Two consequences worth knowing. A privilege and a group membership are both
read into the access token **at logon**, so the account must sign out and back
in for 1 and 2 — any new logon does it, and an `ssh` login into the box is the
- quick way to check without dropping the desktop. (The ACE in 3 is machine
- state, read when a session starts, so it applies immediately.) And this only
+ quick way to check without dropping the desktop. The ACE in 3 is machine state
+ instead, and a logon does nothing for it: ETW reads these descriptors into a
+ cache, so it takes a **reboot** — with the ACE written and readable, `xperf -on
+ base` was still denied from a fresh shell on the running system. Plan on both
+ on a first run. And this only
helps a **non-admin** account: UAC hands an administrator a filtered token
carrying just five harmless privileges, so an admin's ordinary shell still
cannot trace however the policy reads. Verify from the target account,
# TRACELOG_ACCESS_KERNEL_LOGGER is the one that names the NT Kernel Logger\r
# specifically; the rest are what any controller needs to create a session,\r
# write it to disk and enable providers on it.\r
-$EtwControllerRights = 0x0FE1\r
+#\r
+# READ_CONTROL (0x20000) and SYNCHRONIZE (0x100000) go with them - the SYSTEM and\r
+# Administrators entries on this GUID carry 0x120FFF. Without READ_CONTROL the\r
+# group cannot read the descriptor back, which makes EventAccessQuery useless as\r
+# a check on whether the grant landed: it answers "access denied" either way.\r
+$EtwControllerRights = 0x120FE1\r
\r
function Grant-EtwGuidAccess([string]$Guid, [string]$Sid, [uint32]$Rights) {\r
Initialize-EtwAclType\r
# For the same reason 1 and 2 do not take effect in an already-open session: the\r
# account has to sign out and back in. Any NEW logon does it - an ssh login into\r
# this box is one, which is the quick way to check without dropping the desktop.\r
-# The ACE in 3 is machine state, read when a session is started, so that one\r
-# applies immediately.\r
+# The ACE in 3 is machine state rather than token state, so a logon does nothing\r
+# for it. ETW reads these descriptors into a cache, so a REBOOT is what is\r
+# expected to put the change into effect: with the ACE written and readable in\r
+# the descriptor, xperf -on base was still answering "Access is denied" from a\r
+# fresh shell on the running system. So on a first run, plan on both - a new\r
+# logon for 1 and 2, a reboot for 3.\r
#\r
# Analysis never needed any of this: wpa.exe opens an existing .etl as a plain\r
# user. This step is only about collection.\r
}\r
\r
# --- The kernel logger's own descriptor ---\r
- # Idempotent: adding the ACE for a SID that already has it rewrites the same\r
- # entry. Kept in its own try so that a failure here still leaves the group\r
+ # Safe to repeat: a second ACE for the same SID unions to the same access.\r
+ # Kept in its own try so that a failure here still leaves the group\r
# membership below to be done - user-mode sessions work without it.\r
+ #\r
+ # ETW reads these descriptors out of the registry into a cache, so a REBOOT\r
+ # is what puts a change here into effect - not a new logon, which is what the\r
+ # group membership and the privilege need. Both, on a first run.\r
try {\r
Grant-EtwGuidAccess $SystemTraceControlGuid $PerfLogUsersSid $EtwControllerRights\r
Write-Host (" Granted Performance Log Users the controller rights (0x{0:X4}, TRACELOG_ACCESS_KERNEL_LOGGER included) on SystemTraceControlGuid" -f $EtwControllerRights)\r
}\r
\r
Write-Host ''\r
- Write-Host " $target must sign out and back in before this takes effect." -ForegroundColor Yellow\r
+ Write-Host " $target must sign out and back in for the group and the privilege," -ForegroundColor Yellow\r
+ Write-Host ' and the box must be REBOOTED for the kernel logger ACE (ETW caches it).' -ForegroundColor Yellow\r
Write-Host ' Then, from that account (NOT elevated):' -ForegroundColor Yellow\r
Write-Host ' whoami /priv | findstr SeSystemProfilePrivilege' -ForegroundColor Yellow\r
Write-Host ' xperf -on base ; xperf -stop C:\Temp\trace.etl' -ForegroundColor Yellow\r
vilimpoc.org / repos / dotfiles / commitdiff