Following the recent rollout of the Windows 11 24H2 preview update (KB5060829), users and IT administrators have reported a surge in error messages related to Windows Firewall With Advanced Security. The issue, which manifests as recurring entries in the Event Viewer, has raised questions and concerns across the Windows community.
Nature of the Issue
After installing the KB5060829 update, many systems are logging Event ID 2042 errors with the message “Config Read Failed” and “More data is available” each time the device restarts. These entries appear in the Windows Firewall event logs, leading some users to question the stability and security of their systems.
Root Cause
Microsoft has acknowledged the issue, attributing it to a feature currently under development that was inadvertently included in the preview update. The company has clarified that these error messages do not reflect any malfunction or compromise of the Windows Firewall. The firewall continues to operate as intended, enforcing all configured rules and providing expected protection.
Impact Assessment
- System Security: There is no impact on system security or firewall functionality. All firewall rules and protections remain active and effective.
- System Operations: The error is limited to event logging and does not affect Windows processes or network connectivity.
- User Experience: The primary effect is the presence of repeated error entries in the Event Viewer, which may cause concern or clutter logs, especially in managed IT environments.
Microsoft’s Guidance
Microsoft advises users and administrators that no action is required in response to these error messages. The errors are benign and can safely be ignored. For those who wish to maintain cleaner event logs, Microsoft suggests filtering out Event ID 2042 within the Event Viewer or using PowerShell scripts to exclude these entries.
Workarounds
- Uninstall the Update: If the error messages are disruptive, users can uninstall the KB5060829 update via Settings > Windows Update > Update History > Uninstall updates, followed by a system restart.
- Event Log Filtering: Administrators can filter or suppress Event ID 2042 from logs to reduce noise until a permanent fix is released.
Resolution Timeline
Microsoft has confirmed that a fix is in development and will be delivered in a future update. However, no specific timeline has been provided at this time.
Summary Table
| Symptom | Cause | Impact | Recommended Action | Fix ETA |
|---|---|---|---|---|
| Event ID 2042: “Config Read Failed” | In-development feature in KB5060829 update | None (Firewall operates normally) | Ignore or filter event; optionally uninstall update | Pending |
