[BUG] Cowork Windows 11 Pro: Persistent HcnCreateEndpoint 0x800706bf failures, ghost NAT entries, macOS diagnostics on Windows

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

[BUG] Cowork Windows 11 Pro: Persistent HcnCreateEndpoint 0x800706bf failures, ghost NAT entries, macOS diagnostics on Windows

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Cowork on Windows 11 Pro experiences frequent connection drops and workspace startup failures that are not recoverable without a full system reboot. Standard troubleshooting (service restarts, HNS resets, workspace reinstalls) does not resolve the issue. This makes Cowork effectively unusable for sustained work sessions on a Max plan.

Three interrelated bugs observed:

Bug 1: HcnCreateEndpoint fails with HRESULT 0x800706bf

After a session disconnection (typically a socket closure), Cowork cannot restart the workspace. The error failed to create network endpoint: HcnCreateEndpoint failed with HRESULT 0x800706bf persists through:

• Restarting HNS and vmcompute services
• Removing and recreating HNS networks
• Deleting HNS state (C:\ProgramData\Microsoft\Windows\HNS\HNSData)
• Reinstalling the workspace

Only a full system reboot clears the stale endpoint state.

Bug 2: Ghost NAT entries — cannot create or remove WinNAT rules

Get-NetNat returns empty, but New-NetNat fails with Windows System Error 52 ("duplicate name exists"). The HNS network has an internal NatName property (NAT82AC83CC-...) that conflicts at the OS level but is invisible to WinNAT management cmdlets. Attempted workarounds:

• Remove-WmiObject on MSFT_NetNat — no effect
• Using a different NAT name — still fails (conflict is on the subnet prefix, not the name)
• Deleting HNSData and restarting HNS — ghost NAT reappears

Bug 3: Network diagnostics run macOS commands on Windows

The cowork_vm_node.log shows the diagnostic code attempting to run /sbin/ifconfig, /usr/sbin/scutil, /usr/sbin/kextstat, and /usr/bin/pgrep — all macOS binaries that don't exist on Windows. The output is labeled "Comprehensive macOS Diagnostics." This means when networking fails, the app gathers zero useful diagnostic information to aid recovery or bug reporting.

This appears to be the same issue as #25024 (CSP fix carried to macOS but not Windows), still present in v1.1.3918.

Error Messages/Logs

HcnCreateEndpoint failure (from cowork_vm_node.log)

2026-02-21 20:30:50 [error] [VM:start] VM boot failed: failed to create network endpoint: HcnCreateEndpoint failed with HRESULT 0x800706bf

macOS diagnostics running on Windows (from cowork_vm_node.log)

2026-02-21 20:30:45 [info] [networkDiagnostics] === Comprehensive macOS Diagnostics ===
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /sbin/ifconfig: Error: Failed to spawn /sbin/ifconfig: spawn /sbin/ifconfig ENOENT
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /usr/bin/pgrep: Error: Failed to spawn /usr/bin/pgrep: spawn /usr/bin/pgrep ENOENT
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /usr/sbin/scutil: Error: Failed to spawn /usr/sbin/scutil: spawn /usr/sbin/scutil ENOENT
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /usr/sbin/kextstat: Error: Failed to spawn /usr/sbin/kextstat: spawn /usr/sbin/kextstat ENOENT

Ghost NAT (PowerShell)

PS> Get-NetNat
# (empty)

PS> New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
# Error 52: duplicate name exists

PS> New-NetNat -Name "cowork-nat-fix" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
# Error 52: duplicate name exists (conflict is on subnet, not name)

Hyper-V Compute errors (Event Log)

Id: 11001
The specified property query is invalid: The virtual machine or container JSON document is invalid.
(0xC037010D, 'Invalid JSON document '$'').

VirtioFS mount failure (observed during recovery attempts)

RPC error -1: failed to ensure virtiofs mount: Plan9 mount failed: bad address

Steps to Reproduce

1. Use Cowork on Windows 11 Pro for a sustained work session (30+ minutes)
2. Wait for a socket disconnection: API Error: The socket connection was closed unexpectedly
3. Attempt to start a new Cowork task — fails with HcnCreateEndpoint 0x800706bf
4. Restart HNS/vmcompute services — still fails
5. Remove HNS networks and HNSData — still fails
6. Only a full system reboot recovers

Expected Behavior

• Cowork should maintain stable connections for sustained work sessions
• If a connection drops, Cowork should recover without manual intervention
• Service restarts should clear stale networking state without requiring a reboot
• Network diagnostics should use Windows-appropriate commands (ipconfig, netsh, Get-NetAdapter)
• WinNAT rules should be properly created and managed by the app

Environment

• OS: Windows 11 Pro x64
• Hardware: AMD Ryzen / Gigabyte X570 GAMING X
• BIOS: American Megatrends F30
• Claude Desktop: v1.1.3918
• Hyper-V: Enabled (full, Pro edition)
• Subscription: Max plan

Impact

As a Max plan subscriber, the constant disconnections and reboot requirement make it impossible to use Cowork for any sustained work. Most sessions end in a connection drop within 30-60 minutes, and recovery requires a full reboot cycle of 3-5 minutes plus workspace restart time. I estimate I'm unable to use more than half of my plan's capacity due to these interruptions.

Related Issues

• #25024 — CSP blocks a-api.anthropic.com, macOS diagnostics on Windows
• #24918 — Cannot connect to Claude API from workspace (Windows 11)
• #25308 — VM starts but API is UNREACHABLE on Windows 11
• #26510 — NAT rule creation fails with "duplicate name" error
• #25155 — VM boots but cannot reach Claude API, missing WinNAT rule

What Should Happen?

Expected Behavior

• Cowork should maintain stable connections for sustained work sessions
• If a connection drops, Cowork should recover without manual intervention
• Service restarts should clear stale networking state without requiring a reboot
• Network diagnostics should use Windows-appropriate commands (ipconfig, netsh, Get-NetAdapter)
• WinNAT rules should be properly created and managed by the app

Error Messages/Logs

HcnCreateEndpoint failure:
2026-02-21 20:30:50 [error] [VM:start] VM boot failed: failed to create network endpoint: HcnCreateEndpoint failed with HRESULT 0x800706bf

macOS diagnostics on Windows:
2026-02-21 20:30:45 [info] [networkDiagnostics] === Comprehensive macOS Diagnostics ===
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /sbin/ifconfig: Error: Failed to spawn /sbin/ifconfig: spawn /sbin/ifconfig ENOENT
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /usr/sbin/scutil: Error: Failed to spawn /usr/sbin/scutil: spawn /usr/sbin/scutil ENOENT
2026-02-21 20:30:45 [error] [networkDiagnostics] Failed to run /usr/sbin/kextstat: Error: Failed to spawn /usr/sbin/kextstat: spawn /usr/sbin/kextstat ENOENT

Ghost NAT (PowerShell):
PS> Get-NetNat
(empty)
PS> New-NetNat -Name "cowork-vm-nat" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
Error 52: duplicate name exists
PS> New-NetNat -Name "cowork-nat-fix" -InternalIPInterfaceAddressPrefix "172.16.0.0/24"
Error 52: duplicate name exists (conflict is on subnet prefix, not name)

Hyper-V Compute (Event Log):
Id: 11001 - The specified property query is invalid: The virtual machine or container JSON document is invalid. (0xC037010D, 'Invalid JSON document '$'').

Socket disconnection (triggers the cascade):
API Error: The socket connection was closed unexpectedly.

VirtioFS failure (during recovery attempts):
RPC error -1: failed to ensure virtiofs mount: Plan9 mount failed: bad address

Steps to Reproduce

Steps to Reproduce

1. Use Cowork on Windows 11 Pro for a sustained work session (30+ minutes)
2. Wait for a socket disconnection: API Error: The socket connection was closed unexpectedly
3. Attempt to start a new Cowork task — fails with HcnCreateEndpoint 0x800706bf
4. Restart HNS/vmcompute services — still fails
5. Remove HNS networks and HNSData — still fails
6. Only a full system reboot recovers

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

Claude Desktop v1.1.3918

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Max plan subscriber. The frequency of disconnections (every 30-60 minutes) and the reboot-only recovery path make Cowork unusable for sustained work on Windows. Happy to provide full cowork_vm_node.log files or gather additional diagnostics if needed.