How to Configure Windows Sandbox Auto-Logon and Shell Overrides via XML in Windows 11

Windows Sandbox provides a clean, disposable desktop environment that isolates untrusted executables and isolated testing workflows from your primary operating system. While the default configuration boots straight into the standard Windows Explorer desktop shell, advanced developers and security analysts can override the startup shell entirely. By authoring custom .wsb XML configuration files, you can automate logon behaviours, swap out the desktop shell for custom command processors or kiosk utilities, and launch targeted diagnostic sessions without interactive overhead.

Understanding WSB Shell and Command Directives

Windows Sandbox configuration files use an XML schema with the root element <Configuration>. To control startup execution and automate interactive sessions, the configuration relies on two primary directives:

• <LogonCommand>: Defines scripts or binaries executed immediately upon user logon. The default virtual account (WDAGUtilityAccount) logs on automatically without requiring a password prompt.
• <MappedFolders>: Mounts host directories into the sandbox environment, allowing custom boot scripts, installers, and PowerShell packages to be invoked directly by the logon sequence.

Authoring a Custom Auto-Logon and Shell Launch Script

Create a dedicated workspace folder on your host machine (for example, C:\SandboxWorkspace) and save an automation script named InitSandbox.bat:

@echo off
:: Wait for basic system services to initialise
timeout /t 3 /nobreak >nul

:: Launch PowerShell in an elevated, non-terminating interactive session
start powershell.exe -NoExit -ExecutionPolicy Bypass -Command "Write-Host 'Windows Sandbox Automated Environment Ready' -ForegroundColor Green; Get-Process | Out-GridView"

Constructing the Advanced .wsb Configuration File

Save the following XML payload as AutomatedSession.wsb on your host desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxWorkspace</HostFolder>
      <SandboxFolder>C:Automation</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>C:AutomationInitSandbox.bat</Command>
  </LogonCommand>
</Configuration>

Overriding the Default Explorer Shell Dynamically

If your testing scenario requires suppressing the standard Windows desktop shell (explorer.exe) to run a focused security analysis sandbox:

1. In your logon script, modify the Sandbox user registry to replace the active Shell binary:

   reg add "HKCUSoftwareMicrosoftWindows NTCurrentVersionWinlogon" /v Shell /t REG_SZ /d "cmd.exe" /f

2. Alternatively, launch a fullscreen terminal or security harness directly from the logon script while terminating unnecessary background Explorer tasks:

   taskkill /f /im explorer.exe
   start wt.exe

Launching and Validating the Automated Sandbox

Double-click the AutomatedSession.wsb file in Windows 11. The sandbox container initialises in seconds, bypasses any authentication hurdles, maps the designated read-only volume, and executes your configured startup commands. When testing finishes, closing the sandbox window instantly discards all virtual disk changes, leaving your host system pristine.