Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack

If you’re a repacker creating custom images, here’s how to avoid 0xc0000035 entirely:

Ideally, ETW sessions are transient. However, if a previous Windows Update process crashed or was terminated improperly (perhaps during a previous, failed repackaging attempt), the ETW session object was not destroyed. The Windows Kernel believes the session is still running. When the Windows Update service tries to start it again, error 0xC0000035 is thrown because the name is already in use.

If logman fails, reset ETW via WPR:

If you are repackaging an OS image (sysprep/capture), the wuauserv (Windows Update) service is likely starting up during the boot process of the reference machine. If the capture process begins while Windows Update is initializing its logging, the collision occurs.

Open Command Prompt as Administrator and run: If you’re a repacker creating custom images, here’s

logman query

Look for any session named WindowsUpdateTraceLog or a session using GUID that looks update-related. If found, stop it:

logman stop WindowsUpdateTraceLog -ets

If you see an unnamed session with a GUID, stop it using: Look for any session named WindowsUpdateTraceLog or a

logman stop paste-guid-here -ets

To fix the problem, you must first decode the message.

The error 0xc0000035 typically arises in three scenarios for system repackers: If you see an unnamed session with a

Alex reran the update check:

usoclient startscan

Then checked the event log again – no more 0xc0000035 errors. The log session started cleanly.