Map Host Folders as Read-Only in Windows Sandbox

Windows Sandbox allows users to safely run untrusted applications in an isolated environment on Windows 11. By using a custom Windows Sandbox configuration file (.wsb), you can map specific folders from your host machine into the sandbox environment with read-only permissions, ensuring the isolated system can access necessary files without the risk of modifying, overwriting, or deleting the original host data.

Prerequisites

• Windows 11 Pro, Enterprise, or Education edition.
• Windows Sandbox feature enabled via Turn Windows features on or off.

Step 1: Create a Sandbox Configuration File

Windows Sandbox uses XML-based configuration files with the .wsb extension to control settings such as networking, vGPU, and mapped folders.

1. Open Notepad or your preferred text editor.
2. Paste the following XML configuration:

<Configuration>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Path\To\Host\Folder</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\SharedFolder</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Step 2: Configure the Folder Paths and Permissions

Modify the tags within the XML to match your specific requirements:

• <HostFolder>: Replace C:\Path\To\Host\Folder with the absolute path of the directory on your Windows 11 host that you want to share.
• <SandboxFolder> (Optional): Designates the destination path inside the sandbox. If omitted, Windows Sandbox places a shortcut on the sandbox desktop.
• <ReadOnly>: Set to true to enforce read-only access. When set to true, the sandbox environment cannot write, edit, or delete files in the host directory.

Step 3: Save and Launch the Configuration

1. In Notepad, click File > Save As.
2. Set Save as type to All Files (.).
3. Name the file with a .wsb extension (for example, ReadOnlySandbox.wsb).
4. Save the file to your preferred location, such as your Desktop.
5. Double-click the .wsb file to launch Windows Sandbox with the mapped read-only folder applied.

Verifying Read-Only Access

Once Windows Sandbox opens, navigate to the mapped folder. To verify permissions:

1. Open any file inside the mapped folder and attempt to save changes.
2. Try creating a new file or folder inside the mapped directory.

Windows Sandbox will display an access denied error, confirming that your host files are fully protected against unauthorized modifications.