Windows Sandbox: Safely Testing Software Without Risking Your System

Every experienced Windows user has experienced the aftermath of installing the wrong software: an adware toolbar that buries itself in the browser, a dubious download that installs a background service, or a poorly written installer that scatters files across the system. Even with antivirus protection, some software misbehaves in ways that are hard to reverse.

Windows Sandbox solves this problem elegantly. It is a temporary, isolated Windows environment that runs inside your existing Windows 11 session. You can install software, run executables, browse dubious websites, or test configurations — and when you close the Sandbox, every trace of what happened inside it disappears permanently. Your main system is completely unaffected.

Windows Sandbox is exclusive to Windows 11 Professional (and Enterprise). If you are still on Windows Home, this is one of the compelling reasons to upgrade. The Sandbox uses the same virtualisation technology as Hyper-V but requires almost no configuration — you enable it, and it is ready to use within minutes.

System Requirements for Windows Sandbox

Before enabling Sandbox, verify that your hardware meets the requirements:

• Processor: AMD64 or ARM64 architecture. Intel or AMD CPU with virtualisation extensions (Intel VT-x or AMD-V)
• Virtualisation: Hardware virtualisation must be enabled in BIOS/UEFI (usually under Advanced → CPU Configuration)
• RAM: 4 GB minimum; 8 GB or more recommended. Sandbox dynamically allocates memory, and with less than 8 GB you may notice performance impacts on the host system
• Storage: 1 GB of free disk space (the Sandbox itself is relatively small as it shares the host OS kernel)
• Windows edition: Windows 11 Professional, Enterprise, or Education

To check if your CPU supports virtualisation and whether it is currently enabled, open Task Manager (Ctrl + Shift + Esc), click the Performance tab, select CPU, and look for the Virtualisation line. It should read Enabled.

If it shows Disabled, restart your PC, enter BIOS (usually by pressing F2, F12, Del, or Esc during startup — varies by manufacturer), and enable Intel VT-x or AMD-V. The exact menu location varies, but it is typically under Advanced Settings, CPU Configuration, or Security settings.

Enabling Windows Sandbox

Windows Sandbox is a Windows optional feature that must be explicitly enabled:

1. Press Win + S and search for Turn Windows features on or off, then open it.
2. Scroll down the list and tick Windows Sandbox.
3. Click OK and wait for Windows to install the feature. This takes a couple of minutes.
4. When prompted, restart your computer.

Alternatively, enable it via PowerShell as administrator:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online

After restarting, search for Windows Sandbox in the Start menu. You will find it listed as an application. Launching it opens a clean, minimal Windows 11 session inside a window on your desktop.

What Windows Sandbox Contains (and Does Not Contain)

Each time you launch Windows Sandbox, you get a completely fresh Windows 11 installation with:

• A clean desktop environment
• Microsoft Edge browser
• A basic set of Windows utilities
• Internet access (using your host machine’s connection)
• The ability to run most Windows applications

What Sandbox does not have:

• Access to your host computer’s files, unless you explicitly configure folder sharing
• Persistent storage — everything inside Sandbox is lost when it closes
• Clipboard sharing by default (configurable)
• GPU hardware acceleration by default (configurable in Windows 11)
• Audio capabilities (by default, though this is configurable)

This isolation is the point. The Sandbox cannot see your documents, cannot modify your registry, cannot install services that persist after it closes, and cannot communicate with your main OS beyond controlled sharing channels.

Using Windows Sandbox: Practical Scenarios

Testing an Executable Before Installing It

This is the most common use case. When you download software from an unfamiliar source, do not double-click it on your main system — drag it into the Sandbox window first and install it there. Watch what it does: does it install browser toolbars? Does it show suspicious activity in Task Manager? Does it try to connect to unusual network addresses?

To move files into Sandbox, simply drag and drop from your host desktop into the Sandbox window. The file is copied into the Sandbox’s temporary session.

Testing Browser Extensions Safely

Malicious browser extensions are a common attack vector. Install and test a suspicious extension in the Edge browser inside Sandbox. It cannot affect your main browser installation, and it disappears completely when the Sandbox closes.

Testing Software Uninstallers

Before running a third-party uninstaller on your main system, test it inside Sandbox. Install the target software inside Sandbox, then run the uninstaller and check whether it cleanly removes everything.

Running Legacy Software

Sandbox can run older software that might conflict with your current system configuration. If you need to run an old installer that requires .NET 3.5 or other legacy components, you can install those components inside Sandbox without polluting your main system.

Safe Web Browsing for Research

If your work involves visiting potentially risky websites (security research, competitive intelligence, investigating suspicious links), do it inside Sandbox. Even if the site delivers a drive-by download or exploits a browser vulnerability, the damage is contained and wiped on Sandbox close.

Advanced Configuration with Sandbox Configuration Files

The default Sandbox settings cover most use cases, but you can create custom configurations using .wsb files — simple XML files that define exactly how the Sandbox starts. This is one of Windows Sandbox’s most powerful and underused features.

Create a text file with the extension .wsb and open it to launch Sandbox with custom settings. Here is a full example configuration:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\TestFiles</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TestFiles</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\TestFiles</Command>
  </LogonCommand>
  <AudioInput>Disable</AudioInput>
  <VideoInput>Disable</VideoInput>
  <ClipboardRedirection>Enable</ClipboardRedirection>
  <PrinterRedirection>Disable</PrinterRedirection>
  <MemoryInMB>4096</MemoryInMB>
</Configuration>

Breaking down each element:

• VGpu: Enable or Disable GPU virtualisation. Enabling this provides hardware-accelerated graphics inside Sandbox (useful for testing graphical applications), at the cost of slightly more GPU sharing with the host.
• Networking: Disable to completely isolate Sandbox from the internet. Essential when testing malware samples or especially suspicious software.
• MappedFolders: Shares a host folder into the Sandbox. Set ReadOnly to true to prevent Sandbox from modifying your host files.
• LogonCommand: A command that runs automatically when Sandbox starts — useful for launching an installer immediately.
• ClipboardRedirection: Controls whether you can copy and paste between host and Sandbox.
• MemoryInMB: Reserves a specific amount of RAM for the Sandbox session.

Creating a Pre-Configured Testing Environment

Create multiple .wsb files for different testing scenarios. For example:

• isolated_test.wsb — No networking, no clipboard, read-only folder share pointing to a Downloads folder
• web_test.wsb — Networking enabled, GPU enabled, clipboard enabled, used for testing web apps
• software_install.wsb — Networking enabled, full folder access to a software testing directory, with an auto-run command to launch the installer

Store these .wsb files on your desktop for quick access. Double-clicking them launches the appropriately configured Sandbox instantly.

Performance Considerations

Windows Sandbox uses Microsoft’s hypervisor — the same technology that powers Hyper-V — to create true hardware isolation. Unlike browser-based sandboxes or compatibility layers, it runs a complete Windows instance.

On modern hardware (8-core CPU, 16 GB RAM), you will barely notice Sandbox running alongside your normal workflow. On older or lower-specification machines (4-core CPU, 8 GB RAM), you may experience some slowdown, particularly if the host system is already under load. In these cases, close unnecessary applications before launching Sandbox.

One important note: Sandbox is not suitable for long-duration testing where you need to preserve state. Because everything disappears on close, if you need a persistent isolated environment (for example, to test software over several days), a full Hyper-V virtual machine is a better choice. Hyper-V is also available in Windows 11 Professional — the two features complement each other rather than compete.

Common Issues and Solutions

• “Windows Sandbox failed to start”: Usually caused by virtualisation being disabled in BIOS, or by a conflict with another hypervisor (such as third-party VM software). Check that Hyper-V and the Windows Hypervisor Platform features are also enabled in Windows Features, and ensure no other hypervisor is running exclusively.
• Sandbox is slow: Allocate more RAM via the MemoryInMB setting in a .wsb file, or close memory-intensive applications on the host system.
• Cannot copy files into Sandbox: Ensure ClipboardRedirection is enabled in your .wsb file, or drag and drop the file directly into the Sandbox window.
• Applications crash inside Sandbox: Some applications perform hardware fingerprinting and behave differently in virtualised environments. This is normal — the Sandbox is doing its job of isolating the environment.

Conclusion

Windows Sandbox is a genuinely excellent feature that has no real equivalent in Windows Home. For anyone who regularly evaluates software, works in IT support, conducts security research, or simply wants a safe place to run unfamiliar executables without risk, it is one of the best reasons to be on Windows 11 Professional.

The combination of zero-configuration for basic use, powerful .wsb file customisation for advanced scenarios, and complete disposal of everything on close makes it a tool you will use repeatedly once you have it available. Get Windows 11 Professional from GetRenewedTech for £18.99 and start testing software the safe way.