How to Completely Disable ‘Windows Sandbox’ via Group Policy in Windows 11

Windows Sandbox is an excellent, lightweight desktop environment in Windows 11 designed to safely run untrusted applications in isolation. Once the Sandbox is closed, all the software and files within it are permanently deleted. While this is a boon for security researchers and power users, it can be a massive liability in a corporate environment. If Windows Sandbox is left enabled, a malicious insider or a compromised user account could use the Sandbox to execute unauthorized software, bypass corporate endpoint detection and response (EDR) agents, or exfiltrate data via the isolated clipboard without leaving a forensic trace on the host OS.

This guide explains how to completely disable Windows Sandbox system-wide using the Group Policy Editor in Windows 11, ensuring untrusted virtualization is impossible.

Disable Windows Sandbox via Group Policy

To enforce a strict block on the Sandbox feature and prevent users from launching it (even if the Windows Feature is installed), we must deploy an administrative template. Note that this requires Windows 11 Pro, Enterprise, or Education editions.

1. Log into Windows 11 with an Administrator account.
2. Press the Windows Key + R to open the Run dialogue box.
3. Type gpedit.msc and press Enter to launch the Local Group Policy Editor.
4. In the left-hand navigation pane, navigate precisely to this path:

   Computer Configuration > Administrative Templates > Windows Components > Windows Sandbox

5. In the right-hand pane, locate the policy named Allow vGPU for Windows Sandbox and, more importantly, if you want to block it entirely, you must use a different method as Group Policy only controls specific Sandbox behaviors (like clipboard sharing or vGPU). To completely disable the execution of the Sandbox itself across the domain, you must use AppLocker or Software Restriction Policies to block the executable. However, the most direct way to disable it at the OS level is to remove the Windows Feature.
6. Open an elevated PowerShell prompt (Run as Administrator).
7. Execute the following command to completely strip the Sandbox hypervisor components from the OS:

   Disable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online

8. Press Y to restart the computer when prompted.

Verify the Virtualization Lockdown

Using PowerShell removes the underlying hypervisor capability, which is far more secure than merely hiding the shortcut.

To verify the restriction is active, log back into Windows 11 after the restart. Open the Start menu and search for “Windows Sandbox”. The application will no longer appear in the search results. Furthermore, if you open the “Turn Windows features on or off” control panel, the checkbox next to “Windows Sandbox” will be completely cleared. The endpoint is now secure against isolated, untraceable software execution.