How to Configure Windows Sandbox AppLocker Policies via XML in Windows 11

Windows Sandbox provides a disposable environment for testing unknown applications and scripts without exposing primary host files. However, security analysts, incident responders, and compliance engineers frequently need to test how untrusted software behaves within heavily locked-down enterprise environments where AppLocker application control policies are strictly enforced. By configuring Windows Sandbox startup scripts to import AppLocker XML rule sets and activate the Application Identity service upon boot, you can simulate zero-trust enterprise endpoints inside a disposable sandbox container in Windows 11.

Understanding AppLocker Architecture and Rule Collections

AppLocker enforces application control rules across five distinct software collections:

• Executable Rules (.exe, .com): Restricts binary execution to approved paths, publisher digital signatures, or file hashes.
• Windows Installer Rules (.msi, .msp): Controls software package installations.
• Script Rules (.ps1, .bat, .cmd, .vbs, .js): Prevents unauthorized scripting engines from executing.
• Packaged App Rules (.appx, .msix): Governs modern Windows Store applications.
• Enforcement Modes: Supports both AuditOnly (logs violations to Windows Event Log) and Enabled (blocks unauthorized executions immediately).

Exporting and Authoring the AppLocker Policy File

On your host machine, create a directory (e.g. C:\SandboxAppLocker) and save an AppLocker policy XML named AppLockerPolicy.xml:

<AppLockerPolicy Version="1">
  <RuleCollection Type="Exe" EnforcementMode="Enabled">
    <FilePathRule Id="921cc481-6e17-4653-8f75-050b4b639bd20" Name="Allow Windows Binaries" Description="Allow execution from Windows directory" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePathCondition Path="%WINDIR%*" />
      </Conditions>
    </FilePathRule>
    <FilePathRule Id="a61c8b27-01cd-4206-a5da-d0d448e81cb2" Name="Allow Program Files" Description="Allow execution from Program Files" UserOrGroupSid="S-1-1-0" Action="Allow">
      <Conditions>
        <FilePathCondition Path="%PROGRAMFILES%*" />
      </Conditions>
    </FilePathRule>
  </RuleCollection>
</AppLockerPolicy>

Authoring the Automated Provisioning Script

In the same folder, save a PowerShell provisioning script named InitAppLocker.ps1:

# InitAppLocker.ps1 - Start AppIDSvc and apply AppLocker policy
Write-Host "Initialising Application Identity service..." -ForegroundColor Cyan

# Start the required AppLocker background service
Start-Service -Name "AppIDSvc"
Set-Service -Name "AppIDSvc" -StartupType Automatic

# Import and apply AppLocker policy XML
Import-Module AppLocker
Set-AppLockerPolicy -XmlPolicy "C:AppLockerAppLockerPolicy.xml"

Write-Host "AppLocker policy successfully enforced inside Windows Sandbox." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named LockedSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxAppLocker</HostFolder>
      <SandboxFolder>C:AppLocker</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:AppLockerInitAppLocker.ps1</Command>
  </LogonCommand>
</Configuration>

Testing Policy Enforcement Inside the Sandbox

To verify that AppLocker is actively blocking unauthorized software:

1. Double-click LockedSandbox.wsb to boot the sandbox session.
2. The PowerShell window starts AppIDSvc and confirms policy enforcement.
3. Attempt to execute any non-Windows executable saved on the desktop or user download directory (e.g. C:\Users\WDAGUtilityAccount\Desktop\test.exe).
4. Verify that Windows 11 immediately blocks execution with an error dialog:

   This app has been blocked by your system administrator.

5. Open Windows Event Viewer inside the sandbox and inspect Applications and Services Logs > Microsoft > Windows > AppLocker > EXE and DLL to review blocked event ID 8004 logs.