Skip to content

Windows sandbox provisioning fails with helper_unknown_error: setup refresh had errors #41715

Open
Open
Windows sandbox provisioning fails with helper_unknown_error: setup refresh had errors#41715
Labels
appIssues related to the Codex desktop appbugSomething isn't workingsandboxIssues related to permissions or sandboxingwindows-osIssues related to Codex on Windows systems

Description

@rrf66hndgr-lang
rrf66hndgr-lang
opened on Aug 30, 2026

Problem

Codex Desktop on Windows is unable to execute any command.

Every execution fails before PowerShell or the requested command starts.

Exact error:

Failed to create unified exec process: helper_unknown_error: setup refresh had errors

Example:

exec_command failed for:
"C:\Users\Seb.cache\codex-runtimes\codex-primary-runtime\dependencies\native\powershell\pwsh.exe"

CreateProcess {
message: "Rejected("Failed to create unified exec process: helper_unknown_error: setup refresh had errors")"
}

Environment

  • Windows 11 Professional, 64-bit
  • Windows build: 10.0.26200
  • ChatGPT Desktop: 26.825.6671.0
  • Codex runtime: approximately 0.151.0-alpha.7.2
  • sandbox_mode: workspace-write
  • approval_policy: on-request
  • Codex authentication configured with ChatGPT
  • Network connectivity test succeeds

Codex Doctor

codex doctor reports:

  • sandbox provisioning: FAILED
  • error code: helper_unknown_error
  • sandbox backend: elevated
  • filesystem sandbox: restricted
  • network sandbox: enabled
  • CrowdStrike Falcon detected with a warning that it can interfere with Codex
  • thread inventory warnings
  • search/ripgrep warning

The hard failure reported by Doctor is the Windows sandbox provisioning failure.

Troubleshooting already performed

  • Restarted ChatGPT/Codex
  • Rebooted Windows
  • Used Windows app "Repair"
  • Retested in new Codex conversations
  • Verified normal Windows PowerShell works
  • Verified Codex runtime files exist
  • Verified project directory ownership
  • Project owner is the normal Windows user, not a CodexSandbox account
  • Parent directory has the same normal owner
  • CodexSandboxUsers already has explicit Modify/Synchronize permissions on the workspace
  • No Azure AD, Windows domain, or Workplace Join is configured
  • CrowdStrike Falcon Sensor is installed and running
  • No explicit CrowdStrike blocking event was found in the Windows Application/System logs
  • CrowdStrike has NOT been disabled or modified

The failure occurs before the requested PowerShell command starts.

Expected behavior

Codex should provision/refresh its Windows sandbox and execute commands in the authorized workspace.

Actual behavior

Sandbox setup/refresh fails before process creation, so no Codex command can execute.

Please advise whether this is a known Windows sandbox provisioning issue and whether additional diagnostic information from codex doctor would help.

Activity

  1. github-actions
    added
    bugSomething isn't working
    appIssues related to the Codex desktop app
    windows-osIssues related to Codex on Windows systems
    sandboxIssues related to permissions or sandboxing
    on Aug 30, 2026

  2. github-actions commented on Aug 30, 2026

    @github-actions
    github-actionsbot
    on Aug 30, 2026 – with GitHub Actions
    Contributor

    Potential duplicates detected. Please review them and close your issue if it is a duplicate.

    Powered by Codex Action

  3. FunnyKode commented on Sep 3, 2026

    @FunnyKode
    FunnyKode
    on Sep 3, 2026

    Hey @rrf66hndgr-lang,

    I was running into the exact same error and here's how I fixed it:

    What worked for me:

    1. Restart ChatGPT completely
    2. Give ChatGPT full access/permissions

    After doing both, the error disappeared and everything worked normally.

    I think the issue was probably related to permissions or a temporary state of the application.

    Hope this helps you too! Let me know if it works on your end. 👍

  4. ProGo2026 commented on Sep 6, 2026

    @ProGo2026
    ProGo2026
    on Sep 6, 2026

    I can reproduce the same Windows sandbox failure on Codex Desktop 26.901.6511.0.

    helper_unknown_error: setup refresh had errors

    Even a read-only command such as:

    Get-Location

    fails before process creation.

    Additional diagnostics from my machine:

    • Windows 11
    • OpenAI.Codex AppX status: Ok
    • External PowerShell works normally
    • Workspace and .git ownership are normal
    • CodexSandboxOffline and CodexSandboxOnline both exist, are enabled, and belong to CodexSandboxUsers
    • Neither sandbox account has a Win32_UserProfile
    • Neither sandbox SID has a corresponding ProfileList registry entry
    • setup_marker.json exists and is readable
    • Explicitly granting the current user access to setup_marker.json did not change the failure
    • No custom sandbox/writable-root config is present
    • No relevant recent User Profiles Service errors were found
    • Historical Codex sandbox logs on the same machine previously showed:
      SetNamedSecurityInfoW failed: 5
      against the Codex WindowsApps installation directory
    • The sandbox has also successfully initialized on this same machine in the past

    The current failure does not appear to produce a fresh detailed sandbox log, which makes diagnosis difficult.

    This looks isolated to Codex Desktop Windows sandbox/profile provisioning rather than the project itself.

    It may be worth checking whether missing sandbox user profiles / ProfileList entries, or stale ACL state across AppX updates, can trigger setup refresh had errors.

    A more detailed underlying provisioning error or a Windows sandbox repair/diagnostic command would be very helpful.

  5. mitakalostboy commented on Sep 6, 2026

    @mitakalostboy
    mitakalostboy
    on Sep 6, 2026 – with ChatGPT Codex Connector

    Additional reproducible case on Windows 11 with the current ChatGPT/Codex desktop app.

    Minimal command execution fails before process creation, including a harmless echo sandbox-ok test:

    Failed to create unified exec process: helper_unknown_error: setup refresh had errors

    Troubleshooting already performed without changing the result:

    • Windows reboot
    • ChatGPT/Codex app restart
    • Windows app Repair
    • Full uninstall/reinstall
    • Confirmed the app reports it is up to date
    • External PowerShell works normally

    The fresh sandbox log consistently identifies the failing operation:

    granting write ACE to C:\KEIBA_EDGE for sandbox group and capability SID
write ACE grant failed on C:\KEIBA_EDGE: SetNamedSecurityInfoW failed: 5
setup refresh completed with errors
setup error: setup refresh had errors

    ACL state for C:\KEIBA_EDGE:

    Owner                   : BUILTIN\Administrators
AreAccessRulesProtected : False
Authenticated Users     : Modify
SYSTEM                  : FullControl
Administrators          : FullControl
Users                   : ReadAndExecute

    icacls C:\KEIBA_EDGE likewise shows inherited ACLs and no obvious ownership anomaly. Child project directories previously checked also have normal ownership; no CodexSandbox* ownership was found.

    So this appears to be a reproducible write-ACE provisioning failure on an ordinary local NTFS workspace root. The error persists after repair/reinstall/reboot, and blocks all Codex execution before the requested command starts.

    I have deliberately not applied a manual WRITE_DAC/FullControl workaround yet, to preserve the failing state for diagnosis.

  6. jinlingjie01-hue commented on Oct 8, 2026

    @jinlingjie01-hue
    jinlingjie01-hue
    on Oct 8, 2026

    Additional affected Windows user confirming the same failure.

    Environment:

    • Codex Desktop: 26.1002.52244 (the app reports it is up to date)
    • Windows desktop

    Symptom:
    Local command execution fails before the requested PowerShell command starts, with:

    Failed to create unified exec process: helper_unknown_error: setup refresh had errors

    Troubleshooting performed:

    • Restarted Codex three times; the failure persists.
    • Confirmed the app reports that it is up to date.

    I also submitted in-app feedback for this issue. Feedback ID: 01a11b53-bbe6-7bf3-ad98-d1e4e4fa078f

    I’m seeing the same runtime read/execute validation failure on Windows. My sandbox log reports that opening ...\runtimes\cua_node\3dd31cfff853001c\bin\node_repl.exe for ACL validation failed because another process is using the file (os error 32). The setup refresh then fails and Codex cannot start local commands.
    Codex Desktop version: 26.1002.52244 (reported up to date)
    Feedback ID: 01a11b53-bbe6-7bf3-ad98-d1e4e4fa078f

  7. oishi1216 commented on Oct 8, 2026

    @oishi1216
    oishi1216
    on Oct 8, 2026 – with ChatGPT Codex Connector

    Additional Windows reproduction with a bounded, redacted Codex Doctor result (2026-10-08 JST).

    The affected operation was a read-only, user-controlled Codex CLI source syntax check. GitHub content retrieval succeeded, but the shell command failed before PowerShell launched, with:

    Failed to create unified exec process: helper_unknown_error: setup refresh had errors

    A subsequent single, non-elevated Windows PowerShell invocation of codex doctor --json, filtered in memory to avoid disclosing raw diagnostics, reported:

    DOCTOR_JSON=PASS
SANDBOX_HELPERS=FAIL
HELPER_ERROR_PRESENT=YES
REPAIR2_AST=NOT_RUN

    Here DOCTOR_JSON=PASS means that the output was parsed; it is not a health PASS. The sandbox.helpers check returned FAIL, and the error section contained a recognized helper/setup-refresh failure string.

    The failed task did not reach the requested PowerShell AST parser. No files were written and no sandbox bypass, elevation, ACL or service/account change, cache removal, or reinstall was performed. Windows and installed app/runtime build numbers have not been freshly collected, so I am not assigning a build/version or attributing the issue to any particular cause.

    Could the maintainers clarify the supported, non-destructive troubleshooting path to identify the underlying sandbox helper setup-refresh failure (for example, which bounded codex doctor fields or safely redacted diagnostic category would help), while preserving project files and avoiding raw credentials, user paths, and broad logs? Thank you.

  8. hulinxuanxuan-cmd commented on Oct 9, 2026

    @hulinxuanxuan-cmd
    hulinxuanxuan-cmd
    on Oct 9, 2026 – with ChatGPT Codex Connector

    I can reproduce this same Windows sandbox provisioning failure in a separate Codex Desktop session.

    After restarting Codex, a minimal read-only command (Get-Location) still fails before the command starts:

    Failed to create unified exec process: helper_unknown_error: setup refresh had errors

    The Node execution bridge also exits during startup with:

    windows sandbox failed: helper_unknown_error: setup refresh had errors

    I re-granted session-level filesystem access to the relevant generated-assets directory and workspace, but the failure persisted. A simple workspace file write through the patch tool also failed. The dependency metadata tool still responds, so this appears isolated to local sandbox provisioning/execution rather than the conversation service. Restarting Codex did not resolve it. I do not have a local Codex build/version number because all local command execution is blocked.

    Could maintainers advise how to collect the sandbox setup log/doctor diagnostics, or provide a repair path for this setup-refresh failure?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    appIssues related to the Codex desktop appbugSomething isn't workingsandboxIssues related to permissions or sandboxingwindows-osIssues related to Codex on Windows systems

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions