Exact error
Match the message before using the fix
windows sandbox: CryptUnprotectData failed: 2148073483The application was unable to start correctly (0xc0000142)codex-windows-sandbox-setup.exe - Application ErrorQuick answer
Start here
Keep the two failures in sequence. The source report first saw `CryptUnprotectData failed: 2148073483`; after moving `.sandbox-secrets`, sandbox recreation failed because the setup executable returned `0xc0000142`. No durable fix is confirmed. If you already renamed the folder, close Codex and restore the original directory to return to the known DPAPI state. Do not delete the backup or apply generic DLL-repair advice to this branch.
Diagnosis
Why it happens
- The first error is Windows DPAPI code `0x8009000B` (`NTE_BAD_KEY_STATE`) while Codex reads its sandbox credential state.
- Moving the credential directory exposes a second recovery-path failure: the sandbox setup executable cannot initialize and exits with `0xc0000142`.
- Other Codex `0xc0000142` reports have different causes, including helper materialization and non-interactive Session 0 access; this page applies only when the DPAPI error came first.
Safest first
Fixes, in order
Confirm the two-stage signature
Applies when: Before changing credentials, DLLs, or sandbox files
The preceding DPAPI error is what distinguishes this open recovery branch from generic `0xc0000142` failures.
- Check whether the original Codex failure was exactly `CryptUnprotectData failed: 2148073483`.
- Confirm `0xc0000142` appeared only after `.sandbox-secrets` was moved or regenerated.
- Record Codex app version, Windows build, and the exact setup executable path.
- If there was no preceding DPAPI error, use a different `0xc0000142` diagnosis.
Expected: The failure is identified as the DPAPI recovery sequence rather than a generic DLL initialization error.
Restore the original sandbox-secrets directory
Applies when: When you already renamed the directory and the setup executable now fails with `0xc0000142`
The reporter confirmed that restoring the original directory returns Codex to the original, known DPAPI failure instead of leaving recovery in the second broken state.
- Quit every Codex window and confirm the app is no longer running.
- Keep the renamed directory intact as the only backup.
- Move it back to its exact original `.sandbox-secrets` name and location.
- Reopen Codex and confirm which of the two exact errors appears.
Expected: Codex returns to the original `CryptUnprotectData` error, preserving the credential state for further diagnosis.
Escalate without destructive credential reset
Applies when: The original DPAPI error remains after restoring the directory
Restart, reinstall, runtime-cache recreation, and an older config did not repair the source case.
- Preserve the `.sandbox-secrets` backup and record its file timestamps without opening secret contents.
- Capture the sandbox log and Windows Application event for the setup executable.
- Do not delete the credential directory, download replacement DLLs, or run registry cleaners.
- Track the linked open issues for a vendor-supported recovery path.
Expected: The unresolved case retains recoverable evidence and does not become a destructive credential-loss incident.
Verification
Prove the fix worked
- A real fix requires a harmless command such as `Get-Location` to run in the normal native Windows sandbox.
- Confirm neither DPAPI code 2148073483 nor setup error `0xc0000142` appears after a full app restart.
- Keep backups until a second session succeeds.
Escalation
If it still fails
- Do not assume all `0xc0000142` reports share the DPAPI cause.
- Do not publish or attach `.sandbox-secrets` contents; they are credential material.
- Record whether Codex runs interactively, through SSH/Session 0, or from a packaged WindowsApps installation because those contexts have separate known branches.
Scope
Environment and version notes
- The exact two-stage report used Codex Desktop 26.813.12317 on Windows 11 x64 build 26200.
- The issue remained open on August 20, 2026. Codex CLI 0.148.0 was current in npm, but Desktop and CLI version lines are not interchangeable.
- Sources rechecked August 20, 2026.
Evidence
Sources
Source labels describe the evidence available on the checked date. A closed issue is not automatically a shipped fix.
First-hand DPAPI-to-setup-error sequence, reversible folder restore, and failed troubleshooting list.
Related orphaned sandbox credential DPAPI report.
Separate setup-executable `0xc0000142` report illustrating that the code has multiple causes.