ETW graphics providers: StartTraceA returns 5 non-elevated, EnableTraceEx2 returns 1450 elevated

NTDEV
1

Hi,

I am debugging an ETW-based FPS collector for a Windows desktop overlay and I have reached a fairly specific privilege split that I would like to sanity-check with people who know ETW/Windows internals better than I do.

Setup:

  • Windows 11
  • native C++ FPS agent
  • non-elevated WPF/UI process
  • separate elevated helper process for hardware telemetry
  • target app is PathOfExile.exe (DX12)

What I am trying to do:

  • get present-based FPS from graphics ETW providers
  • providers tested:
    • Microsoft-Windows-DxgKrnl
    • Microsoft-Windows-DXGI
    • D3D9

Observed behavior:

  1. Non-elevated native FPS agent
  • successfully finds and locks PathOfExile.exe
  • StartTraceA fails with Win32 error 5 (Access Denied)
  1. Elevated helper / elevated native agent
  • StartTrace succeeds
  • EnableTraceEx2 fails with Win32 error 1450 (ERROR_NO_SYSTEM_RESOURCES)
  • this happens for all three providers:
    • DxgKrnl
    • DXGI
    • D3D9
  • OpenTrace then produces no usable event flow
  1. Additional checks already done
  • xperf -loggers shows no obvious competing graphics ETW sessions
  • logman query -ets only showed MSDTC_TRACE_SESSION
  • WPR was not recording
  • Xbox-related process and MSI Afterburner were stopped
  • behavior did not change
  • same behavior reproduced from deployed path, not just dev output
  1. Important extra test
    I changed the native FPS agent manifest from requireAdministrator to asInvoker and started that same native agent directly from the non-elevated UI process.

Result:

  • the process starts fine
  • it finds PathOfExile.exe
  • it attempts ETW
  • StartTraceA still fails with error 5

So the split is now very clear:

  • non-elevated: cannot StartTrace (error 5)
  • elevated: can StartTrace, but cannot EnableTraceEx2 on these graphics providers (error 1450)

At this point I am trying to understand whether this pattern is:

  • expected Windows security behavior for graphics ETW providers
  • a quota/provider resource issue that is not visible through normal logger enumeration
  • related to protected process / anti-cheat behavior
  • or effectively a dead end for this architecture

One idea I considered was a split design where:

  • an elevated process owns the ETW session and also runs OpenTrace/ProcessTrace
  • the non-elevated UI only reads decoded FPS results through file/IPC

Before I spend more time on that, I wanted to ask:

  1. Does this exact split sound familiar?
  • StartTraceA = 5 in non-elevated process
  • EnableTraceEx2 = 1450 in elevated process for DxgKrnl/DXGI/D3D9
  1. Is there any known reason why EnableTraceEx2 would consistently return 1450 for all graphics providers in an elevated process even when:
  • the target game is already running
  • the target PID is known
  • no obvious competing graphics ETW sessions are visible
  • all providers fail the same way
  1. Is the “elevated ETW worker + non-elevated UI consuming only decoded results” model the only realistic ETW architecture here, or does the 1450 result already suggest that even that model is unlikely to work on this machine?

I am not asking for a full design review, mostly whether this failure pattern points to something known/expected before I go further down the ETW path.

Thanks.