ETW graphics providers fail in split privilege model: StartTraceA=5 non-elevated, EnableTraceEx2=1450 elevated

Question

ETW graphics providers fail in split privilege model: StartTraceA=5 non-elevated, EnableTraceEx2=1450 elevated

Thomas Hansen 5

I am building a Windows desktop overlay in C++/WPF that needs FPS from graphics present events.

Current setup:

non-elevated UI process (normal desktop app)
elevated helper/agent process for hardware telemetry
native C++ FPS agent using ETW
target game: PathOfExile.exe (DX12), tested on Windows 11

What we observe:

Non-elevated native FPS agent

successfully finds and locks PathOfExile.exe
StartTraceA fails with Win32 error 5 (Access Denied)

Elevated/native helper path

StartTrace succeeds
EnableTraceEx2 fails with Win32 error 1450 (ERROR_NO_SYSTEM_RESOURCES) for all 3 providers:
- Microsoft-Windows-DxgKrnl
- Microsoft-Windows-DXGI
- D3D9
OpenTrace then fails / no events received

Machine-level checks already done

xperf -loggers shows no obvious graphics ETW logger conflicts
logman query -ets shows only MSDTC_TRACE_SESSION
WPR is not recording
Xbox-related process and MSI Afterburner were closed; behavior did not change
same behavior when testing from copied deployment path

Important extra result:

We changed the native FPS agent manifest from requireAdministrator to asInvoker
running the agent directly from the non-elevated UI process no longer fails at process start
but then StartTraceA still fails with error 5
so the split is now:
- non-elevated: cannot StartTrace
- elevated: can StartTrace, but cannot EnableTraceEx2 on DxgKrnl/DXGI/D3D9

Question:

Has anyone seen this exact ETW privilege split for graphics providers before?

Is there a supported architecture for this case where:

an elevated process owns the ETW session and consumes ProcessTrace
a non-elevated UI only reads decoded FPS results via IPC/file

and if so, is that expected to avoid the 1450 failure?

Secondary question:

For graphics ETW providers, is there any known reason why EnableTraceEx2 would consistently return 1450 in an elevated process even when:

the game is already running
the target PID is known
there are no visible competing graphics ETW sessions
multiple providers all fail the same way?

Any guidance on whether this is:

expected Windows security behavior
a known ETW quota/provider issue
anti-cheat / protected process interaction
or simply a dead end for this architecture

would be very helpful.

Gary Nebbett 6,536 Reputation points

2026-07-20T09:14:50.6766667+00:00

Hello Thomas,

Is the account used to run the non-elevated agent a member of the "Performance Log Users" group?

Do commands such as logman start poc -ets -p Microsoft-Windows-DxgKrnl -o poc.etl work?

What values do you use for buffer size and number of buffers?

Is the "D3D9" provider actually "Microsoft-Windows-D3D9"? You used the full names for the other 2 providers.

Why do you "lock" "PathOfExile.exe"? What locking mechanism do you use?

Why would one even think that "the game is already running" or "the target PID is known" would have any impact on the observed behaviour? Are you trying to use the "private logger mode"?

Regarding the requested guidance:

expected Windows security behavior : depends on answer to "group membership" question.

a known ETW quota/provider issue : depends on answer to buffer size/number question and EVENT_TRACE_USE_PAGED_MEMORY flag.

anti-cheat / protected process interaction : very unlikely.

or simply a dead end for this architecture : not clear what "this architecture" means - if it just means use of Event Tracing then it is not a dead end.

Gary

1 answer

Your answer

Gary Nebbett 6,536 Reputation points

2026-07-20T09:14:50.6766667+00:00

Hello Thomas,

Is the account used to run the non-elevated agent a member of the "Performance Log Users" group?

Do commands such as logman start poc -ets -p Microsoft-Windows-DxgKrnl -o poc.etl work?

What values do you use for buffer size and number of buffers?

Is the "D3D9" provider actually "Microsoft-Windows-D3D9"? You used the full names for the other 2 providers.

Why do you "lock" "PathOfExile.exe"? What locking mechanism do you use?

Why would one even think that "the game is already running" or "the target PID is known" would have any impact on the observed behaviour? Are you trying to use the "private logger mode"?

Regarding the requested guidance:

expected Windows security behavior : depends on answer to "group membership" question.

a known ETW quota/provider issue : depends on answer to buffer size/number question and EVENT_TRACE_USE_PAGED_MEMORY flag.

anti-cheat / protected process interaction : very unlikely.

or simply a dead end for this architecture : not clear what "this architecture" means - if it just means use of Event Tracing then it is not a dead end.

Gary

Answer 1

Hi Gary,

Thanks, that pointed us in the right direction.

You were right to focus on Performance Log Users.

The non-elevated account was not a member of that group. On this Danish Windows install the localized group name is Brugere af ydelseslog.

After adding the user to that group and restarting Windows, the ETW FPS path started working correctly.

What changed after that:

the graphics ETW session starts successfully
provider enable succeeds
live events are received from Microsoft-Windows-DxgKrnl and Microsoft-Windows-DXGI
FPS is now shown correctly and matches the game behavior in PathOfExile.exe (DX12)

Recent state/logs now show:

etwStartFailureCount = 0
lastEtwError = ""
dxgKrnlEnabled = true
dxgiEnabled = true
d3d9Enabled = true
etwEventsReceived = true

So in our case this was not anti-cheat, and not a dead end for ETW. It was a permissions/setup issue, and Performance Log Users membership plus reboot was the missing piece.

Thanks again, ThomasHi Gary,