session windowsupdatetracelog failed to start with the following error 0xc0000035 repack

Session Windowsupdatetracelog | Failed To Start With The Following Error 0xc0000035 Repack

If WindowsUpdateTraceLog keeps getting stuck, Alex learned to:

But in most cases, simply stopping the old session fixed it forever.

"Repackaging" inherently involves monitoring file and registry changes. Some third-party monitoring tools (legacy App-V sequencers or specific antivirus software) may hook into ETW providers. If the repackaging tool attempts to capture all system activity, it may clash with the Windows Update service's attempt to write to its own log file (WindowsUpdateTraceLog.etl), resulting in a handle collision.

If the above fails, the collision might be in the global ETW controller. Use this PowerShell script to list and force-remove any duplicate sessions:

$sessionName = "WindowsUpdateTraceLog"
$sessions = logman query -ets | Select-String $sessionName -Context 0,2

if ($sessions) 
Write-Host "Found conflicting session – removing..."
logman stop $sessionName -ets
logman delete $sessionName -ets

Then restart the Windows Update service:

Restart-Service wuauserv -Force

Error code 0xc0000035 translates to STATUS_OBJECT_NAME_COLLISION. In simple terms: An object (file, registry key, or session) with the same name already exists.

So the message means: Windows tried to start the ETW session for logging Windows Updates, but another session or system component already holds that resource. But in most cases, simply stopping the old

The Windows Event error 0xc0000035 typically denotes STATUS_OBJECT_NAME_COLLISION — an attempt to create an object (file, named pipe, event, session, or registry key) which already exists. When observed for the WindowsUpdateTraceLog session (part of Windows Event Tracing for Windows, ETW), the error prevents trace collection for Windows Update diagnostics and may indicate resource/name collisions, leftover state from previous tracing sessions, improper shutdown, or interfering third‑party software.

This paper analyzes the Windows event indicating "Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035 repack". It examines root causes, diagnostic steps, and remediation approaches, and provides a reproducible troubleshooting workflow and preventive recommendations.

The error 0xc0000035 during a repack indicates a conflict over the WindowsUpdateTraceLog ETW session. It is rarely

The error 0xc0000035 is a Kernel Event Tracing issue that occurs when Windows attempts to start a logging session (like WindowsUpdateTraceLog or RUXIMLog) but fails because an object with the same name already exists. In technical terms, it is a STATUS_OBJECT_NAME_COLLISION.

While it often appears in the Event Viewer, it is usually harmless unless accompanied by system crashes or failed updates. Quick Fixes

Restart the Computer: Often, a simple reboot clears the temporary logging conflict. Run Windows Update Troubleshooter:

Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters.

Run the Windows Update troubleshooter and follow the prompts. Advanced Repair Steps leftover state from previous tracing sessions

If the error persists and is causing performance issues, use these command-line tools to repair corrupted system files. 1. Run SFC and DISM

These tools scan and repair corrupted Windows system files that may be blocking the trace log. Open Command Prompt as an administrator. Type sfc /scannow and press Enter.

Once finished, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. 2. Modify the Registry (Use Caution)

This method changes how the system handles the specific event log causing the collision. Open Regedit (Registry Editor) as administrator.

Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\EventLog-System. Locate the Enabled and EnableProperty keys. Double-click each and change the Value Data from 1 to 0. Restart your computer for changes to take effect. 3. Reset Windows Update Components

Manually clearing the update cache can resolve conflicts with the WindowsUpdateTraceLog. Open Command Prompt (Admin). Stop services by running: net stop wuauserv net stop cryptSvc net stop bits net stop msiserver

Rename the software distribution folders to clear the cache:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old and remediation approaches

Restart the services using net start for each of the four listed above. Summary Table: Error Impact

This error message typically appears in the Windows Event Viewer

when a background diagnostic logging session fails to initialize. In most cases, it is a benign system glitch that can be safely ignored unless you are experiencing severe performance issues or blue screens. Microsoft Learn What the Error Means 0xc0000035 : This code usually refers to STATUS_OBJECT_NAME_COLLISION

, meaning a logging session with that exact name was already running or a file with that name already exists. WindowsUpdateTraceLog

: This is a specific event tracing session used by the operating system to track the health and activity of the Windows Update service. Benign Nature : Experts from Microsoft Community Support

often note that these log entries are common during normal operations and do not necessarily indicate a critical system failure. Microsoft Learn How to Fix It

If you notice system slowdowns or want to clear the error, try these steps: Troubleshoot problems updating Windows - Microsoft Support

Go to Top