How to Configure Windows Sandbox Custom Environment Variables via XML in Windows 11

Windows Sandbox provides a disposable, isolated environment for testing software packages, build scripts, and untrusted executables. However, developer toolchains—such as Python virtual environments, Node.js tooling, and Java development kits—frequently require custom system environment variables (such as JAVA_HOME, NODE_ENV, or extended PATH entries) to execute correctly. While the native Windows Sandbox XML configuration schema lacks a dedicated environment variable element, you can seamlessly inject persistent session variables using automated logon scripts. In Windows 11, combining .wsb XML with PowerShell enables reliable environment variable provisioning.

Understanding Environment Variable Scope in Windows Sandbox

Inside Windows Sandbox, processes run under the dedicated local container account WDAGUtilityAccount. You can set environment variables across two primary scopes:

• User Scope (HKCU:\Environment): Variables applied specifically to the interactive sandbox user session.
• System Scope (HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment): System-wide variables that apply to all background services, scheduled tasks, and command prompts instantiated within the sandbox.

Authoring the Environment Provisioning Script

Create a dedicated host folder (e.g. C:\SandboxConfig) and save a provisioning script named SetEnvironment.ps1:

# SetEnvironment.ps1 - Inject custom environment variables inside Windows Sandbox
Write-Host "Configuring custom environment variables..." -ForegroundColor Cyan

# Set System-Level Environment Variables
[Environment]::SetEnvironmentVariable("NODE_ENV", "development", "Machine")
[Environment]::SetEnvironmentVariable("APP_DATA_DIR", "C:ToolsData", "Machine")

# Append custom directory to system PATH
$currentPath = [Environment]::GetEnvironmentVariable("Path", "Machine")
$customBinPath = "C:Toolsin"
if ($currentPath -notlike "*$customBinPath*") {
    $newPath = "$currentPath;$customBinPath"
    [Environment]::SetEnvironmentVariable("Path", $newPath, "Machine")
    Write-Host "Appended $customBinPath to System PATH" -ForegroundColor Green
}

# Broadcast environment change message so running processes inherit updates
$HWND_BROADCAST = [IntPtr]0xffff
$WM_SETTINGCHANGE = 0x001a
[void][Win32]::SendMessageTimeout($HWND_BROADCAST, $WM_SETTINGCHANGE, [IntPtr]::Zero, "Environment", 2, 5000, [ref][IntPtr]::Zero)

Write-Host "Environment provisioning complete." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named DevEnvSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxConfig</HostFolder>
      <SandboxFolder>C:Config</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:ConfigSetEnvironment.ps1</Command>
  </LogonCommand>
</Configuration>

Verifying Environment Variables Inside the Sandbox

To validate that your custom variables have taken effect:

1. Double-click DevEnvSandbox.wsb in Windows 11.
2. The sandbox launches, executes SetEnvironment.ps1, and remains in an interactive PowerShell window.
3. Verify that your custom variables evaluate correctly:

   $env:NODE_ENV
   $env:APP_DATA_DIR

4. Launch a standard Command Prompt (cmd.exe) inside the sandbox and run echo %Path% to confirm that C:\Tools\bin is present across all terminal contexts.