Windows Sandbox: a throwaway Windows PC in seconds (plus .wsb config files)

Windows Sandbox is a small, temporary copy of Windows that runs in a window on your PC. Everything you do inside it is thrown away when you close it. That makes it perfect for opening a suspicious attachment, trying an installer you don’t trust, or testing a script, without touching your real system.

What you need

• Windows 10 (version 1903 or later) or Windows 11, in the Pro, Enterprise or Education edition. Microsoft says Sandbox isn’t supported on Home.
• Virtualization turned on in your PC’s firmware (BIOS/UEFI setup, often called Intel VT-x, AMD-V or SVM).
• At least 4 GB of RAM (8 GB recommended), 1 GB of free disk space and 2 CPU cores, according to Microsoft.

Turn it on

1. Search Start for Turn Windows features on or off.
2. Tick Windows Sandbox, click OK and restart when asked.
3. Open Windows Sandbox from Start.

Or in an administrator PowerShell window:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

If the checkbox is missing, either your edition doesn’t support Sandbox or virtualization is off in the firmware.

What it’s like inside

• Every launch starts as clean as a brand-new Windows installation. Apps installed on your PC aren’t available inside; install what you need in the sandbox itself.
• Microsoft says that starting with Windows 11 version 24H2, built-in Store apps such as Calculator, Photos, Notepad and Terminal aren’t available inside the sandbox.
• Networking is on by default and the clipboard is shared, so you can paste files in. That also means an untrusted program in the sandbox can reach your home network. Use a config file (below) to turn networking off when you’re testing something suspicious.
• When you close the window, everything inside is deleted. Mapped folders are the one exception (see below).

.wsb config files: the hidden power feature

A .wsb file is a small XML file. Double-click it and Sandbox starts with your settings. Make one in Notepad and save it with quotes around the name, e.g. "Offline.wsb", so Notepad doesn’t add .txt.

Offline sandbox for suspicious files

<Configuration>
  <Networking>Disable</Networking>
  <ClipboardRedirection>Disable</ClipboardRedirection>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Quarantine</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Quarantine</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Put the file you want to inspect in C:\Quarantine first. The folder has to exist, or Sandbox won’t start. It shows up read-only on the sandbox desktop, so nothing inside can change the original.

Test an installer and run a script at startup

<Configuration>
  <MemoryInMB>8192</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxTools</HostFolder>
      <SandboxFolder>C:\Tools</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell -ExecutionPolicy Bypass -File C:\Tools\setup.ps1</Command>
  </LogonCommand>
</Configuration>

Folders are mapped before the logon command runs, so the command can use scripts from the mapped folder. Microsoft recommends putting anything with more than one step into a script like this rather than a long command.

All the options

Setting	Values	Default
vGPU	Enable / Disable	Enabled (not on Arm64)
Networking	Enable / Disable	Enabled
MappedFolders	Host folder, sandbox folder, ReadOnly true/false	None
LogonCommand	One command run after sign-in	None
AudioInput	Enable / Disable	Enabled
VideoInput	Enable / Disable	Disabled
ProtectedClient	Enable / Disable (extra AppContainer isolation)	Disabled
PrinterRedirection	Enable / Disable	Disabled
ClipboardRedirection	Enable / Disable	Enabled
MemoryInMB	Number in MB (values too low to boot are raised to 2048)	Up to 4 GB

Careful with writable mapped folders. Microsoft notes that changes made to a mapped folder that isn’t read-only stay on your real PC after the sandbox closes, and that malware inside the sandbox could tamper with them. Use <ReadOnly>true</ReadOnly> unless you need to copy something out.

Sandbox vs. a full virtual machine

Sandbox is for quick, disposable tests. If you need something that persists (installed apps, snapshots, a different Windows version or Linux), use Hyper-V or another hypervisor instead. Chapter 17 of Bott’s Windows 11 Inside Out covers running Windows 11 in a virtual machine. Microsoft says Sandbox itself relies on the Microsoft hypervisor to isolate it from your PC.