How to Configure Windows Sandbox Custom Volume Shadow Copies (VSS) via XML in Windows 11

Testing enterprise backup agents, ransomware mitigation utilities, and snapshot-aware database engines requires an isolated environment where disk volume snapshots can be created, restored, and deleted without risking production storage pools. In Windows 11, the Volume Shadow Copy Service (VSS) manages point-in-time storage snapshots. While Windows Sandbox creates a dynamic virtual C: drive, the default container configuration leaves the VSS service in manual trigger state and lacks shadow storage allocation pools. Using Windows Sandbox configuration (.wsb) XML profiles and PowerShell automation, systems administrators can initialize VSS snapshot services upon container launch.

Understanding Windows Sandbox VSS Virtualization

Windows Sandbox runs under the Windows Hypervisor platform with isolated storage boundaries:

• VSS (Volume Shadow Copy Service): Coordinates backup applications, volume writers, and storage providers to capture consistent point-in-time volume snapshots.
• vssadmin.exe: The primary administrative command-line utility for managing shadow storage associations and querying volume snapshots.
• <LogonCommand>: Directs the sandbox to execute configuration scripts with elevated container privileges immediately upon desktop session initialization.

Authoring the Windows Sandbox WSB Profile

Save the following configuration as VSS_Testing_Sandbox.wsb on your Windows 11 host machine:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Disable</Networking>
  <MemoryInMB>8192</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:SandboxVSS</HostFolder>
      <SandboxFolder>C:VSS_Deploy</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -NoExit -File C:VSS_DeployConfigure-VSS.ps1</Command>
  </LogonCommand>
</Configuration>

Authoring the PowerShell VSS Initialization Script

In directory C:SandboxVSS on your host, create Configure-VSS.ps1:

Write-Host "Configuring Windows Sandbox Volume Shadow Copy Environment..." -ForegroundColor Cyan

# 1. Start and configure the VSS service
Set-Service -Name "VSS" -StartupType Automatic
Start-Service -Name "VSS"
Write-Host "Volume Shadow Copy Service (VSS) set to Automatic and started." -ForegroundColor Green

# 2. Start the Microsoft Software Shadow Copy Provider (swprv)
Set-Service -Name "swprv" -StartupType Automatic
Start-Service -Name "swprv"
Write-Host "Software Shadow Copy Provider (swprv) started." -ForegroundColor Green

# 3. Add Shadow Storage Association for Volume C:
try {
    # Allocate maximum 2GB of shadow storage space on C:
    & vssadmin.exe add shadowstorage /for=C: /on=C: /maxsize=2048MB | Out-Null
    Write-Host "Shadow storage allocated for C: drive (Max: 2048MB)." -ForegroundColor Green
} catch {
    Write-Warning "Shadow storage association already exists or requires adjustment."
}

# 4. Display Shadow Storage Allocation
Write-Host "Active Shadow Storage Allocations:" -ForegroundColor Yellow
& vssadmin.exe list shadowstorage | Write-Host

# 5. Create a test Volume Shadow Copy snapshot using WMI/CIM
Write-Host "Creating test volume snapshot on C:..." -ForegroundColor Cyan
try {
    $ShadowClass = [wmiclass]"rootcimv2:Win32_ShadowCopy"
    $Result = $ShadowClass.Create("C:", "ClientAccessible")
    if ($Result.ReturnValue -eq 0) {
        Write-Host "Snapshot successfully created! ShadowID: $($Result.ShadowID)" -ForegroundColor Green
    } else {
        Write-Warning "Snapshot creation returned code: $($Result.ReturnValue)"
    }
} catch {
    Write-Error "WMI ShadowCopy invocation failed: $_"
}

# 6. List all active shadow copies
Write-Host "Current Volume Snapshots:" -ForegroundColor Cyan
& vssadmin.exe list shadows | Write-Host

Running and Verifying Snapshot Management

1. Double-click VSS_Testing_Sandbox.wsb on your Windows 11 host.
2. Windows Sandbox spins up in an isolated, secure container.
3. The PowerShell window opens automatically upon logon, starts the VSS and swprv services, allocates 2GB of shadow storage, and takes an instantaneous volume snapshot of C:.
4. Execute enterprise backup software, shadow copy extraction utilities, or snapshot verification scripts directly within the sandbox.
5. Closing Windows Sandbox terminates the session, destroying all generated snapshots and restoring zero footprint on the host system.