Codex Desktop Windows: Sandbox Accounts Stuck in PasswordExpired State Causing CreateProcessWithLogonW Error 1907

What version of the Codex App are you using (From “About Codex” dialog)?

26.814.5517.0

What subscription do you have?

ChatGPT Business

What platform is your computer?

Microsoft Windows [Version 10.0.26200.9168] x64

What issue are you seeing?

Codex Desktop for Windows is unable to execute any local sandbox command. The issue affects all local projects on this device and occurs before any repository-specific operation starts. Even a basic command such as Get-Location fails.

The current Codex error is:

execution error: Io(Custom {
    kind: Other,
    error: "windows sandbox: CreateProcessWithLogonW failed: 1907"
})

### What steps can reproduce the bug?

1. Launch the Codex Desktop app on the affected Windows device.

2. Open any existing local project/repository. The issue is not repository-specific and occurs across all local projects tested.

3. Start a Codex task that requires local sandbox execution. A basic PowerShell operation such as `Get-Location` is sufficient to reproduce the issue.

4. Codex attempts to initialize/refresh the Windows sandbox. The sandbox log shows:

   `setup refresh: spawning ...\codex-windows-sandbox-setup.exe`

   followed by:

   `setup refresh: processed 3 write roots (read roots delegated); errors=[]`

   and:

   `setup binary completed`

5. Codex then attempts to execute the command using the local `CodexSandboxOffline` account.

6. Windows rejects the sandbox logon and Codex returns:

   `windows sandbox: CreateProcessWithLogonW failed: 1907`

7. Windows Security Event ID 4625 is generated at the same time with:

   - Account: `CodexSandboxOffline`
   - Logon Type: `2`
   - Failure Reason: `The specified account's password has expired.`
   - Status: `0xC0000224`
   - Logon Process: `seclogo`

8. Querying the Codex-managed local accounts through ADSI shows:

   `CodexSandboxOffline  PasswordExpired = 1`

   `CodexSandboxOnline   PasswordExpired = 1`

The issue reproduces consistently for local shell/file operations and persists after restarting Codex and rebooting Windows.

Additional troubleshooting already performed:

- Removed/excluded the affected endpoint from the applicable Intune DeviceLock/EAS policy.
- Confirmed Windows MDM Event ID 819 deleted the DeviceLock settings.
- Confirmed the EAS policy registry state changed to `1=0, 2=0`.
- Rebooted Windows.
- Confirmed both sandbox accounts remain `PasswordExpired = 1`.
- Confirmed Codex's own sandbox `setup refresh` completes with `errors=[]` but does not repair the account state.

We have intentionally not reset/delete the sandbox accounts or modify `.sandbox-secrets`, because we do not want to desynchronize Codex's stored credentials from the corresponding Windows SAM credentials.

### What is the expected behavior?

Codex should be able to initialize its Windows sandbox and execute local commands/files without `CreateProcessWithLogonW` failing.

If `CodexSandboxOffline` or `CodexSandboxOnline` enters a password-expired / must-change-password state, Codex's Windows sandbox provisioning process should detect that the sandbox identity is unusable and safely repair or re-provision the account together with its corresponding Codex-managed credentials.

After a successful sandbox setup/refresh, a basic local command such as `Get-Location` should execute successfully instead of returning error 1907.

Ideally, Codex should recover from this condition without requiring the user to delete their `.codex` profile, sessions, memories, configuration, or manually modify the application-managed sandbox accounts.

### Additional information

### Additional technical information

This issue is also currently escalated through OpenAI Support to the specialized team.

**Codex Feedback ID:**  
`019fb9e1-4885-7810-ac4a-d713c7cd2dac`

### Environment

- Codex Desktop package: `OpenAI.Codex_26.814.5517.0_x64__2p2nqsd0c76g0`
- Windows: x64, Microsoft Entra joined and Intune managed
- Device authentication status: `SUCCESS`
- TPM protected: `YES`
- Issue affects local sandbox execution across all tested local projects
- One user/device is confirmed affected so far

### Windows sandbox accounts

Both Codex-created accounts exist:

```text
CodexSandboxOffline
CodexSandboxOnline

Start by reproducing the failure with a basic PowerShell command and compare the sandbox setup refresh output with the CreateProcessWithLogonW error 1907. Check the CodexSandboxOffline and CodexSandboxOnline account state and the related Windows Security Event ID 4625 details. Done means sandbox refresh safely handles password-expired accounts and Get-Location executes successfully without changing the user's profile or stored credentials.