dotfiles: keep the group membership, drop the grants that bought nothing

[dotfiles] / setup-windows.bat

diff --git a/setup-windows.bat b/setup-windows.bat
index 5dc46e6e48680edf9c3e3099a5666f1545524d20..a42c1182f3b6c2363089a8e5b9688a86b9450dd4 100644 (file)
--- a/setup-windows.bat
+++ b/setup-windows.bat
@@ -6,7 +6,9 @@
 \r
 @rem --- Non-admin (per-user) winget installs ---\r
 winget install Anthropic.ClaudeCode\r
+winget install Brave.Brave\r
 winget install Git.Git\r
+winget install Google.AndroidGPUInspector\r
 winget install Microsoft.DotNet.SDK.10\r
 winget install Microsoft.PowerShell Microsoft.Sysinternals.ProcessExplorer Microsoft.Sysinternals.ProcessMonitor Microsoft.Sysinternals.SDelete Microsoft.VisualStudioCode Microsoft.WindowsTerminal\r
 winget install Oracle.VirtualBox\r
@@ -56,10 +58,25 @@ set "DOTNET_EXE=%ProgramFiles%\dotnet\dotnet.exe"
 @rem --- Elevated installs (VS2022, WDK, system tools) ---\r
 @rem The elevated script runs in its own window and logs to setup-windows-uac.log.\r
 @rem -PassThru + $p.ExitCode propagates its real exit code back through to ERRORLEVEL.\r
+@rem\r
+@rem -TraceUser passes YOU across the UAC boundary. Accepting that prompt with an\r
+@rem administrator's credentials runs the elevated half AS that administrator, so\r
+@rem it cannot see whose box this is; the account named here is the one it grants\r
+@rem non-elevated ETW collection rights to (xperf / wpr without a UAC prompt).\r
+@rem\r
+@rem The two values go through the environment, and the quotes the child needs\r
+@rem around them are built in PowerShell as [char]34, so the command line below\r
+@rem contains no embedded quote characters at all. Writing them inline as ""..""\r
+@rem works for ONE argument and quietly breaks at two: the quote-state parsing\r
+@rem swallows everything after the first into the -File value, and the elevated\r
+@rem PowerShell dies with "failed because the file does not have a '.ps1'\r
+@rem extension" and exit code -196608 (0xFFFD0000) before it can log a thing.\r
 set "UAC_LOG=%~dp0setup-windows-uac.log"\r
 if exist "%UAC_LOG%" del "%UAC_LOG%"\r
+set "UAC_SCRIPT=%~dp0setup-windows-with-uac.ps1"\r
+set "UAC_TRACE_USER=%USERDOMAIN%\%USERNAME%"\r
 \r
-powershell -NoProfile -Command "$p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File','""%~dp0setup-windows-with-uac.ps1""' -Wait -PassThru; exit $p.ExitCode"\r
+powershell -NoProfile -Command "$q = [char]34; $p = Start-Process powershell -Verb RunAs -ArgumentList '-NoProfile','-ExecutionPolicy','Bypass','-File',($q + $env:UAC_SCRIPT + $q),'-TraceUser',($q + $env:UAC_TRACE_USER + $q) -Wait -PassThru; exit $p.ExitCode"\r
 set "UAC_RC=%ERRORLEVEL%"\r
 \r
 @rem --- Surface the elevated session's output (its window has already closed) ---\r