ETW StartTraceW fails with ACCESS_DENIED after EA AntiCheat starts (EnableTraceEx2 still works) #573
Description
After EA AntiCheat starts, calls to StartTraceW() consistently fail with ERROR_ACCESS_DENIED. As a result, Intel PresentMon cannot begin monitoring titles that use EA AntiCheat (e.g., Battlefield 6) when capture is initiated after the game is already running.
To address this, we’ll change when StartTraceW() is invoked: the service will create the ETW session at startup (with no providers enabled), and Start Capture / Stop Capture will enable and disable the required provider set via EnableTraceEx2().