Before Windows Sandbox shipped in Windows 10 version 1903, testing a sketchy installer meant spinning up a full VM or just risking it. Sandbox gives you a disposable, lightweight Windows environment in seconds, built directly on the same virtualization stack as Hyper-V.
Enabling It
# Requires Windows 10/11 Pro or Enterprise, and virtualization enabled in BIOS Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All Restart-Computer
Why It’s Different from a Regular VM
- Disposable by design — everything is wiped the moment you close the window, with no snapshots to manage.
- Lightweight — it shares the host’s kernel image via dynamic base image cloning rather than shipping a full separate OS disk image, so it starts in seconds, not minutes.
- Isolated networking — has its own virtual network adapter, separate from the host.
Customizing a Sandbox Session
A .wsb configuration file lets you pre-mount a folder or auto-run a script the moment the sandbox starts, which is handy for repeatable testing:
<Configuration>
<MappedFolders>
<MappedFolder>
<HostFolder>C:\Downloads\ToTest</HostFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
<LogonCommand>
<Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\ToTest</Command>
</LogonCommand>
</Configuration>
What It’s Not
Sandbox is great for testing an unfamiliar installer or opening a suspicious document, but it’s not a substitute for real malware analysis tooling — it shares the host’s virtualization layer rather than being air-gapped, so treat it as a convenience tool, not a security boundary against determined, VM-aware malware.