Paste an error to match it against the wiki. / 粘贴报错后自动匹配。
Error text / 报错原文
SetNamedSecurityInfoW failed: 5grant read ACE failedWindowsApps
What it means
Codex tried to adjust read permissions for packaged resources under WindowsApps and Windows denied the ACL update.
Most common causes
- Microsoft Store package installed under protected WindowsApps ACLs
- The sandbox group cannot be granted the expected read ACE
- App update left packaged resources in a state Codex cannot access
- Running as a special account changes ACL behavior
Fastest fix
- Check whether a newer Store or direct installer build fixes the ACL issue
- Install the app from the official alternate channel if available
- Reboot after update before retrying
- Collect the exact package version and install location
Safe fix
- Prefer official reinstall over manual WindowsApps ACL edits
- Keep a copy of logs before uninstalling
- Use a normal user account for the app
- Avoid putting workspace data inside protected package directories
What not to do
- Do not take ownership of the entire WindowsApps directory
- Do not recursively change ACLs under Program Files
- Do not run unknown ACL repair scripts from issue comments
How to confirm the fix
Run the smallest reproducible command first, then retry the agent task only after authentication, quota, and tool discovery are stable.
Get-AppxPackage OpenAI.Codex | Select Name, Version, InstallLocation icacls "$env:ProgramFiles\WindowsApps"
Related errors
- code=3221225477 - Codex Windows desktop crashes on launch →
- CreateProcessWithLogonW failed: 5 - Codex Windows sandbox →
- MCP auth session does not refresh - Codex OAuth →
- Codex desktop unresponsive with long threads and MCP auto-start duplicates →
- You've hit your session limit / weekly limit - Claude Code →
- Prompt is too long - Claude Code context window →