Session Windowsupdatetracelog Failed: To Start With The Following Error 0xc0000035

The Silent Failure: Understanding and Fixing "Session WindowsUpdateTracelog Failed to Start (0xc0000035)"

If you are a Windows administrator or a power user who frequently checks Event Viewer, you may have encountered a persistent and annoying entry in your system logs. It usually appears as a warning, distinct from the critical errors that crash systems, but consistent enough to raise alarms.

The error reads: "Session WindowsUpdateTracelog failed to start with the following error: 0xc0000035"

While this error rarely causes your computer to crash or prevents you from working, it indicates a breakdown in the communication between your operating system and its diagnostic tools. It suggests that Windows is trying to log update activities but failing to write the necessary data. Over time, this can clutter your logs, mask other serious issues, and interfere with Windows Update troubleshooting.

In this comprehensive guide, we will dissect this specific error code, explore why the WindowsUpdateTracelog session is failing, and provide step-by-step methods to resolve it permanently.

Understanding the Error: What Does 0xc0000035 Mean?

Before attempting any fixes, it is crucial to understand the underlying mechanism. When Windows Update (via the wuaueng.dll or the Update Orchestrator Service) initializes, it attempts to create an Event Tracing for Windows (ETW) session named WindowsUpdateTraceLog. Understanding the Error: What Does 0xc0000035 Mean

ETW is a high-performance logging mechanism built into the operating system. It allows services like Windows Update to log diagnostic data without slowing down the system.

The error 0xc0000035 occurs when the ETW session tries to start but discovers that a session with the exact same name (WindowsUpdateTraceLog) is already running or has been orphaned by a previous process that crashed without cleaning up.

Why this happens

  • A previous Windows Update session did not clean up its ETW (Event Tracing for Windows) session properly.
  • Antivirus or third-party tools that monitor update activity can leave stale sessions.
  • Corruption in the Windows Update diagnostic logging system.

After applying the fix, Windows Update should function normally, and you can safely run windowsupdate.log diagnostics again.

The neon hum of the server room was the only heartbeat in the building. Elias sat hunched over Terminal 4, his eyes reflecting a cascade of scrolling text. He was hunting a ghost in the machine, a silent killer of productivity that had paralyzed the regional grid. Then, it appeared in cold, unfeeling white text: A previous Windows Update session did not clean

session windowsupdatetracelog failed to start with the following error 0xc0000035

"Object Name Already Exists," Elias whispered, the translation of the hex code bitter on his tongue.

It wasn't a simple crash. The system was trying to birth a process into a space already occupied by a phantom. Two realities were fighting for the same memory address. Every time the update service tried to log its progress, it slammed into a mirror image of itself—a digital doppelgänger that shouldn't have been there.

He realized then that the "error" wasn't a bug; it was a footprint. Someone—or something—had hijacked the trace session to mask their movement, leaving a lingering shadow that blocked the system’s own diagnostic eyes. Local report file with diagnostic data

As he reached for the kill command, the screen flickered. The error message didn't disappear. It multiplied, filling the monitor until the hex code was all he could see. The ghost wasn't just in the machine; it was in control. for this specific error or continue the to see what Elias finds?

4. Diagnostic Procedures

2. Error Overview

Observed Error Message:
Session "WindowsUpdateTraceLog" failed to start with the following error 0xc0000035

Hexadecimal Code: 0xc0000035
NTSTATUS Equivalent: STATUS_OBJECT_NAME_COLLISION
Human-Readable Meaning: "A file, registry key, or object with the same name already exists."

9) Reporting & telemetry (optional)

  • Local report file with diagnostic data, actions taken, and timestamps.
  • Option to upload anonymized report to support (consent required).

5.1. Safe Resolution – Clear the AutoLogger (Recommended)

  1. Open Registry Editor (regedit.exe).
  2. Navigate to: 
    HKLM\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger
  3. Export the WindowsUpdateTraceLog key for backup (right-click → Export).
  4. Delete the WindowsUpdateTraceLog key.
  5. Reboot the system.

After reboot, the Windows Update service will recreate the AutoLogger correctly on demand.

Gift this article