How to Configure Windows Sandbox Startup Scripts and Networking Using WSB Files

Windows Sandbox provides an isolated, lightweight desktop environment ideal for safely testing untrusted software, debugging code, and running isolated web sessions. Because Windows Sandbox is completely ephemeral—discarding all files, state, and registry changes upon closing—setting up testing environments manually every time you launch a sandbox is inefficient. By utilizing Windows Sandbox configuration files (.wsb), developers and security researchers can automate folder mapping, network isolation, and startup script execution.

Understanding the Structure of .wsb Configuration Files

A Windows Sandbox configuration file is a simple XML document with a .wsb extension. When double-clicked, Windows Sandbox launches and interprets the XML directives. Key configurable nodes include:

• <VGpu>: Enables or disables hardware GPU acceleration (Enable or Disable).
• <Networking>: Controls internet access inside the sandbox (Enable or Disable). Disabling networking is critical for malware detonation.
• <MappedFolders>: Maps host file system directories into the sandbox with read-only or read-write permissions.
• <LogonCommand>: Executes a command, batch script, or PowerShell script automatically upon user logon.
• <MemoryInMB>: Specifies the maximum RAM allocation for the sandbox.

Creating a Tailored .wsb Configuration File

Follow these steps to create an automated developer sandbox environment:

1. Open Notepad or your code editor on Windows 11.
2. Enter the following XML configuration structure:

   <Configuration>
     <VGpu>Enable</VGpu>
     <Networking>Enable</Networking>
     <MappedFolders>
       <MappedFolder>
         <HostFolder>C:\SandboxTools</HostFolder>
         <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Tools</SandboxFolder>
         <ReadOnly>true</ReadOnly>
       </MappedFolder>
     </MappedFolders>
     <LogonCommand>
       <Command>powershell.exe -ExecutionPolicy Bypass -File C:\Users\WDAGUtilityAccount\Desktop\Tools\setup.ps1</Command>
     </LogonCommand>
   </Configuration>

3. Save the file with a .wsb extension (e.g., DevEnvironment.wsb). Ensure the save dialog is set to All Files (*.*) so Notepad does not append .txt.

Building an Automated Setup Script

In your mapped host directory (e.g., C:\SandboxTools), create the setup.ps1 script referenced by the <LogonCommand>:

# Install development tools using winget inside the sandbox:
winget install -e --id Microsoft.VisualStudioCode --accept-package-agreements --accept-source-agreements
winget install -e --id Git.Git --accept-package-agreements --accept-source-agreements
winget install -e --id Node.js --accept-package-agreements --accept-source-agreements

# Configure test environment variables:
[System.Environment]::SetEnvironmentVariable("NODE_ENV", "development", "Machine")

Creating an Isolated Offline Malware Analysis Profile

For testing suspicious binaries without risking network contagion or command-and-control communication, configure a zero-network sandbox:

<Configuration>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\MalwareSamples</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Samples</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Launching and Testing Configuration Profiles

To run your configured sandbox:

• Double-click the .wsb file in Windows File Explorer.
• Windows Sandbox spins up in seconds, mounts the specified host folder onto the virtual desktop, and executes the logon command automatically.
• When testing concludes, closing the sandbox window instantly purges all changes, leaving the host operating system completely untouched.

Configuring customized .wsb profiles transforms Windows Sandbox into a rapid, repeatable, and secure workspace for developers and IT professionals.