Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack Now

Fix: “Session WindowsUpdateTraceLog Failed to Start with Error 0xc0000035” (Repack Guide)

If you are a Windows system administrator, a PC technician, or an advanced user building custom images (repacks), you may have encountered a cryptic error message while inspecting the Event Viewer or during a sysprep process:

“Session ‘WindowsUpdateTraceLog’ failed to start with the following error 0xc0000035.” This error often appears alongside the keyword “repack”

This error often appears alongside the keyword “repack” — referring to repackaged Windows installations, custom ISOs, or modified system images. It is frustrating because it doesn’t always crash the system visibly, but it can lead to update failures, performance degradation, and Sysprep errors. or conflicting tracing state.

This article will explain exactly what this error means, why it happens during repacking, and how to resolve it permanently. Check for leftover registry keys (advanced

---

References and Further Reading

(Normative references typically include Microsoft Docs on ETW, logman, wevtutil, Autologger registry keys, DISM/SFC, and Windows Update troubleshooting.)

Diagnosis

1. Gather evidence:
   • Event Viewer: note event ID, task, timestamp, and full message.
   • System log entries around same timestamp (Service Control Manager, kernel, Windows Update).
   • ETW session list: use logman or wevtutil to enumerate sessions.
   • Running processes: check for processes holding ETW sessions (e.g., wuauserv, svchost, Microsoft-Windows-Servicing/TrustedInstaller).
2. Check for existing session name collisions:
   • Run: logman query -ets
   • Run: wevtutil enum-logs and wevtutil gp Microsoft-Windows-? (as needed)
3. Inspect registry for leftover ETW session entries:
   • HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT\Channels
4. Check file/pipe names and permissions if relevant.
5. Recreate reproduction steps: note whether error appears after update, upgrade, reboot, or servicing operation.

Q: Can I ignore it in a repack?

Not if you plan to sysprep or deploy widely. The collision can prevent future Windows Updates and cause system file checker (SFC) hiccups.

2. Error Breakdown

Immediate troubleshooting steps (safe, non-destructive)

1. Reboot the PC (clears ETW sessions). If not done already, reboot and check if error persists.
2. Check Event Viewer:
   • Open Event Viewer → Windows Logs → System and Applications → look for errors around the same time; capture EventID and full message.
3. List current ETW sessions:
   • Open elevated Command Prompt (Run as administrator) and run:

     logman query -ets
     

     Look for any session named WindowsUpdateTraceLog or similar duplicates.
4. If a duplicate/stale session appears, stop and delete it:
   • Stop:

     logman stop <SessionName> -ets
     

   • Delete:

     logman delete <SessionName>
     

5. Use wevtutil to check provider/state (optional):

   wevtutil gp Microsoft-Windows-WindowsUpdateClient /ge
   

   (Inspect for odd configuration.)
6. Run System File Checker and DISM:

   sfc /scannow
   DISM /Online /Cleanup-Image /RestoreHealth
   

7. Check Task Scheduler:
   • Open Task Scheduler → Library → Microsoft → Windows → WindowsUpdate (or UpdateOrchestrator) and inspect related tasks for malformed XML or duplicates. Disable/enable or re-create if suspicious.
8. Check for leftover registry keys (advanced; back up registry first):
   • ETW sessions may be under: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
   • Look for keys referencing WindowsUpdateTraceLog and delete duplicates carefully.
9. Review antivirus/security logs or temporarily disable third-party security to test if it blocks session creation.
10. Ensure Windows is up to date and run Windows Update Troubleshooter.

Summary

The error "Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035" indicates a Windows scheduled task or service (related to Windows Update tracing) could not start because an object with the same name already exists (STATUS_OBJECT_NAME_COLLISION). This typically points to a corrupted or duplicate trace session, leftover ETW (Event Tracing for Windows) registration, or conflicting tracing state.