Session Windowsupdatetracelog Failed — To Start With The Following Error 0xc0000035 Repack [2021]

0xc0000035 (often paired with Event ID 2) for the WindowsUpdateTracelog indicates a name collision

where the system attempts to start a logging session with a name that is already in use

. This typically happens during system startup and is often considered a benign "timing issue" that does not necessarily mean your updates are failing. Understanding the Error : The code 0xc0000035 corresponds to STATUS_OBJECT_NAME_COLLISION

: In most cases, if your computer is receiving and installing updates normally, this error in the Event Viewer can be safely ignored as it is a logging-related conflict rather than a system failure. Microsoft Learn Recommended Troubleshooting Steps

If you are experiencing system slowdowns or Windows Update issues alongside this error, follow these steps to resolve potential underlying file or service corruption: 1. Run System Repair Tools

Repair corrupted system files that might be interfering with the tracing session. Microsoft Learn Command Prompt Administrator Run the following commands one by one, letting each finish: DISM /Online /Cleanup-Image /RestoreHealth sfc /scannow Microsoft Learn 2. Clear the Windows Update Cache

Resetting the update components can resolve name collisions in the trace logs. Microsoft Learn Command Prompt (Admin) Stop the update services by entering these commands: net stop wuauserv net stop bits net stop cryptSvc

Rename the update folders to force Windows to recreate them:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old Restart the services: net start wuauserv net start bits net start cryptSvc Microsoft Learn 3. Adjust Registry (For Persistent Log Flooding)

If the error is flooding your Event Viewer but not causing performance issues, you can disable the specific autologger causing the conflict. : This stops the specific log from being generated. , and hit Enter. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\b675ec37-bdb6-4648-bc92-f3fdc74d3ca2 EnableProperty DWORD values to Restart your computer. 4. Hardware and Driver Checks

In rare cases, this error can be a symptom of hardware or driver instability:

Windows Update is a critical component of the Windows operating system, ensuring your PC receives the latest security patches, feature updates, and driver fixes. However, the update process generates a massive amount of background data. To monitor and troubleshoot this process, Windows uses Event Tracing for Windows (ETW).

One common and frustrating error that users encounter in the Windows Event Viewer regarding this process is: "Session WindowsUpdateTracelog failed to start with the following error: 0xc0000035". 0xc0000035 (often paired with Event ID 2) for

If you are seeing this error frequently in your Event Viewer logs, this comprehensive guide will explain what causes it and how to fix it permanently. What is Error 0xc0000035?

The error code 0xc0000035 translates to STATUS_OBJECT_NAME_COLLISION.

In plain English, this means that the operating system tried to create a new session, task, or file with a specific name, but another active session or file was already using that exact same name. Because two things cannot occupy the exact same space in the system's registry or memory under the same identifier, the system fails to start the new session and throws this error.

In the context of the WindowsUpdateTracelog, the OS is attempting to start a diagnostic trace log to monitor Windows Update activities. Because a previous trace session failed to close properly, or a duplicate logging instance is already running, the system hits a naming collision and halts. Common Causes of the Error

While the core issue is always a name collision, several underlying factors can trigger this specific event:

Autologger Conflicts: The Windows OS has hardcoded rules for starting diagnostic sessions on boot. If the setup is duplicated, it crashes.

Corrupted Log Files: If the physical .etl (Event Trace Log) file on your hard drive is corrupted, Windows might fail to overwrite or access it.

Third-Party Antivirus Interference: Overprotective security software sometimes locks log files or prevents Windows from shutting down background tracing tasks properly.

Pending or Corrupted Updates: A stuck or broken Windows Update can leave active trace logs open indefinitely. How to Fix WindowsUpdateTracelog Error 0xc0000035

Here are the step-by-step methods to resolve this error, ordered from the most effective and common fixes to advanced troubleshooting.

Method 1: Modify the Autologger Registry Key (Most Effective)

Since this is a naming collision error during the boot-up or startup trace logging, disabling or resetting the specific autologger session in the Windows Registry is often the most direct fix. Press the Windows Key + R to open the Run dialog box. Type regedit and press Enter to open the Registry Editor.

Navigate to the following path:HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WindowsUpdateTracelog In the right-hand pane, look for a DWORD value named Start. Step 2: Clear Stale ETW Sessions (The "Clean

Double-click on Start and change its value data from 1 to 0. (Setting it to 0 disables the autologger from trying to boot up a duplicate session). Click OK. Restart your computer. Method 2: Clear the Windows Update Cache

If a corrupted or stuck update is holding the trace log hostage, clearing the SoftwareDistribution folder will force Windows to reset its update components and clear out active trace files.

Type cmd in the Windows search bar, right-click on Command Prompt, and select Run as administrator.

Type the following commands one by one, pressing Enter after each to stop the update services: net stop wuauserv net stop bits net stop cryptsvc

Leave the Command Prompt open. Press Windows Key + R, type C:\Windows\SoftwareDistribution and press Enter.

Select all files and folders inside this folder and Delete them (do not delete the SoftwareDistribution folder itself, just its contents).

Return to the Command Prompt and restart the services by typing and entering: net start wuauserv net start bits net start cryptsvc Restart your PC. Method 3: Run SFC and DISM Scans

System file corruption can prevent Windows services from communicating correctly, leading to false object name collisions. Running built-in repair tools can fix this. Open Command Prompt as an administrator. Type the following command and press Enter:sfc /scannow

Wait for the scan to finish. If it repairs files, restart your PC.

If the error persists, reopen Command Prompt as administrator and run the DISM tool:DISM /Online /Cleanup-Image /RestoreHealth Restart your computer once the process is 100% complete.

Method 4: Disable IPv6 (Workaround for Specific Network Collisions)

In some documented instances, the 0xc0000035 error on startup is tied to network location awareness and IPv6 IP collisions rather than just the Windows Update Tracelog itself, though the error manifests under the same code. Press Windows Key + R, type ncpa.cpl and press Enter.

Right-click on your active internet connection (Wi-Fi or Ethernet) and select Properties. Open Command Prompt (Admin) or PowerShell (Admin)

Scroll down and uncheck the box next to Internet Protocol Version 6 (TCP/IPv6). Click OK and restart your computer. Should You Be Worried About This Error? For the vast majority of users, no.

If your computer is downloading and installing Windows Updates successfully, and you are not experiencing system crashes, blue screens, or extreme slowdowns, this error is mostly benign. It simply means a diagnostic background log failed to start.

Unless you are actively troubleshooting a failed Windows Update with Microsoft support and need those specific trace logs, you can safely ignore this Event Viewer error or use Method 1 to stop it from cluttering your administrative logs.

I can share more specific guides to help you resolve this. Tell me:

Are you having issues downloading/installing Windows Updates right now? Is this error causing your PC to freeze or crash? Which version of Windows are you currently running?

Here’s a detailed guide to understanding and resolving the error: “Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035 repack”.

This error typically appears in Windows Event Viewer or during system repairs (e.g., using DISM or SFC), especially after a Windows update fails or a system image corruption occurs. The error code 0xc0000035 means STATUS_OBJECT_NAME_COLLISION – essentially, a duplicate object name exists (e.g., two processes trying to use the same log session name).

Step 2: Clear Stale ETW Sessions (The "Clean Slate" Fix)

If the error persists because the system thinks a session is already running, you must clear the ETW state. This is done via the command line (Admin privileges):

  1. Open Command Prompt (Admin) or PowerShell (Admin).
  2. List current running traces to confirm the conflict: 
    logman query
    Look for "WindowsUpdateTraceLog" in the list.
  3. If found, stop and delete the session: 
    logman stop WindowsUpdateTraceLog -ets
    (Note: -ets sends commands directly to the kernel trace engine).

6. Preventing the Error When Building a Repack

If you’re a repacker creating custom images, here’s how to avoid 0xc0000035 entirely:

Q: Does this error affect Windows 11 differently than Windows 10?

No – both versions handle ETW sessions identically for Windows Update. The fix works across Windows 10/11 and Server 2019/2022.

Summary

The error "Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035" indicates a Windows scheduled task or service (related to Windows Update tracing) could not start because an object with the same name already exists (STATUS_OBJECT_NAME_COLLISION). This typically points to a corrupted or duplicate trace session, leftover ETW (Event Tracing for Windows) registration, or conflicting tracing state.

5. Check for Orphaned Trace Session Handles

Use handle.exe from Sysinternals (Microsoft) to see if another process holds the trace session:

  1. Download Handle.
  2. Run as admin: 
    handle64.exe -a WindowsUpdateTraceLog
  3. If a PID is shown, kill that process (after verifying it's safe) or reboot.

Remediation Steps (ordered, prescriptive)

  1. Restart ETW consumers and related services:
    • Restart Windows Update service (wuauserv) and Background Intelligent Transfer Service (BITS).
    • If safe, reboot the system to clear kernel named objects.
  2. Enumerate and stop conflicting sessions:
    • logman query -ets to find sessions named like WindowsUpdateTraceLog or containing "repack".
    • For a running autologger session: logman stop -ets
  3. Remove stale Autologger registry entries (if present):
    • Backup registry.
    • Inspect HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger<SessionName> and delete orphaned keys matching the problematic session.
    • Reboot after changes.
  4. Check for third‑party interference:
    • Temporarily disable security/monitoring tools; repeat steps 1–2.
  5. Repair system components:
    • Run DISM and SFC:
      • dism /online /cleanup-image /restorehealth
      • sfc /scannow
  6. Recreate or reset ETW sessions:
    • Use wevtutil or PowerShell to re-register default channels/providers if corrupted:
      • wevtutil.exe gp Microsoft-Windows-WindowsUpdate /f:true > backup.xml
      • wevtutil um Microsoft-Windows-WindowsUpdate
      • wevtutil im backup.xml
    • Only perform provider unregister/register when corruption is confirmed.
  7. If error occurs during an update/repackaging operation:
    • Review installer logs (CBS, SetupAPI, WindowsUpdateClient) for failing steps.
    • Re-run the update or repair the package.
  8. Collect diagnostic traces if issue persists:
    • Use logman to start kernel/user tracing with unique session names to capture creation failures.
    • Capture Process Monitor (ProcMon) during attempted session creation to see CreateFile/CreateNamedPipe/RegCreateKey collisions.

Q: Can I ignore it in a repack?

Not if you plan to sysprep or deploy widely. The collision can prevent future Windows Updates and cause system file checker (SFC) hiccups.

Recommended Troubleshooting Workflow (concise)

  1. Reboot. If issue persists:
  2. Run logman query -ets; stop any conflicting WindowsUpdateTraceLog/repack sessions.
  3. Backup registry; remove matching keys under Autologger if orphaned.
  4. Restart Windows Update services; run DISM/SFC.
  5. If still failing, capture ETW/procmon traces and analyze for object-name collisions; escalate with logs to Microsoft support.