Currently trying to deploy the ChatGPT app to multiple devices, it is listed as 9PLM9XGG6VKS in the Microsoft Store. Currently, the latest package returns:
OpenAI.Codex OpenAI.Codex_26.715.9079.0_x64__2p2nqsd0c76g0 when installed using
get-appxpackage openai | select name, packagefullname in PowerShell. I am able to deploy the application without issue, however users are not administrators and I am unable to complete the setup as it is prompting a UAC. Normally, these applications could be installed using SYSTEM, but in this case it doesn’t seem like this is an option to bypass this as the request is after the application is installed:
Does anyone have any ideas how this could be successfully deployed? It seems like there should be a way to give access to this in an enterprise environment without requiring local administrative rights.
Thank you.
VeitB
July 21, 2026, 8:53pm
2
Hi and welcome to the community!
I took a look at the existing issues in the official Codex repo, and I think these two are fairly close matches. You can also look through the other issues or create your own, of course.
I hope this helps get the issue fixed sooner rather than later.
opened 04:23PM - 02 Jun 26 UTC
bug
windows-os
mcp
sandbox
tool-calls
app
# Codex Desktop Windows: stdout capture broken and node_repl elevation failure f… or non-Administrator user accounts
**Filed by:** Kyle (ToastNightmare on GitHub)
**Date prepared:** 2026-06-03 00:18 GMT+8 (Australia/Perth)
**Codex version tested:** OpenAI.Codex 26.527.7698.0 x64 (Microsoft Store)
**Status:** Reproducible after clean reinstall
---
## Summary
Codex Desktop on Windows cannot reliably capture shell command output for users whose Windows account is not in the local Administrators group. Two distinct failure modes are present even after a clean Microsoft Store reinstall:
1. **Stdout capture failure**: Shell commands run via the sandbox-managed command-runner complete with exit code 0 and `SUCCESS:` in `sandbox.log`, but no output is returned to the chat UI.
2. **node_repl elevation failure**: The `node_repl` MCP server attempts to spawn `C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\<hash>\codex-windows-sandbox-setup.exe`, which requires elevation and fails with Windows error 740 (`ERROR_ELEVATION_REQUIRED`) for non-admin users.
This makes Codex Desktop unusable for production coding work for users following Windows security best-practice (running as standard user).
---
## Environment
- **OS**: Windows 11, build 10.0.26200.8524
- **Codex Desktop**: `OpenAI.Codex 26.527.7698.0 x64` (Microsoft Store)
- **User account**: Standard user (`whoami /groups` shows NOT a member of `BUILTIN\Administrators`)
- **PowerShell**: 5.1.26100 (system), 7.6.1 (Codex-bundled `pwsh`)
- **Node**: 24.14.0 system; 22.x bundled by Codex
- **Git**: 2.53.0.windows.1
- **pnpm**: 10.33.3 (via Codex wrapper)
- **Config**: `[windows] sandbox = "elevated"` (default after install)
- **Reinstall fully performed**: yes, from Microsoft Store, version bumped from 26.527.3686.0 to 26.527.7698.0
- **`.codex/` data**: preserved (not wiped)
---
## Reproduction
1. Sign into a Windows account that is NOT in the local Administrators group.
2. Install Codex Desktop from the Microsoft Store.
3. Open a fresh chat with a new worktree.
4. Run any shell command, e.g.:
```
pwd
git rev-parse --show-toplevel
git branch --show-current
git status --short
node -e "console.log('node-ok')"
cmd.exe /d /c "echo cmd-ok"
powershell -NoProfile -Command "Write-Output powershell-ok"
```
---
## Expected
- Each command returns its stdout in the chat UI.
- Tools that depend on subprocess output (file inspection, build verification, test runs, git status checks) work as documented.
---
## Actual
### Sandbox pipeline succeeds, output still missing
From `C:\Users\<user>\.codex\.sandbox\sandbox.2026-06-02.log` (timestamps GMT+8):
```
[2026-06-03 00:11:55.979] START: pwsh.cmd -NoProfile -Command try { ... } catch {}
[2026-06-03 00:11:56.068] setup refresh: spawning C:\Program Files\WindowsApps\OpenAI.Codex_26.527.7698.0_..\app\resources\codex-windows-sandbox-setup.exe
[2026-06-02T16:11:56.100] granting write ACE to C:\Users\Admin\.codex\worktrees\ed5c\app for sandbox group
[2026-06-02T16:11:56.106] read-acl-only mode: applying read ACLs
[2026-06-02T16:11:56.109] granting read ACE to C:\Users\Admin\AppData for sandbox users
[2026-06-02T16:12:06.721] applied deny ACE to protect C:\Users\Admin\.codex\worktrees\ed5c\app\.git
[2026-06-02T16:12:06.724] setup refresh: processed 2 write roots (read roots delegated); errors=[]
[2026-06-03 00:12:06.739] helper copy: validating command-runner
[2026-06-03 00:12:06.742] helper launch resolution: using copied command-runner path C:\Users\Admin\.codex\.sandbox-bin\codex-command-runner-0.136.0-alpha.2.exe
[2026-06-03 00:12:07.038] junction: created C:\Users\CodexSandboxOffline\.codex\.sandbox\cwd\55d0b68618c1c406 -> C:\Users\Admin\.codex\worktrees\ed5c\app
[2026-06-03 00:12:07.325] SUCCESS: pwsh.cmd ...
```
Sandbox bootstrap completes cleanly. Command-runner v0.136.0-alpha.2 is invoked. Write ACEs are granted. Junction is created. `SUCCESS:` is logged with exit code 0. **The chat UI shows blank output.**
### node_repl path still fails with elevation error
```
[2026-06-03 00:13:03.089] START: ...AppData\Local\OpenAI\Codex\bin\5b9024f90663758b\node.exe ... kernel.js --session-id ...
[2026-06-03 00:13:03.143] setup refresh: spawning C:\Users\Admin\AppData\Local\OpenAI\Codex\bin\716dda49c14d31a0\codex-windows-sandbox-setup.exe (cwd=C:\Users\Admin\.codex\worktrees\ed5c\app)
[2026-06-03 00:13:03.310] setup refresh: failed to spawn ...: The requested operation requires elevation. (os error 740)
[2026-06-03 00:13:27.453] START: ...same node.exe...
[2026-06-03 00:13:27.508] setup refresh: failed to spawn ...: requires elevation. (os error 740)
```
The AppData copy of `codex-windows-sandbox-setup.exe` has a manifest that requires Administrator elevation. UAC prompt does not appear (none can satisfy it without admin password the user does not have). `CreateProcess` returns ERROR_ELEVATION_REQUIRED. Reinstall renamed the hash subdir but did not change the manifest.
---
## Workarounds attempted (all unsuccessful)
- Restart Codex app (force-kill all 13-22 codex processes and relaunch)
- Backup + remove empty `setup_marker.json` (Codex regenerated but still with empty `read_roots`/`write_roots` in the marker file, despite runtime logs showing roots ARE being applied)
- Rename `codex-windows-sandbox-setup.exe` aside (Codex restored on next launch)
- Comment out `[windows]` section in config.toml (Codex disabled the entire sandbox-init code path, broke output capture differently)
- `[windows] sandbox = "default"` -- rejected: `unknown variant 'default', expected 'elevated' or 'unelevated'`
- `[windows] sandbox = "unelevated"` -- Codex accepts, skips sandbox bootstrap entirely, output capture remains blank
- Microsoft Store reinstall (version bump 26.527.3686.0 to 26.527.7698.0) -- bootstrap now works clean, output capture still broken
---
## Other observations
- Dual install pattern persists across reinstall: both `C:\Program Files\WindowsApps\OpenAI.Codex_...\` and `C:\Users\<user>\AppData\Local\OpenAI\Codex\bin\` are populated with `codex.exe`, `codex-windows-sandbox-setup.exe`, `codex-command-runner.exe`, plus older orphan hash subdirs from prior versions.
- `setup_marker.json` reports `read_roots: []`, `write_roots: []` even when runtime logs show 2 write roots were applied -- the marker file appears informational, not authoritative.
- Stale `codex-command-runner-*.exe` binaries accumulate in `C:\Users\<user>\.codex\.sandbox-bin\` (currently 7 different versions from 0.126 through 0.136-alpha.2).
---
## Requested fix
Either:
1. Provide a sandbox mode that produces working command-runner stdout capture without requiring Administrators-group membership, OR
2. Fix `sandbox = "unelevated"` to retain the command-runner IPC bridge, OR
3. Update `codex-windows-sandbox-setup.exe` so its AppData copy does not require elevation when invoked from a non-admin token, OR
4. Document the Administrators-group requirement clearly in install / first-run UI so users can self-diagnose.
---
## Logs available on request
- `C:\Users\Admin\.codex\.sandbox\sandbox.2026-06-02.log` (63KB, contains the full repro window 00:00 to 00:14)
- `C:\Users\Admin\.codex\config.toml` (current state, default `sandbox = "elevated"`)
- `C:\Users\Admin\.codex\.sandbox\setup_marker.json` (regenerated but empty roots in file)
A local copy of the sandbox log used to prepare this report is preserved and can be shared on request (it contains no credentials, just sandbox/spawn telemetry).
---
## Possibly related issues filed today
- #25876 - Windows sandbox fails with standalone CLI despite valid junction install layout (same `os error 740` + `spawn setup refresh`, CLI angle vs this report's desktop-app angle)
- #25877 - codex crashed itself and wsl2
- #25878 - Bundled plugins (chrome, browser, computer-use) become unavailable after Microsoft Store auto-update
Filing separately because the **stdout capture failure under `sandbox = "unelevated"` and after a healthy bootstrap with `sandbox = "elevated"`** is a distinct symptom from the above. Happy to merge / close as duplicate if maintainers determine it overlaps.
opened 06:31PM - 08 Mar 26 UTC
enhancement
windows-os
app
User Request
Feature
### What variant of Codex are you using?
App
### What feature would you like t… o see?
Many Windows users cannot easily install applications from the Microsoft Store due to system restrictions, corporate policies, offline environments, or personal preference for traditional installers.
Currently the Codex Windows app appears to be distributed only through the Microsoft Store. It would be very helpful if a standalone installer such as `codex-setup.exe` or `.msi` were provided.
Benefits of a standalone installer:
- Allows installation without Microsoft Store
- Works in offline or restricted enterprise environments
- Lets users choose the installation directory
- Easier automation and deployment (scripts, DevOps, package managers)
- Better compatibility with portable setups and custom Windows environments
Many developer tools provide both distribution methods (Store + standalone installer), which gives users more flexibility.
A simple downloadable installer from the GitHub releases page or official website would solve this.
Example:
```
codex-setup.exe
codex-x64.msi
```
### Additional information
Other developer tools commonly provide standalone installers alongside store versions, which improves accessibility for developers using custom setups or environments where the Microsoft Store is disabled.
Providing a traditional installer would make Codex easier to adopt across a wider range of developer environments.
Hello, @VeitB , I really appreciate your reply. These are similar in many ways, but do not seem to resolve a way to give users access to the elevated sandbox without being administrators to complete the install process as administrators through the UAC prompt. This poses issues from an enterprise deployment standpoint. I will try to add the concern on github. Thank you again.
