The robot inside didn't even look up. "I'm already doing it, pal. Check the logs. Session's active."
Third-party repack scripts disable update services but leave autologger hooks active.
Error 0xc0000035 is known to block when you try to generalize a repacked Windows image. Sysprep stops ETW sessions before capture, but if a trace session (like WindowsUpdateTraceLog ) is stuck in an “orphaned” state, Sysprep throws a fatal error.
And the server lived happily ever after – with fewer mysterious errors and more reliable updates. The robot inside didn't even look up
Sometimes, manually purging the physical log files forcing the collision solves the issue instantly.
Leftover .etl (Event Trace Log) files from an improper shutdown can block new sessions from creating fresh files.
logman query
When dealing with the WindowsUpdateTracelog , the collision is typically triggered by:
This error often appears alongside the keyword — referring to repackaged Windows installations, custom ISOs, or modified system images. It is frustrating because it doesn’t always crash the system visibly, but it can lead to update failures, performance degradation, and Sysprep errors.
If you see “repack” in the error message, you may be running a (e.g., modified ISO). These often break tracing. Session's active
So, Windows Update couldn’t properly log what it was doing – which meant updates might still work, but diagnosing problems would be harder.
The error you're seeing appears in the Windows , specifically under the Kernel-EventTracing source with the Event ID 2 . The hexadecimal code 0xC0000035 translates to a Windows system status code: STATUS_OBJECT_NAME_COLLISION or STATUS_OBJECT_NAME_NOT_FOUND . Simply put, this means Windows attempted to start a trace logging session to monitor system processes—likely for Windows Update or other critical OS components—but failed because the session's configuration was either corrupted, missing, or in conflict with an existing session.
If the error persists on every reboot, you can disable the specific "AutoLogger" that is failing. And the server lived happily ever after –
The Windows Update Trace Log is a valuable tool for system administrators and power users to diagnose and troubleshoot issues related to Windows updates. However, sometimes this log may fail to start, hindering the troubleshooting process. One such error that users may encounter is "Session Windows Update Trace Log failed to start with the following error: 0xc0000035." In this article, we will explore the possible causes of this error and provide step-by-step solutions to resolve the issue, specifically focusing on the "repack" aspect.
Inside RtBackup or the main WMI directory, look for files associated with WindowsUpdateTracelog.etl . or rename the file to WindowsUpdateTracelog.old . Restart your computer. Method 2: Modify the Registry to Prevent Automatic Startup