Windows setup fails before the UAC prompt, and both setup options are non-functional

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

• #31134

Powered by Codex Action

Tried reinstall, OS restart and "Run as administrator", nothing helps.
The last update made the app completely broken.

The issue was resolved by using CC Switch to first switch to a third-party API, and then switch back to the official subscription.

请问你是怎么解决的这个问题呀 我也遇到了一模一样的问题

Turned out these messages in UI were misleading and the root cause was incorrect value in <user>/.codex/.config.toml.
I backed up the whole .codex directory and deleted it. Then the app started working and I asked an agent to try to find the faulty values and it did.

Deleting everything in C:/Users/username/.codex and reinstalling the app fixed it. I had nothing to lose, because it was the first time I tried installing. Do NOT do this unless you're sure you have nothing in there you're deleting that you need. I don't know what's specifically stored in there.

I ran into the same issue. Codex had been working fine until I added the following entry to ~/.codex/config.toml:

``` toml
[projects.'C:\Users\jhc20\Documents\codex_projects\web']
trust_level = "trustesd"

The problem was caused by the typo in trustesd; the correct value should be trusted. After I removed this entry, Codex started working again.

Therefore, this UAC-related setup screen may be triggered by an invalid entry in ~/.codex/config.toml, rather than by an actual UAC or Windows permission problem. The app should ideally display the configuration parsing error instead of redirecting users to the Windows setup screen.

I am seeing the same Windows setup loop on a Windows 11 ARM64 Oracle Cloud VM over RDP.

Environment:

• Windows 11 ARM64 on Oracle Cloud
• ChatGPT installed from Microsoft Store package 9PLM9XGG6VKS
• Installed version shown by winget: 26.707.3748.0
• Publisher shown by winget: OpenAI
• Account is in the local Administrators group
• EnableLUA is

Update: moving %USERPROFILE%\.codex aside fixed the problem on this machine.

Command used:

if exist "%USERPROFILE%\.codex" ren "%USERPROFILE%\.codex" ".codex.bak-20260711"

After renaming the .codex directory, the ChatGPT Windows app entered normally. This confirms that, at least in this case, the "Complete Windows setup" / "Windows setup incomplete" screen was caused by something in the existing .codex state/config rather than Microsoft Store installation, UAC, or the official app package itself.

It would be helpful if the app surfaced the actual .codex config/state error instead of showing the Windows setup flow.

okay following the advice here let me login properly but has anyone figured out how to retrieve the old chats back? i have backed up the old .codex folder

I backed up ~/.codex/config.toml, then restarted the app so it could generate a new config file. The app is working normally again now.

Confirmed workaround on the Microsoft Store Windows app (version 26.707.3748.0). The app was stuck on Finish Windows setup: the screen showed a UAC illustration, but no real UAC prompt appeared, and retrying failed.

Renaming only the existing config file and restarting the app fixed it immediately:

$cfg = Join-Path $env:USERPROFILE '.codex\config.toml'
if (Test-Path $cfg) {
    $backupName = 'config.toml.bak-' + (Get-Date -Format 'yyyyMMdd-HHmmss')
    Rename-Item -Path $cfg -NewName $backupName
}

This is safer than deleting the entire .codex directory because it preserves sessions and other local state. After restart, the app generated a clean config and completed startup normally.

This further suggests that the Windows/UAC setup page can be triggered by an invalid, stale, or unparsable config.toml, rather than an actual Windows permission failure. It would help if the app surfaced the configuration parsing error directly.

Same problem with windows beta app, so both of them are broken.

The issue lies in config.toml. Switching the CC Switch to a third-party API and then back can fix it. I think the switching process forces a refresh that overwrites the content of config.toml, inadvertently fixing the problem. This method can preserve your settings and sessions.

The issue lies in config.toml. Switching the CC Switch to a third-party API and then back can fix it. I think the switching process forces a refresh that overwrites the content of config.toml, inadvertently fixing the problem. This method can preserve your settings and sessions.

kindly pin my comment if it solved the issue.

Fixed with Claude :D
In my case there was a duplicated line in Codex config (config.toml).
Take care, Codex can modify it and break itself.
Probably OpenAI should provide correct error's type.

Same issue here.

Windows ChatGPT/Codex app version: 26.707.9564.0
Platform: Windows x64

After today’s update I am stuck on the “Finish Windows setup” screen.

No real Windows UAC prompt appears.
“Retry Windows setup” fails/does nothing useful.
“Continue with limited access” also does nothing.
Running the app as administrator does not fix it.

The app is completely unusable because it cannot get past this setup screen.

Same issue here. Windows ChatGPT/Codex app version: 26.707.9564.0 Platform: Windows x64 After today’s update I am stuck on the “Finish Windows setup” screen. No real Windows UAC prompt appears. “Retry Windows setup” fails/does nothing useful. “Continue with limited access” also does nothing. Running the app as administrator does not fix it. The app is completely unusable because it cannot get past this setup screen.

Confirmed workaround on the Microsoft Store Windows app (version 26.707.3748.0). The app was stuck on Finish Windows setup: the screen showed a UAC illustration, but no real UAC prompt appeared, and retrying failed.

Renaming only the existing config file and restarting the app fixed it immediately:

$cfg = Join-Path $env:USERPROFILE '.codex\config.toml'
if (Test-Path $cfg) {
$backupName = 'config.toml.bak-' + (Get-Date -Format 'yyyyMMdd-HHmmss')
Rename-Item -Path $cfg -NewName $backupName
}

This is safer than deleting the entire .codex directory because it preserves sessions and other local state. After restart, the app generated a clean config and completed startup normally.

This further suggests that the Windows/UAC setup page can be triggered by an invalid, stale, or unparsable config.toml, rather than an actual Windows permission failure. It would help if the app surfaced the configuration parsing error directly.

I found a working workaround for this issue.

Environment:

• Windows 10 Home 22H2, build 19045
• ChatGPT/Codex desktop app 26.707.6957.0
• The app was stuck on “Finish Windows setup”
• No real UAC prompt appeared
• Retry and limited-access mode did not work
• Reinstalling/resetting the app did not help

Workaround:

1. Fully close the ChatGPT/Codex desktop app.
2. Open CC Switch.
3. Select the Codex tab.
4. Select the built-in “OpenAI Official” provider.
5. Click Enable / Use.
6. Reopen the ChatGPT/Codex desktop app.
7. Click “Finish Windows setup” again.

After switching Codex back to “OpenAI Official”, the real Windows setup process worked and I was able to enter the app normally.

Before this, my Codex configuration had previously been connected to a custom provider. CC Switch appears to have rewritten or normalized the Codex provider configuration.

This is only a workaround. I have not yet confirmed exactly which config field causes the setup page to fail.

<img width="1090" height="760" alt="Image" src="https://github.com/user-attachments/assets/1427bd96-19c1-405e-96da-efaa759c7c67" />

<img width="902" height="632" alt="Image" src="https://github.com/user-attachments/assets/afd54250-50d9-4c4d-9b71-e6cefe2635dc" />

<img width="1090" height="760" alt="Image" src="https://github.com/user-attachments/assets/d2342612-06f1-43c5-a0cd-537913b43949" />

Confirmed workaround on Windows 11 with the Microsoft Store ChatGPT/Codex app.

Environment:

• Windows 11 x64
• Microsoft Store product: 9PLM9XGG6VKS
• Installed package: OpenAI.Codex_26.707.9981.0_x64__2p2nqsd0c76g0

Symptoms:

• App was stuck on Complete Windows setup / Windows setup incomplete.
• Retry Windows setup only looped back to the same screen.
• Continue with limited access had no effect.
• Uninstalling/reinstalling the app did not fix it.
• AppX deployment logs showed successful Stage/Register operations and the package status was Ok.

What fixed it:

1. Fully close ChatGPT/Codex.
2. Back up the existing Codex config.
3. Rename only %USERPROFILE%\.codex\config.toml so the app starts without that config.
4. Reopen the desktop app.

PowerShell example:

Get-Process ChatGPT,Codex -ErrorAction SilentlyContinue | Stop-Process -Force

$cfg = "$HOME\.codex\config.toml"
$stamp = Get-Date -Format "yyyyMMdd-HHmmss"

if (Test-Path $cfg) {
    Copy-Item $cfg "$cfg.backup-$stamp"
    Rename-Item $cfg "config.toml.disabled-$stamp"
}

After this, the app opened normally immediately.

In this case, config.toml had previously been modified to add a custom model_instructions_file entry. I did not isolate whether that exact line was the only trigger, so the safer conclusion is that an existing or incompatible ~/.codex/config.toml can incorrectly send the Windows app into the misleading setup/UAC loop.

Important: renaming only config.toml is safer than deleting the whole .codex directory, because it preserves local history, sessions, and other state. The app should ideally surface the actual config parse/compatibility error instead of showing the Windows setup screen.

The issue was resolved by using CC Switch to first switch to a third-party API, and then switch back to the official subscription.

works

I've discovered another critical root cause for the "Finish Windows setup" hang (where the UAC prompt never triggers) that is related to authentication rather than Windows privileges or system features.

The Underlying Issue

If your user session has expired or the OAuth refresh token has been revoked, the desktop app fails to fetch the cloud configuration bundle (cloudConfigBundle) during startup:

failed to load configuration: Your access token could not be refreshed because your refresh token was revoked. Please log out and sign in again.

This causes the backend windowsSandbox/setupStart call to fail with a 401 Unauthorized / Auth error. Instead of displaying a prompt to log out and log in again, the Desktop UI incorrectly routes this error to the "Finish Windows setup" gate, making it appear as a permissions/sandbox setup failure.

This explains why some users find that resetting or deleting config.toml doesn't work for them: if the underlying cause is a revoked OAuth session in auth.json, the cloud config fetch will fail regardless of whether config.toml is clean.

The Fix / Workaround

To break the loop and force the app to show the login screen:

1. Close the ChatGPT/Codex Desktop application completely.
2. Open File Explorer and navigate to your user profile directory: %USERPROFILE%\.codex (usually C:\Users\<username>\.codex).
3. Locate the file named auth.json.
4. Rename auth.json to auth.json.bak (or delete it).
5. Relaunch the ChatGPT/Codex app.

The app will now detect that no login session exists, skip the sandboxing gate, and successfully route you to the Sign In screen. Once you log back in, a fresh OAuth session will be established, and the app will open normally.

通过备份.codex,重启电脑后删除整个.codex,再重装chatgpt然后在ccs更换成官方订阅,验证chatgpt正常后新建ccs供应商解决这个问题
我认为出现这个问题的本质原因是config.toml以及auth.json文件出现错误 chatgpt无法检测到有效的配置误以为是未完成安装导致,所以根据上述的方法对这两个文件进行强制初始化 对于原有的.codex文件被删除可以让codex根据备份文件进行恢复

I updated Codex on Windows and afterward it wouldn’t get past the launch screen. Renaming:

C:\Users\<username>\.codex\config.toml

to config.toml.bak got the app running again, but then all my projects were missing from the sidebar.

Thankfully, nothing was actually deleted. The projects were still on disk, and the old Codex tasks were still in the database. The problem was the project-list state stored in the .codex folder.

Before trying anything, completely close Codex and make a backup of:

C:\Users\<username>\.codex

Inside that folder, look for files with names similar to:

..codex-global-state.json.tmp-1782073535967-xxxxxxxx

Find the newest one from before the update. That should be an older snapshot of the sidebar/project state.

The part that initially tripped me up is that Codex keeps two copies of its global state:

.codex-global-state.json
.codex-global-state.json.bak

Restoring only the first one doesn’t work. When Codex starts, it can replace it using the .bak file, making it look like the recovery did nothing.

With Codex fully closed, open Command Prompt and run the following, replacing the username and snapshot filename:

copy /Y "C:\Users\<username>\.codex\YOUR_SNAPSHOT_FILE" "C:\Users\<username>\.codex\.codex-global-state.json"

copy /Y "C:\Users\<username>\.codex\YOUR_SNAPSHOT_FILE" "C:\Users\<username>\.codex\.codex-global-state.json.bak"

Then reopen Codex. My old projects appeared in the sidebar again.

I can reproduce this exact problem in the new ChatGPT/Codex Windows desktop app.

Environment

• ChatGPT app version: 26.715.10079.0
• Windows 11 Home, version 25H2
• OS build: 26200.8875
• Subscription: ChatGPT Plus
• UI language: Dutch
• The signed-in Windows account is a member of the local Administrators group.

Actual behavior

1. The app shows “Windows-configuratie voltooien” (Finish Windows setup).
2. Clicking “Configuratie voltooien” does not open a real Windows UAC prompt.
3. The app immediately reports “De Windows-configuratie is niet voltooid” (Windows configuration was not completed).
4. Clicking “Windows-configuratie opnieuw proberen” repeats the same failure.

Troubleshooting already attempted

• Repairing and resetting the app in Windows Settings
• Uninstalling and reinstalling the app
• Restarting Windows
• Launching ChatGPT with Run as administrator
• Confirming that the Windows user account has administrator rights

CodexSandboxOnline and CodexSandboxOffline accounts already exist and remain members of CodexSandboxUsers; they were not modified.

The issue persists after a clean reinstall, so this appears to be a setup-helper/UAC launch failure rather than missing administrator rights.

Chiming in from a Windows 10 box (22H2 19045.6466), app OpenAI.Codex 26.721.3996.0.

TL;DR: the app-server couldn't deserialize my ~/.codex/config.toml, silently fell back to default settings (which use the elevated Windows sandbox), and the elevated sandbox setup then fails while granting a read-ACL on the app's own files under C:\Program Files\WindowsApps (TrustedInstaller-locked → SetNamedSecurityInfoW returns error 5 / ACCESS_DENIED). Net effect: the app is wedged on the Windows-setup screen.

---

Layer 1 — config silently ignored ("using defaults")

From the app-server log (~/.codex/logs_2.sqlite, table logs):

ERROR codex_app_server: Invalid configuration; using defaults.
  <USERPROFILE>\.codex\config.toml:164:1: invalid type: sequence, expected struct HooksToml

A [[hooks]] array-of-tables in my config (added by a third-party tool) isn't valid for this build's schema — it expects a hooks struct. So the app-server discards the entire config, including [windows] sandbox = "unelevated". The trap: the popular "set sandbox = "unelevated"" workaround silently does nothing while this error is present. The file is valid TOML syntactically (a tomllib/toml parser accepts it) — it's a schema mismatch, so it's easy to miss. The same error also fires on every account/read / getAuthStatus reload.

Layer 2 — elevated sandbox setup can't complete

With config defaulted, the app requires the elevated sandbox and loops windowsSandbox/setupStart. The helper (codex-windows-sandbox-setup.exe, validly signed) does everything except the final read-ACL grant:

read ACL run completed with errors: ["grant read ACE failed on
  C:\Program Files\WindowsApps\OpenAI.Codex_<version>\app\resources
  for sandbox_group: SetNamedSecurityInfoW failed: 5"]      // 5 = ACCESS_DENIED
setup error: read ACL run had errors

→ persisted to ~/.codex/.sandbox/setup_error.json as { "code": "helper_unknown_error", "message": "read ACL run had errors" }. %ProgramFiles%\WindowsApps\... DACLs are owned by NT SERVICE\TrustedInstaller; an elevated admin still can't rewrite them without taking ownership. In my logs this failed 432×, only ever on ...\app\resources; everything else (sandbox users/group, firewall rules) succeeds, and there are zero ShellExecuteExW / ERROR_CANCELLED (1223) / ERROR_ELEVATION_REQUIRED (740) markers.

---

Fix that worked for me

1. Make the config load cleanly — check the logs for Invalid configuration; using defaults and remove/repair the offending entry (for me: delete the [[hooks]] block from ~/.codex/config.toml).
2. Set [windows] sandbox = "unelevated" (now that it's actually honored).
3. Delete the stale ~/.codex/.sandbox/setup_error.json (keep setup_marker.json).

Relaunch → setup screen gone, app usable. Steps 2–3 alone did nothing until step 1 was fixed.

To check for Layer 1: search the app log (~/.codex/logs_2.sqlite, logs table) for Invalid configuration; using defaults — any hit means your config is being dropped and the sandbox mode you set isn't applied.

Suggested fixes

• Don't hard-block onboarding on an unparseable config, and don't fail silently — surface the parse error, and/or still honor known keys like windows.sandbox when other keys are invalid.
• In the sandbox helper, don't fail the whole setup on the WindowsApps read-ACL — those dirs are already readable to the sandbox accounts via BUILTIN\Users / the package SID; skip/soft-fail on %ProgramFiles%\WindowsApps\..., or take ownership before SetNamedSecurityInfoW.
• Clear/rewrite setup_error.json on a successful/deferred setup so a stale error doesn't wedge onboarding across updates.

(Root-caused with Claude Code — full read-only investigation and a reversible fix.)

Turned out these messages in UI were misleading and the root cause was incorrect value in <user>/.codex/.config.toml. I backed up the whole .codex directory and deleted it. Then the app started working and I asked an agent to try to find the faulty values and it did.

I'm seeing a similar issue on Windows 11 Business 25H2 with ChatGPT Desktop v26.721.4979.0. The app became permanently stuck on "Finish Windows setup". Both "Finish Windows setup" and "Continue with limited access" were non-responsive. Reinstalling, repairing, and resetting did not help. Deleting/renaming %USERPROFILE%\.codex\config.toml immediately resolved the problem.

I am experiencing the same blocking Windows setup failure.

I have already updated my system BIOS and verified that this is not a firmware issue.

Since updating the BIOS:

• Windows speech-to-text now works again.
• My MOTU audio interface now works correctly at 48 kHz.
• The operating system is stable.

The only remaining blocker is the Codex desktop application's Windows setup loop described below.

Environment

• Product: Unified ChatGPT/Codex Windows desktop app
• Installed package: OpenAI.Codex
• Package version observed: 26.727.6591.0
• Package full name: OpenAI.Codex_26.727.6591.0_x64__2p2nqsd0c76g0
• OS: Windows 11 Pro
• Windows version/build: 10.0.26200, x64
• Subscription: ChatGPT Pro
• Windows account: Local account, member of Administrators
• Elevation verified: Mandatory Label\High Mandatory Level
• Virtualization-based security: Running
• Hypervisor-enforced Code Integrity: Running
• VirtualMachinePlatform: Enabled

Actual behavior

1. I install and launch the current ChatGPT/Codex Windows desktop application.
2. The application opens to “Finish Windows setup.”
3. I click “Finish setup.”
4. No real Windows UAC prompt appears. The UAC dialog displayed in the application is only an illustration.
5. The application returns to “Windows setup didn’t finish.”
6. Clicking “Try Windows setup again” repeats the same loop.
7. Clicking “Continue with limited access” only makes that option disappear; it does not open the application.
8. Codex remains completely unusable, so it cannot access or work with my local repositories.

Expected behavior

“Finish setup” should launch the actual elevated setup helper, display a real UAC prompt, complete the Windows sandbox/integration setup, and open Codex.

If elevated setup fails, “Continue with limited access” should open Codex with reduced permissions instead of leaving the application unusable.

Troubleshooting already completed

• Confirmed the Windows user is an administrator.
• Confirmed administrator elevation works normally outside the app.
• Ran the installer as Administrator.
• Unblocked the downloaded installer in Windows file properties.
• Repaired the app through Windows App Settings.
• Reset the package using:

Get-AppxPackage OpenAI.Codex | Reset-AppxPackage

• Uninstalled and reinstalled the application.
• Ended all Codex processes through Task Manager.
• Checked the Windows Application event log; no relevant Codex, .NET Runtime, or application-crash error appeared during the failed setup.
• Verified the package previously reported status and installation information normally through Get-AppxPackage.
• Confirmed that “Continue with limited access” is also non-functional.
• Found %USERPROFILE%\.codex\config.toml and renamed it to config.toml.backup as a diagnostic precaution. However, the application had already been uninstalled at that point, so this workaround has not yet been tested against a fresh installed package.

Important impact

This is not merely preventing use of the ChatGPT desktop interface. It completely blocks Codex from accessing and editing local development repositories, which stops my development workflow.

Please provide either:

1. A corrected Windows desktop build;
2. A supported command-line method to complete or bypass the broken setup gate;
3. A supported Codex CLI installation path that preserves local-repository functionality while the desktop setup bug is unresolved; or
4. Instructions for collecting the specific setup-helper or sandbox logs needed by the engineering team.

I can provide screenshots of:

• “Finish Windows setup”
• “Windows setup didn’t finish”
• The non-functional “Continue with limited access” state
• The installed package information
• Windows version and virtualization/security configuration

<img width="1090" height="760" alt="Image" src="https://github.com/user-attachments/assets/429f37ec-29d7-4ce1-9cbb-446ad8913014" />

UPDATE SOLUTION FOUND

Possible Root Cause / Workaround (Solved on my system)

After spending nearly two full days troubleshooting this, I wanted to share what ultimately solved the problem on my Windows 11 Pro workstation. Hopefully this saves someone else a lot of time.

Symptoms

I was experiencing exactly the symptoms described in this issue:

"Finish Windows setup" looped indefinitely.
Clicking Finish setup either returned to the same screen or displayed "Windows setup didn't finish."
Continue with limited access did nothing.
The desktop application was unusable.
Because Codex could not initialize, I had no access to my local Git repositories.
Things that were NOT the root cause

I ruled out a number of possibilities before finding the actual issue.

I verified or completed all of the following:

Updated ASUS ProArt Z790-CREATOR WIFI BIOS from 2703 → 3107
Windows Memory Diagnostic passed
No WHEA hardware errors
Administrator privileges verified
Repaired and reinstalled the application multiple times
Reset the package
Renamed config.toml
Investigated Codex logs
Investigated Event Viewer
Verified Windows security/UAC functionality

Interestingly, the BIOS update fixed several unrelated issues (speech recognition, MOTU 48 kHz audio, and general stability), but it did not resolve the Codex setup loop.

The breakthrough

The clue came from the installer itself.

When the installer attempted to finish setup, it redirected me toward Microsoft Store.

However...

Clicking View in Store did absolutely nothing.

Running:

Win + R
ms-windows-store:

produced:

We can't open this 'ms-windows-store' link.
Your device needs a new app to open this link.

That should never happen on a healthy Windows installation.

Diagnosis

Running:

Get-AppxPackage Microsoft.WindowsStore

returned nothing.

However:

Get-AppxPackage -AllUsers Microsoft.WindowsStore

returned the Store package, but it showed:

PackageUserInformation:
S-1-5-18 [S-1-5-18]: Staged

In other words:

Microsoft Store existed
but it was not registered for my user account
Fix

Re-registering the Microsoft Store package fixed the problem.

I ran:

$store = Get-AppxPackage -AllUsers Microsoft.WindowsStore
Add-AppxPackage -DisableDevelopmentMode -Register "$($store.InstallLocation)\AppxManifest.xml"

The command completed successfully with no output.

After that:

Win + R
ms-windows-store:

opened Microsoft Store correctly.

Result

After repairing the Store registration:

"Finish Windows setup" completed successfully.
ChatGPT opened normally.
Codex launched normally.
I was able to create/open Codex projects.
Codex successfully attached to my local Git repositories again.
Additional finding

While investigating the issue, I also discovered that my original:

%USERPROFILE%\.codex\config.toml

had become corrupted.

The file consisted almost entirely of zero bytes, and Codex logs repeatedly contained:

Invalid configuration; using defaults.
C:\Users\<user>\.codex\config.toml
key with no value, expected '='

This may have been caused by earlier system crashes.

However, this was NOT the blocker that prevented the setup loop from completing.

The application continued to fail until the Microsoft Store registration was repaired.

Recommendation

If you're seeing this setup loop, before spending hours reinstalling Codex or Windows, check whether the Microsoft Store protocol is functioning:

Win + R
ms-windows-store:

If that doesn't open Microsoft Store, verify whether the Store package is registered for your user account.

Repairing that registration completely resolved the setup loop on my system.