[BUG] Cowork VM fails to start on Windows 11 26H2 — sessiondata.vhdx CreateVirtualDisk 0x1772 (EFS-encrypted LocalCache), same root cause as #83703

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Same root cause as #83703, which was auto-closed as stale without a fix. Still reproducing on a newer version.

Environment

• Windows 11 Pro, version 26H2 (installed 2026-09-30); also failed before on 25H2
• Personal machine, not domain-joined, not MDM-managed
• Claude Desktop 2.16120.0.0 (MSIX, installed under D:\WindowsApps)
• VirtualMachinePlatform, HypervisorPlatform and Microsoft-Hyper-V-All: Enabled
• Services vmms, vmcompute, hns and CoworkVMService: Running

Symptom
Cowork can read and write files, but its Linux terminal never starts, so it cannot delete, move or rename files.

cowork-service.log (repeats on every attempt)
[VHDX] Creating dynamic VHDX: ...\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\vm_bundles\claudevm.bundle\sessiondata.vhdx (size: 10737418240 bytes)
[Server] Warning: failed to create session disk: CreateVirtualDisk failed: 0x1772 (err: Not all privileges or groups referenced are assigned to the caller.)

Confirmation
Get-Item on the claudevm.bundle folder and all its files shows attributes "Archive, Encrypted", matching the root cause described in #83703.

Note: the error text printed in the log ("Not all privileges or groups...") does not match the 0x1772 code (ERROR_FILE_ENCRYPTED), which makes this harder to diagnose. A clearer message would help other users.

What Should Happen?

Cowork's Linux VM should start normally on an MSIX install: CoworkVMService should be able to create sessiondata.vhdx, and the terminal should come up so Cowork can delete, move and rename files.

As suggested in #83703, the session disk should be created in a location that is not EFS-encrypted (outside the MSIX package's LocalCache). If creation fails, the log should report the real cause (ERROR_FILE_ENCRYPTED / EFS) instead of "Not all privileges or groups referenced are assigned to the caller."

Error Messages/Logs

Steps to Reproduce

1. Install Claude Desktop from the Microsoft Store (MSIX) on a personal Windows 11 Pro machine (not domain-joined, not MDM-managed), with Virtual Machine Platform and Hyper-V enabled.
2. Open Claude Desktop and start a Cowork session.
3. Ask Cowork to do something that needs its Linux terminal, such as deleting, moving or renaming a file.
4. Observe that the terminal never starts. Reading and writing files still works.
5. Open C:\ProgramData\Claude\Logs\cowork-service.log and observe on every attempt:

CreateVirtualDisk failed: 0x1772 (err: Not all privileges or groups referenced are assigned to the caller.)

1. In PowerShell, run Get-Item on the claudevm.bundle folder (under ...\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\vm_bundles\) and its files. Observe the attributes "Archive, Encrypted".

Claude Model

None

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

N/A — this is Claude Desktop / Cowork, not the Claude Code CLI. Claude Desktop version: 2.16120.0.0 (MSIX)

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Opening a new issue as requested by the bot when #83703 was auto-closed as stale. The root cause described there (APPX-mandated EFS encryption of LocalCache vs. Hyper-V's inability to create a VHDX in an encrypted folder) still reproduces on Windows 11 26H2 with Claude Desktop 2.16120.0.0.

Related (closed): #83703, #85501, #32186.