If the error persists because the system thinks a session is already running, you must clear the ETW state. This is done via the command line (Admin privileges):

: Stop the Windows Update service, then navigate to C:\Windows\SoftwareDistribution and delete its contents. Restart the service afterward.

Corrupted files within the OS distribution folders frequently cause update logs to duplicate and collide. Resetting these folders clears out stale tracking sessions.

The most direct way to resolve a name collision is to stop the existing session manually. Press Win + R , type perfmon , and hit Enter. Expand on the left sidebar. Click on Startup Event Trace Sessions . Locate WindowsUpdateTracelog in the list. Right-click it and select Stop .

: Open Command Prompt as an administrator and run these two commands to fix potential system file corruption: sfc /scannow DISM /Online /Cleanup-Image /RestoreHealth

Before running Sysprep, execute:

It is worth running the standard fixes, especially SFC and DISM, to check for file corruption.

If the error occurs during , disable the trace session temporarily:

The WindowsUpdate_trace_log is an ETW session that should normally start and stop seamlessly in the background. When Windows Update attempts to initialize this trace session but fails, Event Viewer logs the 0xC0000035 warning. This error can be accompanied by other failed session logs, such as:

The error is a Kernel Event Tracing issue that occurs when Windows attempts to start a logging session (like WindowsUpdateTraceLog or RUXIMLog ) but fails because an object with the same name already exists. In technical terms, it is a STATUS_OBJECT_NAME_COLLISION .

In these custom builds, creators often aggressively disable telemetry, remove core system files, or block the Windows Update infrastructure entirely to save space and resources.

Modified Windows installers (repacks) sometimes have pre-configured logging settings that clash with standard Windows Update protocols. How to Fix WindowsUpdateTracelog Error 0xc0000035 1. Clear the ETW Session via Performance Monitor