Preflight Checklist

• I have searched existing issues and this hasn't been reported yet
• This is a single bug report (please file separate reports for different bugs)
• I am using the latest version of Claude Code

What's Wrong?

Claude Desktop Code/Cowork tab crashes immediately on prompt submission with:

Claude Code process exited with code 3221225477

The application log repeatedly shows coder CLI not found on augmented PATH every 30 seconds. The 2.2 GB Cowork VM bundle (vmlinuz + initrd) downloads successfully from downloads.claude.ai, but the VM never boots.

Critically, no OS event log records this failure — neither Application Error, Microsoft-Windows-CodeIntegrity/Operational, nor CodeIntegrity/ Verbose shows any related entry. This is a silent failure entirely inside Claude Desktop.

Root cause identified: Cowork requires the full Hyper-V networking stack (Get-NetNat, vmms service, cowork-vm-nat HNS network), but on this endpoint only VirtualMachinePlatform is enabled. The full Microsoft-Hyper-V-Hypervisor and Microsoft-Hyper-V-Services features are disabled. This is the recommended enterprise security baseline for endpoints that need WSL2 with minimal attack surface — it is not an edge case.

Diagnostic evidence:

• Get-NetNat → "The specified class does not exist."
• Get-HnsNetwork | ? { $_.Name -eq "cowork-vm-nat" } → empty
• Get-Service vmms → service does not exist
• Get-Service vmcompute, hns → both Running (WSL2 works fine)
• WSL2 + Claude Code CLI 2.1.140 → works perfectly on the same endpoint

A comprehensive technical report with full diagnostic logs, rejected hypotheses, and reproduction steps is attached as Claude_Desktop_Cowork_Bug_Report.md. Please refer to it for complete details.

Claude_Desktop_Cowork_Bug_Report.md

What Should Happen?

Either of the following would resolve this issue:

Option A — Pre-flight check with clear error message (lowest cost): Before attempting to start the Cowork VM, Claude Desktop should verify that the full Hyper-V networking stack is available (e.g., check for vmms service and Get-NetNat availability). If unavailable, display a clear in-app message such as:

Cowork requires the full Hyper-V feature, not just VirtualMachinePlatform. Please ask your IT administrator to enable Microsoft-Hyper-V-Hypervisor and Microsoft-Hyper-V-Services, or use Claude Code CLI in WSL2 as an alternative.

Option B — WSL2 backend fallback (medium-term, broader impact): Offer a WSL2 backend for Cowork, similar to how Docker Desktop operates. This would eliminate the dependency on full Hyper-V and unlock Cowork for the substantial population of enterprise users on Secured-core PC endpoints with VirtualMachinePlatform-only configurations.

Minimum acceptable fix: Replace the misleading coder CLI not found on augmented PATH error message with one that accurately describes the underlying VM boot failure. The current message sends users searching for a coder.exe binary that doesn't and shouldn't exist on the Windows host.

Error Messages/Logs

=== UI Error ===
Claude Code crashed
Try resending the message. If the problem persists, please send feedback so we can investigate.

Claude Code process exited with code 3221225477
(= 0xC0000005, superficially Access Violation, but see diagnostics below)

=== Application Log (main.log) — repeats every 30 seconds ===
%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs\main.log

2026-05-15 10:17:50 [info] [Coder] workspace discovery failed:
  Error: coder CLI not found on augmented PATH
  at zEr (C:\Program Files\WindowsApps\Claude_1.7196.0.0_x64__pzs8sxrjxfjjc\app\
         resources\app.asar\.vite\build\index.js:2409:17320) {
    [stack]: [Getter/Setter],
    [message]: 'coder CLI not found on augmented PATH'
  }

=== Application Log — VM bundle download (completes successfully) ===
2026-05-15 10:44:37 [info] [download:1] 22.2% (496.0/2233.9 MB) avg 7.08 MB/s, ETA 4m 6s
2026-05-15 10:47:37 [info] [download:1] 97.7% (2183.4/2233.9 MB) avg 8.73 MB/s, ETA 6s
2026-05-15 10:47:43 [info] [download:2] Starting download from
  https://downloads.claude.ai/vms/linux/x64/5680b11bcdab215cccf07e0c0bd1bd9213b0c25d/vmlinuz.zst
2026-05-15 10:47:44 [info] [download:3] Starting download from
  https://downloads.claude.ai/vms/linux/x64/5680b11bcdab215cccf07e0c0bd1bd9213b0c25d/initrd.zst

=== Windows Event Logs — CRITICAL: ZERO entries ===
Microsoft-Windows-CodeIntegrity/Operational : zero Claude-related entries
Microsoft-Windows-CodeIntegrity/Verbose      : zero Claude-related entries (enabled during reproduction)
Application Error / WER / .NET Runtime       : zero Claude-related entries

The 3221225477 exit code is therefore NOT a real OS-level Access Violation.
It is being returned voluntarily by a Claude Desktop child process that detects
the Cowork VM is unavailable. This is a silent failure entirely inside Claude
Desktop's own logic.

=== PowerShell Diagnostics — Root Cause ===

PS> Get-NetNat
Get-NetNat: The specified class does not exist.
# The Microsoft-Hyper-V-Services feature is disabled, so NetNat CIM class
# is not registered at all.

PS> Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" }
(empty)
# The cowork-vm-nat HNS network is never created.

PS> Get-Service "CoworkVMService" | Select Status, StartType
Status  StartType
------  ---------
Running Automatic
# The service itself starts fine, but cannot create its VM network.

PS> Get-Service vmcompute, vmms, hns -ErrorAction SilentlyContinue
Name        Status   StartType
----        ------   ---------
hns         Running  Manual
vmcompute   Running  Manual
# vmms does NOT exist — the service is not even installed.
# vmcompute and hns are sufficient for WSL2 but not for full Hyper-V VMs.

PS> dism /online /get-features /format:table | Select-String "Hyper|Virtual"
VirtualMachinePlatform                  Enabled    ← only this is on
HypervisorPlatform                      Disabled
Microsoft-Hyper-V-All                   Disabled
Microsoft-Hyper-V                       Disabled
Microsoft-Hyper-V-Hypervisor            Disabled
Microsoft-Hyper-V-Services              Disabled    ← provides Get-NetNat
Microsoft-Hyper-V-Management-Clients    Disabled
Microsoft-Windows-Subsystem-Linux       Disabled    (WSL2 still works via VMP)
Containers                              Disabled

Steps to Reproduce

This bug is environment-dependent. Reproduction requires a Windows 11 endpoint configured to a specific (but common) enterprise security baseline.

Prerequisites: Endpoint Configuration

1. Provision a Windows 11 Enterprise endpoint with Secured-core PC settings:

   • WDAC Enforcement Mode active
   • HVCI Running
   • Secure Boot enabled
   • DMA protection enabled

2. Enable ONLY VirtualMachinePlatform; leave the following disabled:

   • Microsoft-Hyper-V-Hypervisor
   • Microsoft-Hyper-V-Services
   • Microsoft-Hyper-V-Management-PowerShell
   • Microsoft-Hyper-V-All

   This is the recommended baseline for "endpoint that needs WSL2 but does not need to host VMs" — a very common enterprise configuration.

3. Verify the broken state with PowerShell:

   Get-NetNat
   # Expected on this config: "The specified class does not exist."

   Get-Service vmms -ErrorAction SilentlyContinue
   # Expected: no output (service not installed)

   Get-Service vmcompute, hns
   # Expected: both Running (sufficient for WSL2)

Reproduction Steps

1. Install Claude Desktop on the endpoint above (MSIX from Microsoft Store OR standalone installer — both reproduce identically).

2. Sign in and open the Code tab.

3. Submit any prompt, e.g., "list files in this folder".

4. Wait up to a few minutes (during which the 2.2 GB Cowork VM bundle downloads from downloads.claude.ai).

5. Observe the UI error: Claude Code process exited with code 3221225477

6. Verify the silent failure:

   # cowork-vm-nat HNS network is missing
   Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" }
   # Expected: empty

   # No OS-level crash recorded
   Get-WinEvent -FilterHashtable @{
       LogName='Application'
       StartTime=(Get-Date).AddMinutes(-30)
       Level=1,2,3
   } | Where-Object { $_.Message -match "claude" }
   # Expected: zero entries

1. Verify Claude Desktop's own log shows the misleading error:

Contains repeating coder CLI not found on augmented PATH (every 30 sec).

Confirmation That Claude Code CLI Is Unaffected

On the SAME endpoint:

wsl --install -d Ubuntu-24.04
# Inside Ubuntu:
curl -fsSL https://claude.ai/install.sh | bash
claude  # works perfectly, including all agentic features

This confirms the issue is specific to Claude Desktop's Cowork VM implementation, not to Claude's core capabilities, not to WSL2, and not to the WDAC policy itself.

A comprehensive technical report including rejected hypotheses,

full diagnostic logs, and strategic context is attached as

Claude_Desktop_Cowork_Bug_Report.md.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown (worked on previous endpoint with full Hyper-V enabled)

Claude Code Version

N/A — this report concerns Claude Desktop MSIX 1.7196.0, not Claude Code CLI. For reference, Claude Code CLI 2.1.140 works correctly inside WSL2 Ubuntu 24.04 on the same endpoint: $ claude --version 2.1.140 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

⚠️ Note on Report Scope

This report concerns Claude Desktop (MSIX 1.7196.0) — specifically its Code/Cowork tab — not Claude Code CLI. I am filing here following the established convention that the anthropics/claude-code issue tracker is the central destination for Claude Desktop bug reports (see e.g. #25801, #28231, #28900, #42776, #51143, #53255). Please re-tag with area:desktop, area:cowork, and platform:windows as appropriate.

Summary of Root Cause

Claude Desktop's Cowork feature requires the full Hyper-V networking stack (Get-NetNat CIM class, vmms service, cowork-vm-nat HNS network), but on the modern enterprise Windows baseline only VirtualMachinePlatform is enabled. This is the recommended configuration for endpoints that need WSL2 with minimal attack surface — it is not an edge case.

On such endpoints:

• WSL2 + Claude Code CLI 2.1.140 works perfectly
• Claude Desktop Code/Cowork tab crashes silently (exit 3221225477)
• No OS event log records the failure
• The user sees only the misleading coder CLI not found on augmented PATH

WDAC Enforcement Mode and HVCI were investigated and ruled out as causes — WDAC logs no blocks for Claude. The issue is purely a missing Hyper-V feature dependency.

Why This Matters at Scale

Secured-core PC adoption is accelerating across enterprises in 2026–2028, driven by:

• Cyber insurance underwriting requirements
• SOC 2 / ISO 27001 / J-SOX audit pressure
• Microsoft's own Windows 11 enterprise security baseline guidance

The VirtualMachinePlatform-only configuration (no full Hyper-V) is the recommended baseline in this trajectory. Cowork's current architecture excludes this entire population by design. As a PE advisor working with portfolio companies on IT due diligence and DX, I confirm this configuration is now the default on newly provisioned corporate endpoints, not an outlier.

Requested Improvements (recap)

1. Pre-flight check at startup: verify vmms service and `Get-NetN

errorlog_en.docx

at` availability; if missing, show a clear error message instead of crashing.

1. Replace the misleading coder CLI not found error with one that accurately describes the VM boot failure.

2. WSL2 backend fallback (medium-term): Docker Desktop demonstrates this is viable. Would unlock Cowork for the entire Secured-core PC population.

3. Document the Hyper-V requirement explicitly in Cowork's system requirements (currently undocumented).

Attachments

• Claude_Desktop_Cowork_Bug_Report.md — comprehensive 10-section technical report including all rejected hypotheses, full diagnostic command history, and strategic context. ~500 lines.
• PowerShell screenshots showing Get-NetNat "class does not exist" error and DISM output confirming Hyper-V features all disabled.

Availability for Follow-up

I am a Claude Enterprise customer (Endeavor United Co., Ltd., a PE fund based in Tokyo) and am available for:

• Additional diagnostics or log collection on request
• Pre-release validation of any fix
• Testing of a WSL2 backend if/when prototyped

errorlog_en.docx