How to Set Up and Use Windows Sandbox for Safe App Testing

The Threat of Untrusted Executables on Production Systems

Downloading software from the internet inevitably carries risk. Whether you are testing an open-source utility from GitHub, inspecting a suspicious email attachment, or troubleshooting a script, running unfamiliar code on your primary workstation can lead to system instability, unwanted registry modifications, or malware infection. Traditional virtual machines (such as Hyper-V, VirtualBox, or VMware) provide isolation, but they require gigabytes of disk space, dedicated OS license keys, manual ISO installation, and noticeable resource overhead.

Microsoft solved this dilemma by integrating Windows Sandbox directly into Windows 11 and Windows 10 (Pro, Enterprise, and Education editions). Windows Sandbox provides a lightweight, pristine desktop environment completely isolated from your host system. Every time you close Sandbox, the entire virtual environment—including all downloaded files, installed drivers, and registry edits—is completely discarded.

Hardware and Software Prerequisites

Before enabling Windows Sandbox, verify that your computer meets the following minimum requirements:

• Windows Edition: Windows 11 Pro, Enterprise, or Education (or Windows 10 Pro / Enterprise build 18305 or later). Windows Home edition does not include Sandbox natively.
• CPU Architecture: 64-bit processor (or ARM64) with at least 2 CPU cores (4 cores with hyperthreading recommended).
• Hardware Virtualisation: Virtualisation technology (Intel VT-x or AMD-V) must be enabled in your computer’s BIOS/UEFI firmware.
• Memory and Storage: At least 4 GB of RAM (8 GB strongly recommended) and 1 GB of free SSD space.

How to Check If Virtualisation Is Enabled

1. Press Ctrl + Shift + Esc to launch Task Manager.
2. Select the Performance tab on the left navigation bar.
3. Click CPU and check the lower-right details section. Ensure Virtualisation displays as Enabled.

Step-by-Step Guide: Enabling Windows Sandbox

Windows Sandbox is an optional operating system feature that is disabled by default. You can enable it using either the graphical interface or PowerShell.

Method 1: Enabling via Windows Features (GUI)

1. Press the Windows Key, type Turn Windows features on or off, and press Enter.
2. In the Windows Features dialogue, scroll down the list and locate Windows Sandbox.
3. Tick the checkbox beside Windows Sandbox.
4. Click OK. Windows will download and configure the required container components.
5. When prompted, click Restart now to complete the installation.

Method 2: Enabling via PowerShell (Fastest)

If you prefer using the terminal with administrator privileges:

Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All

Type Y when prompted to restart your computer.

How to Safely Test Applications Inside Sandbox

Once your computer restarts, launching and using Sandbox takes seconds:

1. Press the Windows Key, type Windows Sandbox, and select Run as administrator.
2. A clean Windows desktop window will appear within 10–15 seconds. This environment uses your host system’s GPU and networking by default.
3. Transferring files: You do not need network shares. Simply copy an installer file on your real host desktop (press Ctrl + C) and paste it directly into the Windows Sandbox window (press Ctrl + V).
4. Install and run the application inside the Sandbox window. You can interact with it, test its features, and monitor its behaviour without any risk to your real system files.

Crucial Security Caveats and Disposal Rules

• Absolute state reset: The moment you click the X to close the Windows Sandbox window, a confirmation dialogue warns you that all data will be destroyed. Clicking OK permanently purges the container RAM and virtual disk. If you generated test output or logs you wish to keep, copy them back to your host machine before closing.
• Network isolation considerations: By default, Sandbox shares your host internet connection. If you are inspecting potentially hostile malware that might probe local network devices, disconnect your computer from the local network or use custom XML configuration files to disable networking in Sandbox before running the payload.

Frequently Asked Questions

Can I save the state of Windows Sandbox to resume work later?

No. Windows Sandbox is strictly designed as an ephemeral, disposable container. If you require persistent virtual machines that preserve state across reboots, use Microsoft Hyper-V instead.

Does Windows Sandbox support copy and paste between host and guest?

Yes. Text, images, and files can be copied and pasted seamlessly between your host machine and the Sandbox desktop using standard clipboard shortcuts.