How to Configure Windows Sandbox and Custom Configuration Files in Windows 11

Downloading and evaluating unverified executable installers, testing experimental developer scripts, or opening suspicious email attachments presents severe risks of system malware infection, registry pollution, and bloatware persistence. While full-scale virtual machines (like VirtualBox or Hyper-V guests) provide safety, they demand tens of gigabytes of disk space, dedicated OS licenses, and prolonged boot times. Windows Sandbox solves isolated execution in Windows 11 by providing a lightweight, hypervisor-backed disposable desktop environment that generates clean from your existing host OS files and vanishes completely without a trace the moment you close it.

System and Hardware Prerequisites

Windows Sandbox utilizes hypervisor virtualization integrated natively into the Windows kernel:

• Windows Edition: Windows 11 Pro, Enterprise, or Education (Home edition does not include Sandbox binaries).
• Virtualization: CPU Virtualization (Intel VT-x or AMD-V) enabled in UEFI/BIOS firmware settings.
• Memory & Storage: At least 4 GB of RAM (8 GB strongly recommended) and 1 GB of free disk space (utilizes host dynamically linked binaries).

Enabling Windows Sandbox via Windows Features

To install the optional Windows Sandbox component:

1. Press Win + R, type optionalfeatures.exe, and press Enter to launch the Windows Features dialog.
2. Scroll down the list and check the box labeled Windows Sandbox.
3. Click OK. Windows downloads and stages the necessary hypervisor components.
4. Click Restart now to complete the installation.
5. Alternatively, enable Sandbox instantly via an elevated PowerShell prompt:

   Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

Creating Custom Windows Sandbox (.wsb) Configuration Files

By default, launching Windows Sandbox provides a pristine desktop with default network access, shared clipboard, and zero host filesystem access. To customize hardware allocation, map specific development folders, and auto-execute setup scripts, you can create XML configuration files with the .wsb extension:

1. Open a text editor (such as Notepad or VS Code).
2. Construct a structured XML configuration file (e.g., DeveloperTesting.wsb):

   <Configuration>
     <VGpu>Enable</VGpu>
     <Networking>Default</Networking>
     <MappedFolders>
       <MappedFolder>
         <HostFolder>C:\Users\Public\SandboxShare</HostFolder>
         <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Shared</SandboxFolder>
         <ReadOnly>true</ReadOnly>
       </MappedFolder>
     </MappedFolders>
     <LogonCommand>
       <Command>cmd.exe /c echo Setup Complete</Command>
     </LogonCommand>
   </Configuration>

Understanding WSB Directive Parameters

Fine-tune sandbox execution by configuring key directives:

• <VGpu>: Set to Enable to grant hardware-accelerated GPU rendering for testing 3D graphics or video decoding; set to Disable for strict software rasterization.
• <Networking>: Set to Default to grant internet access via virtual NAT, or Disable to isolate malware analysis completely from local subnets and external domains.
• <MappedFolders>: Mounts host directories into the sandbox. Always enforce <ReadOnly>true</ReadOnly> when inspecting suspicious files to prevent malicious code from modifying host data.
• <LogonCommand>: Automatically executes an administrative PowerShell script, batch file, or installer upon sandbox startup.

Launching and Destroying the Sandbox Session

To run your customized environment, double-click your saved .wsb file. Windows Sandbox spins up within 10 to 15 seconds. Once your evaluation is complete, simply click the X in the upper-right corner of the window. A dialog confirms: “Are you sure you want to close Windows Sandbox? Once Windows Sandbox is closed, all of its content will be discarded and permanently lost.” Click OK, and Windows scrubs all running processes, memory allocations, and temporary files instantly.