Search result -
The error Session "DefenderApiLoggerLowPriv" failed to start with the following error: 0xC0000035 means
STATUS_OBJECT_NAME_COLLISION, which
happens when an Event Tracing for Windows (ETW) logging session tries to start with a name that is already active or improperly cleared. [
1,
2]
Users on forums like
Ten Forums and
Reddit note that this often appears alongside Windows Defender notification quirks or engine updates.
In most cases, it is a benign logging glitch rather than a broken antivirus service. [
1,
2,
3,
4]
How to Fix or Clear the Error
- Update Windows and Security Intelligence: Ensure your system has the latest Windows updates and Microsoft Defender security intelligence definitions installed, as recent patch cycles address related logging and engine crashes. [1]
- Run System File Checker (SFC) and DISM:
- Press the Windows Key, type cmd, right-click Command Prompt, and select Run as administrator.
- Type sfc /scannow and press Enter.
- Once finished, type DISM /Online /Cleanup-Image /RestoreHealth and press Enter. [1]
- Check Event Trace Sessions in Performance Monitor:
- Press Win + R, type perfmon, and click OK.
- Expand Data Collector Sets and click Event Trace Sessions.
- Look for the logging session or check if a stale trace session needs to be stopped or adjusted. [1]
- Backup and Reset Defender Policies (Advanced): If policy conflicts are locking up the service startup, you can export and clear custom Defender registry policies via an elevated PowerShell session. [1]
