[Problem/Bug]: CreateCoreWebView2CompositionController fails under LocalSystem on WinSta0\Winlogon while succeeding on WinSta0\Default

[vevebor]

What happened?

We are evaluating whether WebView2 can be hosted from a LocalSystem process to render UI on the Windows secure desktop (Winlogon Unlock/UAC scenarios). As part of this evaluation, we are using the experimental --allow-run-as-system browser argument together with windowless composition mode (ICoreWebView2CompositionController + DirectComposition).

The WebView2 environment is created successfully using:

CreateCoreWebView2EnvironmentWithOptions(...)

However, creating the composition controller on the WinSta0\Winlogon desktop fails intermittently.

CreateCoreWebView2CompositionController(...)

returns either:

• E_ABORT (0x80004004), or
• HRESULT_FROM_WIN32(ERROR_TIMEOUT) (0x800705B4).

No ICoreWebView2CompositionController instance is created and nothing is rendered.

Using the same application, runtime, LocalSystem account, and initialization sequence on WinSta0\Default consistently succeeds (hr = S_OK) and renders correctly.

During our investigation, we also verified that the behavior is not solely explained by the host process's job-object configuration. Even after allowing process breakaway, composition controller creation on WinSta0\Winlogon still intermittently fails with E_ABORT or ERROR_TIMEOUT, while the same configuration works reliably on WinSta0\Default.

We would appreciate clarification on whether initializing ICoreWebView2CompositionController from a LocalSystem process on the Winlogon (secure) desktop fails intentionally with allow-run-as-system flag.

Importance

Blocking. My app's basic functions are not working due to this issue.

Runtime Channel

Stable release (WebView2 Runtime)

Runtime Version

149.0.4022.98

SDK Version

1.0.3912.50

Framework

Win32

Operating System

Windows 11

OS Version

26200.8655

Repro steps

1. Run a Win32 application as LocalSystem.
2. Set:

   WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS=--allow-run-as-system
   

3. Switch to the WinSta0\Winlogon desktop in Windows Unlock / UAC scenarios.
4. Call:

   CreateCoreWebView2EnvironmentWithOptions(...)

5. Wait for the environment creation callback.
6. Call:

   CreateCoreWebView2CompositionController(...)

7. Observe that the completion callback returns either:
   • E_ABORT (0x80004004), or
   • HRESULT_FROM_WIN32(ERROR_TIMEOUT) (0x800705B4),
     and no composition controller is created.
8. Repeat the same initialization sequence on WinSta0\Default.
9. Observe that CreateCoreWebView2CompositionController(...) succeeds and the WebView renders successfully.

Repros in Edge Browser

No, issue does not reproduce in the corresponding Edge version

Regression

Regression in newer Runtime

Last working version (if regression)

119.0.2151.44

[anuragkumar878]

Hi @vevebor launching as system is not recommended and not a supported scenario. More on that flag here - https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/webview-features-flags
https://learn.microsoft.com/en-us/microsoft-edge/webview2/concepts/security

[vevebor]

Thanks @anuragkumar878.

I understand that --allow-run-as-system is experimental and that hosting WebView2 under LocalSystem is not a supported scenario. However, the "unsupported" explanation doesn't fully explain the behavior I'm observing, and I'd appreciate some clarification.

A few observations suggest the behavior is more nuanced than simply LocalSystem being unsupported:

1. Scenario-specific behavior: Using the same application, LocalSystem token, runtime, and initialization sequence:

   • Login and Switch User scenarios successfully initialize ICoreWebView2CompositionController on the WinSta0\Winlogon desktop.
   • Unlock and UAC scenarios intermittently fail with E_ABORT (0x80004004) or HRESULT_FROM_WIN32(ERROR_TIMEOUT) (0x800705B4).

   This suggests the issue is not simply the Winlogon desktop itself, but something specific to the Unlock/UAC secure-desktop flow.

2. Browser process behavior changes during Unlock/UAC: During the failing Unlock/UAC scenario, even with --allow-run-as-system, the msedgewebview2.exe browser process is launched under the interactive user's explorer.exe, causing it to execute in the user's interactive session instead of under the LocalSystem host. This behavior is not observed during the Login or Switch User scenarios.

3. Failure pattern: CreateCoreWebView2EnvironmentWithOptions() consistently returns S_OK, and the browser processes are created successfully. The failure occurs only during CreateCoreWebView2CompositionController(), which either stalls for approximately 34–79 seconds before returning HRESULT_FROM_WIN32(ERROR_TIMEOUT) (0x800705B4), or immediately returns E_ABORT (0x80004004).

Diagnostic summary

CreateCoreWebView2EnvironmentWithOptions()
    -> S_OK

Login / Switch User (WinSta0\Winlogon)
    CreateCoreWebView2CompositionController()
        -> S_OK
        -> NavigationCompleted (HTTP 200)

Unlock / UAC (WinSta0\Winlogon)
    CreateCoreWebView2CompositionController()
        -> E_ABORT (0x80004004)
           or
        -> HRESULT_FROM_WIN32(ERROR_TIMEOUT) (0x800705B4)

Using Process Monitor, I also verified that:

• msedgewebview2.exe is launched successfully in both the working and failing cases.
• During Unlock/UAC, the browser process is launched under the interactive user's explorer.exe, whereas during Login/Switch User it remains under the expected LocalSystem launch path.
• The failure occurs after process creation, during composition-controller initialization.
• Allowing job-object breakaway (JOB_OBJECT_LIMIT_SILENT_BREAKAWAY_OK) does not change the Unlock/UAC behavior, suggesting the job object itself is not the root cause.

Could you please clarify:

• Is launching the browser under the interactive user's session during Unlock/UAC expected behavior when --allow-run-as-system is specified?
• Is the different behavior between the Login/Switch User and Unlock/UAC secure-desktop flows expected by design?
• If so, is there any supported way to host a WebView2 surface on the secure desktop for these scenarios?