For persistent cases, use a tool like or Sysinternals WinObj to inspect the \KernelObjects\ namespace for a stale WindowsUpdateTraceLog event handle. No public tool directly deletes these; a reboot is the cleanest solution.
System file corruption can prevent the Event Tracing engine from managing object names correctly. Open as an administrator.
net stop wuauserv net stop bits net stop dosvc
If the Performance Monitor does not permanently fix the issue, you can force Windows to regenerate the logging parameters via the Registry Editor. Press Win + R , type , and press Enter .
net start wuauserv net start cryptSvc net start bits net start msiserver Use code with caution. Conclusion For persistent cases, use a tool like or
This error is related to logging the update process, not the update process itself. Think of it like a flight recorder (black box) on an airplane. If the black box is broken, the flight recorder cannot start. However, the airplane can usually still fly just fine.
Query existing trace sessions to confirm the collision. Type the following command:
Security software interfering with the ETW (Event Tracing for Windows) system.
: Type DISM /Online /Cleanup-Image /RestoreHealth and press Enter to repair the Windows system image. 2. Reset Windows Update Components Open as an administrator
The error "Session WindowsUpdateTraceLog failed to start with the following error 0xc0000035" is fundamentally a communication breakdown within Windows' own logging infrastructure. While the cryptic error code suggests a deep registry failure, the reality is far more manageable.
Stop the offending session. If you see WindowsUpdateTraceLog listed, stop it with:
A: Rarely. While malware can interfere with system services, this specific error almost always points to a transient operating system state or a bug in the Update service itself.
Stop the core update services by running the following commands one by one (press Enter after each): net start wuauserv net start cryptSvc net start
Open an and run:
You can stop the naming collision by manually stopping the conflicting trace session through the Performance Monitor. Press Win + R , type , and hit Enter . In the left pane, expand Data Collector Sets . Click on Startup Event Trace Sessions . Locate WindowsUpdateTracelog in the center list. Right-click it and select Properties . Switch to the Trace Session tab. Uncheck the Enabled box. Click Apply and OK . Restart your computer.
Restarting the core update infrastructure clears out cached handles and frees up stuck session names. Press Windows Key + R , type services.msc , and press . Locate Windows Update in the list. Right-click it and select Stop .
A previous Windows Update session closed improperly, leaving a locked .etl (Event Trace Log) file in the system directory.
net start wuauserv net start cryptSvc net start bits net start msiserver Use code with caution. Copied to clipboard Microsoft Learn 3. Clear Orphaned Logging Sessions