Skip to content
HOW BISCUITPractical guides

Explore How Biscuit

Search How Biscuit

Enter a word or phrase to search.
Category: Home Tech Topic: Privacy & Security Type: Guide

How to Set Up Windows Sandbox and Use It More Safely

Windows Sandbox creates a disposable virtual Windows environment. Closing it deletes its local state, but networking, clipboard sharing, mapped folders, and user actions can still create paths back to the host or internet.

Updated 4 min read Researched Not hands-on tested

What to know

  • Windows Sandbox creates a disposable virtual Windows environment. Closing it deletes its local state, but networking, clipboard sharing, mapped folders, and user actions can still create paths back to the host or internet.
  • Install Windows Sandbox only on a supported system, disable networking for untrusted files, use read-only mapped folders, and avoid clipboard or account access.

Search Windows for:

Turn Windows features on or off

Enable Windows Sandbox, approve the installation, and restart when prompted.

Windows Sandbox is supported on current Pro, Enterprise, and Education editions, but not Windows Home. It also requires hardware virtualization, at least 4 GB of RAM, at least 1 GB of free storage, and a supported 64-bit processor architecture. Microsoft recommends more memory and processor capacity for practical performance.

Check the Windows edition

Open:

Settings → System → About

Review Windows specifications.

Supported editions include:

  • Windows Pro
  • Windows Enterprise
  • Windows Education
  • Pro Education variants

Windows Home does not currently include Windows Sandbox.

Do not purchase an edition upgrade solely for Sandbox before confirming that the computer also supports virtualization and has enough memory.

Confirm virtualization

Open Task Manager → Performance → CPU.

Look for:

Virtualization: Enabled

When it is disabled, the setting may need to be enabled in BIOS or UEFI firmware.

Firmware changes can affect:

  • BitLocker recovery
  • Secure Boot
  • Virtual machines
  • Device security
  • Startup behavior

Back up the BitLocker recovery key before changing firmware settings.

Install Windows Sandbox

  1. Search for Turn Windows features on or off.
  2. Select Windows Sandbox.
  3. Select OK.
  4. Allow Windows to install the feature.
  5. Restart if requested.
  6. Open Windows Sandbox from the Start menu.

Microsoft also provides a PowerShell installation command for administrators:

Enable-WindowsOptionalFeature `
    -FeatureName "Containers-DisposableClientVM" `
    -All `
    -Online

Use an elevated shell only when you understand the administrative change.

Understand what is disposable

Applications, files, and changes inside the Sandbox are normally deleted when its window is closed.

A new launch begins with a clean environment.

Starting with supported Windows 11 versions, a restart initiated inside the Sandbox can preserve the current session through that restart, but closing the Sandbox still discards its state.

Copy anything legitimate and required back to protected storage before closing.

Networking is on by default

Windows Sandbox normally receives network access automatically.

That means an untrusted application may be able to:

  • Reach the internet
  • Contact command infrastructure
  • Scan local network services
  • Send data
  • Download additional components

Microsoft explicitly warns that default networking can expose an internal network to untrusted software.

For genuinely suspicious material, use a configuration that disables networking.

Disable networking with a configuration file

Create a text file with a .wsb extension:

<Configuration>
  <Networking>Disable</Networking>
</Configuration>

Open the .wsb file to launch the configured Sandbox.

Test that the Sandbox cannot reach the internet before opening the material.

Do not assume that disconnecting one browser tab proves network isolation.

Shared folders create a bridge

Mapped host folders allow the Sandbox to access selected files.

Where mapping is necessary, make the folder read-only:

<Configuration>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxInput</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Do not map:

  • Desktop
  • Documents
  • Password vault
  • Entire user profile
  • Network share
  • Business data
  • Backup drive

A writable mapped folder allows software inside the Sandbox to alter host files.

Clipboard and runtime sharing

Newer Windows Sandbox versions can expose runtime controls for:

  • Clipboard redirection
  • Folder sharing
  • Audio input
  • Video input

Microsoft began distributing an updated Sandbox application through the Microsoft Store on supported Windows 11 24H2 systems.

Disable sharing features that are not required.

Do not copy a password, recovery code, or private document while clipboard redirection is active.

What Sandbox does not protect

Windows Sandbox does not protect against:

  • Giving credentials to a phishing page
  • Uploading data voluntarily
  • Malware copied into a writable host folder
  • Attacks against external accounts
  • Malicious network activity
  • Unknown vulnerabilities in the virtualization stack
  • Dangerous content that should not be handled at all

Use it as one isolation layer, not an enchanted quarantine jar.

Bottom line

Install Windows Sandbox only on a supported system, disable networking for untrusted files, use read-only mapped folders, and avoid clipboard or account access.

Closing the Sandbox discards its local state. It does not erase information already transmitted, copied, or deliberately handed to hostile software.

Sources reviewed

Limits and cautions

  • Not hands-on tested
Sources reviewed

Source notes

  1. https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-installlearn.microsoft.com
  2. https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/learn.microsoft.com
  3. https://learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versionslearn.microsoft.com

See something wrong or out of date? Report a correction.