Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 -

Once you have resolved the error, take these steps to ensure it does not return:

  • Search Windows Event Viewer (Applications and Services Logs → Microsoft → Windows → WindowsUpdateClient) for correlated errors and timestamps.
  • Collect an ETL using Windows Performance Recorder (WPR) during the failure sequence for deeper analysis.
  • Some antivirus programs (e.g., McAfee, Norton, Bitdefender, or even some VPN filters) hook into the ETW subsystem to monitor network and process activity. If they hold a lock on the trace log object, 0xc0000035 occurs.

    Temporary test:


    This is a nuclear but highly effective option. It resets the Windows Update client to a clean state. Once you have resolved the error, take these

    Create a .bat script with the following commands (run as Administrator):

    net stop wuauserv
    net stop cryptSvc
    net stop bits
    net stop msiserver
    net stop EventLog
    

    ren C:\Windows\SoftwareDistribution SoftwareDistribution.old ren C:\Windows\System32\catroot2 Catroot2.old ren C:\Windows\Logs\WindowsUpdate WindowsUpdate.old

    net start wuauserv net start cryptSvc net start bits net start msiserver net start EventLog Search Windows Event Viewer (Applications and Services Logs

    wuauclt /resetauthorization /detectnow

    Reboot and test Windows Update again.


    Windows utilizes a technology called Event Tracing for Windows (ETW) to log system activities. ETW is a high-performance, efficient tracing system that allows the OS to write logs without significantly impacting performance.

    The WindowsUpdateTracelog is a specific ETW session dedicated to recording the activities of the Windows Update client. When your computer checks for updates, downloads a patch, or installs a driver, this session is supposed to record the details so that technicians can troubleshoot failures later.