How to Configure Windows Sandbox Memory Dump and Crash Diagnostics via XML in Windows 11

Windows Sandbox provides an ideal disposable test bed for evaluating unstable drivers, pre-release software builds, and untrusted binaries. However, because Windows Sandbox automatically destroys all virtual disks and RAM state upon closing, diagnosing unexpected application crashes or kernel panics (BSOD) presents a unique challenge: all diagnostic dump files (.dmp) are wiped before developers can extract them. By integrating mapped host directories, automated registry dump configuration, and PowerShell logon scripts, you can capture full user-mode memory dumps directly to your physical host storage in Windows 11.

Understanding Windows Error Reporting (WER) Dump Scope

Windows Error Reporting (WER) can be configured via the Windows Registry to automatically generate Local Dumps whenever any process terminates abnormally. By directing WER’s DumpFolder to a mapped host directory, crash artifacts survive container termination intact.

Authoring the Crash Diagnostic Provisioning Script

Create a dedicated host folder (e.g. C:\SandboxTelemetry) and save a PowerShell script named InitDiagnostics.ps1:

# InitDiagnostics.ps1 - Configure crash dump persistence
Write-Host "Configuring automated Windows Error Reporting dumps..." -ForegroundColor Cyan

$werPath = "HKLM:SOFTWAREMicrosoftWindowsWindows Error ReportingLocalDumps"

if (-not (Test-Path $werPath)) {
    New-Item -Path $werPath -Force | Out-Null
}

# Configure dump folder pointing to mapped host directory
Set-ItemProperty -Path $werPath -Name "DumpFolder" -Value "C:CrashOutput" -Type ExpandString
Set-ItemProperty -Path $werPath -Name "DumpCount" -Value 10 -Type DWord
Set-ItemProperty -Path $werPath -Name "DumpType" -Value 2 -Type DWord # 2 = Full Dump, 1 = MiniDump

Write-Host "WER LocalDumps configured. Target: C:CrashOutput" -ForegroundColor Green

Constructing the Diagnostics WSB Configuration File

Create an XML configuration file named DiagnosticSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>8192</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxTelemetry</HostFolder>
      <SandboxFolder>C:CrashOutput</SandboxFolder>
      <ReadOnly>false</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:CrashOutputInitDiagnostics.ps1</Command>
  </LogonCommand>
</Configuration>

Simulating a Crash and Verifying Dump Capture

To verify that crash artifacts are captured successfully to your physical host:

1. Double-click DiagnosticSandbox.wsb to boot the sandbox environment.
2. Inside the sandbox, simulate a deliberate application crash via PowerShell:

   Stop-Process -Id $PID -Force

3. Alternatively, launch your unstable test application inside the sandbox. When an unhandled exception or crash occurs, Windows Error Reporting immediately writes a complete .dmp file to C:\CrashOutput.
4. Switch to your physical Windows 11 host machine. Open C:\SandboxTelemetry in File Explorer and confirm that the timestamped .dmp memory dump file is present and readable.
5. Open the captured dump file on your host machine using WinDbg or Visual Studio to analyze the crash stack trace, registers, and memory state.