How to Configure Windows Sandbox Mapped SMB Share Hardening via XML in Windows 11

Windows Sandbox provides a disposable, hypervisor-isolated desktop environment for running untrusted software. Under the hood, the <MappedFolders> directive shares directories from the physical host to the sandbox container using internal Server Message Block (SMB) network redirects. However, in sensitive security analysis or malware reverse-engineering scenarios, an untrusted binary executing inside the sandbox might attempt to abuse local network protocols, negotiate weak SMB dialects, or launch Man-in-the-Middle (MitM) attacks against the virtual SMB channel. By enforcing strict SMB signing, guest authentication restrictions, and read-only folder policies in Windows 11, you can harden sandbox storage boundaries.

Understanding the Internal Sandbox SMB Architecture

When folders are mapped into Windows Sandbox:

• The host exposes a dedicated virtualized SMB share bound to the Hyper-V virtual switch.
• The sandbox container account (WDAGUtilityAccount) connects to this virtual share to mount directories at C:\SandboxFolder.
• If an attacker executes malicious code inside the sandbox, hardening the SMB client stack ensures the malware cannot tamper with data packets or traverse outside designated mapped boundaries.

Authoring the SMB Hardening Provisioning Script

Create a dedicated host folder (e.g. C:\SandboxSMBShare) and save a PowerShell provisioning script named HardenSmb.ps1:

# HardenSmb.ps1 - Enforce strict SMB security inside Windows Sandbox
Write-Host "Enforcing SMB client hardening..." -ForegroundColor Cyan

# 1. Require SMB Signing (Defends against packet tampering)
Set-SmbClientConfiguration -RequireSecuritySignature $true -Force
Write-Host "Mandatory SMB Signing enforced." -ForegroundColor Green

# 2. Disable Insecure Guest Logons
$lanmanPath = "HKLM:SYSTEMCurrentControlSetServicesLanmanWorkstationParameters"
Set-ItemProperty -Path $lanmanPath -Name "AllowInsecureGuestAuth" -Value 0 -Type DWord
Write-Host "Insecure guest authentications blocked." -ForegroundColor Green

# 3. Restrict SMB Protocol Dialects (Require SMB 3.1.1)
Set-SmbClientConfiguration -MinChannelProtocol "SMB 3.0.0" -Force
Write-Host "Minimum SMB protocol dialect set to SMB 3.0.0." -ForegroundColor Green

Write-Host "SMB transport security configuration complete." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named HardenedSmbSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>6144</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxSMBShare</HostFolder>
      <SandboxFolder>C:SecureShare</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:SecureShareHardenSmb.ps1</Command>
  </LogonCommand>
</Configuration>

Verifying SMB Connection Hardening Inside the Sandbox

To confirm that SMB protections are actively enforced:

1. Double-click HardenedSmbSandbox.wsb to boot the virtual container.
2. The PowerShell window executes and applies the hardened SMB configuration.
3. Inside the sandbox, inspect active SMB connection properties:

   Get-SmbConnection

4. Verify that the active connection to the host share indicates:
   • Dialect: 3.1.1
   • Signed: True
5. Attempt to modify or delete files inside C:\SecureShare. Verify that write access is immediately blocked by the <ReadOnly>true</ReadOnly> host constraint.