Technical Analysis: WindowsUpdateTraceLog Error 0xC0000035

1. Executive Summary

The error message Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035 is a generic Windows Event Tracing (ETW) error. In the context of "repacking" (creating application packages or OS images), this error typically indicates that the capture environment has conflicting tracing sessions or corrupted trace configurations.

Type the following commands one by one, pressing Enter after each to stop the update services: net stop wuauserv net stop bits net stop cryptsvc

On a clean boot, Windows attempts to start WindowsUpdateTraceLog but finds that another session (or a stale handle) is already using its GUID or name.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\

) typically means that Windows tried to start a logging session with a name that was already in use by an existing session. In most cases, this error is harmless and occurs during a normal reboot or update process when a previous session didn't shut down cleanly before a new one tried to start. Microsoft Learn

  1. Disable and re-enable Windows Update diagnostic logging (via Group Policy or registry).
  2. Reboot – which always clears orphaned ETW sessions.
  3. Check for third-party antivirus that might be intercepting ETW sessions.
session windowsupdatetracelog failed to start with the following error 0xc0000035 repack Sign Up for Newsletter

Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack [top] ❲TRUSTED❳

Technical Analysis: WindowsUpdateTraceLog Error 0xC0000035

1. Executive Summary

The error message Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035 is a generic Windows Event Tracing (ETW) error. In the context of "repacking" (creating application packages or OS images), this error typically indicates that the capture environment has conflicting tracing sessions or corrupted trace configurations.

Type the following commands one by one, pressing Enter after each to stop the update services: net stop wuauserv net stop bits net stop cryptsvc Regularly back up your system and important files

On a clean boot, Windows attempts to start WindowsUpdateTraceLog but finds that another session (or a stale handle) is already using its GUID or name. Type the following commands one by one, pressing

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\EventLog-System\ Regularly back up your system and important files

) typically means that Windows tried to start a logging session with a name that was already in use by an existing session. In most cases, this error is harmless and occurs during a normal reboot or update process when a previous session didn't shut down cleanly before a new one tried to start. Microsoft Learn

  1. Disable and re-enable Windows Update diagnostic logging (via Group Policy or registry).
  2. Reboot – which always clears orphaned ETW sessions.
  3. Check for third-party antivirus that might be intercepting ETW sessions.