The Danger of Untrusted Software
Every Windows user has encountered a scenario where they need to run a piece of software, but they aren’t entirely sure it is safe. Perhaps it’s an obscure PDF converter downloaded from a questionable website, or a custom script written by a stranger on a forum. If you run the executable on your main PC and it contains malware, your entire system, your personal files, and your network could be compromised.
Historically, the only safe way to test untrusted software was to install third-party virtualization software (like VirtualBox or VMware) and dedicate hours to installing a full, heavy Windows operating system inside it.
Microsoft solved this problem elegantly in Windows 11 (Pro and Enterprise editions) with Windows Sandbox. This built-in feature instantly spins up a lightweight, isolated, disposable Windows environment on your desktop. You can run any sketchy software inside the Sandbox. The moment you close the Sandbox window, the entire environment—and any malware inside it—is permanently erased.
Prerequisites
Before you can enable Windows Sandbox, you must ensure your hardware supports virtualization.
- Your PC must be running Windows 11 Pro, Enterprise, or Education. (The Home edition does not support this feature).
- Hardware Virtualization must be enabled in your computer’s BIOS/UEFI. (You can check this by opening Task Manager, clicking the Performance tab, selecting CPU, and looking for “Virtualization: Enabled” in the bottom right).
Step 1: Enabling Windows Sandbox
Because it is an advanced feature, Windows Sandbox is disabled by default.
- Press the Windows Key, type
Turn Windows features on or off, and press Enter. - The Windows Features dialog box will appear. Scroll down the alphabetical list.
- Check the box next to Windows Sandbox.
- Click OK. Windows will search for the required files, apply the changes, and prompt you to restart your computer. Click Restart Now.
Step 2: Using the Sandbox
Using the Sandbox is remarkably simple.
- After rebooting, press the Windows Key, type
Windows Sandbox, and press Enter. - A new window will open on your desktop. Inside that window is a pristine, brand new Windows 11 desktop.
How to test software:
The Sandbox is completely isolated from your main PC. It cannot see your C: drive or your personal files. To get the suspicious software into the Sandbox:
- On your main PC, right-click the suspicious
.exefile and select Copy. - Click inside the Windows Sandbox window.
- Right-click on the Sandbox’s desktop and select Paste.
- Double-click the file inside the Sandbox to run it.
If the software is actually ransomware and encrypts the entire Sandbox environment, you are perfectly safe. It cannot escape the virtualization boundary to affect your real PC.
Step 3: Disposing of the Sandbox
The defining feature of Windows Sandbox is its amnesia.
When you are finished testing the software, simply click the X in the top right corner of the Windows Sandbox window.
A warning will pop up stating: “Once Windows Sandbox is closed, all of its content will be discarded and permanently lost.”
Click OK. Every trace of the software, any registry changes it made, and any malware it attempted to install are instantly obliterated. The next time you open Windows Sandbox, you will be presented with a brand new, clean installation again.
Conclusion
Windows Sandbox provides enterprise-grade virtualization security with zero configuration. By utilizing this disposable environment, IT professionals and power users can safely detonate suspicious files, test new software installations, and browse questionable links without ever risking the integrity of their primary workstation.