How to Configure Windows Sandbox Using WSB Configuration Files for Custom Isolated Environments

Windows Sandbox provides a pristine, disposable desktop environment in Windows 11 where you can test untrusted software, run dubious scripts, or inspect suspicious downloads without risking host system security. When closed, all changes and files inside the sandbox are permanently discarded. However, repeatedly setting up testing tools or manually transferring test folders into a freshly booted sandbox can be tedious. Microsoft addresses this with Windows Sandbox Configuration Files (.wsb), an XML-based specification that automatically provisions storage mounts, networking modes, and startup commands on launch.

What is a WSB Configuration File?

A .wsb file is a plain XML document associated with the Windows Sandbox executable. Double-clicking any .wsb file launches Windows Sandbox according to the exact hardware, networking, and filesystem parameters defined in that file.

Key configuration directives supported by .wsb include:

• vGPU (Virtualised GPU): Enable or disable hardware-accelerated 3D rendering for graphics-intensive testing.
• Networking: Toggle network connectivity to test applications in completely air-gapped environments.
• Mapped Folders: Mount host directories directly into the sandbox with granular read-only or read-write permissions.
• Logon Commands: Automatically execute scripts or installers upon completing the boot process.
• Memory Limits: Allocate custom RAM limits in megabytes to simulate resource-constrained hardware.

Basic WSB File Architecture

The root tag of any configuration file is <Configuration>. Here is a baseline template showcasing core parameters:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Enable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxShares\Testing</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TestFiles</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\TestFiles</Command>
  </LogonCommand>
</Configuration>

Step-by-Step: Creating a Custom Development Sandbox

Let us create a specialised sandbox tailored for testing PowerShell scripts and downloaded installers:

1. Create a dedicated folder on your host machine, such as C:\TestingLab.
2. Open Notepad or your preferred text editor.
3. Paste the following configuration into the editor:

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TestingLab</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Lab</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <MemoryInMB>4096</MemoryInMB>
</Configuration>

4. Click File > Save As.
5. Set the file name to AirGappedTest.wsb (ensure the Save as type dropdown is set to All Files (*.*)).
6. Save the file to your Desktop.

Double-click AirGappedTest.wsb. Windows Sandbox boots in an entirely isolated network state, allocates 4 GB of RAM, and presents your C:\TestingLab directory as a read-only folder on the sandbox desktop.

Executing Automated Boot Scripts with LogonCommand

To automatically run installation packages or configure environment variables upon startup, use the <LogonCommand> element to trigger a PowerShell or batch script located in a mapped folder:

<LogonCommand>
  <Command>powershell.exe -ExecutionPolicy Bypass -File C:\Users\WDAGUtilityAccount\Desktop\Lab\setup.ps1</Command>
</LogonCommand>

Parameter Reference Table

Directive	Supported Values	Default
<VGpu>	Enable, Disable, Default	Disable
<Networking>	Enable, Disable, Default	Enable
<ReadOnly>	true, false	false
<MemoryInMB>	Positive integer (e.g. 4096, 8192)	Dynamic host allocation
<AudioInput>	Enable, Disable	Enable
<VideoInput>	Enable, Disable	Disable

Creating task-specific .wsb configuration files allows administrators and developers to spin up secure, purpose-built testing sandboxes in seconds with zero manual configuration.