›_ Claude Code Issues
Claude Code Issues / #56341

[BUG] Cowork's `spawnLocalProcess` fails immediately with `errno: -4094, code: 'UNKNOWN', syscall: 'spawn'` on enterprise Windows machines with WDAC (Windows Defender Application Control) kernel-mode enforcement enabled.

Resolved 💬 2 comments Opened May 5, 2026 by cheezizyummy Closed Jun 27, 2026

Preflight Checklist

  • [x] I have searched existing issues and this hasn't been reported yet
  • [x] This is a single bug report (please file separate reports for different bugs)
  • [x] I am using the latest version of Claude Code

What's Wrong?

What's Wrong?

Cowork's spawnLocalProcess fails immediately with errno: -4094, code: 'UNKNOWN', syscall: 'spawn' on enterprise Windows machines with WDAC (Windows Defender Application Control) kernel-mode enforcement enabled. Cowork is completely non-functional on affected machines — every session fails at initialization.

Environment

  • OS: Windows 11 Enterprise, Intune Autopilot enrolled
  • Hardware: ThinkPad P14s Gen 6 AMD
  • Claude Desktop: MSIX package Claude_1.5354.0.0_x64__pzs8sxrjxfjjc
  • Claude Code SDK: 2.1.121
  • WDAC status: Kernel-mode enforced (SecurityServicesRunning: {2,3,4}, VirtualizationBasedSecurityStatus: 2)
  • HVCI: Enabled (UEFI-locked)

Steps to Reproduce

  1. Install Claude Desktop via MSIX on a Windows 11 machine with WDAC kernel-mode enforcement enabled
  2. Start any Cowork task
  3. Session fails immediately with spawn UNKNOWN

Verify WDAC status with:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus, CodeIntegrityPolicyEnforcementStatus

Affected machines have SecurityServicesRunning including 2 and VirtualizationBasedSecurityStatus = 2.

Error from main.log

[error] Session initialization failed: spawn UNKNOWN {
  errno: -4094,
  code: 'UNKNOWN',
  syscall: 'spawn',
  stack: 'Error: spawn UNKNOWN
    at ChildProcess.spawn (node:internal/child_process:441:11)
    at Object.spawn (node:child_process:810:9)
    at nXi.spawnLocalProcess (…index.js:235:2728)
    at nXi.initialize (…index.js:235:7165)'
}

Key Findings

The spawn never reaches the OS. Process Monitor shows zero Process Create events and zero filesystem access to the claude-code directory during spawn attempts. No Event ID 4688 is logged. The failure occurs inside libuv's uv_spawn before CreateProcessW is called, returning an unmapped NTSTATUS that surfaces as UV_UNKNOWN.

The VM is healthy. Boots successfully, network connected, API reachable, SDK installs. host_loop_mode: true — failure is on the host side only.

claude.exe is valid. Properly signed (Anthropic EV cert via DigiCert, valid), executes fine from PowerShell with a full token (--version → exit 0). Fails silently (exit 1, no output) under a limited token via runas /trustlevel:0x20000.

Spawn target paths only exist in the MSIX-virtualized filesystem:

# From sdkOptions logged before each failure:
executable: 'C:\Users\...\AppData\Roaming\Claude\claude-code\2.1.121\claude.exe'
cwd:        'C:\Users\...\AppData\Roaming\Claude\local-agent-mode-sessions\...\outputs'

# Neither path exists at the real filesystem location — only at:
# %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\...

Creating a symlink at the real path did not resolve the issue.

Ruled Out

The following were fully investigated and confirmed NOT to be the cause:

  • AppLocker (AllowedByDefault, no Event ID 866 blocks)
  • ASR rules (16 rules, all Audit mode)
  • WDAC user-mode enforcement (not enforced, status 0)
  • WDAC enforcement blocks (no Event ID 3077 or 3089)
  • Exploit Protection / DisallowChildProcessCreation (OFF on Claude Desktop)
  • Defender / SmartScreen (no blocks logged)
  • Git Bash, WSL, CLAUDE_CODE_GIT_BASH_PATH (all configured, did not fix)
  • HVCI Intune exemption (UEFI-locked, could not disable, did not fix)
  • Binary signature (valid Anthropic EV cert)
  • Environment block (40 vars, 1925 chars, no control characters)
  • MSIX manifest (has runFullTrust, unvirtualizedResources, localSystemServices)

Separate Packaging Defect

The Claude MSIX package is missing AppxMetadata\CodeIntegrity.cat — the entire AppxMetadata directory is absent. Microsoft's own MSIX packages (e.g. Windows Calculator) include this file. Windows logs repeated Event ID 3010 errors ("unable to load catalog, STATUS_OBJECT_PATH_NOT_FOUND") timed to each Cowork attempt.

Note: CodeIntegrity.cat validates PE files inside the MSIX package, not external binaries, so this is unlikely to be the direct cause of the spawn failure. It is a separate packaging defect that should be corrected regardless.

Questions for Anthropic Engineering

  1. Why does uv_spawn fail before CreateProcessW is called on WDAC kernel-enforced machines? What NTSTATUS is actually being returned?
  2. Does spawnLocalProcess account for MSIX filesystem virtualization when constructing the spawn target path and cwd?
  3. Does the MSIX container assign a limited token to the child process during spawn? claude.exe exits silently under a limited token.
  4. What is the specific interaction between WDAC kernel enforcement and the Electron/Node.js spawn call that causes the failure?

Impact

Affects all Intune Autopilot-enrolled enterprise machines with WDAC kernel enforcement — a standard enterprise security baseline. Cowork is completely non-functional on these machines. Chat and all non-Cowork features work normally.

What Should Happen?

What's Wrong?

Cowork's spawnLocalProcess fails immediately with errno: -4094, code: 'UNKNOWN', syscall: 'spawn' on enterprise Windows machines with WDAC (Windows Defender Application Control) kernel-mode enforcement enabled. Cowork is completely non-functional on affected machines — every session fails at initialization.

Environment

  • OS: Windows 11 Enterprise, Intune Autopilot enrolled
  • Hardware: ThinkPad P14s Gen 6 AMD
  • Claude Desktop: MSIX package Claude_1.5354.0.0_x64__pzs8sxrjxfjjc
  • Claude Code SDK: 2.1.121
  • WDAC status: Kernel-mode enforced (SecurityServicesRunning: {2,3,4}, VirtualizationBasedSecurityStatus: 2)
  • HVCI: Enabled (UEFI-locked)

Steps to Reproduce

  1. Install Claude Desktop via MSIX on a Windows 11 machine with WDAC kernel-mode enforcement enabled
  2. Start any Cowork task
  3. Session fails immediately with spawn UNKNOWN

Verify WDAC status with:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus, CodeIntegrityPolicyEnforcementStatus

Affected machines have SecurityServicesRunning including 2 and VirtualizationBasedSecurityStatus = 2.

Key Findings

The spawn never reaches the OS. Process Monitor shows zero Process Create events and zero filesystem access to the claude-code directory during spawn attempts. No Event ID 4688 is logged. The failure occurs inside libuv's uv_spawn before CreateProcessW is called, returning an unmapped NTSTATUS that surfaces as UV_UNKNOWN.

The VM is healthy. Boots successfully, network connected, API reachable, SDK installs. host_loop_mode: true — failure is on the host side only.

claude.exe is valid. Properly signed (Anthropic EV cert via DigiCert, valid), executes fine from PowerShell with a full token (--version → exit 0). Fails silently (exit 1, no output) under a limited token via runas /trustlevel:0x20000.

Spawn target paths only exist in the MSIX-virtualized filesystem:

# From sdkOptions logged before each failure:
executable: 'C:\Users\...\AppData\Roaming\Claude\claude-code\2.1.121\claude.exe'
cwd:        'C:\Users\...\AppData\Roaming\Claude\local-agent-mode-sessions\...\outputs'

# Neither path exists at the real filesystem location — only at:
# %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\...

Creating a symlink at the real path did not resolve the issue.

Ruled Out

The following were fully investigated and confirmed NOT to be the cause:

  • AppLocker (AllowedByDefault, no Event ID 866 blocks)
  • ASR rules (16 rules, all Audit mode)
  • WDAC user-mode enforcement (not enforced, status 0)
  • WDAC enforcement blocks (no Event ID 3077 or 3089)
  • Exploit Protection / DisallowChildProcessCreation (OFF on Claude Desktop)
  • Defender / SmartScreen (no blocks logged)
  • Git Bash, WSL, CLAUDE_CODE_GIT_BASH_PATH (all configured, did not fix)
  • HVCI Intune exemption (UEFI-locked, could not disable, did not fix)
  • Binary signature (valid Anthropic EV cert)
  • Environment block (40 vars, 1925 chars, no control characters)
  • MSIX manifest (has runFullTrust, unvirtualizedResources, localSystemServices)

Separate Packaging Defect

The Claude MSIX package is missing AppxMetadata\CodeIntegrity.cat — the entire AppxMetadata directory is absent. Microsoft's own MSIX packages (e.g. Windows Calculator) include this file. Windows logs repeated Event ID 3010 errors ("unable to load catalog, STATUS_OBJECT_PATH_NOT_FOUND") timed to each Cowork attempt.

Note: CodeIntegrity.cat validates PE files inside the MSIX package, not external binaries, so this is unlikely to be the direct cause of the spawn failure. It is a separate packaging defect that should be corrected regardless.

Questions for Anthropic Engineering

  1. Why does uv_spawn fail before CreateProcessW is called on WDAC kernel-enforced machines? What NTSTATUS is actually being returned?
  2. Does spawnLocalProcess account for MSIX filesystem virtualization when constructing the spawn target path and cwd?
  3. Does the MSIX container assign a limited token to the child process during spawn? claude.exe exits silently under a limited token.
  4. What is the specific interaction between WDAC kernel enforcement and the Electron/Node.js spawn call that causes the failure?

Impact

Affects all Intune Autopilot-enrolled enterprise machines with WDAC kernel enforcement — a standard enterprise security baseline. Cowork is completely non-functional on these machines. Chat and all non-Cowork features work normally.

Error Messages/Logs

## Error from main.log


[error] Session initialization failed: spawn UNKNOWN {
  errno: -4094,
  code: 'UNKNOWN',
  syscall: 'spawn',
  stack: 'Error: spawn UNKNOWN
    at ChildProcess.spawn (node:internal/child_process:441:11)
    at Object.spawn (node:child_process:810:9)
    at nXi.spawnLocalProcess (…index.js:235:2728)
    at nXi.initialize (…index.js:235:7165)'
}

Steps to Reproduce

Preflight Checklist

  • [x] I have searched existing issues and this hasn't been reported yet
  • [x] This is a single bug report
  • [x] I am using the latest version of Claude Desktop (1.5354.0.0)

What's Wrong?

Cowork's spawnLocalProcess fails immediately with errno: -4094, code: 'UNKNOWN', syscall: 'spawn' on enterprise Windows machines with WDAC (Windows Defender Application Control) kernel-mode enforcement enabled. Cowork is completely non-functional on affected machines — every session fails at initialization.

Environment

  • OS: Windows 11 Enterprise, Intune Autopilot enrolled
  • Hardware: ThinkPad P14s Gen 6 AMD
  • Claude Desktop: MSIX package Claude_1.5354.0.0_x64__pzs8sxrjxfjjc
  • Claude Code SDK: 2.1.121
  • WDAC status: Kernel-mode enforced (SecurityServicesRunning: {2,3,4}, VirtualizationBasedSecurityStatus: 2)
  • HVCI: Enabled (UEFI-locked)

Steps to Reproduce

  1. Install Claude Desktop via MSIX on a Windows 11 machine with WDAC kernel-mode enforcement enabled
  2. Start any Cowork task
  3. Session fails immediately with spawn UNKNOWN

Verify WDAC status with:

Get-CimInstance -ClassName Win32_DeviceGuard -Namespace root\Microsoft\Windows\DeviceGuard |
    Select-Object SecurityServicesRunning, VirtualizationBasedSecurityStatus, CodeIntegrityPolicyEnforcementStatus

Affected machines have SecurityServicesRunning including 2 and VirtualizationBasedSecurityStatus = 2.

Error from main.log

[error] Session initialization failed: spawn UNKNOWN {
  errno: -4094,
  code: 'UNKNOWN',
  syscall: 'spawn',
  stack: 'Error: spawn UNKNOWN
    at ChildProcess.spawn (node:internal/child_process:441:11)
    at Object.spawn (node:child_process:810:9)
    at nXi.spawnLocalProcess (…index.js:235:2728)
    at nXi.initialize (…index.js:235:7165)'
}

Key Findings

The spawn never reaches the OS. Process Monitor shows zero Process Create events and zero filesystem access to the claude-code directory during spawn attempts. No Event ID 4688 is logged. The failure occurs inside libuv's uv_spawn before CreateProcessW is called, returning an unmapped NTSTATUS that surfaces as UV_UNKNOWN.

The VM is healthy. Boots successfully, network connected, API reachable, SDK installs. host_loop_mode: true — failure is on the host side only.

claude.exe is valid. Properly signed (Anthropic EV cert via DigiCert, valid), executes fine from PowerShell with a full token (--version → exit 0). Fails silently (exit 1, no output) under a limited token via runas /trustlevel:0x20000.

Spawn target paths only exist in the MSIX-virtualized filesystem:

# From sdkOptions logged before each failure:
executable: 'C:\Users\...\AppData\Roaming\Claude\claude-code\2.1.121\claude.exe'
cwd:        'C:\Users\...\AppData\Roaming\Claude\local-agent-mode-sessions\...\outputs'

# Neither path exists at the real filesystem location — only at:
# %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\...

Creating a symlink at the real path did not resolve the issue.

Ruled Out

The following were fully investigated and confirmed NOT to be the cause:

  • AppLocker (AllowedByDefault, no Event ID 866 blocks)
  • ASR rules (16 rules, all Audit mode)
  • WDAC user-mode enforcement (not enforced, status 0)
  • WDAC enforcement blocks (no Event ID 3077 or 3089)
  • Exploit Protection / DisallowChildProcessCreation (OFF on Claude Desktop)
  • Defender / SmartScreen (no blocks logged)
  • Git Bash, WSL, CLAUDE_CODE_GIT_BASH_PATH (all configured, did not fix)
  • HVCI Intune exemption (UEFI-locked, could not disable, did not fix)
  • Binary signature (valid Anthropic EV cert)
  • Environment block (40 vars, 1925 chars, no control characters)
  • MSIX manifest (has runFullTrust, unvirtualizedResources, localSystemServices)

Separate Packaging Defect

The Claude MSIX package is missing AppxMetadata\CodeIntegrity.cat — the entire AppxMetadata directory is absent. Microsoft's own MSIX packages (e.g. Windows Calculator) include this file. Windows logs repeated Event ID 3010 errors ("unable to load catalog, STATUS_OBJECT_PATH_NOT_FOUND") timed to each Cowork attempt.

Note: CodeIntegrity.cat validates PE files inside the MSIX package, not external binaries, so this is unlikely to be the direct cause of the spawn failure. It is a separate packaging defect that should be corrected regardless.

Questions for Anthropic Engineering

  1. Why does uv_spawn fail before CreateProcessW is called on WDAC kernel-enforced machines? What NTSTATUS is actually being returned?
  2. Does spawnLocalProcess account for MSIX filesystem virtualization when constructing the spawn target path and cwd?
  3. Does the MSIX container assign a limited token to the child process during spawn? claude.exe exits silently under a limited token.
  4. What is the specific interaction between WDAC kernel enforcement and the Electron/Node.js spawn call that causes the failure?

Impact

Affects all Intune Autopilot-enrolled enterprise machines with WDAC kernel enforcement — a standard enterprise security baseline. Cowork is completely non-functional on these machines. Chat and all non-Cowork features work normally.

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.121 (Claude Code)

Platform

Other

Operating System

Windows

Terminal/Shell

Non-interactive/CI environment

Additional Information

_No response_

View original on GitHub ↗

This issue has 2 comments on GitHub. Read the full discussion on GitHub ↗