Cowork VM Service fails to configure SCM recovery actions (Access Denied)

Cowork VM Service (CoworkVMService) logs on startup:

Claude VM Service starting. Detailed logs: C:\ProgramData\Claude\Logs\cowork-service.log
Claude VM Service: failed to configure SCM recovery actions; if the service crashes it will not restart until the machine reboots: open service: Access is denied.

Tried to configure recovery actions manually via sc.exe failure CoworkVMService ..., first from a plain PowerShell (service not found under the display name "Claude VM Service" — actual service name is CoworkVMService), then from an elevated PowerShell session (confirmed user is in BUILTIN\Administrators). Both attempts failed with Access Denied (error 5).

Checked the service's security descriptor:

sc.exe sdshow CoworkVMService
D:(A;;CCLCSWRPWPDTLOCRRC;;;AU)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;S-1-5-80-1949724575-2387902436-65106593-1201171665-3967308604)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)

Authenticated Users (which includes local Administrators) are granted query/start/stop/pause/interrogate rights but NOT SERVICE_CHANGE_CONFIG (DC). Only the specific service SID has change-config rights. So the ACL appears to intentionally prevent even local admins from setting failure/recovery actions on this service.

This may be by design (hardening), but if so, the startup log line reads as an unexpected failure ("failed to configure...") rather than an expected/informational condition, which is confusing for anyone reading the logs. Either:

• the service should configure its own recovery actions using its own elevated context at install/first-run time (so this log line shouldn't appear at all), or
• the log message should clarify that this is expected and not something the user can or should fix.

Environment: Windows 11 Pro 10.0.26200, PowerShell 7.6.4.