How to Configure Windows Sandbox Dynamic Folder Redirection via Symbolic Links in Windows 11

Windows Sandbox provides a secure, pristine virtual environment for software packaging, security research, and code compilation. By default, user profile directories—such as Desktop, Documents, and Downloads—exist exclusively on the sandbox’s volatile virtual disk, meaning any compilation outputs or captured logs are destroyed upon session shutdown. By leveraging mapped folders combined with symbolic links and directory junctions via .wsb XML files, you can redirect default user folders seamlessly to persistent host storage. This guide covers configuring dynamic folder redirection in Windows 11.

The Mechanics of Windows Sandbox Directory Redirection

A Windows Sandbox configuration file (.wsb) maps a host directory into the virtual machine at a designated guest path. However, applications running inside the sandbox often write hardcoded outputs to standard user profile folders such as C:\Users\WDAGUtilityAccount\Downloads. By configuring a <LogonCommand> that executes a PowerShell script, the sandbox can delete default directories and replace them with NTFS directory junctions (mklink /J) pointing to the mounted host storage.

Structuring Host Folders and Assets

Create a dedicated configuration directory on your Windows 11 host (for example, C:\SandboxEnvironment). Structure the folder as follows:

C:\SandboxEnvironment\
├── HostShare\
├── Setup-Redirection.ps1
└── Redirect_Sandbox.wsb

Authoring the Symbolic Redirection Script

Save the following PowerShell script as C:\SandboxEnvironment\Setup-Redirection.ps1. This script safely unlinks default user folders and establishes persistent junctions:

# Setup-Redirection.ps1 - Automated User Profile Redirection
param (
    [string]$TargetMount = "C:\HostData"
)

$UserDir = "C:\Users\WDAGUtilityAccount"
$FoldersToRedirect = @("Downloads", "Documents")

foreach ($Folder in $FoldersToRedirect) {
    $OriginalPath = Join-Path $UserDir $Folder
    $PersistentPath = Join-Path $TargetMount $Folder

    # Ensure host directory exists
    if (-not (Test-Path $PersistentPath)) {
        New-Item -ItemType Directory -Path $PersistentPath -Force | Out-Null
    }

    # Remove existing sandbox folder
    if (Test-Path $OriginalPath) {
        Remove-Item -Path $OriginalPath -Recurse -Force
    }

    # Create NTFS Directory Junction
    cmd.exe /c "mklink /J `"$OriginalPath`" `"$PersistentPath`""
    Write-Host "Redirected $Folder -> $PersistentPath" -ForegroundColor Green
}

Write-Host "Folder redirection complete. All downloaded files will persist to host." -ForegroundColor Cyan

Creating the WSB Configuration File

Author Redirect_Sandbox.wsb with read-write folder mapping and automated execution:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxEnvironment\HostShare</HostFolder>
      <SandboxFolder>C:\HostData</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>C:\SandboxEnvironment</HostFolder>
      <SandboxFolder>C:\SandboxScripts</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:\SandboxScripts\Setup-Redirection.ps1 -TargetMount C:\HostData</Command>
  </LogonCommand>
</Configuration>

Running and Verifying Persistent Persistence

1. Double-click Redirect_Sandbox.wsb on your Windows 11 host.
2. Upon startup, Windows Sandbox mounts the shared directories and executes the redirection script.
3. Open File Explorer inside the sandbox and navigate to Downloads. Note the shortcut overlay icon indicating a junction point.
4. Download a test file or compile a binary inside the sandbox and save it into Downloads.
5. Inspect C:\SandboxEnvironment\HostShare\Downloads on your host machine to confirm that the file appears immediately.
6. Close Windows Sandbox. The volatile sandbox state is destroyed, but all captured files remain intact on your host drive.