Windows sandbox runner fails to spawn any local command with CreateProcessAsUserW failed: 1312 on Windows 11 24H2

Summary

On Windows 11 Pro (Build 26100.8655), Codex CLI 0.143.0 starts normally and MCP servers work, but every local shell command fails before PowerShell starts.

The failure is reproducible with the simplest command (pwd) and always fails in the Windows sandbox runner with:

windows sandbox: runner failed during SpawnChild:
CreateProcessAsUserW failed: 1312
(A specified logon session does not exist. It may already have been terminated.)

Environment

• Codex CLI: 0.143.0
• Windows 11 Pro
• OS Build: 26100.8655
• PowerShell: 7.6.3
• Sandbox configuration:

[windows]
sandbox = "elevated"

Steps to reproduce

1. Start Codex.
2. Run:

pwd

(or any command such as dir, Get-Location, cmd /c cd).

Expected behavior

The command executes and returns the current directory.

Actual behavior

Every command fails with:

windows sandbox: runner failed during SpawnChild:
CreateProcessAsUserW failed: 1312
(A specified logon session does not exist. It may already have been terminated.)

The runner never reaches PowerShell.

Additional investigation

• MCP servers work correctly (Engram, etc.).
• The issue is independent of the current working directory.
• It reproduces in both the user home directory and project directories.
• The issue persists after updating to 0.143.0.
• Initially there were multiple Codex installations (pnpm and npm). The environment was cleaned and the active CLI is now 0.143.0.
• The previous /nix/store configuration issue was resolved and is unrelated.
• Temporarily disabling Microsoft Defender did not consistently resolve the issue.
• codex-command-runner-0.143.0.exe exists and starts, but process creation fails when spawning child commands.

If there are any diagnostics or additional logs I can provide, I'm happy to test them.