Issue Station
Sign In
Tools hereToolbox

codex - 💡(How to fix) Fix Computer Use fails to start on Windows with sandbox ACL setup error

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Computer Use fails to start on my Windows environment. Based on the sandbox logs, it appears related to ACL setup for the Codex app directory under C:\Program Files\WindowsApps, but I’m not sure whether this is environment-specific or a Codex sandbox compatibility issue.

Error Message

read-acl-only mode: applying read ACLs granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_<version>x64_<publisher-id>\app for sandbox users grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>x64_<publisher-id>\app for sandbox_group: SetNamedSecurityInfoW failed: 5 read ACL run completed with errors: ["grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>x64_<publisher-id>\app for sandbox_group: SetNamedSecurityInfoW failed: 5"] setup error: read ACL run had errors

Root Cause

Computer Use fails to start on my Windows environment. Based on the sandbox logs, it appears related to ACL setup for the Codex app directory under C:\Program Files\WindowsApps, but I’m not sure whether this is environment-specific or a Codex sandbox compatibility issue.

Code Example

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh

---

read-acl-only mode: applying read ACLs
granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox users
grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors: ["grant read ACE failed on C:\\Program Files\\WindowsApps\\OpenAI.Codex_<version>_x64__<publisher-id>\\app for sandbox_group: SetNamedSecurityInfoW failed: 5"]
setup error: read ACL run had errors

---

setup refresh: failed to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe: 要求された操作には管理者特権が必要です。 (os error 740)

---

%USERPROFILE%\.codex\plugins\cache\openai-bundled\computer-use\26.527.30818\node_modules\@oai\sky\bin\windows\codex-computer-use.exe

---

EnableControlledFolderAccess : 0

---

IsTamperProtected         : True
AntivirusEnabled          : True
RealTimeProtectionEnabled : True
BehaviorMonitorEnabled    : True

---

Owner : NT AUTHORITY\SYSTEM
Group : NT AUTHORITY\SYSTEM

---

C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app

---

BUILTIN\Users Allow ReadAndExecute, Synchronize
NT SERVICE\TrustedInstaller Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Administrators Allow ReadAndExecute, Synchronize
NT AUTHORITY\LOCAL SERVICE Allow ReadAndExecute, Synchronize
NT AUTHORITY\NETWORK SERVICE Allow ReadAndExecute, Synchronize
NT AUTHORITY\RESTRICTED Allow ReadAndExecute, Synchronize

---

1. Install and launch Codex Desktop on Windows.
2. Enable/use the bundled Computer Use plugin.
3. In a Codex thread, call Computer Use, for example with a simple test request.
4. Computer Use fails before returning `list_apps()`.

The failure happens during Windows sandbox setup. `node_repl` exits unexpectedly with:

---

The sandbox log shows that setup tries to grant a read ACE to the Codex app directory under `C:\Program Files\WindowsApps`, but the ACL operation fails:

---

A later attempt also logged:

---

This also reproduces with a newly created local Windows user account, so it does not appear to be specific to my original Windows user profile or `.codex` cache.

I do not have a code snippet beyond invoking Computer Use from a Codex thread, since the failure happens during plugin/sandbox initialization before app automation begins.
RAW_BUFFERClick to expand / collapse

What version of the Codex App are you using (From “About Codex” dialog)?

Codex 26.527.30818

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Windows 11 25H2

What issue are you seeing?

Summary

Computer Use fails to start on my Windows environment. Based on the sandbox logs, it appears related to ACL setup for the Codex app directory under C:\Program Files\WindowsApps, but I’m not sure whether this is environment-specific or a Codex sandbox compatibility issue.

Environment

  • OS: Windows
  • Codex Desktop: 26.527.3378.0
  • Computer Use plugin: 26.527.30818
  • Codex app path: C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app
  • Plugin cache: %USERPROFILE%\.codex\plugins\cache\openai-bundled\computer-use\26.527.30818

What happened

When I call Computer Use, node_repl exits unexpectedly:

node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh

The sandbox log shows that setup tries to grant a read ACE to the Codex app directory under WindowsApps, but fails with access denied:

read-acl-only mode: applying read ACLs
granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox users
grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors: ["grant read ACE failed on C:\\Program Files\\WindowsApps\\OpenAI.Codex_<version>_x64__<publisher-id>\\app for sandbox_group: SetNamedSecurityInfoW failed: 5"]
setup error: read ACL run had errors

A later attempt also logged:

setup refresh: failed to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe: 要求された操作には管理者特権が必要です。 (os error 740)

What I checked

codex-computer-use.exe exists:

%USERPROFILE%\.codex\plugins\cache\openai-bundled\computer-use\26.527.30818\node_modules\@oai\sky\bin\windows\codex-computer-use.exe

config.toml contains the notify path to codex-computer-use.exe.

Controlled Folder Access is disabled:

EnableControlledFolderAccess : 0

Windows Security / Defender status:

IsTamperProtected         : True
AntivirusEnabled          : True
RealTimeProtectionEnabled : True
BehaviorMonitorEnabled    : True

Owner of the Codex app folder:

Owner : NT AUTHORITY\SYSTEM
Group : NT AUTHORITY\SYSTEM

ACL excerpt for:

C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app
BUILTIN\Users Allow ReadAndExecute, Synchronize
NT SERVICE\TrustedInstaller Allow FullControl
NT AUTHORITY\SYSTEM Allow FullControl
BUILTIN\Administrators Allow ReadAndExecute, Synchronize
NT AUTHORITY\LOCAL SERVICE Allow ReadAndExecute, Synchronize
NT AUTHORITY\NETWORK SERVICE Allow ReadAndExecute, Synchronize
NT AUTHORITY\RESTRICTED Allow ReadAndExecute, Synchronize

I also tested with a newly created local Windows user account. The same failure occurs there as well, so this does not appear to be specific to my original Windows user profile or .codex cache.

Request

Could you investigate whether this is an expected limitation of the Windows Store/MSIX install path, an environment-specific ACL issue, or a Codex sandbox setup bug?

What steps can reproduce the bug?

1. Install and launch Codex Desktop on Windows.
2. Enable/use the bundled Computer Use plugin.
3. In a Codex thread, call Computer Use, for example with a simple test request.
4. Computer Use fails before returning `list_apps()`.

The failure happens during Windows sandbox setup. `node_repl` exits unexpectedly with:

```text
node_repl kernel exited unexpectedly
windows sandbox failed: spawn setup refresh

The sandbox log shows that setup tries to grant a read ACE to the Codex app directory under C:\Program Files\WindowsApps, but the ACL operation fails:

read-acl-only mode: applying read ACLs
granting read ACE to C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox users
grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_<version>_x64__<publisher-id>\app for sandbox_group: SetNamedSecurityInfoW failed: 5
read ACL run completed with errors: ["grant read ACE failed on C:\\Program Files\\WindowsApps\\OpenAI.Codex_<version>_x64__<publisher-id>\\app for sandbox_group: SetNamedSecurityInfoW failed: 5"]
setup error: read ACL run had errors

A later attempt also logged:

setup refresh: failed to spawn %LOCALAPPDATA%\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe: 要求された操作には管理者特権が必要です。 (os error 740)

This also reproduces with a newly created local Windows user account, so it does not appear to be specific to my original Windows user profile or .codex cache.

I do not have a code snippet beyond invoking Computer Use from a Codex thread, since the failure happens during plugin/sandbox initialization before app automation begins.


### What is the expected behavior?

_No response_

### Additional information

_No response_

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

codex - 💡(How to fix) Fix Computer Use fails to start on Windows with sandbox ACL setup error