How to Configure Windows Sandbox Script and Shell Restrictions via XML in Windows 11

Windows Sandbox provides an isolated, disposable container for inspecting suspicious software packages, testing installers, and executing untrusted web downloads. However, security researchers and enterprise red teams frequently need to test attack vectors or compliance hardening by evaluating how malicious files execute when legacy Windows scripting engines—such as Windows Script Host (wscript.exe, cscript.exe), legacy JScript (mshtml.dll), and unconstrained PowerShell—are locked down. By combining .wsb XML configuration with automated registry provisioning scripts, you can enforce hardened script restriction boundaries inside Windows Sandbox in Windows 11.

Understanding Script Host Lockdown Vectors

Restricting script execution inside Windows Sandbox targets three primary execution layers:

• Windows Script Host (WSH): Disabling WSH completely prevents .vbs, .js, and .wsf scripts from running.
• PowerShell Constrained Language Mode (CLM): Restricts PowerShell to basic cmdlets, preventing direct .NET object instantiation, memory manipulation, and COM object invocations.
• Office/Macro Simulation: Blocking COM activation of legacy scripting components stops common maldoc execution chains.

Authoring the Script Restriction Provisioning Script

Create a dedicated host directory (e.g. C:\SandboxHardening) and save a PowerShell script named HardeningScript.ps1:

# HardeningScript.ps1 - Enforce script restrictions inside Windows Sandbox
Write-Host "Enforcing script engine restrictions..." -ForegroundColor Cyan

# 1. Disable Windows Script Host globally (Blocks wscript.exe and cscript.exe)
$wshPath = "HKLM:SOFTWAREMicrosoftWindows Script HostSettings"
if (-not (Test-Path $wshPath)) { New-Item -Path $wshPath -Force | Out-Null }
Set-ItemProperty -Path $wshPath -Name "Enabled" -Value 0 -Type DWord
Write-Host "Windows Script Host disabled." -ForegroundColor Green

# 2. Enforce PowerShell Constrained Language Mode system-wide
[Environment]::SetEnvironmentVariable("__PSLockdownPolicy", "4", "Machine")
Write-Host "PowerShell Constrained Language Mode enforced." -ForegroundColor Green

# 3. Disable JScript and VBScript COM activation
$jscriptPath = "HKLM:SOFTWAREMicrosoftInternet ExplorerActiveX Compatibility{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}"
if (-not (Test-Path $jscriptPath)) { New-Item -Path $jscriptPath -Force | Out-Null }
Set-ItemProperty -Path $jscriptPath -Name "Compatibility Flags" -Value 0x400 -Type DWord

Write-Host "Script engine hardening applied successfully." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named HardenedScriptSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxHardening</HostFolder>
      <SandboxFolder>C:Hardening</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:HardeningHardeningScript.ps1</Command>
  </LogonCommand>
</Configuration>

Testing Script Blocking Inside the Sandbox

To verify that script restrictions are operating effectively:

1. Double-click HardenedScriptSandbox.wsb to boot the sandbox container.
2. The PowerShell window executes and applies the registry restrictions.
3. Create a test script on the sandbox desktop: test.vbs containing MsgBox "Hello".
4. Double-click test.vbs. Windows immediately blocks execution with an explicit error:

   Windows Script Host access is disabled on this machine. Contact your administrator for details.

5. Open a new PowerShell terminal inside the sandbox and inspect $ExecutionContext.SessionState.LanguageMode. Confirm that it evaluates to ConstrainedLanguage.