PSEC 1.0: Undocumented prerequisites for 0x80070002 under session-0 batch logon #1631

Brief description of your issue

Request for documentation: Windows PSEC creation prerequisites and diagnostics

I'm investigating a native CreateProcessSecurityEnvironment failure on Windows 11 Home 25H2, build 26200.9711, x64.

After extensive diagnostic work, the underlying cause remains unidentified. I'm requesting clarification of the supported Windows PSEC contract and available diagnostic interfaces, rather than reporting a confirmed Microsoft defect.

1. Verified native failure

A non-elevated, medium-integrity, restricted batch-logon process in session 0 attempted to create a PSEC environment.

The result was:

• Native HRESULT: 0x80070002 (ERROR_FILE_NOT_FOUND)

• Returned PSEC handle: null

• API-set discovery: passed

• System32 DLL loading: passed

• Required export resolution: passed

• Startup-attribute preparation: not reached

• Child process: not created

Exact input specification:

• PSEC schema version: 1.0

• FlatBuffer identifier: PSEC

• Serialized size: 88 bytes

• SHA-256: 0ef0db0a4e179cd22ba3468431a85499fde979247075ae2b6e726ef8910c8e92

• Creation flags: 0, verified from frozen source

• Win32k system calls: disallowed

• UI restriction mask: 0x3ff

• Network egress: default deny

• No explicit filesystem grants, denied paths, profile paths or named capabilities

The serialized specification was independently reconstructed and matched the retained historical evidence.

2. Caller context

The failing process had:

• Session and token session: 0

• Logon type: 4 (batch)

• Integrity: medium

• Elevation: disabled

• Restricted-token indicator: enabled

• Restricting SID count: 0

• AppContainer: disabled

• Loaded user-profile hive: absent

A previous interactive, medium-integrity maintenance-account diagnostic on the same reported Windows build accepted the same serialized specification hash and returned a non-null PSEC handle.

However, the account, logon type, session, profile state, helper build and other circumstances differed. This observation does not establish which difference caused the failure.

3. Windows component observations

The current Windows installation reports:

AppInfo and BFS registrations exist. AppInfo declares dependencies on RpcSs and ProfSvc.

The operational health of these services, BFS filter attachment and volume configuration remain unknown.

A later non-elevated inventory was executed in a separate low-integrity AppContainer context. Service-status, minifilter-enumeration and drive-mapping queries were denied. Those access denials cannot be attributed to the earlier medium-integrity PSEC failure.

Historical loaded DLL hashes were not retained, so current disk-file hashes do not prove exact binary equivalence at the time of the original call.

4. Questions for the MXC/Windows maintainers

A. Supported caller context

Does the native PSEC 1.0 creation contract support a medium-integrity, restricted, non-AppContainer caller using a session-0 batch logon without a loaded user-profile hive?

If support is conditional, where are the required token, logon, profile and session prerequisites documented?

B. Error 2 interpretation

Which documented creation-time prerequisite or internal operation can return 0x80070002 when API/DLL/export resolution succeeds and the PSEC specification contains no explicit filesystem grants?

Does the API require any AppInfo, ProfSvc, BFS, system-volume or other host-resource initialization even for this policy?

C. Non-invasive diagnostics

Is there a supported diagnostic interface capable of identifying the originating Windows operation and status without:

• Modifying the original PSEC specification

• Loading or creating a user profile

• Changing the caller's security context

• Relaxing security policies

• Enabling permissive learning mode

• Performing broad filesystem or kernel tracing

D. OS-side ETW events

The pinned Microsoft MXC source references OS TraceLogging provider:

{f6ec123e-314e-400b-9e0a-151365e23083}

Pinned source revision:

b21120168d70befe12356411423266bfef168446

On Windows build 26200.9711, does this provider emit an event specifically for unsuccessful CreateProcessSecurityEnvironment initialization?

If so, could you identify its authoritative event name, descriptor/version, typed originating operation/status fields, emitting process and documented per-invocation or caller/service correlation mechanism?

If the provider does not expose this information, that clarification would also be useful.

5. Related issues and source references

• https://github.com/openai/codex/issues/50981 — same HRESULT but different filesystem-grant conditions

• https://github.com/openai/codex/issues/53417 — same HRESULT with a different, incompletely characterized caller

• https://github.com/microsoft/mxc/issues/1465 — session-0 workload initialization issues after container creation

• https://github.com/microsoft/mxc/issues/1468 — reporter-derived AppInfo/BFS creation path for filesystem-grant processing

• https://github.com/microsoft/mxc/issues/1517 — SDK telemetry correlation discussion

Public MXC documentation:

https://github.com/microsoft/mxc/blob/b21120168d70befe12356411423266bfef168446/docs/development/guides/process-container-adding-os-features.md

These references provide context, but none independently establishes the root cause of the precise no-grants PSEC failure described here.

6. Requested outcome

A version-specific prerequisite contract, confirmed implementation guidance, or supported narrow diagnostic method would be greatly appreciated.

We have deliberately avoided modifying Windows services, filesystem filters, user profiles, security settings or the protected execution context while the cause remains unverified.

Thank you for any clarification the MXC or Windows engineering team can provide.