Session Windowsupdatetracelog Failed To Start With The Following Error 0xc0000035 Site
Feature: Automated Diagnostic & Fix for "Session WindowStartupTraceLog failed to start — error 0xC0000035" Goal Provide users a guided, one-click tool that diagnoses and fixes the Windows error: "Session WindowStartupTraceLog failed to start with the following error 0xC0000035" (status object name collision). Summary of cause Error 0xC0000035 (STATUS_OBJECT_NAME_COLLISION) means a named kernel or user-mode object (event, mutex, semaphore, registry key, ETW session name, or file) already exists with that name, preventing the logging/tracing session from creating it.
Product-spec: feature components 1) UI entry points
Error-detection pop-up when the system logs show the error (Event Viewer integration). Manual shortcut in Support app: "Fix Windows trace session error (0xC0000035)". Command-line tool: win-tracefix.exe with flags: --diagnose, --fix, --report.
2) Diagnostic steps (automated)
Collect context:
Windows version and build Time of error (from event log) Event ID and full message Running processes and services snapshot Active ETW sessions (logman, wevtutil) Named kernel objects list (using Sysinternals Handle or NtQueryDirectoryObject) Registry keys under HKLM\System\CurrentControlSet\Control\WMI\Autologger and HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT
Detect likely conflicting object name (match name from error message or known default session names like "WindowsStartup", "BaseTraces", "BootPerformance"). Check for stale handles or processes owning the object. Check for duplicate scheduled tasks, startup services, or third-party instrumentation (e.g., antivirus, telemetry, virtualization tooling). Manual shortcut in Support app: "Fix Windows trace
3) Remediation steps (automated when user approves)
Option A — Safe automated fix (recommended):
Stop dependent ETW sessions: run logman stop <session> or wevtutil as needed. Terminate or restart offending process/service (graceful stop first). Delete stale named object if safe (using NtClose via tool or via restarting the service that owns it). Recreate the session or restart the Windows feature that failed (e.g., restart Windows Event Log service or the relevant service). Check for stale handles or processes owning the object
Option B — Conservative fix (non-destructive):
Offer to restart affected Windows service(s) only. Offer a scheduled reboot at low-usage time.