Windows: "Couldn't check Windows setup" caused by malformed sandbox setting in config.toml

Summary

Codex for Windows was stuck on:

Couldn't check Windows setup
Try again to continue Windows setup

Reinstalling Codex and retrying the Windows setup did not solve the problem.

The issue was resolved by correcting the Windows sandbox setting in:

%USERPROFILE%\.codex\config.toml

Environment

• Windows 10 Pro
• Version: 22H2
• OS Build: 19045.6466
• Codex app: 26.903.9818.0

Error found in sandbox logs

The sandbox log repeatedly showed:

grant read ACE failed on C:\Program Files\WindowsApps\OpenAI.Codex_...\app\resources for sandbox_group:
SetNamedSecurityInfoW failed: 5

setup error: read ACL run had errors

SetNamedSecurityInfoW failed: 5 indicates an Access Denied error while Codex was trying to configure sandbox permissions.

Important finding

The file:

%USERPROFILE%\.codex\config.toml

contained:

[windows]
sandbox = \"unelevated\"

The escaped quotes were literally present in the TOML file.

Changing it to:

[windows]
sandbox = "unelevated"

and restarting Codex immediately fixed the problem.

No reinstall, Windows update, WSL installation, or modification of C:\Program Files\WindowsApps permissions was required.

Steps that fixed it

1. Close Codex completely.
2. Open %USERPROFILE%\.codex\config.toml.
3. Check the [windows] section.
4. If it contains sandbox = \"unelevated\", change it to sandbox = "unelevated".
5. Save the file.
6. Restart Codex.

Codex then started normally.

Suggestion

It may be useful for Codex to validate config.toml on startup and either:

• automatically repair this malformed value, or
• display a clear configuration parsing error instead of repeatedly showing Couldn't check Windows setup.

This could prevent users from repeatedly reinstalling Codex while the actual problem is a malformed local configuration file.

Start by tracing Windows setup startup handling for %USERPROFILE%.codex\config.toml and reproduce the literal escaped quotes in the [windows] sandbox setting. Verify that Codex either rejects or repairs the malformed value with a clear configuration error instead of showing only "Couldn't check Windows setup".