How to Configure Windows Sandbox, Custom WSB Configuration Files, and Isolated Script Execution in Windows 11

Software developers, cybersecurity analysts, and system administrators frequently need to execute untrusted binaries, inspect suspicious attachments, or test deployment scripts without risking host operating system corruption. Historically, this required spinning up bulky virtual machines using third-party hypervisors, consuming significant storage capacity and requiring independent Windows licensing. Windows 11 resolves this natively through Windows Sandbox.

Windows Sandbox provides a lightweight, disposable desktop environment isolated from the host via Hyper-V hardware virtualization. Using dynamic base image generation, the sandbox mounts a pristine copy of the host’s existing Windows 11 operating system without consuming separate virtual disk space. By authoring custom Windows Sandbox Configuration (.wsb) files, administrators can map host folders into the sandbox as read-only volumes, control GPU and networking capabilities, and automate isolated script execution upon startup.

Architectural Overview: The Windows Sandbox Execution Engine

Windows Sandbox combines container isolation with hypervisor-enforced hardware security:

Subsystem	Architectural Implementation	Security Boundary
Base Image Generation	Dynamic Base Image (links to clean host system files).	Host operating system packages are mounted read-only; mutations are redirected to disposable scratch space.
Kernel Isolation	Micro-Hypervisor partition (Hyper-V).	A dedicated guest kernel runs independently; kernel panics or driver crashes inside the sandbox cannot affect the host.
Snapshot Lifecycle	Stateless memory execution.	Every sandbox session begins from an absolute clean state; all files, registries, and downloaded binaries are permanently discarded upon exit.
Integrated Scheduler	Direct Host Kernel Scheduler integration.	Host OS manages guest CPU thread dispatching dynamically, ensuring optimal power efficiency and zero idle overhead.
Virtual GPU (vGPU)	Hardware-accelerated graphics partitioning.	DirectX rendering commands are paravirtualized and safely marshalled to the physical GPU.

Enabling Windows Sandbox in Windows 11 via PowerShell

Windows Sandbox is included with Windows 11 Pro, Enterprise, and Education editions. It requires a 64-bit processor with virtualization enabled in system BIOS/UEFI.

Step 1: Install the Windows Optional Feature

Open an elevated PowerShell prompt as Administrator and execute:

# Enable Windows Sandbox feature
Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -NoRestart

# Enable Hyper-V hypervisor prerequisites if not already active
Enable-WindowsOptionalFeature -Online -FeatureName "Microsoft-Hyper-V-Hypervisor" -NoRestart

Step 2: Reboot the Workstation

Restart the computer to activate virtualization container hooks:

Restart-Computer

Authoring Custom .wsb XML Configuration Files

While launching Windows Sandbox from the Start Menu creates a generic default instance, double-clicking a custom .wsb configuration file deploys a tailored sandbox environment with pre-mapped folders and automated startup commands.

Step 1: Structure the XML Configuration Schema

Create a dedicated directory for your analysis lab (e.g. C:\SandboxLab) and create a configuration file named MalwareAnalysis.wsb:

<Configuration>
  <!-- Hardware and Networking Isolation -->
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MemoryInMB>4096</MemoryInMB>
  <AudioInput>Disable</AudioInput>
  <VideoInput>Disable</VideoInput>
  <ProtectedClient>Enable</ProtectedClient>
  <ClipboardRedirection>Disable</ClipboardRedirection>
  <PrinterRedirection>Disable</PrinterRedirection>

  <!-- Mapped Shared Folders -->
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxLab\Payloads</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TargetPayloads</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
    <MappedFolder>
      <HostFolder>C:\SandboxLab\Tools</HostFolder>
      <SandboxFolder>C:\Tools</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>

  <!-- Automated Logon Script Execution -->
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File "C:\Tools\Initialize-Lab.ps1"</Command>
  </LogonCommand>
</Configuration>

Step 2: Understand Key Configuration Parameters

• <Networking>Disable</Networking>: Completely severs virtual network connectivity, preventing untrusted scripts from exfiltrating data or beaconing to command-and-control servers.
• <ReadOnly>true</ReadOnly>: Protects host storage folders from being encrypted or altered by malicious payloads inside the sandbox.
• <ProtectedClient>Enable</ProtectedClient>: Applies additional Remote Desktop Protocol (RDP) sandboxing mitigations against guest-to-host escapes.
• WDAGUtilityAccount: The default internal user account context under which Windows Sandbox operates.

Automating Script Bootstrapping on Sandbox Startup

You can automate tool installation and environment preparation using a PowerShell bootstrap script mapped into the sandbox.

Step 1: Write the Initialization Script

Create C:\SandboxLab\Tools\Initialize-Lab.ps1 on your host workstation:

# Initialize analysis environment inside Windows Sandbox
Write-Host "Initialising Isolated Analysis Environment..." -ForegroundColor Cyan

# Unhide file extensions and system files in File Explorer
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "HideFileExt" -Value 0
Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" -Name "Hidden" -Value 1

# Launch diagnostic process monitor from mapped tools
if (Test-Path "C:\Tools\Procmon64.exe") {
    Start-Process -FilePath "C:\Tools\Procmon64.exe" -ArgumentList "/AcceptEula /BackingFile C:\Users\WDAGUtilityAccount\Desktop\trace.pml"
}

Write-Host "Sandbox ready for safe payload inspection." -ForegroundColor Green

Step 2: Launch the Configured Sandbox

Double-click MalwareAnalysis.wsb in File Explorer. Windows Sandbox initializes in seconds, disables networking, mounts the toolset, and executes the PowerShell script automatically.

Troubleshooting Windows Sandbox Failures in Windows 11

Consult this diagnostic reference table to debug sandbox initialization errors and configuration faults:

Error Code / Symptom	Underlying Root Cause	Remediation Procedure
Error 0x80070002 / 0x80070057: Configuration file is invalid	XML syntax error, unclosed tags, or mapped host folders do not exist on the host machine.	Verify the .wsb file in an XML editor. Confirm that all paths defined under <HostFolder> exist on the host filesystem prior to launching.
Error 0xc0350024: Virtualization support is disabled	Intel VT-x or AMD-V CPU virtualization is disabled in motherboard firmware settings.	Reboot into BIOS/UEFI settings and enable CPU Virtualization and Second Level Address Translation (SLAT).
Error 0x800705b4: Windows Sandbox failed to start	Conflicts with nested third-party hypervisors (e.g. VMware Workstation, VirtualBox) or pending Windows Updates.	Ensure third-party hypervisors use the Windows Hypervisor Platform (WHP) API. Complete pending Windows Update reboots on the host.
Logon script fails with execution policy restriction.	PowerShell script execution restricted by default guest policy.	Include -ExecutionPolicy Bypass in the <Command> string inside <LogonCommand>.
Black screen or graphics glitching inside the sandbox window.	Virtual GPU paravirtualization conflict with host display drivers.	Set <VGpu>Disable</VGpu> in the .wsb file to force software rasterization (WARP), or update physical graphics drivers on the host.

Configuring Windows Sandbox with custom WSB files enables security teams and software engineers to conduct rapid, isolated testing within a pristine Windows 11 container, guaranteeing total host environment integrity and zero persistent risk.