOR, PULONG BufferSize)\r
+ [DllImport("advapi32.dll", SetLastError = true)]\r
+ public static extern uint EventAccessQuery(ref Guid guid, byte[] buffer, ref uint bufferSize);\r
+}\r
+'@\r
+}\r
+\r
+# The rights a session controller needs, from evntrace.h:\r
+# 0x0001 WMIGUID_QUERY 0x0100 TRACELOG_ACCESS_KERNEL_LOGGER\r
+# 0x0020 TRACELOG_CREATE_REALTIME 0x0200 TRACELOG_LOG_EVENT\r
+# 0x0040 TRACELOG_CREATE_ONDISK 0x0400 TRACELOG_ACCESS_REALTIME\r
+# 0x0080 TRACELOG_GUID_ENABLE 0x0800 TRACELOG_REGISTER_GUIDS\r
+# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger\r
+# specifically; the rest are what any controller needs to create a session,\r
+# write it to disk and enable providers on it.\r
+#\r
+# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and\r
+# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the\r
+# group cannot read the descriptor back, which makes EventAccessQuery useless as\r
+# a check on whether the grant landed: it answers "access denied" either way.\r
+$EtwControllerRights = 0x120FE1\r
+\r
+function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {\r
+ Initialize-EtwAclType\r
+ $g = [Guid]$Guid\r
+ # Operation 2 = EventSecurityAddDACL: add one ACE and leave every existing\r
+ # one in place. EventSecuritySetDACL (0) would REPLACE the descriptor, which\r
+ # on the kernel logger means removing the entries Windows itself relies on.\r
+ $rc = [EtwAcl]::EventAccessControl([ref]$g, 2, (Get-SidBytes $Sid), $Rights, $true)\r
+ if ($rc -ne 0) { throw (New-Object System.ComponentModel.Win32Exception([int]$rc)) }\r
+}\r
+\r
+function Get-EtwGuidSddl([string]$Guid) {\r
+ Initialize-EtwAclType\r
+ $g = [Guid]$Guid\r
+ $size = [uint32]0\r
+ [void][EtwAcl]::EventAccessQuery([ref]$g, $null, [ref]$size)\r
+ if ($size -eq 0) { return $null }\r
+ $buf = New-Object byte[] $size\r
+ if ([EtwAcl]::EventAccessQuery([ref]$g, $buf, [ref]$size) -ne 0) { return $null }\r
+ return (New-Object System.Security.AccessControl.RawSecurityDescriptor($buf, 0)).GetSddlForm('Access')\r
+}\r
+\r
function Show-VsSetupLogs {\r
# The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
# this script runs elevated, that %TEMP% belongs to the elevated user and is\r
\r
try {\r
\r
+# ---------------------------------------------------------------------------\r
+# ETW collection rights for an ordinary account\r
+#\r
+# Out of the box, xperf and wpr only work elevated. THREE separate things stand\r
+# in a standard user's way, and each has its own error:\r
+#\r
+# xperf -on base -> "NT Kernel Logger: Access is denied. (0x5)"\r
+# wpr -start GeneralProfile\r
+# -> "Failed to enable the policy to profile system\r
+# performance." (0xc5585011)\r
+#\r
+# 1. Creating or controlling ANY event tracing session - even a user-mode one\r
+# naming a single provider - is checked against the security descriptor ETW\r
+# keeps per provider GUID under\r
+# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The DEFAULT descriptor\r
+# grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
+# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to\r
+# SYSTEM, Administrators, the service accounts, and BUILTIN\Performance Log\r
+# Users - and to nobody else. That group is the supported hook; its own\r
+# description says members "may ... enable trace providers, and collect event\r
+# traces".\r
+#\r
+# 2. Switching on the kernel/system trace provider on top of that needs the\r
+# SeSystemProfilePrivilege user right ("Profile system performance"), held by\r
+# default only by Administrators and NT SERVICE\WdiServiceHost. That is the\r
+# one wpr names in its error.\r
+#\r
+# 3. The kernel logger is not covered by that default descriptor. Its own GUID -\r
+# SystemTraceControlGuid, the session both `xperf -on` and wpr drive - carries\r
+# an explicit descriptor that does not mention Performance Log Users, so 1 and\r
+# 2 are not enough by themselves. Measured on this box with both in place: a\r
+# user-mode session starts (exit 0) and the account holds the privilege, and\r
+# `xperf -on base` still answers "NT Kernel Logger: Access is denied" while\r
+# wpr's error changes from the policy message above to a bare 0x80070005.\r
+# Even READING that descriptor comes back access-denied, which is the tell. So\r
+# add an ACE for the group with EventAccessControl; TRACELOG_ACCESS_KERNEL_LOGGER\r
+# is the right that names this particular session.\r
+#\r
+# The privilege and the ACE both go to the GROUP, and the account then goes into\r
+# the group: membership alone becomes the switch, and enabling the next account\r
+# is one `net localgroup` away with no policy or registry edit.\r
+#\r
+# What this costs, stated plainly: a member of that group can capture\r
+# system-wide kernel traces - process, image, file and registry activity across\r
+# every account on the box, paths and command lines included. That is what the\r
+# group is for, and it is the price of collecting a trace without a UAC prompt.\r
+#\r
+# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU\r
+# sampling nor walking stacks in your own processes, and it is equivalent to\r
+# handing out administrator.\r
+#\r
+# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership\r
+# are baked into the access token at LOGON, and UAC hands an administrator a\r
+# filtered token that keeps just five harmless privileges - so an admin's\r
+# ordinary shell still cannot trace, however the policy reads. Running as a\r
+# standard user is what makes this work.\r
+#\r
+# For the same reason 1 and 2 do not take effect in an already-open session: the\r
+# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
+# this box is one, which is the quick way to check without dropping the desktop.\r
+# The ACE in 3 is machine state rather than token state, so a logon does nothing\r
+# for it. ETW reads these descriptors into a cache, so a REBOOT is what is\r
+# expected to put the change into effect: with the ACE written and readable in\r
+# the descriptor, xperf -on base was still answering "Access is denied" from a\r
+# fresh shell on the running system. So on a first run, plan on both - a new\r
+# logon for 1 and 2, a reboot for 3.\r
+#\r
+# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
+# user. This step is only about collection.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'ETW collection rights (non-elevated xperf / wpr)'\r
+$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
+# SystemTraceControlGuid: the NT Kernel Logger / system session that xperf -on\r
+# and wpr both drive. Fixed by contract, from evntrace.h.\r
+$SystemTraceControlGuid = '9e814aad-3204-11d2-9a82-006008a86939'\r
+try {\r
+ # --- The user right, granted to the group ---\r
+ $existing = Get-AccountRight $PerfLogUsersSid\r
+ if ($existing -contains 'SeSystemProfilePrivilege') {\r
+ Write-Host ' OK: Performance Log Users already holds SeSystemProfilePrivilege'\r
+ } else {\r
+ Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'\r
+ Write-Host ' Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'\r
+ }\r
+\r
+ # --- The kernel logger's own descriptor ---\r
+ # Safe to repeat: a second ACE for the same SID unions to the same access.\r
+ # Kept in its own try so that a failure here still leaves the group\r
+ # membership below to be done - user-mode sessions work without it.\r
+ #\r
+ # ETW reads these descriptors out of the registry into a cache, so a REBOOT\r
+ # is what puts a change here into effect - not a new logon, which is what the\r
+ # group membership and the privilege need. Both, on a first run.\r
+ try {\r
+ Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights\r
+ Write-Host (" Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights)\r
+ $sddl = Get-EtwGuidSddl $SystemTraceControlGuid\r
+ if ($sddl) { Write-Host " kernel logger DACL is now $sddl" -ForegroundColor DarkGray }\r
+ } catch {\r
+ Write-Warning "Could not add the ACE on SystemTraceControlGuid: $($_.Exception.Message)"\r
+ Write-Warning 'xperf -on will keep answering "NT Kernel Logger: Access is denied."'\r
+ }\r
+\r
+ # --- The membership ---\r
+ # Fall back to the console user when the caller did not name one: with\r
+ # over-the-shoulder elevation that is the person who started\r
+ # setup-windows.bat, which is who wants to trace.\r
+ $target = $TraceUser\r
+ if (-not $target) {\r
+ $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
+ if ($target) { Write-Host " No -TraceUser given; using the console user $target" }\r
+ }\r
+\r
+ if (-not $target) {\r
+ Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
+ Write-Warning 'The user right is in place, so this is the only step left:'\r
+ Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
+ } else {\r
+ # Resolve to a SID first: it validates the name, and it is what the\r
+ # membership check compares, so a member spelled ".\claude" in one place\r
+ # and "LATISLAB\claude" in another is still recognised as the same account.\r
+ $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
+ [System.Security.Principal.SecurityIdentifier])\r
+\r
+ # By SID, never by name: "Performance Log Users" is localised, and\r
+ # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
+ $group = Get-LocalGroup -SID $PerfLogUsersSid\r
+\r
+ # Get-LocalGroupMember throws on a group holding a SID that no longer\r
+ # resolves (a known Windows 10 bug), so a failure to READ the membership\r
+ # must not stop us from writing it - fall through and let the add report.\r
+ $already = $false\r
+ try {\r
+ $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
+ Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
+ } catch {\r
+ Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
+ }\r
+\r
+ if ($already) {\r
+ Write-Host " OK: $target is already in $($group.Name)"\r
+ } else {\r
+ try {\r
+ Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
+ } catch {\r
+ # "already a member" is only reachable when the enumeration above\r
+ # failed, and is not an error. Matched on the type NAME rather\r
+ # than in a typed catch clause: catch types are resolved when the\r
+ # script is PARSED, before the LocalAccounts module has been\r
+ # autoloaded, so naming the type there is a parse error that\r
+ # would take the whole script down.\r
+ if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
+ }\r
+ Write-Host " Added $target to $($group.Name)"\r
+ }\r
+\r
+ Write-Host ''\r
+ Write-Host " $target must sign out and back in for the group and the privilege," -ForegroundColor Yellow\r
+ Write-Host ' and the box must be REBOOTED for the kernel logger ACE (ETW caches it).' -ForegroundColor Yellow\r
+ Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
+ Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
+ Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
+ }\r
+} catch {\r
+ Write-Warning "ETW rights setup failed: $($_.Exception.Message)"\r
+ Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'\r
+ Write-Warning '"Profile system performance" > add Performance Log Users, then'\r
+ Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
+}\r
+\r
+if ($EtwRightsOnly) {\r
+ # `exit` inside the try still runs the finally below, so the transcript is\r
+ # stopped and the log is left readable by the non-elevated caller.\r
+ Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green\r
+ exit 0\r
+}\r
+\r
+\r
# ---------------------------------------------------------------------------\r
# Base tools via winget\r
# ---------------------------------------------------------------------------\r
}\r
}\r
\r
+\r
# ---------------------------------------------------------------------------\r
-# ETW collection rights for an ordinary account\r
-#\r
-# Out of the box, xperf and wpr only work elevated, and they fail in two\r
-# different ways for a standard user - because two different things are missing:\r
-#\r
-# xperf -on base -> "NT Kernel Logger: Access is denied. (0x5)"\r
-# wpr -start GeneralProfile\r
-# -> "Failed to enable the policy to profile system\r
-# performance." (0xc5585011)\r
-#\r
-# 1. Creating or controlling ANY event tracing session - even a user-mode one\r
-# naming a single provider - is checked against the security descriptor ETW\r
-# keeps per provider GUID under\r
-# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The default grants the\r
-# session-control rights (TRACELOG_CREATE_ONDISK, TRACELOG_CREATE_REALTIME,\r
-# TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM, Administrators, the\r
-# service accounts, and BUILTIN\Performance Log Users - and to nobody else.\r
-# That group is the supported hook; its own description says members "may\r
-# ... enable trace providers, and collect event traces".\r
-#\r
-# 2. Switching on the kernel/system trace provider on top of that needs the\r
-# SeSystemProfilePrivilege user right ("Profile system performance"), held by\r
-# default only by Administrators and NT SERVICE\WdiServiceHost. That is the\r
-# one wpr names in its error, and the one xperf trips over for -on base.\r
-#\r
-# So grant the privilege to the GROUP and then put the account in the group:\r
-# membership alone becomes the switch, and enabling the next account is one\r
-# `net localgroup` away with no policy edit.\r
-#\r
-# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU\r
-# sampling nor walking stacks in your own processes, and it is equivalent to\r
-# handing out administrator.\r
-#\r
-# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership\r
-# are baked into the access token at LOGON, and UAC hands an administrator a\r
-# filtered token that keeps just five harmless privileges - so an admin's\r
-# ordinary shell still cannot trace, however the policy reads. Running as a\r
-# standard user is what makes this work.\r
+# Intel VTune Profiler - reported, not installed\r
#\r
-# For the same reason nothing here takes effect in an already-open session: the\r
-# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
-# this box is one, which is the quick way to check without dropping the desktop.\r
+# Deliberately NOT automated, unlike everything above. The offline installer is\r
+# a ~750 MB download from a URL carrying a per-release GUID\r
+# (registrationcenter-download.intel.com/akdlm/IRC_NAS/<guid>/intel-vtune-<ver>_offline.exe)\r
+# with no "latest" redirect behind it, so every new build means editing a\r
+# hard-coded link in here - and it is only worth having on Intel silicon, since\r
+# hardware event-based sampling reads Intel PMU counters. Not a good trade for a\r
+# script that has to keep working unattended on any box.\r
#\r
-# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
-# user. This step is only about collection.\r
+# So this step only reports. To install it, take the Windows offline installer\r
+# from\r
+# https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html\r
+# and run it elevated; it installs unattended with\r
+# intel-vtune-<version>_offline.exe -a --silent --cli --eula accept\r
# ---------------------------------------------------------------------------\r
-Write-Step 'ETW collection rights (non-elevated xperf / wpr)'\r
-$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
-try {\r
- # --- The user right, granted to the group ---\r
- $existing = Get-AccountRight $PerfLogUsersSid\r
- if ($existing -contains 'SeSystemProfilePrivilege') {\r
- Write-Host ' OK: Performance Log Users already holds SeSystemProfilePrivilege'\r
- } else {\r
- Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'\r
- Write-Host ' Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'\r
- }\r
-\r
- # --- The membership ---\r
- # Fall back to the console user when the caller did not name one: with\r
- # over-the-shoulder elevation that is the person who started\r
- # setup-windows.bat, which is who wants to trace.\r
- $target = $TraceUser\r
- if (-not $target) {\r
- $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
- if ($target) { Write-Host " No -TraceUser given; using the console user $target" }\r
- }\r
-\r
- if (-not $target) {\r
- Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
- Write-Warning 'The user right is in place, so this is the only step left:'\r
- Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
- } else {\r
- # Resolve to a SID first: it validates the name, and it is what the\r
- # membership check compares, so a member spelled ".\claude" in one place\r
- # and "LATISLAB\claude" in another is still recognised as the same account.\r
- $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
- [System.Security.Principal.SecurityIdentifier])\r
-\r
- # By SID, never by name: "Performance Log Users" is localised, and\r
- # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
- $group = Get-LocalGroup -SID $PerfLogUsersSid\r
-\r
- # Get-LocalGroupMember throws on a group holding a SID that no longer\r
- # resolves (a known Windows 10 bug), so a failure to READ the membership\r
- # must not stop us from writing it - fall through and let the add report.\r
- $already = $false\r
- try {\r
- $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
- Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
- } catch {\r
- Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
- }\r
-\r
- if ($already) {\r
- Write-Host " OK: $target is already in $($group.Name)"\r
- } else {\r
- try {\r
- Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
- } catch {\r
- # "already a member" is only reachable when the enumeration above\r
- # failed, and is not an error. Matched on the type NAME rather\r
- # than in a typed catch clause: catch types are resolved when the\r
- # script is PARSED, before the LocalAccounts module has been\r
- # autoloaded, so naming the type there is a parse error that\r
- # would take the whole script down.\r
- if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
- }\r
- Write-Host " Added $target to $($group.Name)"\r
- }\r
-\r
- Write-Host ''\r
- Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
- Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
- Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
- Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
+Write-Step 'Intel VTune Profiler (status only)'\r
+$UninstallKeys = @(\r
+ 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+ 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+)\r
+$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |\r
+ Where-Object { $_.DisplayName -match 'VTune' } |\r
+ Select-Object -First 1\r
+if ($vtune) {\r
+ Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green\r
+ # The oneAPI layout keeps a `latest` junction beside the versioned directory,\r
+ # so this path stays right across upgrades.\r
+ $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe'\r
+ if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" }\r
+} else {\r
+ Write-Host ' Not installed.' -ForegroundColor Yellow\r
+ Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow\r
+ $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer\r
+ if ($cpu -and $cpu -notmatch 'Intel') {\r
+ Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow\r
}\r
-} catch {\r
- Write-Warning "ETW rights setup failed: $($_.Exception.Message)"\r
- Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'\r
- Write-Warning '"Profile system performance" > add Performance Log Users, then'\r
- Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
}\r
\r
# ---------------------------------------------------------------------------\r
vilimpoc.org / repos / dotfiles / blobdiff