Here’s a helpful, easy-to-follow story that explains the error in the context of Session WindowsUpdateTraceLog and how to resolve it.
To troubleshoot and resolve the "Session Windows Update Trace Log failed to start with the following error: 0xc0000035" issue, follow these steps: Enumerate ETW sessions: If you are repackaging an
Open and navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\AutoLogger\EventLog-System Find the keys Enabled and EnableProperty . the collision occurs.
Ideally, ETW sessions are transient. However, if a previous Windows Update process crashed or was terminated improperly (perhaps during a previous, failed repackaging attempt), the ETW session object was not destroyed. The Windows Kernel believes the session is still running. When the Windows Update service tries to start it again, error 0xC0000035 is thrown because the name is already in use. 0xc0000035 Here’s a helpful
If you are repackaging an OS image (sysprep/capture), the wuauserv (Windows Update) service is likely starting up during the boot process of the reference machine. If the capture process begins while Windows Update is initializing its logging, the collision occurs.