Fix Codex CreateProcessWithLogonW Failed: 5 (1056/1326/1385/1909)

Paste your error / 粘贴报错原文

Paste an error to match it against the wiki. / 粘贴报错后自动匹配。

Error text / 报错原文

windows sandbox: CreateProcessWithLogonW failed: 5
CreateProcessWithLogonW failed: 1056
CreateProcessWithLogonW failed: 1326
CreateProcessWithLogonW failed: 1385
CreateProcessWithLogonW failed: 1909
windows sandbox: runner error: CreateProcessAsUserW failed: 5

What it means

Windows rejected Codex while it was creating a sandboxed process. The numeric Win32 code identifies the immediate failure, but the root cause may be stale sandbox setup, a helper-account state, local policy, or an ACL problem—not the command you asked Codex to run.

What each Windows code means

Code	Windows name	Meaning in a Codex report	Next check
5	ERROR_ACCESS_DENIED	Access was denied. The code alone does not identify which file, token, account, or policy caused it.	Inspect sandbox.log for the first denied operation; compare sandboxed and normal PowerShell execution.
1056	ERROR_SERVICE_ALREADY_RUNNING	A Codex report observed this alongside persistent sandbox setup and ACL failures. The generic service text is not a proven Codex root cause.	Restart Codex and inspect setup logs; do not stop unrelated Windows services.
1326	ERROR_LOGON_FAILURE	Windows labels this “user name or password is incorrect.” In Codex it can indicate the sandbox launch identity or stored helper state.	Capture logs and app version; on a managed PC, involve the administrator before changing policy.
1385	ERROR_LOGON_TYPE_NOT_GRANTED	The requested logon type is not granted on this computer.	Check local/domain policy with an administrator; avoid broad user-right assignments.
1909	ERROR_ACCOUNT_LOCKED_OUT	The referenced account is locked. A public Codex issue reports this variant for sandboxed commands.	Restart after updating; collect logs and let an administrator inspect the relevant sandbox identity on managed systems.

The Win32 label is the immediate result returned by Windows. It is evidence, not a complete Codex root-cause diagnosis.

Decision path: diagnose before changing permissions

1. Prove where the failure occurs

Run Get-Location in Codex and in a normal PowerShell window. If normal PowerShell works but Codex fails before any command output, focus on the Codex sandbox or runner—not your shell script.

2. Preserve evidence

Save the exact error, timestamp, Codex version, Windows build, sandbox mode, and a sanitized copy of sandbox.log. Search both the visible .codex tree and any .sandbox subdirectory because paths have varied across builds and reports.

3. Separate global from workspace-specific failure

Open a small Git-backed test folder under your normal user profile. If it works there, inspect ownership and inherited ACLs only on the failing workspace. If every folder fails, focus on app, runner, helper-account, or policy state.

4. Apply the narrowest matching fix

Update and restart first. Use a sandbox re-onboarding workaround only for the older experimental-sandbox symptom it was reported for. Escalate logon-right or account-lockout codes on managed machines instead of self-granting policy rights.

5. Verify end to end

Confirm a harmless read, a file listing, and a tiny Git-backed edit all work inside the intended sandbox. Then retry the original task and confirm no permissions were broadened outside the workspace.

Most common causes

Codex Windows sandbox initialization or re-onboarding state is stale
A sandbox helper account is locked, restricted, or not granted the requested logon type
A workspace path or child directory has unexpected ownership or ACL entries
The Codex local runner fails before PowerShell or the requested command starts
Enterprise security policy affects non-interactive or batch-style logon

Fastest fix

Record the exact function name, numeric code, Codex version, Windows build, sandbox mode, and whether the same harmless command works in an ordinary PowerShell window
Update Codex from its official distribution channel, restart it, and retry only a harmless read command
Find the Codex sandbox.log file and read the first setup or process-launch error, not only the last user-visible message
If the log names a workspace ACL path, reproduce in a new Git-backed folder owned by your normal user before changing any permissions
If an older Codex build shows a stale experimental sandbox onboarding state, consider the issue-reported re-onboarding workaround only after backing up config.toml

Safe fix

Treat code 5 as an access-denied symptom and use the sandbox log to locate the denied object or launch stage
Treat 1326, 1385, and 1909 as account or logon-policy signals; on managed devices, give the exact code and timestamp to the administrator
Treat 1056 as a possible stale helper or setup-state signal in this Codex context; do not stop unrelated Windows services based on the generic message alone
Keep the workspace in a short, user-owned path and preserve a Git commit or backup before testing ownership repair
Report a minimal reproduction with the Codex version, Windows version, sandbox mode, sanitized log excerpt, and whether execution outside the sandbox succeeds

What not to do

Do not grant Everyone full control over C:\, Program Files, WindowsApps, or your entire user profile
Do not recursively take ownership or run icacls repair commands until the log and an ownership inspection identify the exact affected tree
Do not disable antivirus, Controlled Folder Access, UAC, or enterprise policy globally as a first test
Do not delete the whole .codex directory before saving config and logs
Do not assume error 1326 means your interactive Microsoft-account password is wrong; Codex may be launching a separate sandbox identity

How to confirm the fix

Run the smallest reproducible command first, then retry the agent task only after authentication, quota, and tool discovery are stable.

codex --version
Get-ComputerInfo | Select-Object WindowsProductName, WindowsVersion, OsBuildNumber
Get-Location
whoami /all
Get-ChildItem -Path "$env:USERPROFILE\.codex" -Recurse -Filter sandbox.log -ErrorAction SilentlyContinue

About the reported workarounds

The OpenAI GitHub links below are public bug reports and reproductions, not universal fixes. Issue #9062 reports that re-running the older experimental Windows sandbox onboarding recovered one affected installation; other reports show different symptoms, including ACL ownership and local-runner failures.

Frequently asked questions

Should I run Codex as Administrator?

Not as the default fix. Elevation can hide the failing boundary and gives project commands more authority. First identify whether the failure is sandbox setup, workspace ACLs, or managed logon policy.

Can I delete the Codex sandbox account or the entire .codex folder?

Avoid doing that first. Preserve config and logs, update and restart, and use only a current, documented reset flow or a narrowly matched issue workaround.

Why does PowerShell work outside Codex?

That is useful evidence: it suggests the shell and workspace may be readable while the Codex sandbox process-launch path is failing before the command starts.

Does error 1326 prove my Microsoft account password is wrong?

No. It is the Win32 label for a logon failure, but the relevant identity may be Codex sandbox state rather than your interactive account. Use the sandbox log and device policy context.