dotfiles: drop the non-elevated ETW tracing, it never worked

[dotfiles] / README.md

diff --git a/README.md b/README.md
index aea40620d1cc29d4cb713a6039b6cdbd573edf25..7c986501ecf46e0774cc835dd779883fad3bcc3f 100644 (file)
--- a/README.md
+++ b/README.md
@@ -16,7 +16,7 @@ throwaway VM reachable from a Linux host.
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |
 | --- | --- |
 | `setup-windows.bat` | Entry point. Runs the winget installs, then launches the elevated half and prints its log, then runs the non-elevated script. |
 | `setup-windows-no-uac.ps1` | The non-elevated, per-user half: WinMerge and BinSkim on the user `PATH`, and the global git config (identity, plus `core.sshCommand`). Can also be run directly from an ordinary prompt. |

-| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit, and finally grants one ordinary account the rights to collect ETW traces without elevation. Can also be run directly from an Administrator prompt — pass `-TraceUser DOMAIN\user` to say who gets those rights. |
+| `setup-windows-with-uac.ps1` | The elevated half, started via UAC by the batch file. Enables `ssh-agent`, installs the OpenSSH Client and Server capabilities and starts `sshd`, unpacks the `rsync-windows` release zip for this architecture (`rsync.exe` plus the `ssh.exe` it runs) into `C:\Tools\rsync` on the machine `PATH`, then installs Visual Studio 2022 Community with the required components, the WDK, and the Windows Performance Toolkit, and reports whether Intel VTune Profiler is present. Can also be run directly from an Administrator prompt. |

 | `setup-windows-7-test-env.bat` | Prepares a **Windows 7 VM** as a test target driven from the host by `VBoxManage guestcontrol`. Copy it into the guest and run it there; it is idempotent, so re-run it after any snapshot restore. The per-user half needs no UAC (crash-dialog suppression, no screen blanking, a staging directory, the shared folder on `Z:`); the machine-wide half is skipped with a notice unless run elevated inside the guest. It then reports what the box can actually test: DWM composition, printers, audio capture devices. |
 
 ## Usage
 | `setup-windows-7-test-env.bat` | Prepares a **Windows 7 VM** as a test target driven from the host by `VBoxManage guestcontrol`. Copy it into the guest and run it there; it is idempotent, so re-run it after any snapshot restore. The per-user half needs no UAC (crash-dialog suppression, no screen blanking, a staging directory, the shared folder on `Z:`); the machine-wide half is skipped with a notice unless run elevated inside the guest. It then reports what the box can actually test: DWM composition, printers, audio capture devices. |
 
 ## Usage


@@ -137,43 +137,66 @@ throwaway VM reachable from a Linux host.
   msstore`); it is not installed here because the Store source needs an
   interactive, signed-in session, which the unattended elevated half does not
   have.
   msstore`); it is not installed here because the Store source needs an
   interactive, signed-in session, which the unattended elevated half does not
   have.

-- **Tracing without a UAC prompt.** `xperf` and `wpr` fail for a standard user in
-  two different ways, because two different things are missing:
+- **Intel VTune Profiler is reported, not installed.** The elevated half prints
+  whether it is on the box, its version, and the path to `vtune.exe`; if it is
+  missing it prints the download page instead (and says so if the CPU is not
+  Intel). Automating the install is not worth it here: the offline installer is a
+  ~750 MB download from a URL carrying a per-release GUID with no "latest"
+  redirect behind it, so every new build would mean editing a hard-coded link,
+  and it is only worth having on Intel silicon since hardware event-based
+  sampling reads Intel PMU counters. It does install unattended if you want it
+  scripted elsewhere:
+
+  ```powershell
+  intel-vtune-<version>_offline.exe -a --silent --cli --eula accept
+  ```
+
+  **Run it from an administrator account, elevated.** Hardware event-based
+  sampling (`uarch-exploration`, `memory-access`, `hotspots -knob
+  sampling-mode=hw`) requires it, and VTune warns about that at the top of every
+  unelevated run. Worth knowing that the failure it gives there is *"cannot
+  recognize the processor"*, which reads like a hardware problem and is not one:
+  the drivers (`sepdrv5`, `sepdal`, `vtss`) are installed and running, and VTune
+  identifies the PMU through them. There is no group to join to get around it —
+  the Linux driver can be handed to a `vtune` group, but on Windows the
+  documented answer is to run as administrator.
+
+- **Collect traces from an elevated Administrator session. Non-elevated
+  collection was tried here and abandoned.** The attempt was to put one ordinary
+  account into `BUILTIN\Performance Log Users`, which appears in the default
+  security descriptors ETW keeps per provider GUID under
+  `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security`, and collect without a UAC
+  prompt. It does not survive contact with the real workflow: `xperf -on base`
+  and `wpr -start` drive the *NT Kernel Logger*, reserved for Administrators and
+  LocalSystem, and granting the group `SeSystemProfilePrivilege` ("Profile system
+  performance") plus an explicit ACE for `TRACELOG_ACCESS_KERNEL_LOGGER` on
+  `SystemTraceControlGuid` — all three in place, across a reboot — still answered

 
   ```text
 
   ```text

-  xperf -on base             -> NT Kernel Logger: Access is denied. (0x5)
-  wpr -start GeneralProfile  -> Failed to enable the policy to profile system performance.
+  xperf: error: NT Kernel Logger: Access is denied. (0x5).

   ```
 
   ```
 

-  Creating or controlling *any* ETW session — even a user-mode one naming a
-  single provider — is checked against the security descriptor ETW keeps per
-  provider GUID under `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security`, whose
-  default grants the session-control rights to SYSTEM, Administrators, the
-  service accounts and `BUILTIN\Performance Log Users`, and to nobody else.
-  Switching on the *kernel* provider on top of that additionally needs the
-  `SeSystemProfilePrivilege` user right ("Profile system performance"), held by
-  default only by Administrators and `NT SERVICE\WdiServiceHost` — that is the
-  one `wpr` names. So the elevated half grants the privilege to the **group** and
-  puts the account in the group; enabling another account afterwards is just
-  `net localgroup "Performance Log Users" <user> /add`. `SeDebugPrivilege` is
-  deliberately *not* granted: CPU sampling and stack walks of your own processes
-  do not need it, and it is equivalent to handing out administrator.
-
-  Two consequences worth knowing. Both a privilege and a group membership are
-  read into the access token **at logon**, so the account must sign out and back
-  in — any new logon does it, and an `ssh` login into the box is the quick way to
-  check without dropping the desktop. And this only helps a **non-admin**
-  account: UAC hands an administrator a filtered token carrying just five
-  harmless privileges, so an admin's ordinary shell still cannot trace however
-  the policy reads. Verify from the target account, unelevated:
+  It is not a check an ACE overrides, and the same wall turned up often enough
+  elsewhere that the whole approach was dropped rather than carried as a
+  half-working path. **Sign in to an administrator account and run `xperf`, `wpr`
+  and VTune from an elevated prompt.** Analysis is the exception and never needed
+  any of this: `wpa.exe` opens an existing `.etl` as a plain user.
+
+  If an earlier revision of these scripts ran on a box, it left that account in
+  the group. Take it back out with:

 
   ```powershell
 
   ```powershell

-  whoami /priv | findstr SeSystemProfilePrivilege
-  xperf -on base ; xperf -stop C:\Temp\trace.etl
+  net localgroup "Performance Log Users" DOMAIN\user /delete

   ```
 
   ```
 

-  Analysis never needed any of this — `wpa.exe` opens an existing `.etl` as a
-  plain user. This is only about collection.
+  Two revisions also granted the privilege and the ACE. Undo the privilege in
+  `secpol.msc` > Local Policies > User Rights Assignment > "Profile system
+  performance" by removing Performance Log Users. The ACEs sit in the
+  `{9e814aad-3204-11d2-9a82-006008a86939}` value under
+  `HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security`: strip the `LU` entries
+  from that descriptor rather than deleting the value, which also carries entries
+  for SYSTEM, Administrators and two service accounts.
+

 - The scripts were extracted from a native Windows project, so the component
   selection is tuned for that: Spectre-mitigated runtimes, the v141/XP toolset,
   and driver-kit headers. Trim the component lists in the `.ps1` if you don't
 - The scripts were extracted from a native Windows project, so the component
   selection is tuned for that: Spectre-mitigated runtimes, the v141/XP toolset,
   and driver-kit headers. Trim the component lists in the `.ps1` if you don't