The Connector ID Key agent utilizes Event Tracing for Windows (ETW) to obtain the details that make up a login breakdown. Windows has a limit of 8 concurrent sessions per ETW provider:
https://learn.microsoft.com/en-us/windows/win32/etw/about-event-tracing
This command will show current ETW trace sessions which are using the WinLogon Provider, which is the source of the login breakdown events. You need to install Windows Performance Toolkit from the Windows SDK to run xperf: https://developer.microsoft.com/en-us/windows/downloads/windows-sdk/:
xperf -Loggers| Select-String -Pattern "Microsoft-Windows-Winlogon" -Context 18,0 -SimpleMatch | findstr /C:"Logger Name"
Example output, LWL CID Trace Session is the Connector ID session and you only would see it when the CID is actively tracing.
PS C:\WINDOWS\system32> xperf -Loggers|Select-String -Pattern "Microsoft-Windows-Winlogon" -Context 18,0 -SimpleMatch|findstr /C:"Logger Name"
Logger Name : DiagLog
Logger Name : Diagtrack-Listener
Logger Name : EventLog-Application
Logger Name : EventLog-System
Logger Name : SensorFramework-{92410660-c9bb-97e0-8602-f3e902e2933e}
Logger Name : WdiContextLog
Logger Name : LWL CID Trace Session
The CID tracing session will fail if WinLogin already has the maximum of 8 active loggers. You may see an error like this in C:\Program Files\Liquidware\Connector ID\tntupdsvc_log.txt. Disabling other logging sessions or uninstalling the source applications may free up a slot and allow the Connector ID in.
tntupdsvc[29848] 11 2025-02-03 10:40:14 start_etw_session::EnableTrace() logon failed with 1450.