Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack Better May 2026

The error code 0xC0000035 typically indicates a STATUS_OBJECT_NAME_COLLISION, which means the WindowsUpdateTraceLog session failed to start because a logging session with that same name is already running or wasn't properly closed. In most cases, this error is benign and can be safely ignored unless you are experiencing actual failures with Windows Update. Recommended Troubleshooting Steps

If you are seeing this error frequently or experiencing update issues, try the following solutions:

Restart Windows Update Services: Use the Windows Services Manager (services.msc) to find the Windows Update service, right-click it, and select Restart.

Run System Repairs: Open Command Prompt as an administrator and run these two commands to fix potential system file corruption: sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth

Clear the Update Cache: Stop the Windows Update service, then navigate to C:\Windows\SoftwareDistribution and delete its contents. Restart the service afterward.

Manage ETW Sessions: You can manually stop conflicting sessions using the logman command in an elevated Command Prompt: Type logman query -ets to find the active sessions.

Use logman stop "WindowsUpdateTraceLog" -ets to force stop the conflicting session.

Update Drivers: Outdated network or chipset drivers can sometimes cause timing issues that trigger these collisions. Use the Windows Device Manager to check for updates.

If the error persists but your system updates are installing correctly, Microsoft support specialists often suggest it is a known timing issue that does not require further action.

Are you currently facing any specific issues with downloading or installing updates, or is the error only appearing in your Event Viewer?

Here’s a detailed guide to understanding and resolving the error: “Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035 repack”.

This error typically appears in Windows Event Viewer or during system repairs (e.g., using DISM or SFC), especially after a Windows update fails or a system image corruption occurs. The error code 0xc0000035 means STATUS_OBJECT_NAME_COLLISION – essentially, a duplicate object name exists (e.g., two processes trying to use the same log session name).

Method 1: Kill the Stuck Session via Command Line (Fastest)

  1. Open Command Prompt as Administrator.
  2. List all active trace sessions: 
    logman query -ets
  3. Look for WindowsUpdateTraceLog. If found, delete it: 
    logman stop "WindowsUpdateTraceLog" -ets
  4. Restart the Windows Update service: 
    net stop wuauserv && net start wuauserv
  5. Reboot and check Event Viewer again.

Fix: “Session WindowsUpdateTraceLog Failed to Start with Error 0xc0000035” (Repack Guide)

If you are a Windows system administrator, a PC technician, or an advanced user building custom images (repacks), you may have encountered a cryptic error message while inspecting the Event Viewer or during a sysprep process:

“Session ‘WindowsUpdateTraceLog’ failed to start with the following error 0xc0000035.”

This error often appears alongside the keyword “repack” — referring to repackaged Windows installations, custom ISOs, or modified system images. It is frustrating because it doesn’t always crash the system visibly, but it can lead to update failures, performance degradation, and Sysprep errors.

This article will explain exactly what this error means, why it happens during repacking, and how to resolve it permanently.

Why This Happens

  • An old WindowsUpdateTraceLog session wasn't properly closed.
  • A third-party cleaner, AV, or system tweak corrupted ETW state.
  • Abrupt shutdown during Windows Update diagnostic logging.

Step 5: Re-register the Windows Update ETW Provider

The WindowsUpdateTraceLog session depends on a specific ETW provider. Re-register it:

cd /d C:\Windows\System32
regsvr32.exe /u wuapi.dll
regsvr32.exe wuapi.dll
regsvr32.exe wuaueng.dll
regsvr32.exe wucltux.dll

Then rebuild the ETW manifest:

wevtutil im C:\Windows\System32\winevt\Logs\Microsoft-Windows-WindowsUpdateClient%4Operational.man

(If the .man path doesn’t exist, run wevtutil el and find the update client’s manifest.)

Step 3: Delete Corrupt ETW Session Data

Sometimes the trace setup persists across reboots. Delete the registry artifacts:

  1. Open regedit
  2. Navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
  3. Look for a child key named WindowsUpdateTraceLog. If it exists, delete it.
  4. Also check:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels\... for orphaned update channels (less common, but delete if present).

Still Broken?

Try resetting Windows Update components completely: Method 1: Kill the Stuck Session via Command Line (Fastest)

  • Stop BITS, WUAUSERV, Cryptographic Services.
  • Delete C:\Windows\SoftwareDistribution and C:\Windows\System32\catroot2.
  • Re-register Windows Update DLLs.

Last tested: March 2025 – Works on Windows 11 24H2 and Windows Server 2022.

The error 0xC0000035 (STATUS_OBJECT_NAME_COLLISION) during WindowsUpdateTraceLog indicates a benign name conflict, often ignorable if system updates function normally. Resolving this involves clearing the Windows Update cache via Command Prompt or disabling the specific autologger in the registry editor. For a detailed troubleshooting guide, visit Microsoft Q&A.

This error message typically appears in the Windows Event Viewer

when a background diagnostic logging session fails to initialize. In most cases, it is a benign system glitch that can be safely ignored unless you are experiencing severe performance issues or blue screens. Microsoft Learn What the Error Means 0xc0000035 : This code usually refers to STATUS_OBJECT_NAME_COLLISION

, meaning a logging session with that exact name was already running or a file with that name already exists. WindowsUpdateTraceLog

: This is a specific event tracing session used by the operating system to track the health and activity of the Windows Update service. Benign Nature : Experts from Microsoft Community Support

often note that these log entries are common during normal operations and do not necessarily indicate a critical system failure. Microsoft Learn How to Fix It

If you notice system slowdowns or want to clear the error, try these steps: Troubleshoot problems updating Windows - Microsoft Support

The error code 0xc0000035 is the digital equivalent of trying to open a door that’s already been thrown wide open. In Windows-speak, it means STATUS_OBJECT_NAME_COLLISION—basically, the system tried to start the WindowsUpdateTraceLog session, but it realized a session with that exact name was already running in the background [1, 3].

Here is a short story about a very confused robot named Unit 035 to help illustrate what’s happening inside your computer. The Tale of the Double-Booked Robot

In the sprawling, neon-lit basement of the Windows OS, there was a small, high-speed office dedicated entirely to the WindowsUpdateTraceLog. This office had one job: write down every single thing that happened during an update so that if something broke, the engineers would have a map. The lead clerk was a robot named Unit 035.

One Tuesday morning, at exactly 10:00:00 AM, the System Kernel sent a lightning-fast telegram: "START THE TRACELOG SESSION IMMEDIATELY."

Unit 035 grabbed his clipboard and dashed toward the office door. But when he reached for the handle, he found it locked from the inside. He peered through the frosted glass and saw… himself.

Another Unit 035 was already sitting at the desk, coffee in hand, scribbling furiously.

"Hey!" the first Unit 035 shouted, rattling the door. "I’m supposed to be in there! The Kernel told me to start the session!"

The robot inside didn't even look up. "I'm already doing it, pal. Check the logs. Session's active."

Confused and feeling redundant, the first Unit 035 pulled out a red stamp and slammed it onto the Kernel's telegram. Since he couldn't start a job that was already being done, he wrote the only thing his programming allowed for a name collision: Error 0xc0000035.

He sent the telegram back upstairs, sighed, and went to the breakroom to wait for the next update. How to Fix the "Collision"

Since this error usually just means a duplicate process is trying to run, it’s often harmless. However, if it’s cluttering your Event Viewer, you can "clear the office" by following these steps:

The Quick Reset: Restarting your computer usually kills the "ghost" session and lets a fresh one start cleanly [4, 5]. Open Command Prompt as Administrator

Clean the Cache: Sometimes old log files get stuck. Navigate to C:\Windows\SoftwareDistribution and delete the contents of the DataStore and Download folders (you may need to stop the Windows Update service first) [2, 4].

The Manual Stop: Open a Command Prompt as Administrator and type perfmon /res. Look under the CPU or Disk tabs for any "WindowsUpdate" processes that are hung and end them manually [5].

Are you seeing this error pop up frequently in your Event Viewer, or did it just happen once during a manual update?

The error code 0xc0000035 is technically defined as STATUS_OBJECT_NAME_COLLISION, which indicates that a tracking session or logger is attempting to start using a name that is already in use by the system. In the context of "WindowsUpdateTracelog," this often occurs during routine background maintenance or updates and is generally considered benign unless you are experiencing active system instability or update failures. Understanding the Error

When Windows Update or performance diagnostic tools attempt to initiate a Kernel Event Tracing session, they may encounter this collision if a previous session didn't close properly or if multiple services are requesting the same log name simultaneously. Recommended Solutions

If this error is cluttering your Event Viewer or causing noticeable performance dips, you can resolve it through several standard Windows repair methods:

Run Built-in Troubleshooters: The first step should be the Windows Update Troubleshooter, which can automatically detect and clear common logging collisions.

Repair System Files: Use the System File Checker (SFC) and Deployment Image Servicing and Management (DISM) tools to repair corrupted registry keys or system files that might be triggering the collision: Open Command Prompt as an Administrator. Run sfc /scannow.

Once complete, run DISM /Online /Cleanup-Image /RestoreHealth.

Reset Update Cache: If the collision persists, clearing the update cache can force a "clean" restart of the logging session. This is done by stopping the Windows Update service and clearing the C:\Windows\SoftwareDistribution folder.

Registry Modification (Advanced): Some users resolve the persistent trace log error by navigating to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\EventLog-System and setting the Enabled and EnableProperty values to 0. Note: Always back up your registry before making changes.

If your system is otherwise stable and updates are installing successfully, many Microsoft Community Experts suggest that this specific log error can be safely ignored.

Are you experiencing any specific performance issues like slow boot times or failed updates alongside this error?

The error 0xc0000035 is a Kernel Event Tracing issue that occurs when Windows attempts to start a logging session (like WindowsUpdateTraceLog or RUXIMLog) but fails because an object with the same name already exists. In technical terms, it is a STATUS_OBJECT_NAME_COLLISION.

While it often appears in the Event Viewer, it is usually harmless unless accompanied by system crashes or failed updates. Quick Fixes

Restart the Computer: Often, a simple reboot clears the temporary logging conflict. Run Windows Update Troubleshooter:

Go to Settings > Update & Security > Troubleshoot > Additional troubleshooters.

Run the Windows Update troubleshooter and follow the prompts. Advanced Repair Steps

If the error persists and is causing performance issues, use these command-line tools to repair corrupted system files. 1. Run SFC and DISM

These tools scan and repair corrupted Windows system files that may be blocking the trace log. Open Command Prompt as an administrator. Type sfc /scannow and press Enter. or servicing operation.

Once finished, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. 2. Modify the Registry (Use Caution)

This method changes how the system handles the specific event log causing the collision. Open Regedit (Registry Editor) as administrator.

Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\EventLog-System. Locate the Enabled and EnableProperty keys. Double-click each and change the Value Data from 1 to 0. Restart your computer for changes to take effect. 3. Reset Windows Update Components

Manually clearing the update cache can resolve conflicts with the WindowsUpdateTraceLog. Open Command Prompt (Admin). Stop services by running: net stop wuauserv net stop cryptSvc net stop bits net stop msiserver

Rename the software distribution folders to clear the cache:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old

Restart the services using net start for each of the four listed above. Summary Table: Error Impact

0xC0000035 typically translates to STATUS_OBJECT_NAME_COLLISION

, which means a logging session is trying to start using a name that is already in use or wasn't properly closed. While often harmless and safe to ignore if your system is running normally, you can resolve or suppress it using the following steps. Microsoft Learn 1. Run System Repair Tools

Repairing corrupted system files often clears up logging conflicts. Microsoft Learn Command Prompt as an Administrator. Run the System File Checker: sfc /scannow Once finished, run the Deployment Image tool: DISM /Online /Cleanup-Image /RestoreHealth 2. Reset Windows Update Components

If the trace log failure is tied to a stuck update service, resetting the cache can help. Microsoft Learn Command Prompt (Admin) and stop these services: net stop wuauserv net stop bits net stop cryptSvc Rename the update folders:

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 catroot2.old Restart the services: net start wuauserv net start bits net start cryptSvc Microsoft Learn 3. Adjust Log File Size (Advanced)

A common cause for this specific "failed to start" error is a log file size limit that is too small. Performance Monitor (search for it in the Start menu). Data Collector Sets Startup Event Trace Sessions Locate the problematic logger (e.g., WindowsUpdateTracelog or similar). Right-click it, select Properties , and go to the Stop Condition Increase the Maximum Size (e.g., to 250 MB) to ensure it has enough space to write. 4. Suppress the Error via Registry

If the error is persistent but doesn't affect performance, you can stop it from appearing in your Event Viewer. and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\

Find the key corresponding to the failing session (often a long GUID). Change the values for EnableProperty Are you seeing this error alongside system stutters failing updates , or are you just cleaning up your Event Viewer

The Tale of the Log That Wouldn’t Start

Once upon a time, in a small IT department, there was a Windows Server named LogiCorp-SRV02. Every morning, the admin, Alex, checked the System Event Log for clues about the server’s health.

One Tuesday, Alex saw a strange yellow warning:

"Session 'WindowsUpdateTraceLog' failed to start with the following error: 0xc0000035. Repack."

Alex frowned. “What’s a ‘repack’? And why can’t a trace log start?”

Diagnosis

  1. Gather evidence:
    • Event Viewer: note event ID, task, timestamp, and full message.
    • System log entries around same timestamp (Service Control Manager, kernel, Windows Update).
    • ETW session list: use logman or wevtutil to enumerate sessions.
    • Running processes: check for processes holding ETW sessions (e.g., wuauserv, svchost, Microsoft-Windows-Servicing/TrustedInstaller).
  2. Check for existing session name collisions:
    • Run: logman query -ets
    • Run: wevtutil enum-logs and wevtutil gp Microsoft-Windows-? (as needed)
  3. Inspect registry for leftover ETW session entries:
    • HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels
  4. Check file/pipe names and permissions if relevant.
  5. Recreate reproduction steps: note whether error appears after update, upgrade, reboot, or servicing operation.