How to Configure Windows Sandbox Custom Startup Commands via XML in Windows 11

Windows Sandbox provides a lightweight, disposable desktop environment that isolates untrusted applications and testing workloads from your host Windows 11 operating system. Every time the sandbox closes, all installed software, files, and registry modifications are permanently discarded. However, manually installing developer tools, downloading runtimes, or mapping shared directories upon every launch wastes valuable time. By authoring custom Windows Sandbox configuration (.wsb) XML files, developers can automate startup scripts, map read-only host folders, and bootstrap testing environments automatically.

Understanding Windows Sandbox XML Schema (.wsb)

A Windows Sandbox configuration file is a plain XML document saved with a .wsb extension, recognized natively by Windows 11:

• <Configuration>: The root wrapper element.
• <VGpu>: Controls virtualized GPU hardware acceleration (Enable or Disable).
• <Networking>: Controls sandbox network access (Default or Disable).
• <MappedFolders>: Shares host directories into the sandbox with granular <ReadOnly> permission controls.
• <LogonCommand>: Defines shell commands or automated scripts executed automatically upon sandbox desktop login.

Authoring the Complete .wsb Configuration File

Create an automated configuration that maps a host tools folder and executes an automated setup script upon boot:

1. Open an elevated PowerShell prompt.
2. Create a designated host directory for shared sandbox assets:

   New-Item -Path "C:\SandboxTools" -ItemType Directory -Force | Out-Null

3. Create an automated PowerShell startup script inside the shared host folder:

   $bootstrapScript = @'
   Write-Host "Bootstrapping Windows Sandbox Environment..." -ForegroundColor Cyan
   
   # Install tools silently via Winget or Chocolatey inside Sandbox
   winget install --id Git.Git -e --source winget --accept-source-agreements --accept-package-agreements
   winget install --id Microsoft.VisualStudioCode -e --source winget --accept-source-agreements --accept-package-agreements
   
   Write-Host "Environment initialization complete!" -ForegroundColor Green
   '@
   $bootstrapScript | Out-File -FilePath "C:\SandboxTools\bootstrap.ps1" -Encoding utf8

4. Create the corresponding .wsb configuration file:

   $wsbContent = @"
   
     Enable
     Default
     
       
         C:SandboxTools
         C:UsersWDAGUtilityAccountDesktopTools
         true
       
     
     
       powershell.exe -ExecutionPolicy Bypass -NoExit -File C:UsersWDAGUtilityAccountDesktopToolsootstrap.ps1
     
   
   "@
   
   $wsbContent | Out-File -FilePath "$env:USERPROFILE\Desktop\DevSandbox.wsb" -Encoding utf8

Launching and Testing the Automated Sandbox

To execute your automated sandbox environment:

1. Navigate to your Windows 11 desktop.
2. Double-click the newly generated DevSandbox.wsb shortcut icon.
3. Windows Sandbox launches immediately:
   • Virtual GPU acceleration is engaged.
   • The host directory C:SandboxTools appears on the sandbox desktop as a read-only folder.
   • The PowerShell login command runs automatically in an open terminal window, installing Git and Visual Studio Code without manual intervention.

Troubleshooting Common LogonCommand Failures

If startup commands fail to execute or terminate prematurely:

• Default User Path: Windows Sandbox boots under the local identity WDAGUtilityAccount. Ensure all hardcoded paths reference C:UsersWDAGUtilityAccount... rather than host usernames.
• Execution Policy Restrictions: Always include -ExecutionPolicy Bypass in the PowerShell logon command string to prevent script signing errors.
• Interactive UAC Prompts: Windows Sandbox operates with elevated administrator permissions by default; ensure internal script installers pass silent flags (e.g., /quiet, /qn, or --silent) to prevent blocking installation dialogs.

Safely Exiting and Cleaning Up

When your testing session concludes, simply close the Windows Sandbox window. Windows purges the entire virtual machine disk image and RAM instantly, leaving your host system 100% clean and free of leftover build artifacts.