Windows: CreateProcessAsUserW fails with error 5 before a read-only command starts

What version of the Codex App are you using (From “About Codex” dialog)?

Codex Desktop: 26.901.6511.0 and Codex CLI: 0.153.4

What subscription do you have?

ChatGPT Pro

What platform is your computer?

Microsoft Windows Version 25H2 (OS Build 26200.9168)

What issue are you seeing?

The Codex App on Windows failed to launch a child process for a read-only PowerShell operation.

The tool reported:

Failed to create unified exec process: runner failed during SpawnChild: CreateProcessAsUserW failed: 5 (Access is denied.)

According to the tool response, the requested child process was not created. The displayed launcher diagnostic was truncated.

Earlier operations in the same task had succeeded, including read-only checks and file materialization. The underlying cause of the later process-launch failure is unknown.

No retry, elevation, account change, or sandbox-policy change was attempted after this failure.

In-app feedback was submitted with diagnostic logs.
Feedback ID: 01a00b31-1cd5-7012-abec-458a568b4b6b

What steps can reproduce the bug?

Observed sequence — a reliable minimal reproduction has not been established:

1. Use the Codex App on Windows for an existing local task.
2. Earlier tool operations complete successfully.
3. Codex requests a read-only PowerShell Get-Content operation on local task files.
4. The launcher returns CreateProcessAsUserW error 5 during SpawnChild, before the requested child process starts.
5. The displayed diagnostic is truncated, so the complete launcher details are unavailable.

The failed operation has not been retried. I am requesting guidance on collecting the complete diagnostic through a supported method before attempting further troubleshooting.

What is the expected behavior?

Commands permitted by the existing security controls should start successfully.

If process creation is denied, Codex should provide a complete, actionable diagnostic identifying the failed operation and, where available, the resource or access check involved.

Troubleshooting should preserve the existing security controls.

Additional information

Reported launcher fields:

• env_u16_len=4484
• si_flags=256
• creation_flags=525312

The available sandbox log identifies codex-command-runner-0.153.4.exe. This is a runner component version, not a verified Codex App version.

The examined sandbox.2026-09-06.log contains 3,985,075 bytes and 27,998 lines. It contains no CreateProcessAsUserW or SpawnChild entries.

It contains repeated SetFileAttributesW access-denied warnings involving C:\Users\Default and two sandbox junction-creation access-denied messages. These have not been correlated with the failed child launch and are not established as its cause.

Please advise how to obtain the complete launcher diagnostic and correlate it with Feedback ID 01a00b31-1cd5-7012-abec-458a568b4b6b.

CODEX_ERROR5_SUPPORT_ADDENDUM.md

Start with CODEX_ERROR5_SUPPORT_ADDENDUM.md and the referenced sandbox.2026-09-06.log, then trace the runner's SpawnChild/CreateProcessAsUserW path. The log currently lacks those entries, so first establish a reproducible failure and capture the complete launcher diagnostic. Done means permitted read-only commands launch successfully or the failure reports actionable details without weakening security controls.