How to Create and Customise Windows Sandbox Configuration Files (.wsb) for Automated Testing

Windows Sandbox provides a pristine, disposable, hypervisor-isolated desktop environment on Windows 10 and 11 Pro, Enterprise, and Education editions. Every time you launch Windows Sandbox, it spins up a completely fresh copy of Windows; when you close it, all files, registry keys, and malware modifications are instantly discarded. However, repeatedly setting up testing tools, copying test installers from your host PC, or running prerequisite scripts every time you open a sandbox is tedious. To automate and streamline testing, Microsoft supports Windows Sandbox Configuration Files (.wsb). By crafting simple XML configuration files, you can map host folders, control virtual GPU rendering, restrict network access, and execute automated logon scripts.

What Can You Control with a .wsb File?

A Windows Sandbox configuration file is a formatted XML document saved with the .wsb extension. Double-clicking a .wsb file automatically boots Sandbox and executes the specified parameters:

• vGPU (Virtual GPU Acceleration): Enable or disable hardware GPU virtualization to test graphic rendering performance or simulate software rasterization.
• Networking: Enable or disable virtual networking. Disabling network access creates an airtight offline environment to safely analyse suspected malware without risk of command-and-control communication.
• Mapped Folders: Share specific host directories into the sandbox with granular Read-Only or Read/Write permissions.
• Logon Commands: Automatically run batch files, PowerShell scripts, or software installers immediately upon sandbox initialization.
• Audio and Video Input: Control microphone and webcam passthrough for privacy.
• Protected Client (Enhanced Security): Applies additional sandboxing guardrails using AppContainer isolation.

Step 1: Understand the XML Schema Structure

The root element of any configuration file is <Configuration>. Here is a baseline skeleton demonstrating the core configuration tags:

<Configuration>
    <VGpu>Enable</VGpu>
    <Networking>Default</Networking>
    <MappedFolders>
        <MappedFolder>
            <HostFolder>C:\SandboxShare</HostFolder>
            <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Shared</SandboxFolder>
            <ReadOnly>true</ReadOnly>
        </MappedFolder>
    </MappedFolders>
    <LogonCommand>
        <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\Shared</Command>
    </LogonCommand>
</Configuration>

Step 2: Map Host Directories with Read-Only Security

When testing unverified software, you must ensure malicious installers cannot write to or corrupt your host files. Mapping folders as Read-Only allows the sandbox to execute installers while keeping host drives strictly protected:

1. Create a dedicated testing folder on your host machine (for example, D:\Installers\Testing).
2. In your configuration file, define the folder mapping inside <MappedFolders>:

   <MappedFolders>
       <MappedFolder>
           <HostFolder>D:\Installers\Testing</HostFolder>
           <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TestFiles</SandboxFolder>
           <ReadOnly>true</ReadOnly>
       </MappedFolder>
   </MappedFolders>

Note: In Windows Sandbox, the active user profile path is always C:\Users\WDAGUtilityAccount\.

Step 3: Automate Startup Scripts and Software Installation

Use the <LogonCommand> block to run automated commands as soon as the desktop finishes loading.

Example A: Automatically Open the Shared Testing Folder

<LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\TestFiles</Command>
</LogonCommand>

Example B: Execute a Silent PowerShell Setup Script

Place a script named setup.ps1 in your shared folder and invoke it with execution bypass:

<LogonCommand>
    <Command>powershell.exe -ExecutionPolicy Bypass -File C:\Users\WDAGUtilityAccount\Desktop\TestFiles\setup.ps1</Command>
</LogonCommand>

Step 4: Create an Isolated Offline Sandbox for Malware Inspection

If you are inspecting a suspicious email attachment or potential Trojan, cutting off network access completely prevents data exfiltration and payload downloading:

<Configuration>
    <Networking>Disable</Networking>
    <ClipboardRedirection>Disable</ClipboardRedirection>
    <MappedFolders>
        <MappedFolder>
            <HostFolder>C:\SuspiciousSamples</HostFolder>
            <ReadOnly>true</ReadOnly>
        </MappedFolder>
    </MappedFolders>
</Configuration>

Setting <ClipboardRedirection>Disable</ClipboardRedirection> prevents malicious code in the sandbox from accessing your host clipboard memory.

Step 5: Save and Launch Your .wsb Configuration

1. Open Notepad or your preferred code editor.
2. Paste your completed XML configuration code.
3. Click File > Save As.
4. In the Save as type dropdown, choose All Files (*.*).
5. Name your file with the .wsb extension (e.g., AppTestingEnvironment.wsb or OfflineSandbox.wsb).
6. Save the file to your Desktop or a convenient folder.
7. Double-click the .wsb file. Windows automatically initializes Windows Sandbox with your exact custom parameters.

Troubleshooting Windows Sandbox Configurations

• “Windows Sandbox Failed to Initialize” Error: Ensure Windows Sandbox feature is enabled in Windows Features (optionalfeatures.exe) and that hardware virtualization (Intel VT-x or AMD-V) is enabled in your UEFI/BIOS.
• XML Parsing Errors: XML tags are case-sensitive. Ensure tag casing strictly matches documentation (e.g., <ReadOnly>true</ReadOnly>, not <readonly> or <READONLY>).
• Mapped Folder Missing in Sandbox: Verify that the path entered in <HostFolder> exists on your physical host before launching the .wsb file. If the path does not exist, Sandbox will fail with an error code.