[BUG] CoworkVMService (cowork-svc.exe) spams Windows Event Log with ~14,000 debug-level messages per hour

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

aThe Claude desktop app's background Windows service CoworkVMService (cowork-svc.exe) writes excessive debug/trace-level messages to the Windows Application Event Log — approximately 14,000 events per hour.

The service logs every internal RPC request/response and session lifecycle event as Event ID 1 (Information level):

• [Server] Received request: method=isGuestConnected
• - [Server] Client connected
• - - [Server] Session toufe:...\Claude has no active connections, idle timeout starts
• - - - [Server] Sent response: success=true
• - - - - [RPC] Received response: id=req-XXXXXX

The event source also lacks a registered message DLL, so Event Viewer displays "Incorrect function." instead of the actual message text (the real content is only visible via PowerShell Get-EventLog).

Impact:

• ~14,000 events/hour floods the Application log, crowding out legitimate entries from other applications
• - Makes Event Viewer unusable for diagnosing other application issues
• - - Unnecessary disk I/O from continuous event log writes

Service details:

• Binary: C:\Program Files\WindowsApps\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
• - Display name: "Claude"
• - - Runs as LocalSystem, AUTO_START
• - - - Service type: WIN32_PACKAGED_PROCESS

What Should Happen?

aDebug/trace-level messages (RPC calls, client connections, session lifecycle) should be written to a dedicated log file or suppressed entirely — not to the Windows Application Event Log.

Only significant events (service start/stop, errors, warnings) should be logged to the Event Log.

The event source should also register a proper message DLL so Event Viewer can display the messages correctly instead of showing "Incorrect function."

Error Messages/Logs

PS> (Get-EventLog -LogName Application -Source CoworkVMService -After (Get-Date).AddHours(-1)).Count
13932

PS> Get-EventLog -LogName Application -Source CoworkVMService -Newest 5 | Select-Object TimeGenerated, Message | FL

TimeGenerated : 3/7/2026 11:07:01 PM
Message       : [Server] Received request: method=isGuestConnected

TimeGenerated : 3/7/2026 11:07:01 PM
Message       : [Server] Client connected

TimeGenerated : 3/7/2026 11:07:00 PM
Message       : [Server] Session toufe:...\Claude has no active connections, idle timeout starts

TimeGenerated : 3/7/2026 11:07:00 PM
Message       : [Server] Sent response: success=true

TimeGenerated : 3/7/2026 11:07:00 PM
Message       : [RPC] Received response: id=req-104653

Event Viewer shows "Incorrect function." for all entries due to missing message DLL.

Service config:
SERVICE_NAME: CoworkVMService
TYPE: WIN32_PACKAGED_PROCESS
START_TYPE: AUTO_START
BINARY_PATH_NAME: C:\Program Files\WindowsApps\Claude_1.1.4498.0_x64__pzs8sxrjxfjjc\app\resources\cowork-svc.exe
DISPLAY_NAME: Claude
SERVICE_START_NAME: LocalSystem

Steps to Reproduce

a1. Install Claude desktop app from Microsoft Store (version 1.1.4498.0 or similar)

1. Let the app run — the CoworkVMService service starts automatically
2. 3. Open Windows Event Viewer → Application log
3. 4. Observe hundreds of Event ID 1 entries from source "CoworkVMService" logged per minute
4. 5. In Event Viewer, the message shows "Incorrect function." — run PowerShell to see actual content:
5. ```
6. Get-EventLog -LogName Application -Source CoworkVMService -Newest 10 | Select-Object TimeGenerated, Message | FL
7. ```
8. 6. Count events in the last hour:
9. ```
10. (Get-EventLog -LogName Application -Source CoworkVMService -After (Get-Date).AddHours(-1)).Count
11. ```

Claude Model

None

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

N/A — this is the Claude desktop app (Windows Store), not Claude Code CLI. App version: 1.1.4498.0

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

Windows Terminal

Additional Information

Note: This bug report is for the Claude desktop app's Windows service, not Claude Code CLI. Filing here as there doesn't appear to be a separate repo for the Claude desktop app.

The service name is CoworkVMService but its display name is "Claude". It runs as a packaged Windows service (WIN32_PACKAGED_PROCESS) installed via the Microsoft Store version of the Claude desktop app.

Windows 11 Pro 10.0.26200