| Method | Difficulty | Time | Primary Benefit | | :--- | :--- | :--- | :--- | | | Low | 10-20 min | Repairs corrupted system files | | DISM RestoreHealth | Medium | 20-30 min | Repairs the underlying system image | | Reset Windows Update | Low | 10 min | Clears corrupted update caches | | logman command | High | 5-10 min | Directly deletes problematic ETW sessions | | Registry Key Modification | High | 5 min | Stops the specific error from being logged | | In-Place Upgrade | High | 1-2 hours | Repairs deep system corruption |
"Session 'WindowsUpdateTracelog' failed to start with the following error: 0xc0000035,"
One Tuesday morning, at exactly 10:00:00 AM, the System Kernel sent a lightning-fast telegram: "START THE TRACELOG SESSION IMMEDIATELY." | Method | Difficulty | Time | Primary
The 0xc0000035 error is a kernel-level event tracing issue you'll typically discover in the Windows Event Viewer under the "Kernel-EventTracing" source, with Event ID 2. The complete error message usually reads:
ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 Catroot2.old Restart the services: net start wuauserv net start cryptSvc net start bits net start msiserver Restart your PC. Method 3: Run SFC and DISM Repairs Expand the EventLog-System key and look for subkeys
logman is the command-line tool for managing ETW sessions.
Expand the EventLog-System key and look for subkeys that govern Windows Update traces (often labeled with a long string of letters and numbers in curly brackets). There is a nuanced contradiction in documentation, where
The hex error code 0xC0000035 corresponds to the NTSTATUS value . In plain English, this means the system attempted to create an object (like a logging session) that already exists. There is a nuanced contradiction in documentation, where some sources also interpret this code as STATUS_OBJECT_NAME_NOT_FOUND (missing files or registry entries). Regardless of the exact interpretation, both point to a core problem with the Event Tracing for Windows (ETW) infrastructure, which manages performance logging.
often note that these log entries are common during normal operations and do not necessarily indicate a critical system failure. Microsoft Learn How to Fix It