How to Configure Windows Sandbox Virtualized Isolated User Mode (IUM) via XML in Windows 11

In modern Windows enterprise operating systems, Virtualization-Based Security (VBS) uses hardware virtualization features (Hyper-V) to create a secure memory enclave separate from the standard Windows operating system kernel. Operating within this secure realm (Virtual Secure Mode, or VSM) is Isolated User Mode (IUM), which hosts secure processes known as "trustlets"—including Credential Guard (LsaIso.exe) and virtual TPM operations. When evaluating security tools, simulating kernel rootkit defenses, or developing cryptographic trustlets, engineers can configure nested virtualization inside Windows Sandbox to test IUM trustlets cleanly in Windows 11.

Understanding Virtual Secure Mode (VSM) and Trustlet Architecture

VBS divides the operating system memory into distinct Virtual Trust Levels (VTL):

• VTL 0 (Normal World): Houses the standard Windows kernel, drivers, Win32 subsystems, and standard user applications.
• VTL 1 (Secure World): Houses the Secure Kernel, Isolated User Mode (IUM), and security trustlets. Even if a zero-day vulnerability grants an attacker full kernel execution rights in VTL 0, hardware memory masking prevents reading or modifying VTL 1 memory.
• Credential Guard: Isolates NTLM password hashes and Kerberos tickets inside VTL 1 trustlets, rendering memory dumping attacks completely ineffective.

Authoring the VBS Provisioning Script

Create a dedicated host folder (e.g. C:\SandboxVBS) and save a PowerShell script named InitVBS.ps1:

# InitVBS.ps1 - Configure Virtualization-Based Security and IUM inside Windows Sandbox
Write-Host "Configuring Virtual Secure Mode and Isolated User Mode..." -ForegroundColor Cyan

$vbsPath = "HKLM:SYSTEMCurrentControlSetControlDeviceGuard"
if (-not (Test-Path $vbsPath)) { New-Item -Path $vbsPath -Force | Out-Null }

# Enable Virtualization Based Security
Set-ItemProperty -Path $vbsPath -Name "EnableVirtualizationBasedSecurity" -Value 1 -Type DWord
Set-ItemProperty -Path $vbsPath -Name "RequirePlatformSecurityFeatures" -Value 1 -Type DWord # 1 = Secure Boot, 2 = Secure Boot + DMA

# Enable Credential Guard in Isolated User Mode
$lsaPath = "HKLM:SYSTEMCurrentControlSetControlLsa"
Set-ItemProperty -Path $lsaPath -Name "LsaCfgFlags" -Value 1 -Type DWord # 1 = Enabled with UEFI lock

Write-Host "VBS and IUM configuration registered. Registry keys applied." -ForegroundColor Green

Constructing the WSB Configuration File

Create an XML configuration file named VbsSandbox.wsb on your desktop:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Default</Networking>
  <MemoryInMB>8192</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxVBS</HostFolder>
      <SandboxFolder>C:VBSConfig</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -NoExit -ExecutionPolicy Bypass -File C:VBSConfigInitVBS.ps1</Command>
  </LogonCommand>
</Configuration>

Verifying VBS and Trustlet Status Inside the Sandbox

To inspect security enclave properties inside Windows Sandbox:

1. Double-click VbsSandbox.wsb to boot the virtual container.
2. The PowerShell window executes and verifies registry provisioning.
3. Open System Information inside the sandbox by running msinfo32.exe.
4. Scroll down to the bottom of the System Summary view.
5. Examine the Virtualization-based security entries. Verify that Virtualization-based security Services Configured displays Credential Guard.
6. Open PowerShell and inspect active processes: Get-Process LsaIso -ErrorAction SilentlyContinue. Confirm that the isolated LSA trustlet process entity is present.