How to Enable and Use Windows Sandbox for Safe Application Testing

Downloading software installers from unfamiliar websites, running diagnostic scripts from open-source repositories, or opening suspicious email attachments introduces significant security risks to personal and corporate workstations. Setting up a dedicated virtual machine through Hyper-V, VirtualBox, or VMware Workstation can mitigate this risk, but full VMs require gigabytes of disk storage, complicated ISO installation routines, and tedious management. Microsoft solved this friction by creating Windows Sandbox. Built directly into Windows 11 Pro, Enterprise, and Education editions, Windows Sandbox provides a lightweight, isolated desktop environment where you can execute untrusted applications safely without endangering your host operating system.

How Windows Sandbox Operates Under the Hood

Windows Sandbox combines desktop containerization with hypervisor-enforced hardware security:

• Disposable Virtual Architecture: Every time Windows Sandbox launches, it generates a pristine, brand-new Windows 11 installation derived dynamically from your host system’s existing files.
• Zero Persistence by Design: When you close the Windows Sandbox window, the entire guest container and all of its files, registry changes, temporary caches, and running processes are completely and permanently deleted.
• Dynamic Base Image: Rather than consuming 30–50 GB of disk space like a full virtual machine image, Sandbox dynamically mounts a copy of the host operating system binaries that are already stored on your hard drive, consuming barely 100 MB of disk space.
• Hardware-Based Virtualization Isolation: Windows Sandbox utilizes the Microsoft Hyper-V hypervisor to partition guest memory and CPU threads cleanly away from the host kernel. Malware executed inside Sandbox cannot escape into your primary workstation files.

System Requirements for Windows Sandbox

Before enabling Windows Sandbox, verify that your computer meets the technical prerequisites:

• Windows Edition: Windows 11 Pro, Enterprise, or Education (Windows 11 Home does not support Sandbox natively).
• Hardware Virtualization: AMD-V or Intel VT-x enabled inside your motherboard UEFI/BIOS.
• Processor Architecture: 64-bit CPU with at least 2 cores (4 cores with hyperthreading recommended).
• Memory and Storage: At least 4 GB of RAM (8 GB recommended) and at least 1 GB of free solid-state storage.

Step-by-Step: Enabling Windows Sandbox in Windows 11

To activate Windows Sandbox through the optional Windows Features dialogue:

1. Press Windows Key + R to open the Run dialogue.
2. Type optionalfeatures and press Enter to open the Windows Features manager.
3. Scroll down the alphabetical list and locate Windows Sandbox.
4. Check the box next to Windows Sandbox. (If the option is greyed out, verify that CPU Virtualization is enabled in your BIOS/UEFI settings).
5. Click OK. Windows will download and configure the necessary hypervisor components.
6. When prompted, click Restart now to reboot your computer and finalise installation.

Enabling Windows Sandbox via PowerShell

System administrators can quickly enable Sandbox using an elevated PowerShell terminal:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

Reboot your PC when prompted to complete the setup process.

Running Untrusted Software Inside Windows Sandbox

Once your computer restarts, using Windows Sandbox is straightforward:

1. Open the Start menu, search for Windows Sandbox, and click the application icon.
2. Windows initializes the isolated environment; within a few seconds, a full desktop window appears displaying a clean Windows desktop.
3. To test an installer or script from your host computer, simply copy the file on your host machine (Ctrl + C) and paste it directly inside the Sandbox desktop window (Ctrl + V).
4. Run the installer, test the executable, or browse untrusted links using Microsoft Edge inside the Sandbox.
5. Once testing is finished, simply close the Sandbox window (click the X in the top-right corner).
6. Windows displays a confirmation banner: “Are you sure you want to close Windows Sandbox? Once Windows Sandbox is closed, all of its content will be discarded and permanently lost.” Click OK to wipe the container instantly.

Windows Sandbox vs Full Virtual Machines (Hyper-V / VirtualBox)

Evaluation Metric	Windows Sandbox	Full Virtual Machine (Hyper-V / VirtualBox)
Disk Space Required	~100 MB (shared host binaries)	20 GB – 60 GB per guest OS
Startup Time	5 to 10 seconds	30 to 60 seconds
Persistence & State	Ephemeral (destroyed on close)	Persistent (saved states, snapshots)
OS Installation Routine	Zero (automatic dynamic image)	Manual ISO installation and configuration
Licensing Cost	Included free in Windows Pro/Enterprise	Requires separate guest OS licenses
Hardware Virtualization	Hyper-V integration	Hyper-V / VT-x / AMD-V

Advanced Automation Using .wsb Configuration Files

You can automate Sandbox startup behaviour—such as disabling network access, mapping specific host folders in read-only mode, or running startup logon scripts—by creating custom XML-based .wsb configuration files. For example, to run an isolated Sandbox with internet access disabled:

<Configuration>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TestFiles</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TestFiles</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Save this text as IsolatedTest.wsb and double-click the file to launch Windows Sandbox pre-configured to those exact security constraints.

Frequently Asked Questions

Can malware escape from Windows Sandbox onto my primary computer?

Windows Sandbox provides hypervisor-level containerization managed by Microsoft’s Hyper-V. Malware running inside the Sandbox cannot access your host filesystem, registry, or processes unless you deliberately map a writable host folder using custom configuration files.

Can I install Windows Sandbox on Windows 11 Home edition?

Officially, Microsoft restricts Windows Sandbox to Windows 11 Pro, Enterprise, and Education editions. While community batch scripts exist that attempt to enable the container packages on Home edition, they are unsupported and often break during cumulative Windows Updates.

Does Windows Sandbox support audio, microphones, and webcam input?

Audio output works automatically. Microphone and webcam sharing are disabled by default for privacy, but can be enabled via .wsb configuration files using <AudioInput>Enable</AudioInput> and <VideoInput>Enable</VideoInput> tags.