How to Configure Windows Sandbox Mapped Folders in Windows 11 Using PowerShell

Windows Sandbox provides a disposable, isolated desktop environment for safely running untrusted applications and inspecting suspicious files in Windows 11. While launching the sandbox through the Start menu opens a blank virtual machine, creating tailored Windows Sandbox configuration (.wsb) files allows administrators to mount host folders as read-only or read-write drives and automate bootstrap commands on launch. Generating these files via PowerShell streamlines isolated lab testing.

Understanding Windows Sandbox Configuration Architecture

A Windows Sandbox configuration is an XML-formatted document saved with a .wsb extension. It supports several key customization parameters:

• <MappedFolders>: Mounts host file system directories into the container’s virtual desktop.
• <ReadOnly>: Accepts true or false to prevent sandboxed processes from altering host files.
• <LogonCommand>: Defines an automated command or script executed immediately upon sandbox boot.
• <Networking>: Accepts Disable to sever all container network access for air-gapped malware analysis.

Generating Custom WSB Configurations via PowerShell

Open an elevated PowerShell prompt and run the following script to create a secure mapped testing environment:

# Define workspace paths
$hostShare = "C:\SandboxTools"
$wsbFilePath = "$HOME\Desktop\SecureSandbox.wsb"

# Ensure host directory exists
if (-not (Test-Path $hostShare)) {
    New-Item -ItemType Directory -Path $hostShare -Force | Out-Null
}

# Construct XML configuration payload
$wsbContent = @"
<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Enable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>$hostShare</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Tools</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\Tools</Command>
  </LogonCommand>
</Configuration>
"@

# Write XML payload to desktop
Set-Content -Path $wsbFilePath -Value $wsbContent -Encoding UTF8
Write-Host "Sandbox configuration successfully generated at $wsbFilePath" -ForegroundColor Green

This automated generator mounts the host C:\SandboxTools folder directly onto the sandbox desktop with strict read-only protection and launches File Explorer immediately upon logon.

Launching and Automating the Sandbox Instance

To start your configured sandbox directly from PowerShell:

Start-Process "$HOME\Desktop\SecureSandbox.wsb"

The disposable sandbox initializes within seconds, providing immediate access to your diagnostic utilities without exposing your host operating system to unintended modifications.