Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Repack May 2026

The most immediate fix is to prevent the service from starting during the capture. Before starting your repackaging tool:

In the context of this error, “repack” refers to a custom Windows image — for example, a modified .wim or .esd file created with tools like NTLite, MSMG Toolkit, or DISM. Repacking often involves removing components, integrating updates, or altering services. This process commonly triggers the error.

Sometimes the trace setup persists across reboots. Delete the registry artifacts:

For a repack, you want to clean without breaking customizations. Run these commands in an admin CMD:

net stop wuauserv
net stop cryptSvc
net stop bits
net stop msiserver

ren C:\Windows\SoftwareDistribution SoftwareDistribution.old
ren C:\Windows\System32\catroot2 catroot2.old The most immediate fix is to prevent the


net start wuauserv
net start cryptSvc
net start bits
net start msiserver

If you are repackaging an OS image (sysprep/capture), the wuauserv (Windows Update) service is likely starting up during the boot process of the reference machine. If the capture process begins while Windows Update is initializing its logging, the collision occurs.

If WindowsUpdateTraceLog keeps getting stuck, Alex learned to: Sometimes the trace setup persists across reboots

But in most cases, simply stopping the old session fixed it forever.

The error 0xc0000035 means:

STATUS_OBJECT_NAME_COLLISION – “A file or folder with that name already exists.”

In simple terms:
Windows was trying to create a new Event Tracing for Windows (ETW) session named WindowsUpdateTraceLog.
But a session with that exact name was already running – probably leftover from a previous, incomplete Windows Update operation. If you are repackaging an OS image (sysprep/capture),

The word "Repack" in the message refers to Windows trying to reuse or repackage the logging session, but failing because of the name clash.

So, Windows Update couldn’t properly log what it was doing – which meant updates might still work, but diagnosing problems would be harder.

Follow these steps carefully. They are ordered from least to most invasive.