How to Configure Windows Sandbox Custom Local Administrator Password via XML in Windows 11

By default, Windows Sandbox in Windows 11 logs into an interactive desktop session using an unauthenticated local user profile named WDAGUtilityAccount without an active password. While this passwordless design facilitates rapid disposable testing, it presents significant obstacles when testing client-server software, database services, or remote administration tools (such as OpenSSH Server, WinRM, or SQL Server LocalDB) that require authenticated Windows credentials or explicit local administrator accounts. Using Windows Sandbox configuration (.wsb) XML profiles paired with PowerShell logon commands, systems administrators can create dedicated local administrator accounts and assign secure passwords upon container launch.

Understanding Windows Sandbox Account Architecture

Windows Sandbox operates with constrained local user security boundaries:

• WDAGUtilityAccount: The default built-in user account generated dynamically for Windows Defender Application Guard and Windows Sandbox containers. Operates with administrative privileges but lacks an assigned password.
• net user and New-LocalUser: PowerShell cmdlets utilized to provision new local user accounts, configure password expiration policies, and add accounts to the local Administrators group.
• <LogonCommand>: Directs Windows Sandbox to execute provisioning scripts immediately upon desktop session initialization before launching background testing services.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as Auth_Admin_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxAdminAssets</HostFolder>
      <SandboxFolder>C:AdminDeploy</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:AdminDeployConfigure-AdminAccount.ps1 -AdminUser "SandboxAdmin" -PlainPassword "SecureP@ssw0rd2026!"</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Account Provisioning Script

In directory C:SandboxAdminAssets on your host, create Configure-AdminAccount.ps1:

param (
    [string]$AdminUser = "SandboxAdmin",
    [string]$PlainPassword = "SecureP@ssw0rd2026!"
)

Write-Host "Initialising Windows Sandbox Local Administrator Account..." -ForegroundColor Cyan

# 1. Convert plain password to SecureString
$SecurePass = ConvertTo-SecureString $PlainPassword -AsPlainText -Force

# 2. Check if account already exists
$ExistingUser = Get-LocalUser -Name $AdminUser -ErrorAction SilentlyContinue

if (-not $ExistingUser) {
    # Create new local user with non-expiring password
    New-LocalUser -Name $AdminUser -Password $SecurePass -FullName "Sandbox Administrator" -Description "Authenticated administrative account for service testing" -PasswordNeverExpires | Out-Null
    
    # Add user to local Administrators security group
    Add-LocalGroupMember -Group "Administrators" -Member $AdminUser | Out-Null
    
    Write-Host "Local user $AdminUser created and granted Administrator privileges." -ForegroundColor Green
} else {
    # Update password on existing user
    Set-LocalUser -Name $AdminUser -Password $SecurePass
    Write-Host "Password updated for existing user $AdminUser." -ForegroundColor Green
}

# 3. Enable and assign password to built-in Administrator account if desired
$BuiltInAdmin = Get-LocalUser -Name "Administrator" -ErrorAction SilentlyContinue
if ($BuiltInAdmin) {
    Enable-LocalUser -Name "Administrator" | Out-Null
    Set-LocalUser -Name "Administrator" -Password $SecurePass | Out-Null
    Write-Host "Built-in Administrator account enabled with custom credentials." -ForegroundColor Green
}

# 4. Display user status
Write-Host "Current Local Users in Sandbox:" -ForegroundColor Yellow
Get-LocalUser | Format-Table Name, Enabled, PasswordRequired, PasswordNeverExpires

Write-Host "Account provisioning complete. Services may now authenticate locally." -ForegroundColor Cyan

Running and Verifying Authenticated Services

1. Double-click Auth_Admin_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in seconds.
3. The PowerShell window opens automatically upon logon, creates the SandboxAdmin account, adds it to the local Administrators group, and displays the user status table.
4. Test local credential validation using runas or authenticating against a local database:

   runas /user:SandboxAdmin cmd.exe

   Enter the configured password to launch an authenticated command prompt.
5. Closing Windows Sandbox terminates the session, completely purging all user accounts and passwords from host memory.