Skip to main content

Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Info

Open Registry Editor and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger

Check for the presence of the WindowsUpdateTraceLog key.

Open an elevated Command Prompt and run: Check for the presence of the WindowsUpdateTraceLog key

logman query -ets

Look for any session named WindowsUpdateTraceLog. If present but not functioning, it may be a stale session.

If the error persists, we can manually target the log file itself. The file extension is .etl. Because these files can be hidden or system-protected, this requires a bit of navigation. Look for any session named WindowsUpdateTraceLog

  • Use the search bar in the folder to search for WindowsUpdateTraceLog.
  • If you find a file named WindowsUpdateTraceLog.etl, try to rename it to WindowsUpdateTraceLog.old.
  • Restart your computer. Windows will attempt to start the session, realize the file is missing, and generate a brand new one.
  • Look for entries containing "WindowsUpdateTraceLog", "WindowsUpdate", "WindowsUpdateClient", or similar.
  • If found, note the session name and PID. To stop a session (if owned by you/allowed): 
    logman stop <SessionName> -ets
    or use: 
    wevtutil.exe stop <ChannelName>
    (Replace / with the exact name displayed.)

    • Boot into Safe Mode with Networking, then run:

    logman stop "Windows Update Trace Log" -ets

    Reboot normally.

    Why does this collision happen? There are three primary culprits:

    For administrators who prefer a GUI over command lines: Boot into Safe Mode with Networking