X-Git-Url: https://vilimpoc.org/repos/dotfiles/blobdiff_plain/3c096107d23668caeec91ba27095c9f94d3792b5..1e91b38f9f50d0f6e706c8f710ad6a77c974799e:/setup-windows-with-uac.ps1?ds=inline diff --git a/setup-windows-with-uac.ps1 b/setup-windows-with-uac.ps1 index 254db14..34bfa8b 100644 --- a/setup-windows-with-uac.ps1 +++ b/setup-windows-with-uac.ps1 @@ -1,20 +1,51 @@ #Requires -RunAsAdministrator <# setup-windows-with-uac.ps1 - Elevated portion of BlockBox Windows provisioning. Invoked by setup-windows.bat + Elevated portion of the Windows provisioning. Invoked by setup-windows.bat via Start-Process -Verb RunAs, or run manually from an Administrator prompt. What this installs / configures: + - OpenSSH Client capability (the ssh.exe rsync shells out to, and the + System32 libcrypto.dll the release's own ssh.exe links against) - ssh-agent set to automatic + started + - OpenSSH Server (sshd) capability: automatic + started + inbound TCP 22 + - rsync for Windows (nuket/rsync-windows) in C:\Tools\rsync, on the machine + PATH: rsync.exe plus the ssh.exe it runs, out of the release zip for this + architecture - Visual Studio 2022 Community (C++ desktop workload, Spectre libs, WDK VSIX, Win11 SDK 26100, Clang/LLVM, and the v141 + Windows XP targeting toolset) - Windows Driver Kit 10.0.26100 + - Windows Performance Toolkit - xperf, wpr and Windows Performance Analyzer + (wpa.exe) - on the machine PATH + - ETW collection rights for one ordinary account: Performance Log Users + membership plus the "Profile system performance" user right, so xperf and + wpr run WITHOUT elevation Change $VsInstallerUrl below to the Professional or Enterprise bootstrapper if needed: Professional : https://aka.ms/vs/17/release/vs_professional.exe Enterprise : https://aka.ms/vs/17/release/vs_enterprise.exe #> +param( + # Account to be granted non-elevated ETW collection rights (see the "ETW + # collection rights" step at the bottom). Defaults to the interactive + # console user, but setup-windows.bat passes it explicitly: with + # over-the-shoulder elevation THIS script runs as the administrator whose + # credentials went into the UAC prompt, not as the user who started the + # batch file, so $env:USERNAME here is the wrong answer. + # + # Pass an empty string to skip the group membership (the user right is still + # granted to the group, so adding an account later is one command). + [string] $TraceUser = '', + + # Do the ETW rights step and nothing else. That step is seconds of registry + # and LSA work with no downloads, where a full run is dominated by the three + # Visual Studio passes, which take minutes even when they have nothing to do. + # It is why the ETW step runs FIRST: -EtwRightsOnly is then just an early + # exit rather than a set of guards down the rest of the script. + [switch] $EtwRightsOnly +) + $ErrorActionPreference = 'Stop' function Write-Step([string]$Msg) { @@ -31,6 +62,220 @@ function Assert-ExitCode([int]$Code, [string]$Step) { } } +# --------------------------------------------------------------------------- +# User rights assignment (LSA account rights) +# +# Windows has no built-in cmdlet for "grant this SID this privilege". The two +# ways to script it are secedit (export the whole USER_RIGHTS area to an INF, +# edit one line, re-import) and the LSA API. The API is used here because it is +# surgical: LsaAddAccountRights adds exactly one right to exactly one SID and is +# a no-op when it is already held, where a secedit round-trip re-applies every +# user right on the box to fix one of them. The GUI equivalent, for a human, is +# secpol.msc > Local Policies > User Rights Assignment +# +# The type is compiled on first use; C# 5 only, since Windows PowerShell 5.1's +# Add-Type compiles with the in-box CodeDom compiler. +# --------------------------------------------------------------------------- +function Initialize-LsaRightsType { + if ('LsaRights' -as [type]) { return } + Add-Type -TypeDefinition @' +using System; +using System.ComponentModel; +using System.Runtime.InteropServices; + +public static class LsaRights +{ + [StructLayout(LayoutKind.Sequential)] + private struct LSA_UNICODE_STRING + { + public ushort Length; + public ushort MaximumLength; + public IntPtr Buffer; + } + + [StructLayout(LayoutKind.Sequential)] + private struct LSA_OBJECT_ATTRIBUTES + { + public int Length; + public IntPtr RootDirectory; + public IntPtr ObjectName; + public uint Attributes; + public IntPtr SecurityDescriptor; + public IntPtr SecurityQualityOfService; + } + + [DllImport("advapi32.dll", SetLastError = true)] + private static extern uint LsaOpenPolicy(IntPtr systemName, + ref LSA_OBJECT_ATTRIBUTES objectAttributes, uint desiredAccess, out IntPtr policyHandle); + + [DllImport("advapi32.dll", SetLastError = true)] + private static extern uint LsaAddAccountRights(IntPtr policyHandle, byte[] accountSid, + LSA_UNICODE_STRING[] userRights, uint countOfRights); + + [DllImport("advapi32.dll", SetLastError = true)] + private static extern uint LsaEnumerateAccountRights(IntPtr policyHandle, byte[] accountSid, + out IntPtr userRights, out uint countOfRights); + + [DllImport("advapi32.dll")] + private static extern uint LsaClose(IntPtr policyHandle); + + [DllImport("advapi32.dll")] + private static extern uint LsaFreeMemory(IntPtr buffer); + + [DllImport("advapi32.dll")] + private static extern int LsaNtStatusToWinError(uint status); + + private const uint POLICY_VIEW_LOCAL_INFORMATION = 0x00000001; + private const uint POLICY_CREATE_ACCOUNT = 0x00000010; + private const uint POLICY_LOOKUP_NAMES = 0x00000800; + + // Returned by LsaEnumerateAccountRights when the SID holds no rights at all, + // which is an empty list rather than an error. + private const uint STATUS_OBJECT_NAME_NOT_FOUND = 0xC0000034; + + private static IntPtr OpenPolicy() + { + LSA_OBJECT_ATTRIBUTES attrs = new LSA_OBJECT_ATTRIBUTES(); + attrs.Length = Marshal.SizeOf(typeof(LSA_OBJECT_ATTRIBUTES)); + IntPtr handle; + uint status = LsaOpenPolicy(IntPtr.Zero, ref attrs, + POLICY_VIEW_LOCAL_INFORMATION | POLICY_CREATE_ACCOUNT | POLICY_LOOKUP_NAMES, out handle); + if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); } + return handle; + } + + public static string[] Get(byte[] sid) + { + IntPtr policy = OpenPolicy(); + try + { + IntPtr rights; + uint count; + uint status = LsaEnumerateAccountRights(policy, sid, out rights, out count); + if (status == STATUS_OBJECT_NAME_NOT_FOUND) { return new string[0]; } + if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); } + try + { + string[] result = new string[count]; + int stride = Marshal.SizeOf(typeof(LSA_UNICODE_STRING)); + for (int i = 0; i < count; i++) + { + LSA_UNICODE_STRING s = (LSA_UNICODE_STRING)Marshal.PtrToStructure( + new IntPtr(rights.ToInt64() + (long)i * stride), typeof(LSA_UNICODE_STRING)); + result[i] = Marshal.PtrToStringUni(s.Buffer, s.Length / 2); + } + return result; + } + finally { LsaFreeMemory(rights); } + } + finally { LsaClose(policy); } + } + + public static void Add(byte[] sid, string right) + { + IntPtr policy = OpenPolicy(); + try + { + LSA_UNICODE_STRING[] rights = new LSA_UNICODE_STRING[1]; + rights[0].Buffer = Marshal.StringToHGlobalUni(right); + // Length counts BYTES and excludes the terminator; MaximumLength includes it. + rights[0].Length = (ushort)(right.Length * 2); + rights[0].MaximumLength = (ushort)(right.Length * 2 + 2); + try + { + uint status = LsaAddAccountRights(policy, sid, rights, 1); + if (status != 0) { throw new Win32Exception(LsaNtStatusToWinError(status)); } + } + finally { Marshal.FreeHGlobal(rights[0].Buffer); } + } + finally { LsaClose(policy); } + } +} +'@ +} + +function Get-SidBytes([string]$Sid) { + $s = New-Object System.Security.Principal.SecurityIdentifier($Sid) + $bytes = New-Object byte[] $s.BinaryLength + $s.GetBinaryForm($bytes, 0) + return ,$bytes +} + +function Get-AccountRight([string]$Sid) { + Initialize-LsaRightsType + return [LsaRights]::Get((Get-SidBytes $Sid)) +} + +function Grant-AccountRight([string]$Sid, [string]$Right) { + Initialize-LsaRightsType + [LsaRights]::Add((Get-SidBytes $Sid), $Right) +} + +# --------------------------------------------------------------------------- +# ETW provider-GUID access control +# +# ETW keeps a security descriptor per provider GUID under +# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security, and EventAccessControl is +# the documented way to edit one. Editing the registry value directly would work +# too - it is a self-relative SD in a REG_BINARY - but the API takes the SID and +# the rights mask and leaves the descriptor's shape to Windows. +# --------------------------------------------------------------------------- +function Initialize-EtwAclType { + if ('EtwAcl' -as [type]) { return } + Add-Type -TypeDefinition @' +using System; +using System.Runtime.InteropServices; + +public static class EtwAcl +{ + // ULONG EventAccessControl(LPGUID, ULONG Operation, PSID, ULONG Rights, BOOLEAN AllowOrDeny) + [DllImport("advapi32.dll", SetLastError = true)] + public static extern uint EventAccessControl(ref Guid guid, uint operation, byte[] sid, + uint rights, [MarshalAs(UnmanagedType.U1)] bool allowOrDeny); + + // ULONG EventAccessQuery(LPGUID, PSECURITY_DESCRIPTOR, PULONG BufferSize) + [DllImport("advapi32.dll", SetLastError = true)] + public static extern uint EventAccessQuery(ref Guid guid, byte[] buffer, ref uint bufferSize); +} +'@ +} + +# The rights a session controller needs, from evntrace.h: +# 0x0001 WMIGUID_QUERY 0x0100 TRACELOG_ACCESS_KERNEL_LOGGER +# 0x0020 TRACELOG_CREATE_REALTIME 0x0200 TRACELOG_LOG_EVENT +# 0x0040 TRACELOG_CREATE_ONDISK 0x0400 TRACELOG_ACCESS_REALTIME +# 0x0080 TRACELOG_GUID_ENABLE 0x0800 TRACELOG_REGISTER_GUIDS +# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger +# specifically; the rest are what any controller needs to create a session, +# write it to disk and enable providers on it. +# +# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and +# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the +# group cannot read the descriptor back, which makes EventAccessQuery useless as +# a check on whether the grant landed: it answers "access denied" either way. +$EtwControllerRights = 0x120FE1 + +function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) { + Initialize-EtwAclType + $g = [Guid]$Guid + # Operation 2 = EventSecurityAddDACL: add one ACE and leave every existing + # one in place. EventSecuritySetDACL (0) would REPLACE the descriptor, which + # on the kernel logger means removing the entries Windows itself relies on. + $rc = [EtwAcl]::EventAccessControl([ref]$g, 2, (Get-SidBytes $Sid), $Rights, $true) + if ($rc -ne 0) { throw (New-Object System.ComponentModel.Win32Exception([int]$rc)) } +} + +function Get-EtwGuidSddl([string]$Guid) { + Initialize-EtwAclType + $g = [Guid]$Guid + $size = [uint32]0 + [void][EtwAcl]::EventAccessQuery([ref]$g, $null, [ref]$size) + if ($size -eq 0) { return $null } + $buf = New-Object byte[] $size + if ([EtwAcl]::EventAccessQuery([ref]$g, $buf, [ref]$size) -ne 0) { return $null } + return (New-Object System.Security.AccessControl.RawSecurityDescriptor($buf, 0)).GetSddlForm('Access') +} + function Show-VsSetupLogs { # The VS Installer writes dd_*.log to the invoking user's %TEMP%. Because # this script runs elevated, that %TEMP% belongs to the elevated user and is @@ -100,9 +345,217 @@ try { Start-Transcript -Path $LogFile -Force | Out-Null } catch {} try { +# --------------------------------------------------------------------------- +# ETW collection rights for an ordinary account +# +# Out of the box, xperf and wpr only work elevated. THREE separate things stand +# in a standard user's way, and each has its own error: +# +# xperf -on base -> "NT Kernel Logger: Access is denied. (0x5)" +# wpr -start GeneralProfile +# -> "Failed to enable the policy to profile system +# performance." (0xc5585011) +# +# 1. Creating or controlling ANY event tracing session - even a user-mode one +# naming a single provider - is checked against the security descriptor ETW +# keeps per provider GUID under +# HKLM\SYSTEM\CurrentControlSet\Control\WMI\Security. The DEFAULT descriptor +# grants the session-control rights (TRACELOG_CREATE_ONDISK, +# TRACELOG_CREATE_REALTIME, TRACELOG_GUID_ENABLE, TRACELOG_LOG_EVENT) to +# SYSTEM, Administrators, the service accounts, and BUILTIN\Performance Log +# Users - and to nobody else. That group is the supported hook; its own +# description says members "may ... enable trace providers, and collect event +# traces". +# +# 2. Switching on the kernel/system trace provider on top of that needs the +# SeSystemProfilePrivilege user right ("Profile system performance"), held by +# default only by Administrators and NT SERVICE\WdiServiceHost. That is the +# one wpr names in its error. +# +# 3. The kernel logger is not covered by that default descriptor. Its own GUID - +# SystemTraceControlGuid, the session both `xperf -on` and wpr drive - carries +# an explicit descriptor that does not mention Performance Log Users, so 1 and +# 2 are not enough by themselves. Measured on this box with both in place: a +# user-mode session starts (exit 0) and the account holds the privilege, and +# `xperf -on base` still answers "NT Kernel Logger: Access is denied" while +# wpr's error changes from the policy message above to a bare 0x80070005. +# Even READING that descriptor comes back access-denied, which is the tell. So +# add an ACE for the group with EventAccessControl; TRACELOG_ACCESS_KERNEL_LOGGER +# is the right that names this particular session. +# +# The privilege and the ACE both go to the GROUP, and the account then goes into +# the group: membership alone becomes the switch, and enabling the next account +# is one `net localgroup` away with no policy or registry edit. +# +# What this costs, stated plainly: a member of that group can capture +# system-wide kernel traces - process, image, file and registry activity across +# every account on the box, paths and command lines included. That is what the +# group is for, and it is the price of collecting a trace without a UAC prompt. +# +# Deliberately NOT granted: SeDebugPrivilege. xperf needs it for neither CPU +# sampling nor walking stacks in your own processes, and it is equivalent to +# handing out administrator. +# +# THIS ONLY HELPS A NON-ADMIN ACCOUNT. Both a privilege and a group membership +# are baked into the access token at LOGON, and UAC hands an administrator a +# filtered token that keeps just five harmless privileges - so an admin's +# ordinary shell still cannot trace, however the policy reads. Running as a +# standard user is what makes this work. +# +# For the same reason 1 and 2 do not take effect in an already-open session: the +# account has to sign out and back in. Any NEW logon does it - an ssh login into +# this box is one, which is the quick way to check without dropping the desktop. +# The ACE in 3 is machine state rather than token state, so a logon does nothing +# for it. ETW reads these descriptors into a cache, so a REBOOT is what is +# expected to put the change into effect: with the ACE written and readable in +# the descriptor, xperf -on base was still answering "Access is denied" from a +# fresh shell on the running system. So on a first run, plan on both - a new +# logon for 1 and 2, a reboot for 3. +# +# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain +# user. This step is only about collection. +# --------------------------------------------------------------------------- +Write-Step 'ETW collection rights (non-elevated xperf / wpr)' +$PerfLogUsersSid = 'S-1-5-32-559' # BUILTIN\Performance Log Users +# SystemTraceControlGuid: the NT Kernel Logger / system session that xperf -on +# and wpr both drive. Fixed by contract, from evntrace.h. +$SystemTraceControlGuid = '9e814aad-3204-11d2-9a82-006008a86939' +try { + # --- The user right, granted to the group --- + $existing = Get-AccountRight $PerfLogUsersSid + if ($existing -contains 'SeSystemProfilePrivilege') { + Write-Host ' OK: Performance Log Users already holds SeSystemProfilePrivilege' + } else { + Grant-AccountRight $PerfLogUsersSid 'SeSystemProfilePrivilege' + Write-Host ' Granted SeSystemProfilePrivilege ("Profile system performance") to Performance Log Users' + } + + # --- The kernel logger's own descriptor --- + # Safe to repeat: a second ACE for the same SID unions to the same access. + # Kept in its own try so that a failure here still leaves the group + # membership below to be done - user-mode sessions work without it. + # + # ETW reads these descriptors out of the registry into a cache, so a REBOOT + # is what puts a change here into effect - not a new logon, which is what the + # group membership and the privilege need. Both, on a first run. + try { + Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights + Write-Host (" Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights) + $sddl = Get-EtwGuidSddl $SystemTraceControlGuid + if ($sddl) { Write-Host " kernel logger DACL is now $sddl" -ForegroundColor DarkGray } + } catch { + Write-Warning "Could not add the ACE on SystemTraceControlGuid: $($_.Exception.Message)" + Write-Warning 'xperf -on will keep answering "NT Kernel Logger: Access is denied."' + } + + # --- The membership --- + # Fall back to the console user when the caller did not name one: with + # over-the-shoulder elevation that is the person who started + # setup-windows.bat, which is who wants to trace. + $target = $TraceUser + if (-not $target) { + $target = (Get-CimInstance Win32_ComputerSystem -ErrorAction SilentlyContinue).UserName + if ($target) { Write-Host " No -TraceUser given; using the console user $target" } + } + + if (-not $target) { + Write-Warning 'No account to add to Performance Log Users (pass -TraceUser DOMAIN\user).' + Write-Warning 'The user right is in place, so this is the only step left:' + Write-Warning ' net localgroup "Performance Log Users" DOMAIN\user /add' + } else { + # Resolve to a SID first: it validates the name, and it is what the + # membership check compares, so a member spelled ".\claude" in one place + # and "LATISLAB\claude" in another is still recognised as the same account. + $targetSid = (New-Object System.Security.Principal.NTAccount($target)).Translate( + [System.Security.Principal.SecurityIdentifier]) + + # By SID, never by name: "Performance Log Users" is localised, and + # Get-LocalGroup -SID is how this stays correct on a non-English box. + $group = Get-LocalGroup -SID $PerfLogUsersSid + + # Get-LocalGroupMember throws on a group holding a SID that no longer + # resolves (a known Windows 10 bug), so a failure to READ the membership + # must not stop us from writing it - fall through and let the add report. + $already = $false + try { + $already = @(Get-LocalGroupMember -SID $PerfLogUsersSid | + Where-Object { $_.SID.Value -eq $targetSid.Value }).Count -gt 0 + } catch { + Write-Host " (could not enumerate $($group.Name) members: $($_.Exception.Message))" -ForegroundColor DarkGray + } + + if ($already) { + Write-Host " OK: $target is already in $($group.Name)" + } else { + try { + Add-LocalGroupMember -SID $PerfLogUsersSid -Member $targetSid.Value + } catch { + # "already a member" is only reachable when the enumeration above + # failed, and is not an error. Matched on the type NAME rather + # than in a typed catch clause: catch types are resolved when the + # script is PARSED, before the LocalAccounts module has been + # autoloaded, so naming the type there is a parse error that + # would take the whole script down. + if ($_.Exception.GetType().Name -ne 'MemberExistsException') { throw } + } + Write-Host " Added $target to $($group.Name)" + } + + Write-Host '' + Write-Host " $target must sign out and back in for the group and the privilege," -ForegroundColor Yellow + Write-Host ' and the box must be REBOOTED for the kernel logger ACE (ETW caches it).' -ForegroundColor Yellow + Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow + Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow + Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow + } +} catch { + Write-Warning "ETW rights setup failed: $($_.Exception.Message)" + Write-Warning 'Grant them by hand: secpol.msc > Local Policies > User Rights Assignment >' + Write-Warning '"Profile system performance" > add Performance Log Users, then' + Write-Warning ' net localgroup "Performance Log Users" /add' +} + +if ($EtwRightsOnly) { + # `exit` inside the try still runs the finally below, so the transcript is + # stopped and the log is left readable by the non-elevated caller. + Write-Host "`n-EtwRightsOnly: skipping the installs." -ForegroundColor Green + exit 0 +} + + # --------------------------------------------------------------------------- # Base tools via winget # --------------------------------------------------------------------------- + +# --------------------------------------------------------------------------- +# OpenSSH Client +# +# Present by default on Windows 10 1809+ / Windows 11, but removable, and absent +# from some Server images. Two things below want it: rsync does not speak ssh +# itself, it execs an ssh binary, and the release's own ssh.exe links against the +# libcrypto.dll this capability puts in System32. It also owns the ssh-agent +# service configured next, so a missing client is why that step would fail. +# +# Non-fatal, like the server half below: a box that cannot have it should still +# finish provisioning. +# --------------------------------------------------------------------------- +Write-Step 'OpenSSH Client' +try { + $sshc = Get-WindowsCapability -Online -Name 'OpenSSH.Client*' | + Select-Object -First 1 + if (-not $sshc) { + Write-Warning 'OpenSSH.Client capability not offered by this Windows image - skipping.' + } elseif ($sshc.State -eq 'Installed') { + Write-Host " OK: $($sshc.Name) already installed" + } else { + Write-Host " Installing $($sshc.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshc.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Client]' -ForegroundColor Yellow } + } +} catch { + Write-Warning "OpenSSH Client setup failed: $($_.Exception.Message)" +} + # --------------------------------------------------------------------------- # SSH agent # --------------------------------------------------------------------------- @@ -110,6 +563,190 @@ Write-Step 'Enabling ssh-agent' Set-Service -Name ssh-agent -StartupType Automatic if ((Get-Service ssh-agent).Status -ne 'Running') { Start-Service ssh-agent } +# --------------------------------------------------------------------------- +# OpenSSH Server (sshd) +# +# Used to reach the test VMs (VirtualBox) from the host: remote shell plus the +# transport rsync rides on when seeding test data in. Ships with Windows 10 +# 1809+ / Windows 11 as an on-demand capability, so no third-party install. +# +# The capability normally adds the "OpenSSH Server (sshd)" inbound firewall +# rule; we verify and create it if missing (it is absent on some images). +# +# Non-fatal: a box that can't run sshd should still finish provisioning. +# --------------------------------------------------------------------------- +Write-Step 'OpenSSH Server (sshd)' +try { + $sshd = Get-WindowsCapability -Online -Name 'OpenSSH.Server*' | + Select-Object -First 1 + if (-not $sshd) { + Write-Warning 'OpenSSH.Server capability not offered by this Windows image - skipping.' + } else { + if ($sshd.State -ne 'Installed') { + Write-Host " Installing $($sshd.Name) ..." + $r = Add-WindowsCapability -Online -Name $sshd.Name + if ($r.RestartNeeded) { Write-Host ' [reboot required after OpenSSH Server]' -ForegroundColor Yellow } + } else { + Write-Host " OK: $($sshd.Name) already installed" + } + + Set-Service -Name sshd -StartupType Automatic + if ((Get-Service sshd).Status -ne 'Running') { Start-Service sshd } + Write-Host ' sshd: Automatic + running' + + # Firewall: allow inbound 22 on all profiles. VirtualBox host-only and + # bridged adapters are frequently classified Public, and the capability's + # own rule is Private-only on some images, which is what leaves a plainly + # running sshd plainly unreachable. + # + # OpenSSH-Server-In-TCP is the name the capability itself uses, so this + # WIDENS that rule rather than adding a second one next to it. Creating + # our own under a different name would leave the narrow rule in place and + # the box still unreachable on a Public-classified adapter; creating one + # under the same name would collide. Adopt it if present, create it if not. + $ruleName = 'OpenSSH-Server-In-TCP' + if (Get-NetFirewallRule -Name $ruleName -ErrorAction SilentlyContinue) { + Set-NetFirewallRule -Name $ruleName -Enabled True -Profile Any + Write-Host " Widened firewall rule $ruleName to all profiles" + } else { + New-NetFirewallRule -Name $ruleName -DisplayName 'OpenSSH SSH Server (sshd)' ` + -Enabled True -Direction Inbound -Protocol TCP -Action Allow ` + -LocalPort 22 -Profile Any | Out-Null + Write-Host " Added firewall rule $ruleName (TCP 22, all profiles)" + } + } +} catch { + Write-Warning "OpenSSH Server setup failed: $($_.Exception.Message)" +} + +# --------------------------------------------------------------------------- +# rsync for Windows (github.com/nuket/rsync-windows) +# +# Windows' OpenSSH ships the transport only - no rsync - so pushing test data +# from a Linux box needs an rsync.exe on the Windows side. +# +# The release is one zip per architecture - rsync-windows-x64.zip and +# rsync-windows-x86.zip - each holding rsync.exe, the ssh.exe it runs, and the +# licence texts under exactly those names. Both exes are installed, together: +# rsync.exe prefers an ssh.exe in its own directory, and the release's build is +# what makes a push FROM this box run at line rate. The ssh.exe Windows ships +# reads its stdin 3KB at a time, which holds a send at ~17MB/s however fast the +# link is. Nothing else about it differs - same ~/.ssh, same ssh-agent, same +# known_hosts - and a bare `ssh` still resolves to the in-box client, which sits +# ahead of C:\Tools\rsync on the machine PATH. +# +# That ssh.exe links against the libcrypto.dll the OpenSSH Client capability +# above puts in System32: Windows' own LibreSSL, and the fast one, since it uses +# AES-NI. No copy of it ships in the zip, so where the capability is missing we +# unpack rsync alone rather than an ssh.exe that will not start. +# +# Installed to C:\Tools\rsync (NOT under "Program Files"): the remote end is +# invoked as `rsync --server ...` through cmd.exe, and a path with spaces makes +# the client-side --rsync-path escape hatch painful to quote. Added to the +# MACHINE PATH so it resolves for every account, including the non-interactive +# sshd session, which builds its environment from the machine + user registry +# PATH rather than from a login shell. +# +# Non-fatal: a download failure only warns. +# --------------------------------------------------------------------------- +Write-Step 'rsync for Windows' +$RsyncRepo = 'nuket/rsync-windows' +$RsyncAsset = if ([Environment]::Is64BitOperatingSystem) { 'rsync-windows-x64.zip' } else { 'rsync-windows-x86.zip' } +# The /releases/latest/download/ redirect rather than the API: unauthenticated +# API calls are rate-limited to 60/hour per IP, which a provisioning run behind a +# shared NAT can genuinely exhaust, and the redirect costs none of that budget. +# To hold a box on a known build, pin the tag instead: +# .../releases/download/v3.5.0-gABCDEF0/$RsyncAsset +$RsyncUrl = "https://github.com/$RsyncRepo/releases/latest/download/$RsyncAsset" +$RsyncDir = 'C:\Tools\rsync' +try { + New-Item -ItemType Directory -Force -Path $RsyncDir | Out-Null + $RsyncExe = Join-Path $RsyncDir 'rsync.exe' + + # Does the release's ssh.exe have the libcrypto it needs? Decided before the + # download so the answer can also gate what comes out of the zip. + $SysCrypto = Join-Path $env:WINDIR 'System32\libcrypto.dll' + $WantSsh = Test-Path $SysCrypto + if (-not $WantSsh) { + Write-Warning "$SysCrypto is missing - the OpenSSH Client capability is not installed - and the release's ssh.exe needs it. Installing rsync.exe only; rsync will use the ssh on the PATH." + } else { + $v = (Get-Item $SysCrypto).VersionInfo.FileVersion + if ($v -and ([version]($v -replace '[^0-9.]', '')) -lt [version]'3.8.2') { + Write-Warning "$SysCrypto is LibreSSL $v; the release's ssh.exe is built against 3.8.2 (Windows OpenSSH Client 9.5). Update Windows, or expect ssh.exe not to start." + } + } + + # Download and unpack beside the targets, not over them, so an interrupted + # transfer can't leave a truncated rsync.exe sitting on the PATH. The scratch + # name still has to END in .zip: Windows PowerShell 5.1's Expand-Archive + # refuses any other extension outright ("*.download is not a supported + # archive file format"), where PowerShell 7 just reads the file. + [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 + $tmpZip = Join-Path $RsyncDir "download-$RsyncAsset" + Invoke-WebRequest -Uri $RsyncUrl -OutFile $tmpZip -UseBasicParsing + Write-Host " Downloaded $RsyncAsset ($([math]::Round((Get-Item $tmpZip).Length / 1MB, 2)) MB)" + + # Verify against the .sha256 published beside it. Same origin, so this is an + # integrity check on the transfer rather than a defence against a hostile + # release - but a truncated or proxy-mangled download is the failure that + # actually happens, and it fails here instead of mid-transfer later. + # + # -OutFile, not .Content: GitHub serves the .sha256 as + # application/octet-stream, and Invoke-WebRequest hands back a byte[] rather + # than a string for any non-text content type, so .Content would compare the + # first BYTE against the hash and fail on every correct download. + $tmpSha = "$tmpZip.sha256" + Invoke-WebRequest -Uri "$RsyncUrl.sha256" -OutFile $tmpSha -UseBasicParsing + $want = (((Get-Content $tmpSha -Raw) -split '\s+')[0]).Trim().ToLower() + Remove-Item $tmpSha -Force -ErrorAction SilentlyContinue + $got = (Get-FileHash $tmpZip -Algorithm SHA256).Hash.ToLower() + if ($want -and $want -ne $got) { + Remove-Item $tmpZip -Force + throw "SHA-256 mismatch for ${RsyncAsset}: expected $want, got $got" + } + Write-Host " SHA-256 verified: $got" + + # Unpack to a scratch directory and move out the files we asked for, rather + # than expanding straight over the install directory: the zip is the unit + # that was checksummed, and this way a future release adding something to it + # cannot quietly drop that something onto the machine PATH. + $unpack = Join-Path $RsyncDir '.unpack' + if (Test-Path $unpack) { Remove-Item -Recurse -Force $unpack } + Expand-Archive -Path $tmpZip -DestinationPath $unpack -Force + Remove-Item $tmpZip -Force + foreach ($f in 'rsync.exe', 'ssh.exe', 'COPYING.txt', 'NOTICE-ssh.txt') { + $src = Join-Path $unpack $f + if (-not (Test-Path $src)) { continue } + if ($f -eq 'ssh.exe' -and -not $WantSsh) { continue } + Move-Item -Path $src -Destination (Join-Path $RsyncDir $f) -Force + } + Remove-Item -Recurse -Force $unpack + Write-Host " Installed $RsyncExe$(if ($WantSsh) { ' and the ssh.exe it runs' })" + + # Machine PATH (HKLM environment). Idempotent: only appends if absent. + $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') + if (-not $m) { $m = '' } + if (($m -split ';') -notcontains $RsyncDir) { + $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $RsyncDir } else { $RsyncDir } + [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') + Write-Host " Added $RsyncDir to the machine PATH (restart shells / sshd to pick it up)." + # sshd caches the environment it was started with, so an already-running + # service would not see the new PATH until restarted. + if ((Get-Service sshd -ErrorAction SilentlyContinue).Status -eq 'Running') { + Restart-Service sshd + Write-Host ' Restarted sshd so it inherits the updated machine PATH.' + } + } else { + Write-Host " OK: $RsyncDir already in the machine PATH" + } + + & $RsyncExe --version | Select-Object -First 1 +} catch { + Write-Warning "rsync install failed: $($_.Exception.Message)" + Write-Warning "Download $RsyncAsset from https://github.com/$RsyncRepo/releases manually" + Write-Warning "and unpack it into $RsyncDir, keeping rsync.exe and ssh.exe together." +} + # --------------------------------------------------------------------------- # Visual Studio 2022 Community # --------------------------------------------------------------------------- @@ -228,30 +865,48 @@ if ($WdkInstalledRoot -and $WdkInstalledRoot -match [regex]::Escape($WdkVersion) } # --------------------------------------------------------------------------- -# Windows Performance Toolkit (xperf / WPA / wpr) -- ETW CPU + loader profiling, -# used by the perf/ measurement scripts. WPT is an OPTIONAL Windows SDK feature -# that the VS "Windows 11 SDK" component does NOT select, so a fresh box lacks it. -# The Windows ADK bundles WPT and winget owns the (versioned) download URL, so it -# is the most reliable source. Idempotent (skips if xperf is already present in -# either the SDK or ADK location) and non-fatal so it never aborts provisioning. -# Lighter alternative if you don't want the full ADK: install the Windows SDK's -# "Windows Performance Toolkit" optional feature via winsdksetup.exe /features -# OptionId.WindowsPerformanceToolkit. +# Windows Performance Toolkit: xperf, wpr, and Windows Performance Analyzer +# (wpa.exe) -- ETW CPU + loader profiling and the GUI that reads the traces. +# +# WPA is NOT a Visual Studio component and has no relationship to VS's own +# Performance Profiler (a separate, .diagsession-based tool that cannot open an +# .etl). It ships in exactly two places: as an optional FEATURE of the Windows +# SDK ("Windows Performance Toolkit", OptionId.WindowsPerformanceToolkit), and +# in the Windows ADK, which bundles the same toolkit. Whether the SDK install +# that Visual Studio performs happens to select that feature varies with the VS +# and SDK version - when it does, WPT lands in +# %ProgramFiles(x86)%\Windows Kits\10\Windows Performance Toolkit and the SDK +# puts that directory on the machine PATH itself - so this step DETECTS first +# and only falls back to installing the ADK (winget owns the versioned download +# URL, which makes it the reliable source) when nothing is there. That fallback +# is a large download; to install just the toolkit instead, run the standalone +# SDK setup with +# winsdksetup.exe /features OptionId.WindowsPerformanceToolkit /q +# +# There is also a newer WPA in the Microsoft Store (`winget install --id +# 9N0W1B2BXGNZ --source msstore`), which updates independently of the SDK. It is +# not installed here: the Store package needs an interactive, signed-in session, +# which is exactly what this elevated, unattended half does not have. +# +# Idempotent and non-fatal - it never aborts provisioning. # --------------------------------------------------------------------------- -Write-Step 'Windows Performance Toolkit (xperf / WPA)' -$wptRoots = @( - (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'), - (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit\xperf.exe'), - (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit\xperf.exe') +Write-Step 'Windows Performance Toolkit (xperf / wpr / WPA)' +$WptDirs = @( + (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Windows Performance Toolkit'), + (Join-Path $env:ProgramFiles 'Windows Kits\10\Windows Performance Toolkit'), + (Join-Path ${env:ProgramFiles(x86)} 'Windows Kits\10\Assessment and Deployment Kit\Windows Performance Toolkit') ) -$xperf = $wptRoots | Where-Object { Test-Path $_ } | Select-Object -First 1 -if ($xperf) { - Write-Host " OK: WPT already present ($xperf)" -ForegroundColor Green +function Find-WptDir { $script:WptDirs | Where-Object { Test-Path (Join-Path $_ 'xperf.exe') } | Select-Object -First 1 } + +$WptDir = Find-WptDir +if ($WptDir) { + Write-Host " OK: WPT already present ($WptDir)" -ForegroundColor Green } else { try { winget install --id Microsoft.WindowsADK --exact --silent --disable-interactivity ` --accept-source-agreements --accept-package-agreements Write-Host ' Windows ADK (includes Windows Performance Toolkit) installed.' + $WptDir = Find-WptDir } catch { Write-Warning "WPT install failed: $($_.Exception.Message)" Write-Warning 'Install manually: winget install Microsoft.WindowsADK, or add the' @@ -259,6 +914,78 @@ if ($xperf) { } } +if ($WptDir) { + # Report what actually landed. wpa.exe is the piece people come looking for + # and it is the one that is absent if a trimmed toolkit ever shows up. + foreach ($tool in 'xperf.exe', 'wpr.exe', 'wpa.exe', 'wpaexporter.exe') { + $p = Join-Path $WptDir $tool + if (Test-Path $p) { + Write-Host " $tool $((Get-Item $p).VersionInfo.ProductVersion)" + } else { + Write-Warning "$tool is missing from $WptDir" + } + } + + # The WPT installer normally adds this to the machine PATH itself (and the + # Start Menu gets "Windows Kits > Windows Performance Toolkit" shortcuts for + # WPA and WPR). Re-assert it anyway: on the machine PATH rather than a user + # one so it also resolves for the non-interactive sshd sessions this box is + # driven through, which build their environment from the registry PATH. + # Compared trailing-backslash-insensitively - the installer's own entry has + # one, and adding a second spelling of the same directory is just noise. + $m = [Environment]::GetEnvironmentVariable('Path', 'Machine') + if (-not $m) { $m = '' } + $have = ($m -split ';') | Where-Object { $_.TrimEnd('\') -eq $WptDir.TrimEnd('\') } + if ($have) { + Write-Host " OK: $WptDir already in the machine PATH" + } else { + $new = if ($m.Trim()) { $m.TrimEnd(';') + ';' + $WptDir } else { $WptDir } + [Environment]::SetEnvironmentVariable('Path', $new, 'Machine') + Write-Host " Added $WptDir to the machine PATH (restart shells to pick it up)." + } +} + + +# --------------------------------------------------------------------------- +# Intel VTune Profiler - reported, not installed +# +# Deliberately NOT automated, unlike everything above. The offline installer is +# a ~750 MB download from a URL carrying a per-release GUID +# (registrationcenter-download.intel.com/akdlm/IRC_NAS//intel-vtune-_offline.exe) +# with no "latest" redirect behind it, so every new build means editing a +# hard-coded link in here - and it is only worth having on Intel silicon, since +# hardware event-based sampling reads Intel PMU counters. Not a good trade for a +# script that has to keep working unattended on any box. +# +# So this step only reports. To install it, take the Windows offline installer +# from +# https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html +# and run it elevated; it installs unattended with +# intel-vtune-_offline.exe -a --silent --cli --eula accept +# --------------------------------------------------------------------------- +Write-Step 'Intel VTune Profiler (status only)' +$UninstallKeys = @( + 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*' + 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' +) +$vtune = Get-ItemProperty $UninstallKeys -ErrorAction SilentlyContinue | + Where-Object { $_.DisplayName -match 'VTune' } | + Select-Object -First 1 +if ($vtune) { + Write-Host " Installed: $($vtune.DisplayName.Trim()) $($vtune.DisplayVersion)" -ForegroundColor Green + # The oneAPI layout keeps a `latest` junction beside the versioned directory, + # so this path stays right across upgrades. + $VTuneCli = Join-Path $vtune.InstallLocation 'vtune\latest\bin64\vtune.exe' + if (Test-Path $VTuneCli) { Write-Host " CLI: $VTuneCli" } +} else { + Write-Host ' Not installed.' -ForegroundColor Yellow + Write-Host ' https://www.intel.com/content/www/us/en/developer/tools/oneapi/vtune-profiler-download.html' -ForegroundColor Yellow + $cpu = (Get-CimInstance Win32_Processor -ErrorAction SilentlyContinue | Select-Object -First 1).Manufacturer + if ($cpu -and $cpu -notmatch 'Intel') { + Write-Host " (This CPU reports itself as '$cpu' - VTune's hardware event-based sampling wants Intel silicon.)" -ForegroundColor Yellow + } +} + # --------------------------------------------------------------------------- Write-Host "`nAll done." -ForegroundColor Green Write-Host 'If a reboot was flagged above, restart before opening VS or building drivers.'