[BUG] Cowork VM silent boot failure on Windows 11 with VirtualMachinePlatform-only (no full Hyper-V) configuration

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Claude Desktop Code/Cowork tab crashes immediately on prompt submission with:

Claude Code process exited with code 3221225477

The application log repeatedly shows coder CLI not found on augmented PATH
every 30 seconds. The 2.2 GB Cowork VM bundle (vmlinuz + initrd) downloads
successfully from downloads.claude.ai, but the VM never boots.

Critically, no OS event log records this failure — neither Application
Error, Microsoft-Windows-CodeIntegrity/Operational, nor CodeIntegrity/
Verbose shows any related entry. This is a silent failure entirely inside
Claude Desktop.

Root cause identified: Cowork requires the full Hyper-V networking
stack (Get-NetNat, vmms service, cowork-vm-nat HNS network), but on
this endpoint only VirtualMachinePlatform is enabled. The full
Microsoft-Hyper-V-Hypervisor and Microsoft-Hyper-V-Services features
are disabled. This is the recommended enterprise security baseline
for endpoints that need WSL2 with minimal attack surface — it is not an
edge case.

Diagnostic evidence:

• Get-NetNat → "The specified class does not exist."
• Get-HnsNetwork | ? { $_.Name -eq "cowork-vm-nat" } → empty
• Get-Service vmms → service does not exist
• Get-Service vmcompute, hns → both Running (WSL2 works fine)
• WSL2 + Claude Code CLI 2.1.140 → works perfectly on the same endpoint

A comprehensive technical report with full diagnostic logs, rejected
hypotheses, and reproduction steps is attached as
Claude_Desktop_Cowork_Bug_Report.md. Please refer to it for complete
details.

Claude_Desktop_Cowork_Bug_Report.md

What Should Happen?

Either of the following would resolve this issue:

Option A — Pre-flight check with clear error message (lowest cost):
Before attempting to start the Cowork VM, Claude Desktop should verify
that the full Hyper-V networking stack is available (e.g., check for
vmms service and Get-NetNat availability). If unavailable, display
a clear in-app message such as:

Cowork requires the full Hyper-V feature, not just VirtualMachinePlatform. Please ask your IT administrator to enable Microsoft-Hyper-V-Hypervisor and Microsoft-Hyper-V-Services, or use Claude Code CLI in WSL2 as an alternative.

Option B — WSL2 backend fallback (medium-term, broader impact):
Offer a WSL2 backend for Cowork, similar to how Docker Desktop operates.
This would eliminate the dependency on full Hyper-V and unlock Cowork
for the substantial population of enterprise users on Secured-core PC
endpoints with VirtualMachinePlatform-only configurations.

Minimum acceptable fix:
Replace the misleading coder CLI not found on augmented PATH error
message with one that accurately describes the underlying VM boot
failure. The current message sends users searching for a coder.exe
binary that doesn't and shouldn't exist on the Windows host.

Error Messages/Logs

=== UI Error ===
Claude Code crashed
Try resending the message. If the problem persists, please send feedback so we can investigate.

Claude Code process exited with code 3221225477
(= 0xC0000005, superficially Access Violation, but see diagnostics below)

=== Application Log (main.log) — repeats every 30 seconds ===
%LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\logs\main.log

2026-05-15 10:17:50 [info] [Coder] workspace discovery failed:
  Error: coder CLI not found on augmented PATH
  at zEr (C:\Program Files\WindowsApps\Claude_1.7196.0.0_x64__pzs8sxrjxfjjc\app\
         resources\app.asar\.vite\build\index.js:2409:17320) {
    [stack]: [Getter/Setter],
    [message]: 'coder CLI not found on augmented PATH'
  }

=== Application Log — VM bundle download (completes successfully) ===
2026-05-15 10:44:37 [info] [download:1] 22.2% (496.0/2233.9 MB) avg 7.08 MB/s, ETA 4m 6s
2026-05-15 10:47:37 [info] [download:1] 97.7% (2183.4/2233.9 MB) avg 8.73 MB/s, ETA 6s
2026-05-15 10:47:43 [info] [download:2] Starting download from
  https://downloads.claude.ai/vms/linux/x64/5680b11bcdab215cccf07e0c0bd1bd9213b0c25d/vmlinuz.zst
2026-05-15 10:47:44 [info] [download:3] Starting download from
  https://downloads.claude.ai/vms/linux/x64/5680b11bcdab215cccf07e0c0bd1bd9213b0c25d/initrd.zst

=== Windows Event Logs — CRITICAL: ZERO entries ===
Microsoft-Windows-CodeIntegrity/Operational : zero Claude-related entries
Microsoft-Windows-CodeIntegrity/Verbose      : zero Claude-related entries (enabled during reproduction)
Application Error / WER / .NET Runtime       : zero Claude-related entries

The 3221225477 exit code is therefore NOT a real OS-level Access Violation.
It is being returned voluntarily by a Claude Desktop child process that detects
the Cowork VM is unavailable. This is a silent failure entirely inside Claude
Desktop's own logic.

=== PowerShell Diagnostics — Root Cause ===

PS> Get-NetNat
Get-NetNat: The specified class does not exist.
# The Microsoft-Hyper-V-Services feature is disabled, so NetNat CIM class
# is not registered at all.

PS> Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" }
(empty)
# The cowork-vm-nat HNS network is never created.

PS> Get-Service "CoworkVMService" | Select Status, StartType
Status  StartType
------  ---------
Running Automatic
# The service itself starts fine, but cannot create its VM network.

PS> Get-Service vmcompute, vmms, hns -ErrorAction SilentlyContinue
Name        Status   StartType
----        ------   ---------
hns         Running  Manual
vmcompute   Running  Manual
# vmms does NOT exist — the service is not even installed.
# vmcompute and hns are sufficient for WSL2 but not for full Hyper-V VMs.

PS> dism /online /get-features /format:table | Select-String "Hyper|Virtual"
VirtualMachinePlatform                  Enabled    ← only this is on
HypervisorPlatform                      Disabled
Microsoft-Hyper-V-All                   Disabled
Microsoft-Hyper-V                       Disabled
Microsoft-Hyper-V-Hypervisor            Disabled
Microsoft-Hyper-V-Services              Disabled    ← provides Get-NetNat
Microsoft-Hyper-V-Management-Clients    Disabled
Microsoft-Windows-Subsystem-Linux       Disabled    (WSL2 still works via VMP)
Containers                              Disabled

Steps to Reproduce

This bug is environment-dependent. Reproduction requires a Windows 11 endpoint
configured to a specific (but common) enterprise security baseline.

Prerequisites: Endpoint Configuration

1. Provision a Windows 11 Enterprise endpoint with Secured-core PC settings:

• WDAC Enforcement Mode active
• HVCI Running
• Secure Boot enabled
• DMA protection enabled

1. Enable ONLY VirtualMachinePlatform; leave the following disabled:

• Microsoft-Hyper-V-Hypervisor
• Microsoft-Hyper-V-Services
• Microsoft-Hyper-V-Management-PowerShell
• Microsoft-Hyper-V-All

This is the recommended baseline for "endpoint that needs WSL2 but does
not need to host VMs" — a very common enterprise configuration.

1. Verify the broken state with PowerShell:

   Get-NetNat
   # Expected on this config: "The specified class does not exist."

   Get-Service vmms -ErrorAction SilentlyContinue
   # Expected: no output (service not installed)

   Get-Service vmcompute, hns
   # Expected: both Running (sufficient for WSL2)

Reproduction Steps

1. Install Claude Desktop on the endpoint above (MSIX from Microsoft Store

OR standalone installer — both reproduce identically).

1. Sign in and open the Code tab.

1. Submit any prompt, e.g., "list files in this folder".

1. Wait up to a few minutes (during which the 2.2 GB Cowork VM bundle

downloads from downloads.claude.ai).

1. Observe the UI error:

Claude Code process exited with code 3221225477

1. Verify the silent failure:

   # cowork-vm-nat HNS network is missing
   Get-HnsNetwork | Where-Object { $_.Name -eq "cowork-vm-nat" }
   # Expected: empty

   # No OS-level crash recorded
   Get-WinEvent -FilterHashtable @{
       LogName='Application'
       StartTime=(Get-Date).AddMinutes(-30)
       Level=1,2,3
   } | Where-Object { $_.Message -match "claude" }
   # Expected: zero entries

1. Verify Claude Desktop's own log shows the misleading error:

Contains repeating coder CLI not found on augmented PATH (every 30 sec).

Confirmation That Claude Code CLI Is Unaffected

On the SAME endpoint:

wsl --install -d Ubuntu-24.04
# Inside Ubuntu:
curl -fsSL https://claude.ai/install.sh | bash
claude  # works perfectly, including all agentic features

This confirms the issue is specific to Claude Desktop's Cowork VM
implementation, not to Claude's core capabilities, not to WSL2, and not
to the WDAC policy itself.

A comprehensive technical report including rejected hypotheses,

full diagnostic logs, and strategic context is attached as

Claude_Desktop_Cowork_Bug_Report.md.

Claude Model

Sonnet (default)

Is this a regression?

Yes, this worked in a previous version

Last Working Version

Unknown (worked on previous endpoint with full Hyper-V enabled)

Claude Code Version

N/A — this report concerns Claude Desktop MSIX 1.7196.0, not Claude Code CLI. For reference, Claude Code CLI 2.1.140 works correctly inside WSL2 Ubuntu 24.04 on the same endpoint: $ claude --version 2.1.140 (Claude Code)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

⚠️ Note on Report Scope

This report concerns Claude Desktop (MSIX 1.7196.0) — specifically its
Code/Cowork tab — not Claude Code CLI. I am filing here following the
established convention that the anthropics/claude-code issue tracker is
the central destination for Claude Desktop bug reports (see e.g. #25801,
#28231, #28900, #42776, #51143, #53255). Please re-tag with area:desktop,
area:cowork, and platform:windows as appropriate.

Summary of Root Cause

Claude Desktop's Cowork feature requires the full Hyper-V networking stack
(Get-NetNat CIM class, vmms service, cowork-vm-nat HNS network), but on
the modern enterprise Windows baseline only VirtualMachinePlatform is
enabled. This is the recommended configuration for endpoints that need WSL2
with minimal attack surface — it is not an edge case.

On such endpoints:

• WSL2 + Claude Code CLI 2.1.140 works perfectly
• Claude Desktop Code/Cowork tab crashes silently (exit 3221225477)
• No OS event log records the failure
• The user sees only the misleading coder CLI not found on augmented PATH

WDAC Enforcement Mode and HVCI were investigated and ruled out as causes —
WDAC logs no blocks for Claude. The issue is purely a missing Hyper-V feature
dependency.

Why This Matters at Scale

Secured-core PC adoption is accelerating across enterprises in 2026–2028,
driven by:

• Cyber insurance underwriting requirements
• SOC 2 / ISO 27001 / J-SOX audit pressure
• Microsoft's own Windows 11 enterprise security baseline guidance

The VirtualMachinePlatform-only configuration (no full Hyper-V) is the
recommended baseline in this trajectory. Cowork's current architecture
excludes this entire population by design. As a PE advisor working with
portfolio companies on IT due diligence and DX, I confirm this configuration
is now the default on newly provisioned corporate endpoints, not an outlier.

Requested Improvements (recap)

1. Pre-flight check at startup: verify vmms service and `Get-NetN

errorlog_en.docx

at`
availability; if missing, show a clear error message instead of crashing.

1. Replace the misleading coder CLI not found error with one that

accurately describes the VM boot failure.

1. WSL2 backend fallback (medium-term): Docker Desktop demonstrates this

is viable. Would unlock Cowork for the entire Secured-core PC population.

1. Document the Hyper-V requirement explicitly in Cowork's system

requirements (currently undocumented).

Attachments

• Claude_Desktop_Cowork_Bug_Report.md — comprehensive 10-section technical

report including all rejected hypotheses, full diagnostic command history,
and strategic context. ~500 lines.

• PowerShell screenshots showing Get-NetNat "class does not exist" error

and DISM output confirming Hyper-V features all disabled.

Availability for Follow-up

I am a Claude Enterprise customer (Endeavor United Co., Ltd., a PE fund based
in Tokyo) and am available for:

• Additional diagnostics or log collection on request
• Pre-release validation of any fix
• Testing of a WSL2 backend if/when prototyped

errorlog_en.docx