Windows Sandbox on Windows 10 & 11
Enable · Configure · Use

What Is Windows Sandbox? The Built-In Disposable Desktop

Windows Sandbox is a lightweight, temporary virtual machine built directly into Windows 10 and Windows 11. It provides an isolated desktop environment where you can run applications, visit websites, or open files that you don't fully trust — without any risk to your main operating system.

Introduced in Windows 10 version 1903 (May 2019 Update), the Sandbox is essentially a clean, fresh copy of Windows that spins up in seconds. Once you close the Sandbox window, everything inside it — files downloaded, registry changes, installed programs — is permanently and irreversibly deleted. Your host system remains completely untouched.

What Makes It Different from a Virtual Machine?

Traditional virtualization solutions like VMware or Hyper-V require you to obtain a full OS image, allocate dedicated disk space, and manage persistent snapshots. Windows Sandbox is fundamentally different: it uses dynamic base image technology, sharing immutable OS files directly with the host using copy-on-write semantics. This means the Sandbox consumes almost no extra disk space for the operating system itself.

The result is a startup time measured in seconds (typically 2–5 seconds), a minimal memory footprint (around 100 MB of dedicated RAM overhead), and zero persistent storage for the OS layer. For quick, disposable testing sessions, nothing in the Windows ecosystem comes close.

How Windows Sandbox Works Under the Hood: Architecture Explained

Understanding the internals of Windows Sandbox helps you appreciate its security model and performance characteristics. Microsoft engineered it with three core technologies working in concert.

Dynamic Base Image

The Sandbox does not keep a full copy of the OS on disk. Instead, it uses a dynamically generated base image that maps directly to clean system files on your host drive. Only files that differ between the host and the Sandbox (user-created content, downloaded files, installed applications) are stored separately, using a sparse disk format. The typical footprint for the OS layer is around 100 MB, compared to gigabytes for traditional VMs.

Kernel Isolation via Hardware Virtualization

Windows Sandbox runs as a Hyper-V container under the hood, giving it hardware-level isolation. The Sandbox kernel is completely separate from the host kernel: a vulnerability exploited inside the Sandbox cannot directly affect the host OS. The VM Bus and VSP/VSC architecture handles all communication between host and guest with strict boundaries.

Integrated Kernel Scheduler

To prevent performance degradation on the host, Microsoft built a custom scheduler that ensures Sandbox virtual processors are treated as low-priority from the host CPU perspective. When your main workload needs resources, the Sandbox yields automatically. This means you can run the Sandbox in parallel with your normal workflow without significant slowdown.

Windows Sandbox System Requirements: Is Your PC Compatible?

Before attempting to enable Windows Sandbox, verify your system meets all of the following requirements. Missing even one will prevent the feature from working correctly.

How to Check Your Windows Edition and Version

Press Win + R, type winver, and press Enter. The dialog will show your current Windows edition and build number. Alternatively, go to Settings → System → About and look for "Edition" and "OS build".

How to Check if Virtualization Is Enabled

Open Task Manager (Ctrl + Shift + Esc), click the Performance tab, select CPU, and look for the "Virtualization" label at the bottom. It should read Enabled. If it shows "Disabled", you need to enter your BIOS/UEFI settings and enable Intel VT-x (Intel systems) or AMD-V / SVM Mode (AMD systems).

How to Enable Windows Sandbox on Windows 10: Step-by-Step

There are three methods to enable Windows Sandbox on Windows 10. All three achieve the same result — choose the one you're most comfortable with. A restart is required after enabling the feature.

Method 1: Windows Features (GUI) — Recommended

1. Press Win + S and search for "Turn Windows features on or off", then open it.
2. Scroll down the list and locate Windows Sandbox.
3. Check the checkbox next to Windows Sandbox and click OK.
4. Windows will download and install the required components. This may take a few minutes depending on your internet speed.
5. When prompted, click Restart Now to reboot your computer.
6. After restart, search for "Windows Sandbox" in the Start menu — it will appear as a regular application.

Method 2: PowerShell (Recommended for Administrators)

Open PowerShell as Administrator and run the following command:

PowerShell — Run as Administrator
Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online -All

PowerShell will prompt you to restart. Type Y and press Enter to reboot immediately, or N to reboot manually later.

Method 3: DISM Command Prompt

Open Command Prompt as Administrator and run:

Command Prompt — Run as Administrator
dism /online /Enable-Feature /FeatureName:"Containers-DisposableClientVM" /All /NoRestart

The /NoRestart flag suppresses the automatic restart. Reboot manually when ready.

How to Enable Windows Sandbox on Windows 11: Step-by-Step

The process on Windows 11 is nearly identical to Windows 10 but the UI has been updated. Here are the three methods for Windows 11.

Method 1: Optional Features in Settings (Windows 11 Native)

1. Open Settings with Win + I, then navigate to System → Optional features.
2. Scroll down and click "More Windows features" at the bottom of the page.
3. This opens the classic Windows Features dialog. Locate and check Windows Sandbox.
4. Click OK and wait for installation to complete.
5. Restart when prompted.

Method 2: PowerShell on Windows 11

The command is identical to Windows 10:

PowerShell — Run as Administrator
Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -Online -All

Verifying the Installation

After restarting, open the Start menu and search for Windows Sandbox. You should see the application icon. Right-click it to pin it to your taskbar or Start menu for quick access.

Launching and Using Windows Sandbox for the First Time

Once enabled, Windows Sandbox is straightforward to use. Here is a walkthrough of your first session.

Launching the Sandbox

Search for Windows Sandbox in the Start menu and launch it. Because it runs with elevated Hyper-V privileges, Windows will ask for UAC confirmation — click Yes. The Sandbox window will open within 2–5 seconds, showing a clean Windows desktop inside a resizable window.

The Sandbox Desktop Environment

Inside the Sandbox you get a fully functional, temporary Windows session: a Start menu, File Explorer, Microsoft Edge, and a basic set of Windows applications. Notably, it runs the same Windows version as your host, so there's no compatibility guesswork. The desktop resolution adjusts dynamically as you resize the Sandbox window.

Transferring Files: Copy-Paste and Drag-and-Drop

The simplest way to get files into the Sandbox is to copy them from your host (Ctrl+C) and paste them inside the Sandbox (Ctrl+V). You can paste directly onto the Sandbox desktop or into an open File Explorer window inside it. Drag-and-drop between the host and Sandbox window also works. Clipboard text is shared bidirectionally by default.

Ending a Session

Simply click the X button on the Sandbox window title bar, or shut it down from inside via Start → Power → Shut down. You'll be prompted to confirm since all data will be lost. The session terminates cleanly and all virtualization resources are immediately freed.

Advanced Windows Sandbox Configuration with .wsb Files

Windows Sandbox supports a powerful configuration format via .wsb files (Windows Sandbox Configuration files). These are simple XML documents that let you customize the Sandbox environment: mount shared host folders, run startup scripts, control networking, and more.

Creating a .wsb Configuration File

A .wsb file is a UTF-8 encoded XML file with the extension .wsb. Double-clicking it launches a Sandbox session with that specific configuration applied. Create one in Notepad or any text editor.

Basic .wsb Template
<Configuration>
  <Networking>Disable</Networking>
  <VGpu>Enable</VGpu>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\YourName\Desktop\TestFiles</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\TestFiles</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>C:\Users\WDAGUtilityAccount\Desktop\TestFiles\setup.bat</Command>
  </LogonCommand>
</Configuration>

All Available Configuration Options

Example: Offline Security Analysis Config

A real-world configuration for analyzing a suspicious installer safely — no internet access, read-only access to a shared folder containing the file:

offline-security-scan.wsb
<Configuration>
  <Networking>Disable</Networking>
  <VGpu>Disable</VGpu>
  <MemoryInMB>2048</MemoryInMB>
  <ClipboardRedirection>Disable</ClipboardRedirection>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Quarantine\SuspiciousFiles</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Quarantine</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Practical Use Cases: What You Can Do with Windows Sandbox

Windows Sandbox is a versatile tool that goes well beyond just running suspicious executables. Here are the most valuable real-world scenarios.

1. Testing Suspicious Software Before Installing

This is the most common use case. Before running an installer from an unfamiliar website, drop it into the Sandbox and install it there first. Check what it does: does it spawn extra processes? Does it install browser extensions? Does it call home to unusual IP addresses? All of this can be observed safely, and when you close the Sandbox, no trace remains on your host.

2. Safe Web Browsing of Untrusted Sites

Need to visit a URL that looks suspicious, or click a link from a phishing email to analyze it? Open the Sandbox, launch Edge, and browse from there. Drive-by downloads, malicious scripts, and exploit kits are all contained. Your host browser history, cookies, and credentials remain pristine.

3. Software Development and Testing

Developers can use the Sandbox to test installers, deployment scripts, or clean-room software behavior. Verify that your application runs correctly on a fresh Windows installation with no additional dependencies. This is particularly valuable for testing setup wizards and uninstallers without needing a dedicated test VM.

4. Evaluating Freeware and Shareware

Many free applications bundle adware, browser hijackers, or PUPs (Potentially Unwanted Programs) in their installers. Install them in the Sandbox first to evaluate behavior. If the software is legitimate and useful, you can then install it on your host with confidence.

5. Reproducing and Investigating Bugs

IT professionals and support engineers can use the Sandbox to reproduce issues on a clean Windows state, eliminating "works on my machine" variables. Pair it with a .wsb LogonCommand script that automatically installs relevant software for a repeatable test environment every time.

6. Secure File Opening and Document Analysis

Received a Word or Excel file from an unknown sender? Open it in the Sandbox first. Even if it contains malicious macros or exploits, they cannot escape the Hyper-V boundary and affect your host system.

Windows Sandbox Pros, Cons, and Alternatives

Alternatives to Windows Sandbox

Frequently Asked Questions About Windows Sandbox