KB5127936: reproducible Firewall 2042 and wesp 7000 errors at every boot

After installing the Windows 11 preview update KB5127936, released on 28 October 2026, two recurring startup errors appeared on my system. Uninstalling the update stops both errors; reinstalling it brings them back.

Environment

• Windows 11 Pro, 26H2, build 26300.9818 during the failing captures.
• The corresponding kernel/startup event reports base build 26100.9818.
• After rollback, the startup event reports base build 26100.9711.
• KB5127936 covers builds 26200.9818 and 26300.9818; the captured system here is the 26300 branch.
• The errors also occurred on a clean Windows installation.

1. Windows Firewall with Advanced Security - Event ID 2042

This appears twice per boot:

Failed to read configuration. Configuration: 18 Error: Access denied.

The event data records SettingType 18 and ErrorCode -2147024891 (0x80070005).

1. Service Control Manager - Event ID 7000

The wesp service failed to start due to the following error: The request is not supported.

The captured startup error is Windows error 50 (ERROR_NOT_SUPPORTED). A separate SCM 7026 event also lists wesp as a driver that failed to load.

Checks already performed during a failing boot

• Base Filtering Engine (BFE) and Windows Defender Firewall (mpssvc) were running.
• All three firewall profiles were enabled, with inbound blocked and outbound allowed by default.
• wesp was configured as a boot-start file-system driver, dependent on FltMgr.
• The wesp.sys Microsoft signature was valid in the captured verification.
• The errors were already in the saved logs before a later BIOS IOMMU setting change.
• These Windows errors also persisted with the ChatGPT/Codex desktop app uninstalled.

Additional technical findings The captured mpssvc.dll and FWPolicyIOMgr.dll were version 10.0.26100.9818. Their hashes, and those of wesp.sys and wesp_elam.sys, matched the corresponding x64 entries in Microsoft's KB5127936 file list.

A static comparison against version 10.0.26100.9711 found that firewall global setting 18 had the name EnableAuditMode in the earlier policy-manager descriptor. In the inspected 9818 binary, its name pointer was null, and the inspected read path returns 0x80070005 for a null name. The firewall service still attempts to read setting 18.

This is a static binary finding, not a captured call stack from the failing boot or a Microsoft-confirmed root cause.

Reproduction

1. Install KB5127936 and restart: both error types appear.
2. Uninstall KB5127936 and restart: both error types disappear.
3. Reinstall KB5127936 and restart: both error types return.

Please confirm whether this is a known regression and provide a supported fix or tracking reference. I would like to keep the update installed without disabling firewall protection or security drivers.

Microsoft update page: https://support.microsoft.com/en-us/servicing/os/windows-11/2026/10/kb5127936-windows-11-25h2-26h2-update

Microsoft file list: https://download.microsoft.com/download/108995d1-e4cc-455a-9c50-c7b06db33e0d/5127936.csvAfter installing the Windows 11 preview update KB5127936, released on 28 October 2026, two recurring startup errors appeared on my system. Uninstalling the update stops both errors; reinstalling it brings them back.

**Note:
**
Sucks that the same occuring errors from previous builds (since months ago) are not yet fixed such as:

1. StateRepository: (svchost.exe (wsappx -p): Error0x15: misuse at line 185353 of [737ae4a347
2. AppxPackagingOM (svchost.exe (LocalSystemNetworkRestricted -p)): App manifest validation warning: Declared namespace [http://schemas.microsoft.com/developer/appx/2015/build] http://schemas.microsoft.com/developer/appx/2015/build) is inapplicable, it will be ignored during manifest processing.
3. Various Crypto-NCrypt / LiveID / Cloudstore / Install-Service / Store-SDK / ....