How to Configure Windows Sandbox and Virtual Machine Platform in Windows 11

Downloading software installers, debugging unfamiliar scripts, and visiting suspicious URLs carry significant risks of malware infection, registry corruption, and driver instability. While configuring third-party virtualization software like VirtualBox requires downloading multi-gigabyte ISO images and manually allocating disk space, Windows 11 includes Windows Sandbox. Powered by the native Virtual Machine Platform and Hyper-V hypervisor, Windows Sandbox generates an ephemeral, lightweight desktop environment that boots in seconds and completely vaporizes upon closing—guaranteeing that no malware survives.

Windows Sandbox System Requirements

Windows Sandbox requires Windows 11 Pro, Enterprise, or Education editions (Build 22000 or newer) and virtualization enabled in firmware:

• 64-bit AMD or Intel CPU with SLAT (Second Level Address Translation).
• Hardware virtualization enabled in BIOS/UEFI (Intel VT-x or AMD-V).
• At least 4 GB RAM (8 GB strongly recommended) and 1 GB free SSD storage.

Virtualization Feature	Host Impact	Persistence Behavior
Windows Sandbox	Shared host kernel image (100 MB footprint).	100% Ephemeral; all files, registry, and history wipe on exit.
Full Hyper-V VM	Dedicated VHDX disk file (20+ GB).	Persistent virtual machine with independent lifecycle.
Virtual Machine Platform	Low-level Hyper-V core subsystem.	Required foundation for Sandbox and WSL2 (Linux).

Enabling Windows Sandbox and Virtual Machine Platform

Enable both features through Windows Optional Features or via elevated PowerShell:

# Enable Virtual Machine Platform and Windows Sandbox via PowerShell
Enable-WindowsOptionalFeature -Online -FeatureName "VirtualMachinePlatform" -All -NoRestart
Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All

Alternatively, use the graphical interface:

1. Press Windows Key + R, type optionalfeatures, and press Enter.
2. Scroll down and check the boxes for Virtual Machine Platform and Windows Sandbox.
3. Click OK. Windows fetches the required packages from the Component Store.
4. Restart your computer when prompted to finalize hypervisor enablement.

Launching and Using Windows Sandbox

After rebooting, search for Windows Sandbox in the Start Menu and launch it. Within 10 to 15 seconds, a pristine Windows 11 desktop window appears:

• Copy and Paste Integration: You can copy a downloaded executable or script directly from your host PC and paste it into the Sandbox desktop.
• Network Isolation: The sandbox connects to the internet via an internal virtual NAT switch, allowing you to test network-dependent software safely.
• Disposable Architecture: When testing is finished, simply click the X to close the Sandbox window. Windows presents a prompt: “Are you sure you want to close Windows Sandbox? Once Windows Sandbox is closed, all of its content will be discarded and permanently lost.” Click OK to instantly wipe all changes from RAM and disk.

Configuring Advanced Sandboxes with .wsb Configuration Files

Power users can automate Sandbox behavior by creating custom .wsb (Windows Sandbox Configuration) XML files to disable networking, enable GPU acceleration, or map host folders as read-only:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:MalwareAnalysis</HostFolder>
      <SandboxFolder>C:Analysis</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:Analysis</Command>
  </LogonCommand>
</Configuration>

Double-clicking this .wsb file boots an offline, GPU-accelerated sandbox with your target folder mounted securely in read-only mode, providing an impenetrable security boundary for file analysis.