How to Enable and Use Windows Sandbox in Windows 11

Windows Sandbox provides a lightweight, isolated desktop environment where you can safely run untrusted applications without risking your main operating system. Every time the sandbox is closed, all software, files, and state changes are permanently deleted. This guide walks through the system requirements, enabling the feature via Windows Features or PowerShell, and creating custom configuration files to tailor your testing environment.

Prerequisites

Before enabling Windows Sandbox, ensure your system meets the following requirements:

• Operating System: Windows 11 Pro, Enterprise, or Education (Windows 11 Home does not support Sandbox natively).
• Architecture: AMD64 or ARM64.
• Hardware Virtualization: Enabled in your system’s BIOS/UEFI.
• Memory: Minimum 4 GB RAM (8 GB recommended).
• Storage: At least 1 GB of free disk space (SSD recommended).
• CPU: Minimum 2 CPU cores (4 cores with hyperthreading recommended).

To verify that virtualization is enabled, open Task Manager (Ctrl + Shift + Esc), click the Performance tab, select CPU, and look for Virtualization: Enabled in the bottom-right corner.

Step 1: Enable Windows Sandbox

You can enable Windows Sandbox using the graphical interface or via PowerShell.

Method A: Using Windows Features

1. Press the Windows Key, type Turn Windows features on or off, and press Enter.
2. Scroll down the list and check the box next to Windows Sandbox.
3. Click OK.
4. Once Windows finishes applying changes, click Restart now.

Method B: Using PowerShell

1. Right-click the Start button and select Terminal (Admin) or PowerShell (Admin).

2. Run the following command:

   Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

3. Type Y and press Enter to restart your computer.

Step 2: Running Windows Sandbox

1. Open the Start Menu, search for Windows Sandbox, and select the application.
2. Copy any installer or untrusted executable file from your host machine (Ctrl + C).
3. Paste the file directly inside the Windows Sandbox window (Ctrl + V).
4. Run and test the application inside the sandbox environment.
5. Close the Sandbox window when finished. A prompt will confirm that all sandbox data will be permanently discarded.

Step 3: Configure Windows Sandbox with WSB Files

By default, Sandbox runs with networking enabled and direct access to your GPU, but no access to host folders. You can customize this behavior using XML configuration files saved with the .wsb extension.

Basic Configuration Example

Create a file named SandboxConfig.wsb using a text editor (like Notepad) and add the following structure:

<Configuration>
  <!-- vGPU: Enable or Disable hardware-accelerated graphics -->
  <VGpu>Default</VGpu>

  <!-- Networking: Enable or Disable network access -->
  <Networking>Disable</Networking>

  <!-- MappedFolders: Share a folder from the host machine -->
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxShare</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Shared</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>

  <!-- LogonCommand: Run a command or script automatically upon launch -->
  <LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\Shared</Command>
  </LogonCommand>
</Configuration>

Key Configuration Directives

• <VGpu>: Set to Enable, Disable, or Default. Disabling vGPU prevents graphics acceleration, which is useful when testing malware that targets GPU drivers.
• <Networking>: Set to Disable to completely isolate the sandbox from your local network and the internet, preventing data exfiltration during tests.
• <MappedFolders>: Allows sharing folders between host and sandbox. Set <ReadOnly> to true to ensure the untrusted environment cannot modify host files.
• <LogonCommand>: Executes commands automatically when the sandbox boots.

Double-click any .wsb file to launch a tailored sandbox instance with those exact parameters.