Sharing a quick tip for anyone using Codex on Windows with a windows native sandbox.
I noticed that my Codex auto-review turn count was a little high in Codex Analytics. After some research, I found a few Windows settings that may help reduce unnecessary auto-reviews—saving usage and making Codex a bit faster.
In my case, Codex showed errors such as:
CryptUnprotectData failed
CreateProcessAsUserW failed
Access denied
These errors can indicate a Windows user-permission problem, rather than Codex actually needing full access to the computer.
1. Install PowerShell 7 using the MSI installer
Install PowerShell 7 using Microsoft’s official MSI installer, not the Microsoft Store version:
[Download PowerShell using Microsoft’s installation guide] - (Install PowerShell 7 on Windows - PowerShell | Microsoft Learn)
Look for the “Install the MSI package” section. WinGet might not work, so this is preferable.
The Store version uses a per-user executable under WindowsApps. Codex’s elevated sandbox runs commands through a separate restricted Windows user, which may not be able to access or launch that executable.
The MSI installs PowerShell system-wide under C:\Program Files, where the sandbox can access it. This can prevent “Access denied” errors and unnecessary auto-reviews.
After installation, open a new PowerShell window and run:
where.exe pwsh
pwsh -NoProfile -Command '$PSHOME'
The result should point to:
C:\Program Files\PowerShell\7\pwsh.exe
If it only shows a path containing Microsoft\WindowsApps, Windows is probably still using the Microsoft Store version.
2. Set up the elevated sandbox
Open PowerShell or a windows cmd prompt as Administrator and run:
codex sandbox setup --elevated --current-user
The elevated sandbox lets Codex work inside your repository while isolating it with restricted Windows users, filesystem boundaries, and network rules.
Note: This requires Codex CLI, if you need to install/update it, run:
npm install -g @openai/codex
3. Enable it in Codex
Open %USERPROFILE%\.codex\config.toml and add/update:
[windows]
sandbox = "elevated"
Restart Codex afterward.
This does not give Codex unrestricted access to your computer. It enables the stronger Windows sandbox and may prevent avoidable permission failures from triggering extra codex-auto-review calls.
More information: Codex Windows sandbox documentation
