How to fix "Cloud Files Diagnostic Event Listener" failed to start with error 0xC0000022?

Session "Cloud Files Diagnostic Event Listener" failed to start with the following error: 0xC0000022 is an Event Viewer entry, not a pop-up. It means Windows refused a diagnostic trace session that OneDrive asked for under your account. If OneDrive syncs normally, nothing needs repair; if OneDrive fails too, install its newest version first.

Facts checked on 15 October 2026. Steps written for Windows 11 (25H2 and 26H2) and Windows 10 22H2.

What "Cloud Files Diagnostic Event Listener" failed to start with error 0xC0000022 means

The full text of the entry is Session "Cloud Files Diagnostic Event Listener" failed to start with the following error: 0xC0000022. It is Event ID 2 from Microsoft-Windows-Kernel-EventTracing in the log Microsoft-Windows-Kernel-EventTracing/Admin. Windows writes it when a program asks to start an event tracing session and the start fails.

Cloud Files is the Windows part that OneDrive uses for online-only files, with the filter driver cldflt.sys (service name CldFlt). The "Diagnostic Event Listener" is a logging session that collects diagnostic events from it. It does not move, sync or open any file.

• 0xC0000022 is STATUS_ACCESS_DENIED. Microsoft's NTSTATUS list describes it as: a process has requested access to an object but has not been granted those access rights.
• User in the entry is your own account (a SID ending in a number such as 1001), not SYSTEM. In a report on Microsoft Q&A the related ObserveProcs entry came from SYSTEM, while this one came from the signed-in user.
• ErrorCode 3221225506 on the Details tab is the same code in decimal form. LoggingMode 4194560 was shown in the same report.
• It is not a pop-up. Windows shows nothing on screen. You see it only when you open Event Viewer or a tool that reads the logs.

Why the Cloud Files Diagnostic Event Listener failed to start

We found no Microsoft statement of the exact cause, so the order below follows what the event itself shows and what readers report on Microsoft Q&A. The event names an access problem, not a broken file, so most PCs with this entry have nothing broken at all.

ObserveProcs 0xC0000035, CldFltLog and other entries logged next to it

The same Kernel-EventTracing log often holds a few more Event ID 2 entries at the same start. They look alarming in a list of red errors, but each names a different session and a different code.

Only the last row says that something really stopped working. If you also see a OneDrive error on the network, sync or a file, our guide to OneDrive error 0x8007017C covers the Cloud Files driver from the file side.

How to fix Session "Cloud Files Diagnostic Event Listener" failed to start with error 0xC0000022

Fix 1 decides whether you need the rest. When OneDrive works, stop after it. When OneDrive fails, go through Fixes 2 to 6 in order and test OneDrive after each one.

Fix 1. Check that OneDrive works and confirm the entry is harmless

2 minutesNo riskEveryone who found the entry in Event Viewer.

The event reports a refused diagnostic session, not a failed sync. If OneDrive starts and syncs, the session it could not open changes nothing you can see, and there is nothing to repair.

1. Look for the OneDrive cloud in the notification area at the far right of the taskbar. If you do not see it, select the Show hidden icons arrow.
2. Select the cloud. The panel should say your files are up to date or show recent synced files.
3. Open your OneDrive folder in File Explorer and open one file. It should open without an error.
4. Press Win + R, type eventvwr.msc and select OK.
5. Go to Applications and Services Logs > Microsoft > Windows > Kernel-EventTracing > Admin.
6. Double-click the Event ID 2 entry with the text Session "Cloud Files Diagnostic Event Listener" failed to start with the following error: 0xC0000022.
7. Compare its time with the time you signed in. An entry right after sign-in, with OneDrive working, is the harmless case.

PowerShell: list the Cloud Files entries with their time and user account

Get-WinEvent -FilterHashtable @{ LogName='Microsoft-Windows-Kernel-EventTracing/Admin'; Id=2 } -MaxEvents 100 |
  Where-Object { $_.Message -like '*Cloud Files*' } |
  Format-Table TimeCreated, UserId, Message -Wrap

If PowerShell says it cannot read the log, open Terminal (Admin) from the right-click menu of Start and run the command again. To see whether OneDrive is running at all, run Get-Process OneDrive in the same window.

Fix 2. Install the newest OneDrive over the current one

5 minutesLow riskOneDrive does not start, closes at once, or the Application log shows a OneDrive.exe crash next to the entry.

In a Microsoft Q&A case, OneDrive would not start and the Cloud Files entry came with a OneDrive.exe crash. Microsoft's support staff advised installing the current official OneDrive over it, and the reporter confirmed the fresh installer worked.

1. If OneDrive is running, select the cloud, the gear icon, then Settings, and open the About tab. Note the version shown there.
2. Open Microsoft's Reinstall OneDrive page and follow its link to download the OneDrive sync app.
3. Run the downloaded OneDriveSetup.exe. You do not need to uninstall the old version first.
4. Select Yes if Windows asks for permission.
5. When setup ends, start OneDrive from Start and sign in with the same account if asked.
6. Keep the same OneDrive folder location when setup asks, so nothing is downloaded twice.
7. Restart the PC and check OneDrive as in Fix 1.

Fix 3. Check that the Cloud Files driver (CldFlt) starts with Windows

5 minutesLow riskOneDrive fails after a tweak or debloat tool, or after you changed the CldFlt Start value yourself.

OneDrive's online-only files depend on the Cloud Files filter driver. In the Microsoft Q&A case, changing its Start value let OneDrive run but forced a full download, and Microsoft's staff advised restoring the original value first.

1. Select Start, type cmd, right-click Command Prompt and select Run as administrator. Select Yes.
2. Read the start value of the driver:

   reg query HKLM\SYSTEM\CurrentControlSet\Services\CldFlt /v Start

3. Find the line Start REG_DWORD. 0x2 means the driver starts automatically with Windows, which is what OneDrive Files On-Demand needs.
4. Check that the driver runs now:

   sc query cldflt

5. If STATE says RUNNING and Start is 0x2, the driver is fine. Go to Fix 4.
6. If Start is any other number, set it back to 2:

   reg add HKLM\SYSTEM\CurrentControlSet\Services\CldFlt /v Start /t REG_DWORD /d 2 /f

7. Restart the PC, run sc query cldflt again and check that STATE reads RUNNING.

Fix 4. Reset OneDrive

5 minutes, then a resyncLow riskOneDrive starts but its sync is stuck, shows errors, or the Fix 2 install changed nothing.

A reset clears OneDrive's local settings and sync state without deleting files, so damaged settings that make OneDrive fail at start are rebuilt from scratch.

1. Open the Run box. Press the Windows key and R at the same time.
2. Reset the Microsoft Store cache. Type the command below and select OK. A blank Command Prompt window opens and closes, then the Microsoft Store opens. Close it. This is the first step in Microsoft's instructions. If OneDrive still does not sync, continue.

   wsreset.exe

3. Run the OneDrive reset command. Press the Windows key and R again. Copy the command below, paste it into the box and select OK.

   %localappdata%\Microsoft\OneDrive\onedrive.exe /reset

   

4. If Windows cannot find it, try the second path. If you see a message that starts with Windows cannot find, open the Run box again and use this command instead.

   C:\Program Files\Microsoft OneDrive\onedrive.exe /reset

5. If that fails too, try the third path. If you still see Windows cannot find, use this command. If none of the three works, the OneDrive sync app is not installed on this PC.

   C:\Program Files (x86)\Microsoft OneDrive\onedrive.exe /reset

6. Start OneDrive again. Select Start, type OneDrive in the search box and select the OneDrive desktop app. OneDrive then starts a full sync.

These steps were written for Windows 11 25H2 and 26H2, Windows 10 22H2. The full page with the other versions and what each result means: How to reset OneDrive in Windows

After the reset OneDrive syncs everything again. If you chose only some folders before, choose them again in Settings > Account > Choose folders. A large OneDrive can take hours to finish.

Fix 5. Uninstall and reinstall OneDrive

15 minutes, then a resyncLow riskThe newest version, the driver check and the reset did not get OneDrive working.

A clean uninstall removes the program files and its start entries, then a fresh install registers OneDrive with Windows Cloud Files again. Microsoft's support staff suggested this; one reporter said the event entry itself stayed afterwards.

1. Select the OneDrive cloud, the gear icon, then Settings. On the Account tab select Unlink this PC, then Unlink account. Your files stay in OneDrive online.
2. Close OneDrive fully. Open Command Prompt and run:

   taskkill /f /im OneDrive.exe

3. Open Settings > Apps > Installed apps and uninstall Microsoft OneDrive. Step by step: Uninstall a program or app in Windows
4. Restart the PC.
5. Download OneDrive from Microsoft's Reinstall OneDrive page and run OneDriveSetup.exe.
6. Sign in, keep the same OneDrive folder location and wait for the sync to finish.

Fix 6. Repair Windows system files with DISM and SFC

20 minutesNo riskOneDrive still fails after Fix 5, or other Windows parts misbehave too.

Cloud Files and event tracing are Windows components. If their files are damaged, no OneDrive install can repair them, but DISM and SFC can. Do not expect this to remove the log entry on a healthy PC.

1. Open an elevated command window. Right-click Start and select Terminal (Admin), or type cmd in the search box, right-click Command Prompt and select Run as administrator. Select Yes when Windows asks for permission.

   

2. Run DISM first. Type the command below and press Enter. DISM downloads clean copies of damaged components from Windows Update, so it can take several minutes. Wait until it says The operation completed successfully.

   DISM.exe /Online /Cleanup-Image /RestoreHealth

   

3. Run System File Checker. In the same window, type the command below and press Enter. Do not close the window until the verification reaches 100%.

   sfc /scannow

   

4. Read the result and restart. Compare the last message with the table below this guide, then restart the PC so that repaired files are loaded.

   

These steps were written for Windows 11 24H2 and 25H2. The full page with the other versions and what each result means: Run DISM and SFC to repair Windows system files

In the Microsoft Q&A case, SFC and DISM found no damage and the entry stayed, because nothing was broken. After the scan, restart and test OneDrive again as in Fix 1.

If the Cloud Files event or OneDrive problem continues

If OneDrive works and only the entry remains, you have reached the normal state for many PCs: the entry can keep appearing after every start. If OneDrive itself still fails, the real cause is written in the Application log, not in the Kernel-EventTracing log.

1. Open Event Viewer (Win + R, eventvwr.msc) and select Windows Logs > Application.
2. Select Filter Current Log, type 1000,1002 in the event ID box and select OK.
3. Look for Application Error 1000 with OneDrive.exe as the faulting application, or Application Hang 1002 with the package Microsoft.OneDriveSync.
4. Note the exception code, the OneDrive version and the time.
5. Send these details, plus the Cloud Files entry, to Microsoft through the Help & Settings menu of OneDrive or the OneDrive support page.

• On a work or school PC, the organisation may block or manage OneDrive with policies. Ask your IT department before you reinstall.
• Disk problems show as Disk or Ntfs errors in the System log. If you see those, check the drive with Check a disk for errors (chkdsk) before you blame OneDrive.

How to keep OneDrive errors away (and what you cannot prevent)

You cannot stop OneDrive from asking for the diagnostic session, so the harmless entry may return after updates. What you can prevent is a damaged OneDrive or a changed Cloud Files driver.

If you do not use OneDrive at all, unlink it and uninstall it as in Fix 5. One reporter stopped using OneDrive, and with no OneDrive starting, no program asks for its session.

Frequently asked questions

What is the Cloud Files Diagnostic Event Listener?

It is the name of an event tracing session for Windows Cloud Files, the part of Windows that OneDrive uses for online-only files through the driver cldflt.sys. A tracing session only collects diagnostic events. It does not sync, move or open files. The error entry appears when a program, in practice OneDrive, asks Windows to start that session and the start fails. If OneDrive works, the failed session has no effect you can see.

Is error 0xC0000022 in Event Viewer dangerous?

No, not by itself. 0xC0000022 is STATUS_ACCESS_DENIED: the program was not given the rights it asked for. Here that program runs under your account and asked for a diagnostic session, so it is not malware breaking in and it is not a damaged disk. It becomes worth your time only when OneDrive also fails to start or sync. Then start with Fix 2 on this page.

Why does it appear every time I restart or sign in?

OneDrive starts with your sign-in, and the entry is written when it asks for the trace session. That is why it shows up at the same moment after every restart. In a Microsoft Q&A report, the reporter saw it every time OneDrive started on Windows 11. The repeat does not mean something is getting worse. Compare the times in Event Viewer with your sign-in time to confirm the pattern.

Does it appear on Windows 11?

Yes. The entry is reported on both Windows 11 and Windows 10, with the same text and the same Event ID 2 from Kernel-EventTracing. The Microsoft Q&A case we read came from a Windows 11 desktop. The steps on this page are the same on both versions, except that Windows 10 no longer gets security updates after 14 October 2025, so a move to Windows 11 is worth planning anyway.

Should I turn off Files On-Demand to fix it?

No. Turning off Files On-Demand downloads your whole OneDrive to the PC, which can fill the disk, and we found no source showing that it stops this entry. Older guides suggested it because the entry names Cloud Files. If you want OneDrive to use less space or sync less, choose folders in OneDrive settings instead. Keep Files On-Demand on unless you really want every file stored locally.

Can I disable the session or delete the event?

We found no Microsoft method to turn this session off, and editing tracing settings in the registry can break logging you may need later. Clearing the Kernel-EventTracing log removes old entries, but OneDrive will write a new one at the next start. Neither step changes how OneDrive works. If the red errors bother you, filter Event Viewer to the logs you actually check, such as System and Application.

What does Session ObserveProcs failed to start with error 0xC0000035 mean?

It is a sister entry in the same Kernel-EventTracing log, often logged at the same start. 0xC0000035 is STATUS_OBJECT_NAME_COLLISION: the object name already exists, so a session called ObserveProcs was already running when another start was requested. In the Microsoft Q&A case it came from the SYSTEM account and appeared with the Cloud Files entry whenever OneDrive started. Like the Cloud Files entry, it needs no repair when the PC works.

Will reinstalling OneDrive delete my files?

No. Unlinking and uninstalling OneDrive removes the app from the PC, not your files in OneDrive online. Files you kept only on this PC in the OneDrive folder stay in that folder. After the reinstall, sign in with the same account and keep the same folder location, and OneDrive syncs everything again. A large OneDrive can take hours to sync, so leave the PC on and connected.

Does System Restore fix this error?

It is not needed for this entry. System Restore removes programs and drivers installed after the restore point, which is a high cost for a log entry that usually means nothing is broken. Use it only if OneDrive and other parts of Windows started failing after a specific change, such as a driver or tweak tool, and the fixes on this page did not help. Step by step: Undo recent changes with System Restore.