-# ---------------------------------------------------------------------------\r
-# ETW session control for an ordinary account\r
-#\r
-# Creating or controlling an event tracing session - even a user-mode one naming\r
-# a single provider - is checked against the security descriptor ETW keeps per\r
-# provider GUID under HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The\r
-# default grants the session-control rights (TRACELOG_CREATE_ONDISK,\r
-# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to SYSTEM,\r
-# Administrators, the service accounts and BUILTIN\Performance Log Users, and to\r
-# nobody else. Its own description says members "may ... enable trace providers,\r
-# and collect event traces", and that is what membership buys:\r
-#\r
-# xperf -start MySession -on Microsoft-Windows-Kernel-Process -f trace.etl\r
-# xperf -stop MySession\r
-#\r
-# runs unelevated for a member and is "Access is denied. (0x5)" for everyone\r
-# else. Enough to trace your own application's providers without a UAC prompt.\r
-#\r
-# Membership is read into the access token at LOGON, so the account has to sign\r
-# out and back in. Any NEW logon does it - an ssh login into this box is one,\r
-# which is the quick way to check without dropping the desktop.\r
-#\r
-# WHAT THIS DOES NOT BUY: system-wide kernel traces. `xperf -on base` and\r
-# `wpr -start` drive the NT Kernel Logger, which is reserved for Administrators\r
-# and LocalSystem - Microsoft documents Performance Log Users access as\r
-# explicitly NOT extending to it. Measured here, so that nobody repeats it: with\r
-# the account in the group, SeSystemProfilePrivilege ("Profile system\r
-# performance") granted to that group, and an explicit ACE giving the group\r
-# TRACELOG_ACCESS_KERNEL_LOGGER on SystemTraceControlGuid - all three in place,\r
-# across a reboot - xperf still answered\r
-#\r
-# xperf: error: NT Kernel Logger: Access is denied. (0x5).\r
-#\r
-# It is not a check an ACE overrides. Those two grants were dropped again rather\r
-# than left on the box earning nothing, and CPU sampling and whole-system traces\r
-# are elevated work: run xperf, wpr or VTune from an Administrator prompt.\r
-#\r
-# Analysis needs none of this either way - wpa.exe opens an existing .etl as a\r
-# plain user.\r
-# ---------------------------------------------------------------------------\r
-Write-Step 'ETW session control (non-elevated user-mode tracing)'\r
-$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users\r
-try {\r
- # Fall back to the console user when the caller did not name one: with\r
- # over-the-shoulder elevation that is the person who started\r
- # setup-windows.bat, which is who wants to trace.\r
- $target = $TraceUser\r
- if (-not $target) {\r
- $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName\r
- if ($target) { Write-Host " No -TraceUser given; using the console user $target" }\r
- }\r
-\r
- if (-not $target) {\r
- Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).'\r
- Write-Warning 'To do it later:'\r
- Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add'\r
- } else {\r
- # Resolve to a SID first: it validates the name, and it is what the\r
- # membership check compares, so a member spelled ".\claude" in one place\r
- # and "LATISLAB\claude" in another is still recognised as the same account.\r
- $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate(\r
- [System.Security.Principal.SecurityIdentifier])\r
-\r
- # By SID, never by name: "Performance Log Users" is localised, and\r
- # Get-LocalGroup -SID is how this stays correct on a non-English box.\r
- $group = Get-LocalGroup -SID $PerfLogUsersSid\r
-\r
- # Get-LocalGroupMember throws on a group holding a SID that no longer\r
- # resolves (a known Windows 10 bug), so a failure to READ the membership\r
- # must not stop us from writing it - fall through and let the add report.\r
- $already = $false\r
- try {\r
- $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid |\r
- Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0\r
- } catch {\r
- Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray\r
- }\r
-\r
- if ($already) {\r
- Write-Host " OK: $target is already in $($group.Name)"\r
- } else {\r
- try {\r
- Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value\r
- } catch {\r
- # "already a member" is only reachable when the enumeration above\r
- # failed, and is not an error. Matched on the type NAME rather\r
- # than in a typed catch clause: catch types are resolved when the\r
- # script is PARSED, before the LocalAccounts module has been\r
- # autoloaded, so naming the type there is a parse error that\r
- # would take the whole script down.\r
- if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw }\r
- }\r
- Write-Host " Added $target to $($group.Name)"\r
- }\r
-\r
- Write-Host ''\r
- Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
- Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
- Write-Host ' xperf -start T -on Microsoft-Windows-Kernel-Process -f trace.etl' -ForegroundColor Yellow\r
- Write-Host ' xperf -stop T' -ForegroundColor Yellow\r
- }\r
-} catch {\r
- Write-Warning "Performance Log Users membership failed: $($_.Exception.Message)"\r
- Write-Warning 'Do it by hand with:'\r
- Write-Warning ' net localgroup "Performance Log Users" <user> /add'\r
-}\r
-\r
-if ($EtwRightsOnly) {\r
- # `exit` inside the try still runs the finally below, so the transcript is\r
- # stopped and the log is left readable by the non-elevated caller.\r
- Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green\r
- exit 0\r
-}\r
-\r
-\r
vilimpoc.org / repos / dotfiles / blobdiff