- default grants the session-control rights to SYSTEM, Administrators, the
- service accounts and `BUILTIN\Performance Log Users`, and to nobody else.
- Switching on the *kernel* provider on top of that additionally needs the
- `SeSystemProfilePrivilege` user right ("Profile system performance"), held by
- default only by Administrators and `NT SERVICE\WdiServiceHost` — that is the
- one `wpr` names. So the elevated half grants the privilege to the **group** and
- puts the account in the group; enabling another account afterwards is just
- `net localgroup "Performance Log Users" <user> /add`. `SeDebugPrivilege` is
- deliberately *not* granted: CPU sampling and stack walks of your own processes
- do not need it, and it is equivalent to handing out administrator.
-
- Two consequences worth knowing. Both a privilege and a group membership are
- read into the access token **at logon**, so the account must sign out and back
- in — any new logon does it, and an `ssh` login into the box is the quick way to
- check without dropping the desktop. And this only helps a **non-admin**
- account: UAC hands an administrator a filtered token carrying just five
- harmless privileges, so an admin's ordinary shell still cannot trace however
- the policy reads. Verify from the target account, unelevated:
+ default grants those rights to SYSTEM, Administrators, the service accounts and
+ `BUILTIN\Performance Log Users` — and to nobody else. So the elevated half puts
+ the account named by `-TraceUser` into that group, and the command above then
+ works unelevated; enabling another account later is just
+ `net localgroup "Performance Log Users" <user> /add`. Membership is read into
+ the access token **at logon**, so sign out and back in first — any new logon
+ does it, and an `ssh` login into the box is the quick way to check without
+ dropping the desktop.
+
+ **Kernel traces are not available this way, and cannot be made to be.**
+ `xperf -on base` and `wpr -start` drive the *NT Kernel Logger*, which is
+ reserved for Administrators and LocalSystem — Microsoft documents Performance
+ Log Users access as explicitly not extending to it. That was measured rather
+ than assumed, and the negative result is recorded here so nobody repeats the
+ experiment: with the account in the group, `SeSystemProfilePrivilege` ("Profile
+ system performance") granted to that group, and an explicit ACE giving the
+ group `TRACELOG_ACCESS_KERNEL_LOGGER` on `SystemTraceControlGuid` — all three
+ in place, across a reboot — `xperf -on base` still answered `NT Kernel Logger:
+ Access is denied. (0x5)`. It is not a check an ACE overrides. The privilege
+ grant and the ACE were dropped again rather than left on the box earning
+ nothing: CPU sampling and whole-system traces are elevated work, with `xperf`,
+ `wpr` or VTune from an Administrator prompt.
+
+ Analysis was never affected — `wpa.exe` opens an existing `.etl` as a plain
+ user. This is only about collection.
+
+ The step runs **first** in the elevated half, and `-EtwRightsOnly` runs it and
+ nothing else, which matters because a full run is dominated by the three Visual
+ Studio passes that take minutes even with nothing to do:
vilimpoc.org / repos / dotfiles / blobdiff