How to Configure Windows Sandbox Custom DNS Suffix and WINS Search Orders via XML in Windows 11

In enterprise Windows 11 environments, testing software that relies on internal corporate domains, Active Directory domain controllers, and private microservice clusters requires custom DNS resolution. By default, Windows Sandbox receives dynamic IPv4 configuration via an internal Hyper-V Virtual Switch NAT adapter, inheriting basic host DNS forwarding but lacking enterprise-specific DNS search lists, primary DNS suffixes, and NetBIOS name resolution. System administrators can configure custom DNS search orders and network parameters inside disposable Windows Sandbox instances using custom .wsb configuration files and PowerShell bootstrap scripts.

Understanding Windows Sandbox Networking Modes

The networking node within a .wsb configuration file dictates how the guest container communicates with external networks:

• <Networking>Default</Networking>: Connects the container to an internal NAT virtual switch with dynamic DHCP lease allocation.
• <Networking>Disable</Networking>: Isolates the container completely, disabling virtual network adapters and preventing inbound/outbound packets.
• DNS Suffix Search List: Allows short-name hostname resolution (e.g., resolving git-server instead of git-server.corp.internal.net) by appending configured domain suffixes sequentially during DNS queries.

Authoring the Windows Sandbox XML Profile

Create a sandbox profile named Enterprise_Network_Test.wsb. This configuration mounts a deployment folder containing configuration scripts and automatically executes network customisation upon startup:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxScriptsNetworkConfig</HostFolder>
      <SandboxFolder>C:NetworkConfig</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:NetworkConfigConfigure-DnsSettings.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Network Customisation Script

In host directory C:SandboxScriptsNetworkConfig, save Configure-DnsSettings.ps1. This script configures DNS suffixes, sets primary DNS servers, and disables NetBIOS fallback:

Write-Host "Configuring Windows Sandbox Enterprise DNS Settings..." -ForegroundColor Cyan

# Locate primary Hyper-V virtual network adapter
$Adapter = Get-NetAdapter | Where-Object { $_.Status -eq "Up" } | Select-Object -First 1

if ($Adapter) {
    Write-Host "Configuring adapter: $($Adapter.Name)" -ForegroundColor Green
    
    # Define corporate DNS server addresses
    $DnsServers = @("10.0.10.4", "10.0.10.5")
    Set-DnsClientServerAddress -InterfaceAlias $Adapter.Name -ServerAddresses $DnsServers
    
    # Configure global DNS Suffix Search List via Registry
    $DnsRegPath = "HKLM:SYSTEMCurrentControlSetServicesTcpipParameters"
    $SearchList = "corp.internal.net,dev.internal.net,sandbox.local"
    
    Set-ItemProperty -Path $DnsRegPath -Name "SearchList" -Value $SearchList -Type String
    Set-ItemProperty -Path $DnsRegPath -Name "NV Domain" -Value "corp.internal.net" -Type String
    
    # Disable NetBIOS over TCP/IP (WINS) to prevent broadcast delays
    $NetAdapterConfig = Get-CimInstance -ClassName Win32_NetworkAdapterConfiguration | Where-Object { $_.IPEnabled -eq $true }
    foreach ($Config in $NetAdapterConfig) {
        $Config | Invoke-CimMethod -MethodName SetTcpipNetbios -Arguments @{ TcpipNetbiosOptions = 2 } | Out-Null
    }
    
    Write-Host "Enterprise DNS suffix list set: $SearchList" -ForegroundColor Green
    Write-Host "NetBIOS over TCP/IP disabled." -ForegroundColor Green
} else {
    Write-Error "No active network adapter found in Windows Sandbox."
}

# Verify configuration with ipconfig /all
Write-Host "Displaying Current DNS Configuration:" -ForegroundColor Yellow
ipconfig.exe /all | Select-String "DNS Suffix Search List", "DNS Servers", "NetBIOS over Tcpip" | Write-Host

Testing and Validating Internal DNS Resolution

1. Double-click Enterprise_Network_Test.wsb on your Windows 11 host.
2. Upon container logon, the PowerShell window automatically configures the network adapter and displays the active search list.
3. Test short-name resolution in the sandbox command prompt:

   Resolve-DnsName -Name internal-api

   The resolver automatically iterates through internal-api.corp.internal.net and internal-api.dev.internal.net.
4. Perform an HTTP request to internal enterprise microservices:

   curl.exe https://internal-api/healthz

5. Close the sandbox window to discard all temporary network configurations, preserving the integrity of the host network adapter.