›_ Codex Issues
Codex Issues / #35521

Windows Server 2025 Primary Domain Controller: CreateProcessWithLogonW fails with error 1385

Open 💬 3 comments Opened Jul 26, 2026 by MartialGui
💡 Likely answer: A maintainer (github-actions[bot], contributor) responded on this thread — see the highlighted reply below.

What version of the Codex App are you using (From “About Codex” dialog)?

26.721.4979.0

What subscription do you have?

ChatGPT Plus

What platform is your computer?

Microsoft Windows NT 10.0.26100.0 x64

What issue are you seeing?

Summary

Codex Desktop cannot execute any command when installed on a Windows Server 2025 Primary Domain Controller.

The application starts correctly and the sandbox initialization completes successfully, but command execution fails.

During troubleshooting I observed:

CreateProcessWithLogonW failed: 1385

and on another execution:

setup refresh failed to launch helper:
Access denied (os error 5)

Environment

  • Codex Desktop 26.721.4979.0
  • Windows Server 2025 Standard
  • Primary Domain Controller
  • DomainRole = 5
  • ChatGPT Plus

Investigation performed

The following checks were completed:

  • Sandbox initialization succeeds.
  • Firewall rules are created successfully.
  • Helper binaries are copied correctly.
  • codex-command-runner.exe is present and its digital signature is valid.
  • Workspace ACLs are applied successfully.
  • Sandbox accounts are created successfully.
  • Sandbox accounts exist as Active Directory users.
  • Both accounts are enabled.
  • Accounts are not locked.

Example (anonymized):

CN=CodexSandboxOffline,CN=Users,DC=EXAMPLE,DC=LOCAL
Enabled : True
SamAccountName : CodexSandboxOffline

The exported security policy on the Domain Controller contains:

SeInteractiveLogonRight =
*S-1-5-32-544
*S-1-5-32-548
*S-1-5-32-549
*S-1-5-32-550
*S-1-5-32-551
*S-1-5-9

The sandbox accounts are not listed in this privilege. Since the failure occurs around CreateProcessWithLogonW, this may be related, although I could not determine whether this is the expected privilege required by Codex.

A complete sandbox log is attached (anonymized where necessary).

Question

Is Codex Desktop officially supported on a Windows Server Primary Domain Controller?

If yes:

  • Is any additional security policy required?
  • Is there a recommended configuration for the sandbox accounts?

If not:

  • Could this limitation be documented?

I would be happy to perform additional tests or run a development build if it helps identify the issue.

What steps can reproduce the bug?

  1. Install Codex Desktop 26.721.4979.0 on Windows Server 2025 Standard configured as a Primary Domain Controller.
  1. Launch Codex Desktop.
  1. Open any local Git repository.
  1. Ask Codex to execute a simple command (for example "git status" or "list the current directory").
  1. The sandbox initializes successfully, but command execution fails.

What is the expected behavior?

Codex Desktop should execute the requested command successfully inside the Windows sandbox.

sandbox.2026-07-26.log

Additional information

_No response_

View original on GitHub ↗

3 Comments

github-actions[bot] contributor · 1 month ago

Potential duplicates detected. Please review them and close your issue if it is a duplicate.

  • #34314

Powered by Codex Action

MartialGui · 1 month ago

I reviewed #34314.

The CreateProcessWithLogonW failed: 1385 symptom is similar, but my environment is different:

  • Codex Desktop, not the VS Code extension
  • Windows Server 2025 Standard
  • Primary Domain Controller (DomainRole = 5)
  • The Codex sandbox accounts are created as Active Directory users
  • No elevated execution workaround is available or intended

Because Domain Controllers have different logon-right defaults and no conventional local SAM account model, I believe this may be a distinct environment-specific case.

I am therefore keeping this issue open unless a maintainer confirms that #34314 has the same root cause.

MartialGui · 1 month ago

After several more attempts, I have a new observation that may help narrow down the issue.

The problem does not seem to occur during code generation itself.

The model successfully generates the modifications, but the failure appears to happen when the patch is applied through the integrated apply_patch mechanism.

Observed behaviour:

The execution still fails with:
windows sandbox failed:
CreateProcessWithLogonW failed: 1385
Codex reports:

"No files were modified."

However, the UI simultaneously reports modified files such as:
CodexCommandBuilder.cs
CodexConfiguration.cs
CodexJsonParser.cs

with non-zero diff statistics.

Even more interesting:

newly created files (for example CodexJsonParser.cs) can still be opened in the diff viewer and contain fully generated C# code;
modifications to existing files sometimes appear as +0/-0 with "No content", despite the assistant reporting non-zero changes.

This suggests that:

the model successfully generates the patch;
the UI receives at least part of that patch;
the failure happens while applying the patch through the Windows sandbox;
the UI is left in a partially synchronized state.

So there may actually be two independent issues:

CreateProcessWithLogonW fails on Windows Server 2025 (error 1385);
after this failure, the editor UI can display an inconsistent patch state (partial diff available while the assistant reports that no files were modified).

Hopefully this helps identify whether the problem is in the Windows sandbox layer, the apply_patch helper, or the editor synchronization after a failed patch application.

Thank you.