windows.md Codex Docs, 2026-04-13 00:44 UTC → 2026-04-17 00:44 UTC

32 32 

33`elevated` is the preferred native Windows sandbox. It uses dedicated33`elevated` is the preferred native Windows sandbox. It uses dedicated

34lower-privilege sandbox users, filesystem permission boundaries, firewall34lower-privilege sandbox users, filesystem permission boundaries, firewall

35rules, and local policy changes needed for sandboxed command execution.35rules, and local policy changes needed for commands that run in the sandbox.

36 36 

37`unelevated` is the fallback native Windows sandbox. It runs commands with a37`unelevated` is the fallback native Windows sandbox. It runs commands with a

38restricted Windows token derived from your current user, applies ACL-based38restricted Windows token derived from your current user, applies ACL-based

39filesystem boundaries, and uses environment-level offline controls instead of39filesystem boundaries, and uses environment-level offline controls instead of

40the dedicated offline-user firewall rule. It is weaker than `elevated`, but it40the dedicated offline-user firewall rule. It's weaker than `elevated`, but it

41is still useful when administrator-approved setup is blocked by local or41is still useful when administrator-approved setup is blocked by local or

42enterprise policy.42enterprise policy.

43 43 

64| Windows version | Support level | Notes |64| Windows version | Support level | Notes |

65| -------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |65| -------------------------------- | --------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

66| Windows 11 | Recommended | Best baseline for Codex on Windows. Use this if you are standardizing an enterprise deployment. |66| Windows 11 | Recommended | Best baseline for Codex on Windows. Use this if you are standardizing an enterprise deployment. |

67| Recent, fully updated Windows 10 | Best effort | Can work, but is less reliable than Windows 11. For Windows 10, Codex depends on modern console support, including ConPTY. In practice, Windows 10 October 2018 Update or newer is required. |67| Recent, fully updated Windows 10 | Best effort | Can work, but is less reliable than Windows 11. For Windows 10, Codex depends on modern console support, including ConPTY. In practice, Windows 10 version 1809 or newer is required. |

68| Older Windows 10 builds | Not recommended | More likely to miss required console components such as ConPTY and more likely to fail in enterprise setups. |68| Older Windows 10 builds | Not recommended | More likely to miss required console components such as ConPTY and more likely to fail in enterprise setups. |

69 69 

70Additional environment assumptions:70Additional environment assumptions:

71 71 

72- `winget` should be available. If it is missing, update Windows or install72- `winget` should be available. If it's missing, update Windows or install

73 the Windows Package Manager before setting up Codex.73 the Windows Package Manager before setting up Codex.

74- The recommended native sandbox depends on administrator-approved setup.74- The recommended native sandbox depends on administrator-approved setup.

75- Some enterprise-managed devices block the required setup steps even when the75- Some enterprise-managed devices block the required setup steps even when the

85 85 

86The path must be an existing absolute directory. After the command succeeds, later commands that run in the sandbox can read that directory during the current session.86The path must be an existing absolute directory. After the command succeeds, later commands that run in the sandbox can read that directory during the current session.

87 87 

88We recommend using the native Windows sandbox by default. The native Windows sandbox will offer the best perfomance and highest speeds while keeping the same security. Choose WSL2 when you88Use the native Windows sandbox by default. The native Windows sandbox offers the best performance and highest speeds while keeping the same security. Choose WSL2 when you

89need a Linux-native environment on Windows, when your workflow already lives in89need a Linux-native environment on Windows, when your workflow already lives in

90WSL2, or when neither native Windows sandbox mode meets your needs.90WSL2, or when neither native Windows sandbox mode meets your needs.

91 91