Windows sandbox: intermittent CreateProcessWithLogonW 1907 (ERROR_NO_SUCH_LOGON_SESSION) under concurrent launches from multiple sessions

What version of the Codex App are you using (From “About Codex” dialog)?

0.153.4 (the bundled codex-cli core in the Windows desktop app)

What subscription do you have?

Plus

What platform is your computer?

Microsoft Windows NT 10.0.26200.0 x64

What issue are you seeing?

Sandboxed command launches fail intermittently with CreateProcessWithLogonW failed: 1907 (ERROR_NO_SUCH_LOGON_SESSION). The rejection is not tied to one tool. I have seen it on all three launch paths inside a single session:

• unified exec: Failed to create unified exec process: CreateProcessWithLogonW failed: 1907
• filesystem sandbox helper: fs sandbox helper failed with status exit code: 1: windows sandbox failed: CreateProcessWithLogonW failed: 1907
• JS tool kernel: kernel_status: "exited(code=1)" with windows sandbox failed: CreateProcessWithLogonW failed: 1907 on stderr

The commands are ordinary and harmless (file hashes, pytest, rg, script runs). Retrying with different commands or transports never helps, so this is infrastructure rather than a command or quoting problem.

What makes this different from a persistent breakage is that it tracks concurrency. On 2026-09-06 between 14:05 and 15:13 local time, three sessions I started within ten minutes of each other were rejected with 1907 from their very first command (first rejection 24 to 48 seconds after each session started) and kept failing for up to 68 minutes. During the same window, two older sessions on the same machine completed roughly 266 sandboxed launches with zero failures, and some batches inside the failing sessions mixed successful and rejected launches within the same second. Everything worked again the same evening, with no re-logon and no app restart in between. The same signature shows up in my saved transcripts going back to May, always worst on days when several sessions run at once (28 rejections in one transcript on August 15).

What steps can reproduce the bug?

Not fully deterministic, but it reproduces reliably on busy multi-session days:

1. Windows 11 (build 26200), Codex desktop app with filesystem sandboxing enabled.
2. Start three or more sessions within a few minutes, each issuing batched parallel sandboxed commands (reads, hashes, test runs).
3. Within about a minute, launches in the new sessions start failing with CreateProcessWithLogonW failed: 1907.
4. A session that was already running before the burst keeps launching commands successfully the whole time.
5. After roughly an hour (or a standby cycle), new sessions on the same machine launch normally again.

I can provide sanitized per-call timestamps from saved transcripts if that helps, including the interleaving of successes and rejections within the same second.

What is the expected behavior?

Concurrent sessions should not degrade sandbox launch reliability at all. If a transient 1907 can still happen under heavy parallel launch bursts, the launcher should retry it with backoff instead of surfacing it as a terminal failure. Agents currently misread it as a command problem and waste attempts on it.

Additional information

Related issues, adjacent but not duplicates:

• #34062: per-command CreateProcessWithLogonW(..., LOGON_WITH_PROFILE) profile loads, with SECLOGON stalls under sustained activity. My unproven guess is the same mechanism under concurrency: parallel profile loads for the sandbox account race, the loser gets ERROR_NO_SUCH_LOGON_SESSION, and sequential-rate launches keep working. If that holds, this is the reliability-facing sibling of that performance issue.
• #18620 and #27170: persistent 1326/1909 credential-state failures. Mine is transient, concurrency-linked, and self-healing.
• #33073: persistent 1168 from a broken ProfileList. Nothing was corrupted here and nothing changed when the failures stopped.

Happy to attach sanitized transcript excerpts or run any diagnostic that helps.

Begin at the unified exec, filesystem sandbox helper, and JS tool kernel launch paths, then trace their shared CreateProcessWithLogonW handling under concurrent sessions. Reproduce with three or more sessions and batched sandboxed commands on Windows 11 build 26200; done means transient 1907 failures no longer surface as terminal launch errors, with the relevant behavior covered by validation or diagnostics.