Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack May 2026

"Repackaging" inherently involves monitoring file and registry changes. Some third-party monitoring tools (legacy App-V sequencers or specific antivirus software) may hook into ETW providers. If the repackaging tool attempts to capture all system activity, it may clash with the Windows Update service's attempt to write to its own log file (WindowsUpdateTraceLog.etl), resulting in a handle collision.

List current ETW sessions:

If a duplicate/stale session appears, stop and delete it:

Use wevtutil to check provider/state (optional):

wevtutil gp Microsoft-Windows-WindowsUpdateClient /ge

(Inspect for odd configuration.)

Run System File Checker and DISM:

sfc /scannow
DISM /Online /Cleanup-Image /RestoreHealth

Check Task Scheduler:

Check for leftover registry keys (advanced; back up registry first):

Review antivirus/security logs or temporarily disable third-party security to test if it blocks session creation.

Ensure Windows is up to date and run Windows Update Troubleshooter.

If none of the above work: