The Browser Sandbox
In a high-security enterprise environment, the most common attack vector is an employee clicking a malicious link in an email, which opens their web browser and downloads a zero-day ransomware payload. To stop this, Microsoft introduced Windows Defender Application Guard (WDAG). When an employee attempts to open an untrusted website, WDAG intercepts the request. Instead of opening the site in their standard Microsoft Edge profile, WDAG instantly spins up a microscopic, hardware-isolated Hyper-V virtual machine in the background and opens the website inside the VM.
If the website deploys a zero-day exploit, it successfully infects the browser, but it is physically trapped inside the Hyper-V sandbox. It cannot touch the host operating system, the corporate network, or the user’s files. When the employee closes the browser tab, the Hyper-V VM is instantly destroyed, vaporizing the malware with it.
To make this process fast, WDAG relies on a massive local cache of base virtualization images and pre-compiled networking states. If a Windows Update suddenly changes the core Edge binaries, or if the user’s hard drive experiences a sector fault, the WDAG cache becomes corrupted. The user will click a link, and Edge will simply hang forever, displaying a spinning wheel as the background VM fails to boot. To fix this, you must forcefully obliterate the Application Guard cache via PowerShell.
Locating the Virtualization Caches
The WDAG cache does not exist in the standard user AppData folder. Because it utilizes kernel-level Hyper-V containers (specifically the Windows Container Isolation framework), the cache is deeply buried inside the highly restricted ProgramData\Microsoft\HVSI (Hyper-V Secure Isolation) directory.
Purging the Cache via PowerShell
You cannot use File Explorer to delete these files. You must use an elevated PowerShell session as an Administrator. We must violently terminate the container services to release the NTFS file locks before initiating the deletion.
Step 1: Terminating the Container Services
Before touching the cache, you must stop the background services that manage the virtualized browser instances.
# Stop the Host Network Service (handles VM networking)
Stop-Service -Name hns -Force -ErrorAction SilentlyContinue
# Stop the Container Manager Service
Stop-Service -Name cmsservice -Force -ErrorAction SilentlyContinue
# Stop the specific HVSI service
Stop-Service -Name hvsics -Force -ErrorAction SilentlyContinueStep 2: Obliterating the HVSI Cache
Now that the services are dead and the Hyper-V locks are released, we can aggressively delete the corrupted base images and the user’s specific container state.
$WDAG_Cache = "$env:ProgramData\Microsoft\HVSI"
if (Test-Path $WDAG_Cache) {
# We rename the folder to force Windows to abandon it, rather than attempting a slow file-by-file deletion
Rename-Item -Path $WDAG_Cache -NewName "HVSI.OLD" -Force
Write-Host "Application Guard cache successfully bypassed." -ForegroundColor Green
}Step 3: Flushing the AppData State
While the virtual machine resides in ProgramData, the Microsoft Edge integration state resides in the user’s specific profile. You must clear this as well.
$User_WDAG = "$env:LOCALAPPDATA\Packages\Microsoft.MicrosoftEdge.Stable_8wekyb3d8bbwe\LocalState\WDAG"
if (Test-Path $User_WDAG) {
Remove-Item -Path "$User_WDAG\*" -Recurse -Force -ErrorAction SilentlyContinue
}The Reinitialization
The caches are now completely gone. You must restart the computer to finalize the process, as the Hyper-V kernel extensions must cleanly reboot.
When the user logs back in and clicks an untrusted link, Microsoft Edge will pause for about 15 to 20 seconds. This delay is expected. The HVSI service will realize the base image cache is missing, and it will aggressively rebuild a brand new, uncorrupted Hyper-V container from the core Windows system files. Once the rebuild is complete, the secure browser will open, the malware isolation will function perfectly, and all subsequent untrusted links will open instantly.