How to Configure Windows Sandbox Custom System Font Injection via XML in Windows 11

Testing enterprise desktop software, typography-heavy design applications, or internationalized localized interfaces inside Windows Sandbox often encounters rendering issues when required corporate typefaces, custom barcode fonts, or specialized OpenType/TrueType fonts are absent. Because Windows Sandbox boots from a pristine, minimal Windows 11 base image, it includes only standard system fonts (such as Segoe UI, Arial, and Times New Roman). Using Windows Sandbox configuration (.wsb) XML profiles paired with PowerShell font registration scripts, developers can inject custom system fonts dynamically upon container launch.

Understanding Windows 11 Font Registration Architecture

Font installation in Windows requires coordinating filesystem placement and registry enumeration:

• C:WindowsFonts: The system-wide font storage directory. Copying font files here makes them accessible across all security contexts.
• HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionFonts: The registry store where the Windows graphics subsystem enumerates active font families. Simply copying a font file without writing the registry record leaves the font invisible to applications.
• AddFontResource: The Windows GDI API function that notifies active applications of newly registered fonts without requiring a system reboot.
• <LogonCommand>: Directs Windows Sandbox to execute font deployment scripts immediately upon session initialization.

Preparing Font Assets on the Host Machine

Create a dedicated folder on your Windows 11 host at C:SandboxFonts containing:

• CustomCorporate-Regular.ttf: TrueType font file.
• CustomCorporate-Bold.otf: OpenType font file.
• Install-Fonts.ps1: The automation bootstrap script.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as Font_Deploy_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxFonts</HostFolder>
      <SandboxFolder>C:FontAssets</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:FontAssetsInstall-Fonts.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Font Registration Script

In directory C:SandboxFonts on your host, create Install-Fonts.ps1:

Write-Host "Initialising Windows Sandbox Custom Font Deployment..." -ForegroundColor Cyan

$FontSourceDir = "C:FontAssets"
$SystemFontsDir = "C:WindowsFonts"
$RegistryFontsPath = "HKLM:SOFTWAREMicrosoftWindows NTCurrentVersionFonts"

# Locate TrueType and OpenType font files
$FontFiles = Get-ChildItem -Path $FontSourceDir -Include "*.ttf", "*.otf" -Recurse

if ($FontFiles.Count -gt 0) {
    foreach ($Font in $FontFiles) {
        $DestPath = Join-Path $SystemFontsDir $Font.Name
        
        # 1. Copy font binary to C:WindowsFonts
        Copy-Item -Path $Font.FullName -Destination $DestPath -Force
        
        # 2. Register font in Registry
        $FontName = [System.IO.Path]::GetFileNameWithoutExtension($Font.Name)
        $RegValue = $Font.Name
        
        # Suffix for TrueType vs OpenType
        if ($Font.Extension -eq ".ttf") {
            $FontEntry = "$FontName (TrueType)"
        } else {
            $FontEntry = "$FontName (OpenType)"
        }
        
        Set-ItemProperty -Path $RegistryFontsPath -Name $FontEntry -Value $RegValue -Type String
        Write-Host "Registered: $FontEntry" -ForegroundColor Green
    }
    
    # 3. Notify Windows GDI Subsystem of Font Changes
    Add-Type -TypeDefinition @"
    using System;
    using System.Runtime.InteropServices;
    public class FontHelper {
        [DllImport("gdi32.dll")]
        public static extern int AddFontResource(string lpFileName);
        [DllImport("user32.dll")]
        public static extern int SendMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam);
    }
"@
    foreach ($Font in $FontFiles) {
        $DestPath = Join-Path $SystemFontsDir $Font.Name
        [FontHelper]::AddFontResource($DestPath) | Out-Null
    }
    # Broadcast WM_FONTCHANGE message (0x001D) to all top-level windows
    [FontHelper]::SendMessage([IntPtr]0xffff, 0x001D, [IntPtr]0, [IntPtr]0) | Out-Null
    
    Write-Host "Font notification broadcast complete. Fonts available system-wide." -ForegroundColor Green
} else {
    Write-Warning "No .ttf or .otf font files found in $FontSourceDir"
}

# 4. Display confirmation
Write-Host "Font deployment complete. Launch applications to verify typography." -ForegroundColor Cyan

Running and Verifying Typography in the Sandbox

1. Double-click Font_Deploy_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in seconds.
3. The PowerShell window opens automatically upon logon, copies the font files to C:WindowsFonts, creates the required registry values, and broadcasts the WM_FONTCHANGE notification.
4. Launch WordPad or Notepad inside the sandbox, open the font picker, and verify that your custom corporate font families appear in the list.
5. Closing Windows Sandbox terminates the session, completely purging all injected fonts without modifying the host machine’s font registry.