After disabling IPv6, install the latest NIC driver the issue still came up but not as frequent as before. So for whatever reason the issue was reduced. I then tried the rename setup.etl to setup.old and reboot trick (windows\panther\setup.etl). After a reboot the event viewer started right up showing the Overview and Summary information along with preview box information with very little delay! Because this is the Event Tracing Log and no new file was created (setup.etl) after a reboot I decided to rename setup.old back to setup.etl and do a shut down, cold boot. When I click on the event viewer now I notice that the preview box for "Summary of Admin Events" now shows what files are being read. Then after about 3-5 seconds everything is now displayed. Before the name change the "Summary Admin Events" preview box would remain grayed out showing nothing for 20-30 seconds before the information was shown. Not sure if anyone else noticed this but I wanted to post this up as I'm not the only one who's had this error show up in the event viewer. The error itself hasn't shown up. I've logged out and back in then I Switched Users and no error presented.

Hi, The 0xc0000035 error code is mapped to STATUS_OBJECT_NAME_COLLISION. The STATUS_OBJECT_NAME_COLLISION error may occur if a duplicate domain security identifier (SID) is detected. Based on your description, I think that you have tried a lot of methods to fix this issue, if this issue does not affect the usage of your home and work, you could simply ignore it. It would likely disappear at some point. Alex Zhao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for the information Alex. I'm not 100% clear on what can cause a SID duplication though. Are there any examples of what can cause a duplication like this?

Well, it's been at least 7 days now and haven't seen that error pop up (waited about 2 days before creating this thread). I would still like to know more about SID duplication if possible.

this has nothing to do with SID. the ETW logger is already running. Open regedit.exe, go to this key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger and set the value "Start" to "0". André"A programmer is just a tool which converts caffeine into code" CLIP- Stellvertreter http://www.winvistaside.de/

Hi, Sorry for my late reply. In fact, this error occurs when system tries to start this session until it succeeds. If this session fails to start, according to this error, it may be related to another session or a duplicate security identifier. To find this culprit, you could try to use Process Monitor to check if we can find any information: Process Monitor Meanwhile, regarding the session Circular Kernel Context Logger, please kindly refer to the following article: "Specifies the name of the file where the system state will be saved. The system state is a set of kernel events generated by taking a snapshot of the Circular Kernel Context Logger. The events of the Circular Kernel Context Logger include process events, thread events, disk operations, and other kernel information that provides an indication of what action the operating system was performing when the event was raised. Events for the Circular Kernel Context Logger remain in the operating system memory and are only written to file when a snapshot is taken of the Circular Kernel Context Logger. This property indicates the name of the file to which the contents of the Circular Kernel Context Logger will be written; the file will reside on the local system. The file name needs to be a file name only and cannot include the path to the file. " If you want to eliminate this error, as an alternative, try to disable Circular Kernel Context Logger: Go to Computer Management > Performance > Data Collector Sets > Startup Event Trace Sessions. Right-click Circular Kernel Context Logger, select Properties, and on the Trace Session tab, uncheck the "Enabled" box. But as I said, It would likely disappear at some point. Have a nice day. Alex Zhao TechNet Subscriber Support in forum. If you have any feedback on our support, please contact tngfb@microsoft.comPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Thanks for the info.

Ok, it's been nearly 2 weeks and haven't had this error.