How to Configure Windows Sandbox Local Group Policy (LGPO) Templates via XML in Windows 11

Testing enterprise Group Policy configurations, CIS benchmark baselines, or Microsoft Security Compliance Toolkit templates requires an isolated environment where policy misconfigurations cannot compromise host system stability. While Windows Sandbox creates a pristine Windows 11 environment on every launch, it operates as a standalone workgroup machine detached from Active Directory Domain Services. By combining Windows Sandbox XML configuration (.wsb) files with Microsoft’s Local Group Policy Object (LGPO.exe) utility, administrators can automate the injection of full GPO baselines upon container launch.

Understanding LGPO.exe and Sandbox Policy Injection

Because Windows Sandbox resets to a clean snapshot upon termination, Group Policy settings cannot be persisted. Automating policy enforcement requires applying policy files during container initialization:

• LGPO.exe: Microsoft’s official command-line utility for importing and exporting Local Group Policy settings, including Computer Policy (registry.pol), User Policy, and Security Templates (GptTmpl.inf).
• <LogonCommand>: Directs Windows Sandbox to execute a bootstrap batch or PowerShell script immediately upon guest desktop session launch.
• <MappedFolder>: Mounts host directories containing policy templates, registry keys, and binaries directly into the sandbox filesystem.

Preparing the Host Directory Structure

Create a dedicated folder on your host machine at C:GPO_Testing with the following layout:

• C:GPO_TestingLGPO.exe: The Microsoft LGPO utility binary.
• C:GPO_TestingPolicyBackup: Contains exported GPO backup folders (with subdirectories containing registry.pol and GptTmpl.inf).
• C:GPO_TestingApply-Policies.ps1: The automation bootstrap script.

Authoring the Windows Sandbox WSB Profile

Save the following XML as Apply_GPO_Sandbox.wsb on your Windows 11 host:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Disable</Networking>
  <MemoryInMB>8192</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:GPO_Testing</HostFolder>
      <SandboxFolder>C:GPO_Deploy</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:GPO_DeployApply-Policies.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell Policy Injection Script

Save the following script as C:GPO_TestingApply-Policies.ps1:

Write-Host "Initialising Local Group Policy injection in Windows Sandbox..." -ForegroundColor Cyan

$LgpoExe = "C:GPO_DeployLGPO.exe"
$PolicyDir = "C:GPO_DeployPolicyBackup"

if (Test-Path $LgpoExe) {
    Write-Host "LGPO utility verified. Applying GPO baseline..." -ForegroundColor Green
    
    # 1. Import full GPO backup directory containing Computer and User policies
    if (Test-Path $PolicyDir) {
        & $LgpoExe /g $PolicyDir
        Write-Host "GPO backup directory imported successfully." -ForegroundColor Green
    }
    
    # 2. Force Group Policy background refresh
    Write-Host "Refreshing Local Group Policy engine..." -ForegroundColor Yellow
    gpupdate.exe /force | Out-Null
    
    # 3. Verify applied policies via gpresult
    Write-Host "Applied Policy Summary (Computer):" -ForegroundColor Cyan
    gpresult.exe /Scope Computer /R | Select-String "Applied Group Policy Objects" -Context 0, 5 | Write-Host
} else {
    Write-Error "LGPO.exe binary not found at $LgpoExe"
}

Write-Host "Policy configuration complete. Testing session is active." -ForegroundColor Green

Running and Validating Policy Enforcement

1. Double-click Apply_GPO_Sandbox.wsb to boot the isolated Windows Sandbox instance.
2. The PowerShell console automatically executes upon login, running LGPO.exe to import your computer and user security templates.
3. To verify specific policy settings interactively:
   • Press Win+R, type gpedit.msc, and press Enter to launch the Local Group Policy Editor.
   • Navigate to Computer Configuration > Windows Settings > Security Settings to review imported password complexities, audit policies, and user right assignments.
4. Execute test binaries, installers, or scripts within the constrained sandbox environment to confirm policy compliance.
5. Close the sandbox window to destroy all policy changes, leaving the host Windows 11 system unaltered.