How to Configure Windows Sandbox Network QoS and Bandwidth Throttling via XML in Windows 11

Testing cloud applications, streaming software, and enterprise sync engines under realistic conditions often requires simulating constrained network environments (such as satellite links, throttled 3G/4G connections, or high-packet-loss environments). By default, Windows Sandbox connects to the host machine’s physical network adapter through an unthrottled virtual Hyper-V switch, achieving gigabit speeds. Using Windows Sandbox configuration (.wsb) files and PowerShell network QoS cmdlets, developers can build disposable test environments with strict bandwidth caps and traffic policies.

Understanding Windows Sandbox Networking and Hyper-V QoS

Windows Sandbox runs as a specialized container under the Windows Hypervisor platform:

• <Networking>Default</Networking>: Establishes a NAT interface communicating with the host.
• New-NetQosPolicy: PowerShell cmdlet that allows administrators to define maximum egress bandwidth limits, DSCP priority tags, and protocol filters directly within the Windows network stack.
• <LogonCommand>: Triggers automated configuration scripts immediately upon sandbox desktop initialization.

Authoring the Windows Sandbox WSB Configuration

Save the following configuration as Throttled_Network_Sandbox.wsb on your Windows 11 host:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxQoS</HostFolder>
      <SandboxFolder>C:QoS</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:QoSApply-QoSThrottle.ps1 -BandwidthLimitKB 512</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell QoS Throttling Script

In directory C:SandboxQoS on your host, create Apply-QoSThrottle.ps1 to enforce network constraints inside the sandbox:

param (
    [int]$BandwidthLimitKB = 512
)

Write-Host "Configuring Windows Sandbox Network QoS Throttling..." -ForegroundColor Cyan

# Remove existing QoS policies if present
Get-NetQosPolicy | Remove-NetQosPolicy -Confirm:$false -ErrorAction SilentlyContinue

# Convert KB to bits per second
$LimitBits = $BandwidthLimitKB * 1024 * 8

# Create new system-wide QoS policy capping outbound bandwidth
New-NetQosPolicy -Name "SandboxThrottle" -ThrottleRateActionBitsPerSecond $LimitBits -NetworkProfile All | Out-Null

Write-Host "Egress bandwidth throttled to: $BandwidthLimitKB KB/s ($($BandwidthLimitKB/1024) MB/s)" -ForegroundColor Green

# Display active QoS policy details
Get-NetQosPolicy -Name "SandboxThrottle" | Format-List Name, ThrottleRateActionBitsPerSecond, NetworkProfile

Write-Host "Network throttling is active. Launch testing utilities." -ForegroundColor Yellow

Running and Testing Network Constraints

1. Double-click Throttled_Network_Sandbox.wsb to boot the isolated Windows Sandbox instance.
2. The PowerShell window opens automatically upon logon, creating the QoS policy and clamping outbound throughput to 512 KB/s.
3. Launch a browser or run a command-line transfer inside the sandbox:

   curl.exe -o NUL https://speed.cloudflare.com/__down?bytes=50000000

4. Observe that transfer speeds remain strictly governed by the configured bandwidth cap.
5. Evaluate how client applications handle download pauses, buffer overflows, and reconnection attempts under constrained throughput.
6. Terminating the sandbox discards the temporary QoS policy without impacting host network throughput.