Cowork VM: HCS 0x80070005 (Access Denied) on Win11 25H2 - MSIX SYSTEM ACL missing

Environment

• OS: Windows 11 Pro 25H2 (Build 26200)
• Claude Desktop: 1.1.8359.0 (MSIX / Microsoft Store)
• CPU: 11th Gen Intel Core i5-1135G7 @ 2.40GHz
• System: Dell Latitude 3420
• Hyper-V: Enabled, hypervisor detected and running
• Hyper-V Administrators group: User is a member
• Services running: vmcompute, vmms, HvHost, CoworkVMService
• WSL2: Installed, Default Version 2, Ubuntu (Stopped)
• RAM: 16 GB
• Disk: 55 GB free / 235 GB total

Windows Features State

| Feature | State |
|---|---|
| VirtualMachinePlatform | Enabled |
| Microsoft-Hyper-V-All (all sub-features) | Enabled |
| HypervisorPlatform | Disabled |
| Containers | Disabled (was Enabled, disabled during troubleshooting) |
| Containers-HNS | Disabled |
| Containers-SDN | Disabled |
| Containers-DisposableClientVM | Disabled |

Bug Description

Cowork workspace fails to start with HRESULT 0x80070005 (Access Denied) at the create_vm_config step. The VM bundle is present and valid, all Hyper-V services are running, and the user is in the Hyper-V Administrators group. The auto-reinstall was already attempted once and is now being skipped.

Additionally, the SkillsFetcher is failing with EPERM errors when trying to write to the skills-plugin directory, suggesting broader MSIX VFS permission issues.

Error

[VM:start] VM boot failed: HCS operation failed: failed to create compute system:
HcsWaitForOperationResult failed with HRESULT 0x80070005:
{"Error":-2147024891,"ErrorMessage":"","Attribution":[{"OperationFailure":{"Detail":"Construct"}}]}

Steps to Reproduce

1. Open Claude Desktop (MSIX install)
2. Start a Cowork session
3. Error appears: "Failed to start Claude's workspace"
4. Restarting Claude does not resolve it
5. Reinstalling the workspace does not resolve it

Service Log Excerpt

2026-03-24 11:18:37 [info] [VM:start] Beginning startup, bundlePath=C:\Users\<username>\AppData\Roaming\Claude\vm_bundles\claudevm.bundle
2026-03-24 11:18:37 [info] [VM:start] Bundle version: fb30784dadb34104626c8cf6d8f90dd47cd393cc
2026-03-24 11:18:37 [info] [VM:start] VM instance ID: 788ca05b-d69b-483b-bdab-750fe5eebdf8
2026-03-24 11:18:37 [info] [VM:steps] download_and_sdk_prepare completed (7ms)
2026-03-24 11:18:37 [info] [VM:steps] load_swift_api completed (0ms)
2026-03-24 11:18:37 [info] [VM:start] Copying smol-bin.x64.vhdx to bundle
2026-03-24 11:18:37 [info] [VM:start] smol-bin.x64.vhdx copied successfully
2026-03-24 11:18:38 [info] [VM:start] Windows VM service configured
2026-03-24 11:18:38 [info] [VM:steps] create_network completed (1ms)
2026-03-24 11:18:38 [error] [VM:start] VM boot failed: HCS operation failed: failed to create compute system: HcsWaitForOperationResult failed with HRESULT 0x80070005
2026-03-24 11:18:38 [info] [VM:start] Skipping auto-reinstall (already attempted once)

Additional MSIX Permission Issues

The main.log also shows EPERM errors for the SkillsFetcher:

[error] [SkillsFetcher] Failed to write C:\Users\<username>\AppData\Roaming\Claude\local-agent-mode-sessions\skills-plugin\...\skills\doc-coauthoring.tmp.xxx\SKILL.md: EPERM: operation not permitted

This suggests the MSIX VFS path virtualization may be interfering with file operations. The app writes to C:\Users\<username>\AppData\Roaming\Claude\ but the real path is C:\Users\<username>\AppData\Local\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\. HCS may be receiving the VFS path instead of the real path when creating the compute system, causing the Access Denied error.

VM Bundle Files

All files present and valid (installed 2026-03-13):

• rootfs.vhdx: 9,208 MB
• rootfs.vhdx.zst: 2,219 MB
• initrd: 167 MB / initrd.zst: 164 MB
• vmlinuz: 14 MB / vmlinuz.zst: 14 MB
• sessiondata.vhdx: 4 MB (updated 2026-03-24)
• smol-bin.vhdx: 36 MB (updated 2026-03-24)

What I Tried

1. Multiple restarts of Claude Desktop
2. Restarting the PC
3. Auto-reinstall of workspace (ran once, now skipped on subsequent attempts)
4. Verified user is in Hyper-V Administrators group
5. Verified vmcompute, vmms, HvHost, and CoworkVMService are all running
6. VM bundle files are present and valid (see sizes above)
7. Disabled Containers feature (following #37068 workaround):

``
Disable-WindowsOptionalFeature -Online -FeatureName Containers -NoRestart
`
Feature now shows State: Disabled, but RestartNeeded: True`. Services restarted without reboot -- VM still fails.

1. Restarted HCS and Claude services without reboot:

``
net stop CoworkVMService && net stop vmcompute && net start vmcompute && net start CoworkVMService
``
Both services restarted successfully (RUNNING). No change.

1. Granted Full Control permissions for user on vm_bundles directory:

``
icacls "<vm_bundles_path>" /grant <user>:F /T
``
Successfully processed 16 files, 0 failures. No change.

1. Checked for .auto_reinstall_attempted flag -- file does not exist, not blocking reinstall.
2. Checked logs after all fixes -- Claude Desktop log directory is empty (no log files written), no relevant events in Windows Event Viewer (Application or Hyper-V Compute logs).
3. Discovered NT AUTHORITY\SYSTEM had no ACL on bundle directory. CoworkVMService runs as LocalSystem but the MSIX-virtualized path only had user permissions. Granted SYSTEM full control:

``
icacls "<vm_bundles_path>" /grant "SYSTEM:F" /T
``
This resolved the HCS 0x80070005 error. After this fix, the VM actually booted successfully:

• hcsdiag list showed cowork-vm in Running state
• coworkd.log confirmed: Hyper-V host detected, Plan9 share mounted, network configured, API reachability check passed (api.anthropic.com status=404), SDK installed, "connected, waiting for commands"
• cowork-service.log showed healthy RPC polling (isRunning every 2s with responses)

1. Despite the VM running, Claude Desktop still showed "Authenticating..." and eventually timed out with: "Failed to start Claude's workspace -- VM service not running. The service failed to start."

• CoworkVMService stopped silently (no error in logs)
• The VM was fully functional but the frontend never connected
• Credential Guard is active on this machine (SecurityServicesRunning: 2, VirtualizationBasedSecurityStatus: 2) -- may be interfering

Current State

The original HCS 0x80070005 is resolved by granting SYSTEM permissions. The remaining issue is that the Claude Desktop frontend fails to connect to the running VM and times out, causing the service to stop. The VM itself boots and runs correctly.

Related Issues

• #32574 (main tracking issue for Windows cowork failures)
• #33135 (duplicate of #32574)
• #37068 (similar HCS failure with Containers feature, MSIX VFS issues)

Notes

• Full reboot is still pending to finalize the Containers feature disable. Will update if reboot resolves it.
• The complete lack of log output after recent restarts (log directory empty, no Event Viewer entries) makes debugging very difficult and may be a separate issue.

Suggested Fixes

1. Resolve MSIX VFS path issue: Ensure HCS receives the real filesystem path (...\LocalCache\Roaming\Claude\...) instead of the virtualized path (...\AppData\Roaming\Claude\...) when creating the compute system
2. Pre-flight check for Containers feature: Detect if the Containers Windows feature is enabled and warn the user or adjust HCS config (per #37068)
3. Reset auto-reinstall flag: Allow users to manually trigger reinstall without the .auto_reinstall_attempted one-shot guard blocking it
4. Better error messaging: The current error gives no actionable guidance. Show which specific permission is missing or which path failed
5. Ensure logs are always written: Even on VM boot failure, logs should be persisted for debugging