[BUG] CoworkVMService floods Windows Event Viewer with thousands of EventID 1 "Incorrect function" entries per second while VM is running normally

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Environment

OS: Windows 11 Pro x64
Claude Desktop version: 1.1.3963 (latest as of 2026-02-22)
Hyper-V: Enabled (full)
Subscription: Max plan

What's Wrong?
CoworkVMService writes thousands of events per second to the Windows Application Event Log while Cowork is running normally. The events all show:

Event ID: 1
Source: CoworkVMService
Level: Information
Message: "Incorrect function." (localized: "Funzione non corretta." on Italian systems)

The VM is fully operational — cowork_vm_node.log confirms successful startup, CONNECTED network status, API reachability: REACHABLE, and Keepalive running normally. Despite this, the Event Viewer gets flooded with ~7-10 entries every second continuously.
Root Cause Analysis
The CoworkVMService (Go-based Windows service) does not register a proper Event Source with a message resource DLL in the Windows registry. The key HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\CoworkVMService does not exist.
When a Go service writes to the Windows Event Log without a registered EventMessageFile, Windows cannot resolve the message string for EventID 1 and falls back to interpreting it as Win32 error code 1 (ERROR_INVALID_FUNCTION = "Incorrect function").
I verified this by manually registering the event source:
powershellNew-Item -Path "HKLM:\SYSTEM\CurrentControlSet\Services\EventLog\Application\CoworkVMService"
New-ItemProperty -Path "..." -Name "EventMessageFile" -Value "%SystemRoot%\System32\netmsg.dll" -PropertyType ExpandString
New-ItemProperty -Path "..." -Name "TypesSupported" -Value 7 -PropertyType DWord
After registration, the real message became visible: [Server] Sent response: success=true — confirming the service is logging every single RPC keepalive response to the Event Log.
Two Issues

Missing Event Source registration: The service installer does not create the registry key for the event source, causing all messages to display as "Incorrect function."
Excessive logging verbosity: The service logs every RPC response (keepalive ping every 2 seconds, with multiple log entries per ping) to the Windows Event Log. This generates thousands of entries per minute and clutters the Application log, potentially hiding real errors from other applications.

What Should Happen?

Expected Behavior

CoworkVMService should register a proper Event Source with a message resource DLL during installation
Routine keepalive/RPC responses should NOT be written to the Windows Event Log — these should go to the application's own log file (cowork_vm_node.log) only
The Event Log should only receive significant events: startup, shutdown, errors, and warnings

Error Messages/Logs

EventID 1 "Incorrect function"

Steps to Reproduce

Steps to Reproduce

Install Claude Desktop on Windows 11 with Hyper-V enabled
Open Claude Desktop (Cowork VM starts automatically)
Open Event Viewer → Windows Logs → Application
Observe continuous flood of EventID 1 / "Incorrect function" from CoworkVMService

Claude Model

Opus

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

1.1.3963 (latest as of 2026-02-22)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Impact

Event Viewer Application log becomes unusable — real errors from other applications are buried
Continuous disk I/O from excessive event writing
Log file rotation/size limits are consumed by noise
Misleading "Incorrect function" message causes users to think something is broken when Cowork is working fine

Suggested Fix

Register the event source properly during service installation (add registry key with EventMessageFile and TypesSupported)
Reduce logging verbosity: only log errors/warnings to the Windows Event Log, keep debug/info messages in cowork_vm_node.log
Alternatively, use eventcreate or a proper message catalog .mc/.dll for the Go service

Related Issues

#25914 — CoworkVMService EventID 1 "Incorrect function" during HCS DLL initialization
#27010 — Cowork VM service not running on Windows 10 Pro
#25136 — yukonSilver marked as unsupported + CoworkVMService issues