title: ETW EnableTrace Access Denied
body: <p>I want to log some events from <strong>Microsoft-Windows-Kernel-Network</strong> provider using c(c++) code in <strong>real-time</strong>.</p>
  
  <p>When i'am trying to execute program not as Administrator, it fail at <strong>EnableTrace</strong> (<strong>EnableTraceEx2</strong>) with code 5 (ACCESS DENIED).</p>
  
  <p><strong>BUT</strong></p>
  
  <p>But i can Add provider to my session(if i just create and dont stop and close it in program) using <strong><em>Performance Monitor</em></strong> <em>without administrator privileges</em>.</p>
  
  <hr>
  
  <p>Steps with perfmon:</p>
  
  <pre><code>//Create trace session without providers
  1. StartTrace() // EVENT_TRACE_REAL_TIME_MODE
  2. OpenTrace()  // PROCESS_TRACE_MODE_REAL_TIME | PROCESS_TRACE_MODE_EVENT_RECORD
  
  //Wait for events
  3. ProcessTrace()
  
  //Add provider manually
  4. Open perfmon and add provider manually to my session.
  </code></pre>
  
  <p><strong>Result:</strong> program starts getting events!</p>
  
  <hr>
  
  <p>Steps <em>without</em> perfmon and admin. rights:</p>
  
  <pre><code>//Create trace session without providers
  1. StartTrace() // EVENT_TRACE_REAL_TIME_MODE
  2. OpenTrace()  // PROCESS_TRACE_MODE_REAL_TIME | PROCESS_TRACE_MODE_EVENT_RECORD
  3. EnableTraceEx2() //flag,keyword is 0, level is 0x00 or 0x04(Informational)
  4. ProcessTrace()
  OnError: ControlTrace() and CloseTrace() //EVENT_TRACE_CONTROL_STOP
  </code></pre>
  
  <p><strong>Result</strong>: fail at step 3: ACESS DENIED</p>
  
  <ol>
  <li><p><strong>How i can programmatically add(enable) provider without Admin. privileges?</strong></p></li>
  <li><p>Why perfmon can do this without elevating?</p></li>
  </ol>