Codex Windows setup didn't finish: helper_failed and UAC checks

Identify what failed

Before retrying, record the full message and the time of the attempt. Note whether Windows showed an administrator approval prompt and whether you approved it.

Observation	Next check	Interpretation
The prompt appeared and you declined it	Retry only if you intend and are permitted to approve setup	The required elevation was not granted.
No administrator prompt appeared	Capture the setup error and device policy context	Repeated clicking does not establish why the helper never requested elevation.
You approved the prompt, then saw helper_failed	Inspect the specific setup log error	Approval alone does not mean the helper completed its work.
The app opens in a fallback mode	Check the active sandbox mode and a harmless operation	Opening the app does not verify the stronger sandbox setup.

Fixes, by branch

If setup was declined or blocked by device policy

The official Windows sandbox guidance identifies administrator approval and policies affecting local users, groups, firewall configuration or sandbox-user logon rights as relevant setup prerequisites.

Retry the normal app setup once if you are allowed to approve it. On a managed computer, give IT the exact error and ask whether this setup is permitted. Do not turn off company protections or repeatedly run the entire app as administrator as a substitute for diagnosing the failed setup step.

Expected result: setup completes and the intended sandbox mode becomes usable. If it returns the same error, follow the corresponding branch below.

If no Windows approval prompt appears

Keep this distinct from a prompt you declined. A Windows report describes the setup flow failing to show UAC even though administrator prompts worked elsewhere.

Record the app build and exact error. If your organization controls elevation, include that fact in the report. Save your work and try one normal app relaunch; if the prompt still does not appear, stop repeating the setup loop and preserve the log from that attempt.

That observation does not justify changing permissions on Windows system profiles. Avoid copying a helper executable into an unrelated directory or downloading a replacement from a third-party site.

If the prompt succeeds but helper_failed remains

The generic label says a setup helper failed; the detailed error is what separates launch failure from a later filesystem or policy operation. Keep the first specific failure line and its timestamp rather than only the final banner.

A Windows 11 report had an installed package and a signed helper but still could not complete setup. Those checks confirm only part of the installation. They do not establish that permissions, process launch and sandbox initialization all succeeded.

If the error names a directory, record that path privately and identify whether it belongs to your Codex environment or a Windows-managed location. Do not apply a broad ownership or Full Control command copied from another machine. Repairing access control requires knowing the intended owner and permissions of the specific directory.

If you need the documented fallback

Official guidance offers the unelevated sandbox when elevated setup cannot complete. It has weaker isolation; it is a fallback, not proof that the original setup is fixed. Use it only when acceptable for your machine and organization, and follow the current official configuration instructions rather than assuming a button label in an old report maps to the same mode.

Full Access is not a synonym for successfully repairing the elevated sandbox. Changing to broader access should not be used simply to make the warning disappear.

How to tell it worked

Check the active mode, then ask Codex to perform a harmless read-only operation in the intended project, such as listing its top-level filenames without modifying them. A successful model reply with no local command execution does not test the command sandbox.

Record separately whether elevated setup completed, a fallback is in use, and the local operation succeeded. This makes remaining limitations clear.

What to collect if setup still fails

Keep the app build, Windows version, exact error, UAC outcome, timestamp and a small relevant sandbox-log excerpt. The official documentation identifies the sandbox log under CODEX_HOME/.sandbox/sandbox.log; use the home configured for this installation, not an assumed Windows or WSL path.

Redact credentials and unrelated private paths before sharing. Retain the original configuration and task history. These reports do not establish a universal fixed version, and repeated reinstallations or security disablement are not reliable substitutes for identifying the failing step.