If you are a Windows system administrator, a PC technician, or an advanced user building custom images (repacks), you may have encountered a cryptic error message while inspecting the Event Viewer or during a sysprep process: “Session ‘WindowsUpdateTraceLog’ failed to start with the following error 0xc0000035.” This error often appears alongside the keyword “repack” — referring to repackaged Windows installations, custom ISOs, or modified system images. It is frustrating because it doesn’t always crash the system visibly, but it can lead to update failures, performance degradation, and Sysprep errors.
$sessionName = "WindowsUpdateTraceLog" $sessions = logman query -ets | Select-String $sessionName -Context 0,2 if ($sessions) Write-Host "Found conflicting session – removing..." logman stop $sessionName -ets logman delete $sessionName -ets If you are a Windows system administrator, a
logman stop WindowsUpdateTraceLog -ets If you see an unnamed session with a GUID, stop it using: Need help with a specific repack tool or
Then restart the service:
If you’ve followed this guide, run logman query and check Event Viewer – you should see WindowsUpdateTraceLog running silently, and your repack will be ready for deployment without any 0xc0000035 shadow lurking in the logs. Need help with a specific repack tool or a stubborn Sysprep failure? Let us know in the comments below (or contact your system image provider). a PC technician
DISM /Online /Cleanup-Image /ScanHealth DISM /Online /Cleanup-Image /CheckHealth DISM /Online /Cleanup-Image /RestoreHealth If you’re offline (repacking a mounted image):