How to Configure Windows Sandbox with Custom WSB Configuration Files for Isolated Testing

Testing unverified software packages, inspecting suspicious attachments, and developing scripts in an isolated sandbox prevents accidental host operating system corruption. While full virtual machines (Hyper-V, VirtualBox, VMware) require gigabytes of dedicated RAM, manual operating system installation, and ongoing maintenance, Windows Sandbox provides a lightweight disposable execution environment built directly on Hyper-V container technology. By authoring custom .wsb configuration files, administrators can automate folder mapping, enforce network boundaries, and execute automated logon staging scripts.

Windows Sandbox Architecture and Lifecycle Model

Windows Sandbox operates as an ephemeral container image dynamically synthesized from your existing host Windows 11 installation:

Feature Dimension	Standard Virtual Machine (Hyper-V / VMware)	Windows Sandbox (.wsb)
Disk Storage Footprint	20 GB – 50 GB static virtual disk per VM	Zero static image size; dynamically clones immutable host OS files
Memory Consumption	Static or dynamic RAM reservation (4GB – 16GB)	Dynamic working set; reclaimed immediately upon closure
Lifecycle Persistence	Persistent state retained across reboots	100% ephemeral; all files, registry entries, and downloads purged on exit
Startup Latency	30 – 60 seconds (full OS boot cycle)	Under 10 seconds to full interactive desktop

Enabling Windows Sandbox on Windows 11 Pro and Enterprise

Windows Sandbox requires Windows 11 Pro, Enterprise, or Education with CPU virtualization enabled in UEFI/BIOS:

1. Press Win + R, type optionalfeatures.exe, and press Enter.
2. Scroll down the features list and check Windows Sandbox and Virtual Machine Platform.
3. Click OK and restart your system when prompted.
4. Alternatively, enable the feature via elevated PowerShell:

   Enable-WindowsOptionalFeature -FeatureName 'Containers-DisposableClientVM' -All -Online

Authoring a Custom .wsb XML Configuration File

A Windows Sandbox configuration file is formatted in clean XML and saved with a .wsb extension. Double-clicking the file launches the sandbox pre-configured to your parameters.

Create a file named SecureTestEnvironment.wsb in your preferred editor:

<Configuration>
  <!-- Enable or Disable Virtual GPU rendering (Default: Default) -->
  <VGpu>Enable</VGpu>

  <!-- Enable or Disable Virtual Network Adapter (Disable for air-gapped malware analysis) -->
  <Networking>Enable</Networking>

  <!-- Map Host Folders into Sandbox -->
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Tools\Installers</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Installers</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>

  <!-- Execute Automated Command on First Interactive Logon -->
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\Users\WDAGUtilityAccount\Desktop\Installers\bootstrap.ps1</Command>
  </LogonCommand>

  <!-- Enable Virtual Audio Input (Default: Enable) -->
  <AudioInput>Disable</AudioInput>

  <!-- Enable Video Input Webcams (Default: Disable) -->
  <VideoInput>Disable</VideoInput>

  <!-- Enable Protected Client Isolation (Default: Disable) -->
  <ProtectedClient>Enable</ProtectedClient>

  <!-- Enforce Memory Limit in Megabytes (Windows 11 Build 22621+) -->
  <MemoryInMB>8192</MemoryInMB>
</Configuration>

Configuring Read-Only Mapped Folders and Air-Gapped Isolation

Two security directives in the .wsb schema provide critical containment guarantees:

• Air-Gapped Malware Quarantine: Setting <Networking>Disable</Networking> severs the virtual switch completely. The sandbox cannot contact local subnets, DNS resolvers, or public internet nodes, preventing untrusted binaries from establishing command-and-control communication.
• Read-Only Folder Protection: When mounting host directories (e.g., software installers or forensic tools), always declare <ReadOnly>true</ReadOnly>. This permits the sandbox guest user (WDAGUtilityAccount) to read and execute binaries while preventing malicious payloads or test scripts from writing to or modifying the host disk.

Automating Sandbox Bootstrapping with Logon Scripts

To automatically install testing tools (such as Sysinternals, Notepad++, or Python) whenever the sandbox starts:

1. In your host folder (e.g., C:\Tools\Installers), create a script named bootstrap.ps1:

   # bootstrap.ps1 - Staged in mapped host directory
   Set-ExecutionPolicy Bypass -Scope Process -Force
   
   # Create visual staging indicator on desktop
   New-Item -ItemType Directory -Path "$Home\Desktop\AnalysisWorkspace" -Force
   
   # Launch command prompt with custom environment variables
   Start-Process powershell -ArgumentList "-NoExit", "-Command", "Write-Host 'Sandbox Ready for Testing' -ForegroundColor Green"

2. Double-click your SecureTestEnvironment.wsb file.
3. Windows Sandbox spins up in seconds, mounts the host folder to the guest desktop, executes the bootstrap PowerShell script, and presents an interactive testbed ready for immediate analysis.