Configure Windows Sandbox with WSB Files in Windows 11

Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation, and it can be customized using Windows Sandbox configuration (.wsb) files. This guide explains the structure of .wsb files, the configuration options available in Windows 11, and how to create and run custom sandbox environments to automate tasks, share folders, manage hardware access, and adjust resource limits.

Prerequisites

Before creating custom configurations, ensure Windows Sandbox is enabled on your system:

1. Press Windows Key + R, type optionalfeatures.exe, and press Enter.
2. Check the box for Windows Sandbox and click OK.
3. Restart your PC if prompted.

Note: Windows Sandbox requires Windows 11 Pro, Enterprise, or Education, along with hardware virtualization enabled in your BIOS/UEFI.

Anatomy of a .wsb File

A Windows Sandbox configuration file is a plain-text file formatted in XML with a .wsb extension. It allows you to configure settings inside a root <Configuration> tag.

Here are the primary configuration tags supported in Windows 11:

1. vGPU (Virtual GPU)

Controls whether hardware-accelerated graphics rendering is enabled. * <VGpu>Enable</VGpu>: Enables GPU acceleration. * <VGpu>Disable</VGpu>: Disables GPU acceleration and relies on software rasterization.

2. Networking

Controls network access inside the sandbox. * <Networking>Default</Networking> or <Networking>Enable</Networking>: Enables network access. * <Networking>Disable</Networking>: Disables network access to create an isolated offline environment.

3. Mapped Folders

Shares folders from the host machine to the sandbox. * <HostFolder>: The absolute path on your host PC. * <SandboxFolder>: (Optional) The destination path inside the sandbox. If omitted, it defaults to the sandbox desktop. * <ReadOnly>: Set to true to prevent the sandbox from modifying host files, or false for read/write access.

4. Logon Command

Specifies a single command or script to execute automatically when the sandbox boots up. * <LogonCommand> containing <Command>: Executes commands using cmd.exe syntax, PowerShell, or runs an executable from a mapped folder.

5. Additional System Settings

• <MemoryInMB>: Sets memory limits in megabytes (e.g., <MemoryInMB>4096</MemoryInMB>).
• <AudioInput>: Set to Enable or Disable to control microphone access.
• <VideoInput>: Set to Enable or Disable to control webcam access.
• <ClipboardRedirection>: Set to Enable or Disable host/sandbox clipboard sharing.
• <PrinterRedirection>: Set to Enable or Disable host printer sharing.
• <ProtectedClient>: Set to Enable to turn on extra security mitigations for the Remote Desktop session.

Example Configuration File

Below is a complete .wsb configuration that enables networking, shares a host directory as read-only, sets a memory limit of 4 GB, and automatically launches an installer upon startup.

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Enable</Networking>
  <MemoryInMB>4096</MemoryInMB>
  <ClipboardRedirection>Enable</ClipboardRedirection>
  <AudioInput>Disable</AudioInput>
  <VideoInput>Disable</VideoInput>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxShared</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Shared</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\Users\WDAGUtilityAccount\Desktop\Shared\setup.ps1</Command>
  </LogonCommand>
</Configuration>

How to Create and Run the .wsb File

1. Open Notepad or your preferred text editor.
2. Copy and paste your customized XML configuration into the editor.
3. Click File > Save As.
4. In the “Save as type” dropdown, select All Files (.).
5. Enter a name with the .wsb extension (for example, DevEnvironment.wsb).
6. Double-click the saved .wsb file to start Windows Sandbox with your custom settings.