Windows elevated sandbox setup fails on Windows 11 IoT Enterprise LTSC 2024 with helper_firewall_policy_ineffective

Windows elevated sandbox setup fails on Windows 11 IoT Enterprise LTSC 2024

Summary

The elevated native Windows sandbox setup repeatedly fails with helper_firewall_policy_ineffective. Choosing the fallback allows Codex to finish setup and operate with the unelevated sandbox.

Environment

• Codex desktop package: 26.903.8094.0, x64, Microsoft Store package status Ok
• Codex CLI: 0.153.4
• Actual OS release: Windows 11 IoT Enterprise LTSC 2024 (version 24H2, build 26100)
• A legacy registry compatibility value misleadingly reports Windows 10 IoT Enterprise LTSC 2024; it is not the authoritative product generation
• Edition ID: IoTEnterpriseS
• Composition edition ID: EnterpriseS
• Display version: 24H2
• Build: 26100.9445
• Agent environment: native Windows / PowerShell
• Latest retest configuration: [windows] sandbox = "elevated" (the setup still reports failure)
• VMware Workstation 25.0.0 is installed
• Windows VBS and HVCI are disabled
• codex doctor --summary reports the application installation, configuration, authentication, state databases, and desktop app-server as healthy.

Relevant system state

• Microsoft Defender Firewall service is running with automatic startup.
• Domain, Private, and Public firewall profiles are enabled.
• The device is not domain joined, Microsoft Entra joined, enterprise joined, or workplace joined.
• No Windows Firewall policy keys were found under HKLM\SOFTWARE\Policies\Microsoft\WindowsFirewall.
• No firewall MDM policy keys were found under HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Firewall.
• netsh advfirewall show allprofiles reports LocalFirewallRules: N/A (GPO-store only) for all three profiles.
• The Codex sandbox users and group were created successfully before the setup validation failed.

Exact error

helper_firewall_policy_ineffective
local firewall policy modifications do not apply to every current profile: LocalPolicyModifyState result=HRESULT(0x00000001)

The same error was recorded on every retry, including retries after checking all firewall profiles, selecting elevated in config.toml, approving UAC, and starting Codex with administrator privileges.

The computer was then fully restarted. After reboot, the setup was retried with administrator privileges and failed twice again with the same error. The most recent setup_error.json was updated at local time 2026-09-10 14:32:22. In the latest retest, the active configuration remained elevated after the setup failure. The Codex chat UI remained usable.

Reproduction

1. Install and start the Codex desktop app on the Windows edition above.
2. Accept the prompt to configure the elevated native Windows sandbox.
3. Approve the UAC prompt.
4. Setup creates or verifies the dedicated sandbox users.
5. Setup fails during firewall policy validation with helper_firewall_policy_ineffective.
6. Retry produces the same result.
7. Choosing the fallback completes application setup and changes the sandbox configuration to unelevated.

Expected result

The elevated sandbox should install successfully when Defender Firewall is enabled and the machine has no domain, MDM, or explicit firewall policy restrictions. If this Windows SKU is unsupported, the app should report a specific compatibility message.

Actual result

The elevated setup treats LocalPolicyModifyState = HRESULT(0x00000001) as fatal and cannot complete, despite no detected domain, MDM, or explicit Windows Firewall policy configuration. After the failure, selecting Skip allows Codex to continue with the fallback unelevated mode; this is a user-selected fallback, not a successful elevated installation.

Possible compatibility area

This may be a compatibility issue between the sandbox helper's firewall-policy validation and the IoTEnterpriseS / EnterpriseS LTSC SKU. VMware virtual network components are present, but no evidence currently shows that hardware virtualization or VMware directly caused the failure.

Latest retest clarification

After manually keeping [windows] sandbox = "elevated", restarting Codex, approving the setup flow, and receiving the same setup-failed message:

• The Codex chat UI remained usable and messages could still be sent.
• A normal Codex local command/tool launch failed before process creation with the same helper_firewall_policy_ineffective error.
• The same read-only command succeeded only when explicitly run outside the failed sandbox with user approval.
• Therefore, the setup failure does not make the whole desktop app unusable. The more precise impact is that sandboxed local command execution cannot initialize while this failure persists.

This corrects the earlier tentative assumption that the failure permanently prevented chat messages from being sent.

Privacy note

This report intentionally excludes the Windows username, email address, computer name, IP/MAC addresses, filesystem paths, Codex session/thread IDs, authentication information, and raw session transcripts. A narrowly reviewed sandbox log excerpt can be provided if required.

Begin by reproducing the elevated setup with [windows] sandbox = "elevated" on the reported Windows IoT Enterprise LTSC environment, then trace the helper_firewall_policy_ineffective validation and its LocalPolicyModifyState handling. Done means elevated setup succeeds under the stated conditions, or the app reports a specific unsupported-SKU compatibility message instead of failing generically.