dotfiles: add iperf3 and nasm to the per-user winget installs

[dotfiles] / setup-windows-with-uac.ps1

diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1
index ff947c6ce0c4a9453bad3f7e04a9a6461ae1303b..17d02ee05db79fab0f63aa213e3746076020f27e 100644 (file)
--- a/setup-windows-with-uac.ps1
+++ b/setup-windows-with-uac.ps1
@@ -17,9 +17,10 @@
     - Windows Driver Kit 10.0.26100\r
     - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
       (wpa.exe) - on the machine PATH\r
     - Windows Driver Kit 10.0.26100\r
     - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer\r
       (wpa.exe) - on the machine PATH\r

-    - ETW collection rights for one ordinary account: Performance Log Users\r
-      membership plus the "Profile system performance" user right, so xperf and\r
-      wpr run WITHOUT elevation\r
+    - Performance Log Users membership for one ordinary account, so it can run\r
+      user-mode ETW sessions (xperf -start ... -on <provider>) without elevation.\r
+      Kernel traces are NOT covered - the NT Kernel Logger is admin-only; see the\r
+      step for what was measured.\r

 \r
   Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
     Professional : https://aka.ms/vs/17/release/vs_professional.exe\r
 \r
   Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed:\r
     Professional : https://aka.ms/vs/17/release/vs_professional.exe\r


@@ -27,16 +28,23 @@
 #>\r
 \r
 param(\r
 #>\r
 \r
 param(\r

-    # Account to be granted non-elevated ETW collection rights (see the "ETW\r
-    # collection rights" step at the bottom). Defaults to the interactive\r
-    # console user, but setup-windows.bat passes it explicitly: with\r
-    # over-the-shoulder elevation THIS script runs as the administrator whose\r
-    # credentials went into the UAC prompt, not as the user who started the\r
-    # batch file, so $env:USERNAME here is the wrong answer.\r
+    # Account to put in Performance Log Users (see the "ETW session control"\r
+    # step, which runs first). Defaults to the interactive console user, but\r
+    # setup-windows.bat passes it explicitly: with over-the-shoulder elevation\r
+    # THIS script runs as the administrator whose credentials went into the UAC\r
+    # prompt, not as the user who started the batch file, so $env:USERNAME here\r
+    # is the wrong answer.\r

     #\r
     #\r

-    # Pass an empty string to skip the group membership (the user right is still\r
-    # granted to the group, so adding an account later is one command).\r
-    [string] $TraceUser = ''\r
+    # Pass an empty string to skip it; adding an account later is one\r
+    # `net localgroup` away.\r
+    [string] $TraceUser = '',\r
+\r
+    # Do the ETW step and nothing else. It is a group membership and no\r
+    # downloads, where a full run is dominated by the three Visual Studio\r
+    # passes, which take minutes even when they have nothing to do. It is why\r
+    # that step runs FIRST: -EtwRightsOnly is then just an early exit rather\r
+    # than a set of guards down the rest of the script.\r
+    [switch] $EtwRightsOnly\r

 )\r
 \r
 $ErrorActionPreference = 'Stop'\r
 )\r
 \r
 $ErrorActionPreference = 'Stop'\r


@@ -55,155 +63,6 @@ function Assert-ExitCode([int]$Code, [string]$Step) {
     }\r
 }\r
 \r
     }\r
 }\r
 \r

-# ---------------------------------------------------------------------------\r
-# User rights assignment (LSA account rights)\r
-#\r
-# Windows has no built-in cmdlet for "grant this SID this privilege". The two\r
-# ways to script it are secedit (export the whole USER_RIGHTS area to an INF,\r
-# edit one line, re-import) and the LSA API. The API is used here because it is\r
-# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is\r
-# a no-op when it is already held, where a secedit round-trip re-applies every\r
-# user right on the box to fix one of them. The GUI equivalent, for a human, is\r
-#     secpol.msc > Local Policies > User Rights Assignment\r
-#\r
-# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's\r
-# Add-Type compiles with the in-box CodeDom compiler.\r
-# ---------------------------------------------------------------------------\r
-function Initialize-LsaRightsType {\r
-    if ('LsaRights' -as [type]) { return }\r
-    Add-Type -TypeDefinition @'\r
-using System;\r
-using System.ComponentModel;\r
-using System.Runtime.InteropServices;\r
-\r
-public static class LsaRights\r
-{\r
-    [StructLayout(LayoutKind.Sequential)]\r
-    private struct LSA_UNICODE_STRING\r
-    {\r
-        public ushort Length;\r
-        public ushort MaximumLength;\r
-        public IntPtr Buffer;\r
-    }\r
-\r
-    [StructLayout(LayoutKind.Sequential)]\r
-    private struct LSA_OBJECT_ATTRIBUTES\r
-    {\r
-        public int Length;\r
-        public IntPtr RootDirectory;\r
-        public IntPtr ObjectName;\r
-        public uint Attributes;\r
-        public IntPtr SecurityDescriptor;\r
-        public IntPtr SecurityQualityOfService;\r
-    }\r
-\r
-    [DllImport("advapi32.dll", SetLastError = true)]\r
-    private static extern uint LsaOpenPolicy(IntPtr systemName,\r
-        ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle);\r
-\r
-    [DllImport("advapi32.dll", SetLastError = true)]\r
-    private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid,\r
-        LSA_UNICODE_STRING[] userRights, uint countOfRights);\r
-\r
-    [DllImport("advapi32.dll", SetLastError = true)]\r
-    private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid,\r
-        out IntPtr userRights, out uint countOfRights);\r
-\r
-    [DllImport("advapi32.dll")]\r
-    private static extern uint LsaClose(IntPtr policyHandle);\r
-\r
-    [DllImport("advapi32.dll")]\r
-    private static extern uint LsaFreeMemory(IntPtr buffer);\r
-\r
-    [DllImport("advapi32.dll")]\r
-    private static extern int LsaNtStatusToWinError(uint status);\r
-\r
-    private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001;\r
-    private const uint POLICY_CREATE_ACCOUNT         = 0x00000010;\r
-    private const uint POLICY_LOOKUP_NAMES           = 0x00000800;\r
-\r
-    // Returned by LsaEnumerateAccountRights when the SID holds no rights at all,\r
-    // which is an empty list rather than an error.\r
-    private const uint STATUS_OBJECT_NAME_NOT_FOUND  = 0xC0000034;\r
-\r
-    private static IntPtr OpenPolicy()\r
-    {\r
-        LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES();\r
-        attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES));\r
-        IntPtr handle;\r
-        uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs,\r
-            POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle);\r
-        if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
-        return handle;\r
-    }\r
-\r
-    public static string[] Get(byte[] sid)\r
-    {\r
-        IntPtr policy = OpenPolicy();\r
-        try\r
-        {\r
-            IntPtr rights;\r
-            uint count;\r
-            uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count);\r
-            if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; }\r
-            if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
-            try\r
-            {\r
-                string[] result = new string[count];\r
-                int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING));\r
-                for (int i = 0; i < count; i++)\r
-                {\r
-                    LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure(\r
-                        new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING));\r
-                    result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2);\r
-                }\r
-                return result;\r
-            }\r
-            finally { LsaFreeMemory(rights); }\r
-        }\r
-        finally { LsaClose(policy); }\r
-    }\r
-\r
-    public static void Add(byte[] sid, string right)\r
-    {\r
-        IntPtr policy = OpenPolicy();\r
-        try\r
-        {\r
-            LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1];\r
-            rights[0].Buffer = Marshal.StringToHGlobalUni(right);\r
-            // Length counts BYTES and excludes the terminator; MaximumLength includes it.\r
-            rights[0].Length = (ushort)(right.Length * 2);\r
-            rights[0].MaximumLength = (ushort)(right.Length * 2 + 2);\r
-            try\r
-            {\r
-                uint status = LsaAddAccountRights(policy, sid, rights, 1);\r
-                if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); }\r
-            }\r
-            finally { Marshal.FreeHGlobal(rights[0].Buffer); }\r
-        }\r
-        finally { LsaClose(policy); }\r
-    }\r
-}\r
-'@\r
-}\r
-\r
-function Get-SidBytes([string]$Sid) {\r
-    $s = New-Object System.Security.Principal.SecurityIdentifier($Sid)\r
-    $bytes = New-Object byte[] $s.BinaryLength\r
-    $s.GetBinaryForm($bytes, 0)\r
-    return ,$bytes\r
-}\r
-\r
-function Get-AccountRight([string]$Sid) {\r
-    Initialize-LsaRightsType\r
-    return [LsaRights]::Get((Get-SidBytes $Sid))\r
-}\r
-\r
-function Grant-AccountRight([string]$Sid, [string]$Right) {\r
-    Initialize-LsaRightsType\r
-    [LsaRights]::Add((Get-SidBytes $Sid), $Right)\r
-}\r
-\r

 function Show-VsSetupLogs {\r
     # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
     # this script runs elevated, that %TEMP% belongs to the elevated user and is\r
 function Show-VsSetupLogs {\r
     # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because\r
     # this script runs elevated, that %TEMP% belongs to the elevated user and is\r


@@ -273,6 +132,121 @@ try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {}
 \r
 try {\r
 \r
 \r
 try {\r
 \r

+# ---------------------------------------------------------------------------\r
+# ETW session control for an ordinary account\r
+#\r
+# Creating or controlling an event tracing session - even a user-mode one naming\r
+# a single provider - is checked against the security descriptor ETW keeps per\r
+# provider GUID under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The\r
+# default grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
+# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM,\r
+# Administrators, the service accounts and BUILTIN\Performance Log Users, and to\r
+# nobody else. Its own description says members "may ... enable trace providers,\r
+# and collect event traces", and that is what membership buys:\r
+#\r
+#     xperf -start MySession -on Microsoft-Windows-Kernel-Process -f trace.etl\r
+#     xperf -stop MySession\r
+#\r
+# runs unelevated for a member and is "Access is denied. (0x5)" for everyone\r
+# else. Enough to trace your own application's providers without a UAC prompt.\r
+#\r
+# Membership is read into the access token at LOGON, so the account has to sign\r
+# out and back in. Any NEW logon does it - an ssh login into this box is one,\r
+# which is the quick way to check without dropping the desktop.\r
+#\r
+# WHAT THIS DOES NOT BUY: system-wide kernel traces. `xperf -on base` and\r
+# `wpr -start` drive the NT Kernel Logger, which is reserved for Administrators\r
+# and LocalSystem - Microsoft documents Performance Log Users access as\r
+# explicitly NOT extending to it. Measured here, so that nobody repeats it: with\r
+# the account in the group, SeSystemProfilePrivilege ("Profile system\r
+# performance") granted to that group, and an explicit ACE giving the group\r
+# TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid - all three in place,\r
+# across a reboot - xperf still answered\r
+#\r
+#     xperf: error: NT Kernel Logger: Access is denied. (0x5).\r
+#\r
+# It is not a check an ACE overrides. Those two grants were dropped again rather\r
+# than left on the box earning nothing, and CPU sampling and whole-system traces\r
+# are elevated work: run xperf, wpr or VTune from an Administrator prompt.\r
+#\r
+# Analysis needs none of this either way - wpa.exe opens an existing .etl as a\r
+# plain user.\r
+# ---------------------------------------------------------------------------\r
+Write-Step 'ETW session control (non-elevated user-mode tracing)'\r
+$PerfLogUsersSid = 'S-1-5-32-559'   # BUILTIN\Performance Log Users\r
+try {\r
+    # Fall back to the console user when the caller did not name one: with\r
+    # over-the-shoulder elevation that is the person who started\r
+    # setup-windows.bat, which is who wants to trace.\r
+    $target = $TraceUser\r
+    if (-not $target) {\r
+        $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
+        if ($target) { Write-Host "    No -TraceUser given; using the console user $target" }\r
+    }\r
+\r
+    if (-not $target) {\r
+        Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
+        Write-Warning 'To do it later:'\r
+        Write-Warning '    net localgroup "Performance Log Users" DOMAIN\user /add'\r
+    } else {\r
+        # Resolve to a SID first: it validates the name, and it is what the\r
+        # membership check compares, so a member spelled ".\claude" in one place\r
+        # and "LATISLAB\claude" in another is still recognised as the same account.\r
+        $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
+                        [System.Security.Principal.SecurityIdentifier])\r
+\r
+        # By SID, never by name: "Performance Log Users" is localised, and\r
+        # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
+        $group = Get-LocalGroup -SID $PerfLogUsersSid\r
+\r
+        # Get-LocalGroupMember throws on a group holding a SID that no longer\r
+        # resolves (a known Windows 10 bug), so a failure to READ the membership\r
+        # must not stop us from writing it - fall through and let the add report.\r
+        $already = $false\r
+        try {\r
+            $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
+                         Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
+        } catch {\r
+            Write-Host "    (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
+        }\r
+\r
+        if ($already) {\r
+            Write-Host "    OK: $target is already in $($group.Name)"\r
+        } else {\r
+            try {\r
+                Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
+            } catch {\r
+                # "already a member" is only reachable when the enumeration above\r
+                # failed, and is not an error. Matched on the type NAME rather\r
+                # than in a typed catch clause: catch types are resolved when the\r
+                # script is PARSED, before the LocalAccounts module has been\r
+                # autoloaded, so naming the type there is a parse error that\r
+                # would take the whole script down.\r
+                if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
+            }\r
+            Write-Host "    Added $target to $($group.Name)"\r
+        }\r
+\r
+        Write-Host ''\r
+        Write-Host "    $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
+        Write-Host '    Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
+        Write-Host '        xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl' -ForegroundColor Yellow\r
+        Write-Host '        xperf -stop T' -ForegroundColor Yellow\r
+    }\r
+} catch {\r
+    Write-Warning "Performance Log Users membership failed: $($_.Exception.Message)"\r
+    Write-Warning 'Do it by hand with:'\r
+    Write-Warning '    net localgroup "Performance Log Users" <user> /add'\r
+}\r
+\r
+if ($EtwRightsOnly) {\r
+    # `exit` inside the try still runs the finally below, so the transcript is\r
+    # stopped and the log is left readable by the non-elevated caller.\r
+    Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green\r
+    exit 0\r
+}\r
+\r
+\r

 # ---------------------------------------------------------------------------\r
 # Base tools via winget\r
 # ---------------------------------------------------------------------------\r
 # ---------------------------------------------------------------------------\r
 # Base tools via winget\r
 # ---------------------------------------------------------------------------\r


@@ -695,129 +669,45 @@ if ($WptDir) {
     }\r
 }\r
 \r
     }\r
 }\r
 \r

+\r

 # ---------------------------------------------------------------------------\r
 # ---------------------------------------------------------------------------\r

-# ETW collection rights for an ordinary account\r
-#\r
-# Out of the box, xperf and wpr only work elevated, and they fail in two\r
-# different ways for a standard user - because two different things are missing:\r
-#\r
-#     xperf -on base         -> "NT Kernel Logger: Access is denied. (0x5)"\r
-#     wpr -start GeneralProfile\r
-#                            -> "Failed to enable the policy to profile system\r
-#                                performance."  (0xc5585011)\r
-#\r
-# 1. Creating or controlling ANY event tracing session - even a user-mode one\r
-#    naming a single provider - is checked against the security descriptor ETW\r
-#    keeps per provider GUID under\r
-#    HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The default grants the\r
-#    session-control rights (TRACELOG_CREATE_ONDISK, TRACELOG_CREATE_REALTIME,\r
-#    TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM, Administrators, the\r
-#    service accounts, and BUILTIN\Performance Log Users - and to nobody else.\r
-#    That group is the supported hook; its own description says members "may\r
-#    ... enable trace providers, and collect event traces".\r
-#\r
-# 2. Switching on the kernel/system trace provider on top of that needs the\r
-#    SeSystemProfilePrivilege user right ("Profile system performance"), held by\r
-#    default only by Administrators and NT SERVICE\WdiServiceHost. That is the\r
-#    one wpr names in its error, and the one xperf trips over for -on base.\r
+# Intel VTune Profiler - reported, not installed\r

 #\r
 #\r

-# So grant the privilege to the GROUP and then put the account in the group:\r
-# membership alone becomes the switch, and enabling the next account is one\r
-# `net localgroup` away with no policy edit.\r
+# Deliberately NOT automated, unlike everything above. The offline installer is\r
+# a ~750 MB download from a URL carrying a per-release GUID\r
+# (registrationcenter-download.intel.com/akdlm/IRC_NAS/<guid>/intel-vtune-<ver>_offline.exe)\r
+# with no "latest" redirect behind it, so every new build means editing a\r
+# hard-coded link in here - and it is only worth having on Intel silicon, since\r
+# hardware event-based sampling reads Intel PMU counters. Not a good trade for a\r
+# script that has to keep working unattended on any box.\r

 #\r
 #\r

-# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU\r
-# sampling nor walking stacks in your own processes, and it is equivalent to\r
-# handing out administrator.\r
-#\r
-# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership\r
-# are baked into the access token at LOGON, and UAC hands an administrator a\r
-# filtered token that keeps just five harmless privileges - so an admin's\r
-# ordinary shell still cannot trace, however the policy reads. Running as a\r
-# standard user is what makes this work.\r
-#\r
-# For the same reason nothing here takes effect in an already-open session: the\r
-# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
-# this box is one, which is the quick way to check without dropping the desktop.\r
-#\r
-# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
-# user. This step is only about collection.\r
+# So this step only reports. To install it, take the Windows offline installer\r
+# from\r
+#     https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html\r
+# and run it elevated; it installs unattended with\r
+#     intel-vtune-<version>_offline.exe -a --silent --cli --eula accept\r

 # ---------------------------------------------------------------------------\r
 # ---------------------------------------------------------------------------\r

-Write-Step 'ETW collection rights (non-elevated xperf / wpr)'\r
-$PerfLogUsersSid = 'S-1-5-32-559'   # BUILTIN\Performance Log Users\r
-try {\r
-    # --- The user right, granted to the group ---\r
-    $existing = Get-AccountRight $PerfLogUsersSid\r
-    if ($existing -contains 'SeSystemProfilePrivilege') {\r
-        Write-Host '    OK: Performance Log Users already holds SeSystemProfilePrivilege'\r
-    } else {\r
-        Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege'\r
-        Write-Host '    Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users'\r
-    }\r
-\r
-    # --- The membership ---\r
-    # Fall back to the console user when the caller did not name one: with\r
-    # over-the-shoulder elevation that is the person who started\r
-    # setup-windows.bat, which is who wants to trace.\r
-    $target = $TraceUser\r
-    if (-not $target) {\r
-        $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
-        if ($target) { Write-Host "    No -TraceUser given; using the console user $target" }\r
-    }\r
-\r
-    if (-not $target) {\r
-        Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
-        Write-Warning 'The user right is in place, so this is the only step left:'\r
-        Write-Warning '    net localgroup "Performance Log Users" DOMAIN\user /add'\r
-    } else {\r
-        # Resolve to a SID first: it validates the name, and it is what the\r
-        # membership check compares, so a member spelled ".\claude" in one place\r
-        # and "LATISLAB\claude" in another is still recognised as the same account.\r
-        $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
-                        [System.Security.Principal.SecurityIdentifier])\r
-\r
-        # By SID, never by name: "Performance Log Users" is localised, and\r
-        # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
-        $group = Get-LocalGroup -SID $PerfLogUsersSid\r
-\r
-        # Get-LocalGroupMember throws on a group holding a SID that no longer\r
-        # resolves (a known Windows 10 bug), so a failure to READ the membership\r
-        # must not stop us from writing it - fall through and let the add report.\r
-        $already = $false\r
-        try {\r
-            $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
-                         Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
-        } catch {\r
-            Write-Host "    (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
-        }\r
-\r
-        if ($already) {\r
-            Write-Host "    OK: $target is already in $($group.Name)"\r
-        } else {\r
-            try {\r
-                Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
-            } catch {\r
-                # "already a member" is only reachable when the enumeration above\r
-                # failed, and is not an error. Matched on the type NAME rather\r
-                # than in a typed catch clause: catch types are resolved when the\r
-                # script is PARSED, before the LocalAccounts module has been\r
-                # autoloaded, so naming the type there is a parse error that\r
-                # would take the whole script down.\r
-                if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
-            }\r
-            Write-Host "    Added $target to $($group.Name)"\r
-        }\r
-\r
-        Write-Host ''\r
-        Write-Host "    $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
-        Write-Host '    Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
-        Write-Host '        whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
-        Write-Host '        xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
+Write-Step 'Intel VTune Profiler (status only)'\r
+$UninstallKeys = @(\r
+    'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+    'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*'\r
+)\r
+$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue |\r
+         Where-Object { $_.DisplayName -match 'VTune' } |\r
+         Select-Object -First 1\r
+if ($vtune) {\r
+    Write-Host "    Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green\r
+    # The oneAPI layout keeps a `latest` junction beside the versioned directory,\r
+    # so this path stays right across upgrades.\r
+    $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe'\r
+    if (Test-Path $VTuneCli) { Write-Host "    CLI: $VTuneCli" }\r
+} else {\r
+    Write-Host '    Not installed.' -ForegroundColor Yellow\r
+    Write-Host '    https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow\r
+    $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer\r
+    if ($cpu -and $cpu -notmatch 'Intel') {\r
+        Write-Host "    (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow\r

     }\r
     }\r

-} catch {\r
-    Write-Warning "ETW rights setup failed: $($_.Exception.Message)"\r
-    Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >'\r
-    Write-Warning '"Profile system performance" > add Performance Log Users, then'\r
-    Write-Warning '    net localgroup "Performance Log Users" <user> /add'\r

 }\r
 \r
 # ---------------------------------------------------------------------------\r
 }\r
 \r
 # ---------------------------------------------------------------------------\r