Tuesday, 14 December 2010

SBS 2011 Error – WBCommandletInBuiltTracing failed to start 0xC0000035

On this newly minted SBS 2011 RTM VM we have the following error:


Log Name:      Microsoft-Windows-Kernel-EventTracing/Admin
Source:        Microsoft-Windows-Kernel-EventTracing
Date:          12/14/2010 8:34:13 AM
Event ID:      2
Task Category: Session
Level:         Error
Keywords:      Session
User:          DOMAIN\DomainAdmin
Computer:      SBS.DOMAIN.local
Session "WBCommandletInBuiltTracing" failed to start with the following error: 0xC0000035

And, according to the SBS 2011 Release Notes this is a known issue though not a show stopper:


Again, it is a good idea to check out the SBS 2011 Release Notes to be aware of any hiccups or other situations with the operating system so that nothing comes as a surprise.

UPDATE: After the image capture blunder, that domain is now toast.

Philip Elder
Microsoft Small Business Specialists
Co-Author: SBS 2008 Blueprint Book

*Our original iMac was stolen (previous blog post). We now have a new MacBook Pro courtesy of Vlad Mazek, owner of OWN.

Windows Live Writer


Anonymous said...

Do we know if this error is specific to Hyper-V environments or virtual environments in general? I have not deployed SBS 2011 on metal as yet but have loaded it in VM and we're seeing this error every few seconds...

Okay... So we can "ignore it" but it is flooding the logs and this type of thing is quite annoying for us MSPs monitoring dozens of servers... Even if it is confined to VMs we have a number of SBS environments running on Hyper-V...

So... It has been a few weeks since this post... Do we have a registry hack, hotfix, or other way to resolve this problem from MS yet?

I was really hoping the 2011 release would be free of the "Known Out-Of-Box Issues" we've seen in the past... I don't understand how these things make it into an RTM after all the in-house and wide-beta testing...

Philip Elder SBS MVP said...


Good question. We have not seen anything yet on the what/why/when it will get fixed.

We are keeping an eye on any issues we have seen out of the box and so far none have been show stoppers.

Doesn't the MSP software have the ability to filter the error out of the reports?


itplanning said...

It's not specific to Hyper-V, I have this error on my physical box.

Anonymous said...

I'm seeing the same message here, one per second as well. Its not a Small Buiness Server though. Its a Windows 2008 R2 Standard server with the File Services role enabled.

It would be nice to have a fix to clean up the event log.

Eddi said...

I'm seeing this error too, on a sbs 2011, but hyper-v is not activated...

Anonymous said...

Yes, most RMM tools can filter this error out but it still floods the logs reducing the amount of history and making troubleshooting of other issues more difficult.

So we still don't have a way to supress this error at this point?

Philip Elder SBS MVP said...

We have not seen any changes on this yet. Hopefully we will see an Update Rollup that will address the little things that are there after the initial set up.


Marcel Zwakenberg said...

I am having the same thing happening on SBS2011 running on core Hyper-V.

Still no resolution for this?

And yeah, flooding the logs is not good!

Anonymous said...

We are seeing this on a physical box that is a swing migration from SBS 2003 to 2011. We also saw it a couple months back on a swing to SBS 2011 in VM.

When are we going to see a fix for this?


bchild said...

If someone has found a fix for this issue please post!

Anonymous said...

Found this blog because of the error. Server is physical, after migration from SBS2003 to SBS2011

Anonymous said...

I have the same error, have installed the hyper-v role with Terminal Server, not active at the moment..

When do we see a resolution for this?

Anonymous said...

Same issue - flooding logs, happens 3 or 4 times a second, and then not again for almost 30 minutes

AndyKash said...

I had same issue on SBS 2011 (not Hiper-V). I disable DHCP server and error messages stopped.

Sandro Cuzzetto said...

I have this on my SBS2011 bpox without DHCP running on it. Therefore, I do not think it's DHCP connected. As well, it is on the physical box and not virtual boxes.

Anonymous said...

I'm so sick of seeing this error. I keep searching for solutions and this post keeps popping up. Has anyone figured out how to fix this? Many of the other "pay no attention to these" errors have steps to resolve them. I really hope someone can figure out this one.

Kevin Morse said...

Happens every hour on the hour for me. SBS 2011 guest on 2008 R2 host. Usually two or three times.

It would be really nice if they could just fix whatever it is.

Kevin Morse said...

Happens every hour on the hour for me. SBS 2011 guest on 2008 R2 host. Usually two or three times.

It would be really nice if they could just fix whatever it is.

nehemos said...

Considering that this error has been in verification for two years, I think it is safe to consider that they just don't care anymore.

Anonymous said...

Close the SBS console and the errors stop.

Dan Popescu said...

Go to Administrative Tools> Perf Mon>Data Collector Sets> Event Trace Sessions and disable the WBCommandletInBuiltTracing

Anonymous said...

couldn't see a way of disabling it but can sztop it. No doubt it will start again on a reboot!

Adam said...

You can delete it.

Anonymous said...

I had this error after a raft of updates.

I ran:
PSConfig.exe -cmd upgrade -inplace b2b -force -cmd applicationcontent -install -cmd installfeatures

from an elevated command prompt, and the errors stopped.

I know this command is required in some circumstances to apply updates to SharePoint successfully, and it was pure coincidence that I needed to run it.

Maybe that will help others!

Anonymous said...

I have this error after install
Update Rollup 5 for Windows Server Solution Best Practice Analyzer 1.0, (KB2908176)

Anonymous said...

I know this is an older thread, but since I didn't see an answer in it I thought I'd post it.
Go to the folder "C:\Windows\Logs\WindowsServerBackup" and delete the file called "WBCommandlet.0.etl"
It seems that somehow it gets corrupted, and when the Performance Counter tries to check it, it fails.
The file will regenerate itself, and so far the removal seems to have no ill effects.

-- GLotsapot

Anonymous said...

Thank you, will check that it works.

Alex P said...

It worked for me.
i have SBS2011 on VMware.

Charles Burch said...

Removing the file did not work for me. MS Server 2008 R2 non-VM environment.