Session “NetCfgTrace” failed to start with the following error: 0xC0000035

Since recent Windows 10 major updates many users encounter the following error in their event viewer: Session “NetCfgTrace” failed to start with the following error: 0xC0000035

There’s a lot of speculation whether the source of this notification is harmful or not. And maybe even¬†more important: Until now I’ve found no solution on any blog post or forum. This post solves the mystery. ūüôā

Symptoms of NetCfgTrace error 0xC0000035

Everytime you start your computer, or when¬†enable or disable a network interface (this includes WIFI), an event id 2 is logged. In the Windows 10 Performance Monitor, there’s an Event Trace Session named NetCfgTrace. This session is responsible for the error. The screenshot beneath shows you

  • at the left:¬†the event of the NetCfgTrace error
  • at the right: the Performance Monitor where¬†you can drill down to the¬†root cause of the problem: Event Trace Session “NetCfgTrace”.

0xc0000035 netcfgtrace

To open the Performance Monitor, start typing Performance in your start menu. It will pop up as hint automatically.

The logs of NetCfgTrace are saved to C:\Windows\Logs\NetSetup

Solution to Session “NetCfgTrace” failed to start (0xc0000035)¬†

One way to prevent the error from occuring is to stop the NetCfgTrace Session from running. However, the best solution is to delete service.0.etl :

  1. Navigate to C:\Windows\Logs\NetSetup.
  2. Delete service.0.etc. You may need administrator permissions to delete.
  3. Reboot your system and the error is gone.

For references, this is the original event logged in your event viewer:

Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Event ID:      2
Task Category: Session
Level:         Error
Keywords:      Session
User:          SYSTEM
Session "NetCfgTrace" failed to start with the following error: 0xC0000035
0 0 votes
Article Rating
Notify of
1 Comment
Newest Most Voted
Inline Feedbacks
View all comments
Ronald Smit

Hi! I would like to now what a kernel event trace is in the first place. Very rarely, I get a kernel event trace (event ID 2) considering Muroc system trace event not started. I know it MIGHT have to do something with AV-software. But even then, there is not much I can do about it. The only thing I would like to know is if those errors are harmful/critical to the system stability. Or can I just ignore them safely? Right now, when I see this mysterious Muroc-event I restore an earlier made image and all is ok again.… Read more »

Would love your thoughts, please comment.x