If you frequently download programs, open email attachments, or test tools from dubious sources, having a safe and disposable environment within Windows is practically essential. That's where Windows Sandbox comes in, a feature built into Windows Professional editions that allows you to run tests without compromising your main system.
With Windows Sandbox, you can launch a clean, virtual, and temporary Windows environment in seconds , use it as if it were your own desktop, and upon closing it, completely erase everything that happened within it. No software remnants, no configurations, no persistent malware: it's like starting with a brand-new, virgin system every time you open it.
What is Windows Sandbox and how does its isolation work?
Windows Sandbox, also known as Windows Isolated Space (WSB) , is a lightweight desktop environment that runs within your own system using hardware virtualization. In practical terms, it's similar to having a virtual machine, but without having to install an additional operating system or deal with complex configurations.
This isolated environment relies on Microsoft's hypervisor and hardware-based virtualization to isolate the kernel . In other words, the operating system running within the sandbox has its own kernel, separate from your main Windows system, drastically reducing the possibility of malicious software escaping to the host.
One of its biggest advantages is that it's a disposable and ephemeral environment : each time you open it, a new, clean instance is created, as if you had installed Windows from scratch right then and there. As soon as you close the window, all the changes, files, and settings you applied are discarded.
The software installed on your main system is not automatically copied into the sandbox . Anything you want to use in the isolated environment must be explicitly installed there, or copied from the host using the clipboard or designated folders. This is part of the isolation process: nothing is shared unless you choose to allow it.
To achieve very fast boot times and reduce resource consumption, Windows Sandbox uses memory optimization techniques and a minimal environment . It's not a heavyweight virtual machine with tens of gigabytes of reserved disk space, but a lightweight instance created on the fly with a maximum of about 4 GB of memory by default and virtual storage that is not persisted.
Key features of Windows Sandbox
One of the most interesting things about this feature is that it's built into Windows Professional, so you don't need to download ISO images or third-party virtual machine managers. If you have a compatible edition, all you have to do is enable the feature and you're good to go.
The environment is completely clean on every run . Each time you start Windows Sandbox, a fresh installation is created with no additional software, no remnants of previous configurations, and no prior modifications. It's perfect if you want to test a program "as if it were the first time," without any libraries or data that could affect the outcome.
Another key element is security. Isolation is achieved by combining virtualization, AppContainer (in protected client mode) , and strict separation between processes, networks, devices, and credentials. This way, even if you run malware in the sandbox, its chances of affecting the host are minimal.
Performance is quite good. Windows Sandbox typically boots in just a few seconds , takes advantage of a virtual GPU (vGPU) on x64 systems when enabled, and manages memory efficiently to avoid excessive resource consumption. It doesn't quite reach the speed of a native app, but it performs much better than a traditional, resource-intensive virtual machine.
Finally, it's designed to be user-friendly for everyone, regardless of their expertise. With a single click, you can open a completely new environment to test installers, visit suspicious websites, or run scripts. And if you have more technical skills, you can fine-tune it using the .wsb configuration files.
Practical uses of Sandbox isolation in Windows
One of the most common use cases is having a clean environment for testing new software . Developers, support technicians, or advanced users can install beta versions, test builds, or little-known programs without "cluttering" their live system.
It's also very convenient for safer web browsing when you need to access shady websites, potentially dangerous downloads, or portals you don't trust. You open the Sandbox, browse with the built-in browser, and if something goes wrong, simply close the window and everything disappears.
Sandboxing is especially useful when opening untrusted attachments and executables , such as documents from unknown senders or portable utilities downloaded from forums. You can copy the file to the sandbox, open it there, and if it turns out to be malicious, it will be trapped in that environment.
Another very practical scenario is the first contact with new programs, add-ons, or extensions . Before installing something on your main Windows system, you can test it in the Sandbox, see how it behaves, and decide if it's worth integrating into your daily work environment.
Finally, many developers take advantage of sandboxing to maintain multiple, well-separated testing environments . For example, you can use it to test different versions of Python with different dependencies, or different combinations of libraries and configurations, without having to set up multiple permanent virtual machines.
Compatible Windows editions and licensing
To use this feature, you must have a professional or educational edition of Windows . Windows Sandbox is available in Windows Pro, Windows Enterprise, Windows Pro Education/SE, and Windows Education, including their equivalent versions in Windows 11.
Licenses that grant the right to use Windows Sandbox include Windows Pro and Pro Education/SE , as well as Windows Enterprise E3 and E5 subscriptions and Windows Education A3 and A5 educational editions. In practical terms, if your computer came with a Pro version or you're in a corporate environment with Enterprise, you should be able to activate it.
If you're using Windows Home, you won't be able to activate Windows Sandbox natively. In those cases, the alternative would be to use traditional virtualization solutions (Hyper-V, VirtualBox, VMware, etc.), but you'd lose the easy integration and one-click disposable nature that this feature offers.
Hardware and virtualization requirements
In addition to the correct edition of Windows, your computer must meet a series of minimum hardware and virtualization requirements for Sandbox isolation to work correctly and securely.
On the one hand, a 64-bit processor with virtualization support and at least two physical cores is required ; Microsoft recommends four cores with hyperthreading for better performance. In practice, most processors released in recent years meet these requirements without issue.
Regarding memory, the system needs a minimum of 4 GB of RAM to boot Windows Sandbox, although for a smooth experience it is recommended to have 8 GB or more, especially if you work with heavy applications simultaneously on the host and in the isolated environment.
Regarding storage, at least 1 GB of free disk space is required , ideally using an SSD for faster environment creation and deletion, and smoother internal operation. The sandbox does not create a traditional persistent hard drive, but it does require temporary space.
Finally, it is mandatory that virtualization options are enabled in your computer's BIOS or UEFI (Intel VT-x/VT-d, AMD-V, etc.). This is the foundation that Hyper-V uses to create the separate hardware environment. If virtualization is disabled, the Sandbox will not start.
How to enable virtualization in the BIOS
For sandbox isolation to be effective, Windows relies on Hyper-V and hardware CPU virtualization . While many processors have this feature enabled by default, in other cases it needs to be manually enabled in the BIOS or UEFI.
The exact process depends on your motherboard manufacturer, but generally you'll need to access the BIOS when you turn on your computer , usually by pressing keys like Delete, F2, F10, or F12 right at startup. Some laptops display an on-screen message indicating which key to use.
Once inside, you should look for the section related to CPU, advanced security, or system settings , where you'll usually find the virtualization option. The exact name varies: Virtualization, Intel Virtualization Technology, VT-x, VT-d, SVM, VM Monitor Mode Extensions, Hyper-V, RVI, etc.
Once you locate that option, make sure it is enabled. Save the changes from the corresponding menu (Save & Exit, or similar) and let the computer restart for virtualization to become active at the hardware level.
Keep in mind that some CPUs integrate virtualization without allowing modification from the BIOS, so you won't see any option but the functionality will already be enabled . In those cases, if you meet the other requirements, Windows Sandbox should still work.
How to activate Windows Sandbox in Windows
Once you confirm that your Windows edition is compatible and that virtualization is ready, the next step is to activate the Windows Sandbox feature , as it is disabled by default in the system.
To do this, open the Windows search bar and start typing “Turn Windows features on or off.” When the result appears, click on it, and a window will open with a list of optional system features that you can enable or disable.
Within that list, locate the entry "Windows Sandbox" . Check the box to its left and confirm the changes. Windows will download and configure the necessary components; this process may take a few minutes, depending on your computer's speed.
After installation, the system will prompt you to restart your computer to apply the new feature. Accept the restart, and when your computer boots up again, Windows Sandbox will be available among your applications.
From that point on, simply search for “Windows Sandbox” in the Start menu or search box to launch the sandbox. You'll see a window open with a clean Windows desktop, separate from your own.
Default Sandbox Isolation Settings
If you start Windows Sandbox without any custom configuration files, the environment is created with default settings designed to balance security and ease of use . The memory limit is set to 4 GB, and certain basic host integrations are enabled.
On non-ARM x64 systems, the virtual GPU (vGPU) is usually enabled by default , allowing you to take advantage of the host system's graphics acceleration within the sandbox. This improves the performance of the interface and some applications, although it slightly increases the attack surface.
At the network level, the Sandbox starts with connectivity enabled through a virtual Hyper-V switch and an associated virtual network interface card (NIC). This allows you to browse the internet, download installers, or access online resources directly from within the isolated environment.
The audio input (microphone) is usually enabled, allowing internal applications to capture sound from the host if needed. However, the video input (camera) is disabled to prevent applications within the sandbox from accessing the computer's webcam without authorization.
For security reasons, printer redirection remains disabled, while the shared clipboard is enabled . This allows you to easily copy and paste text and files between your regular Windows system and the sandboxed environment.
.wsb files: advanced isolation settings
If you want to go a step further, Windows Sandbox supports configuration files with the .wsb extension , written in simple XML format. These files allow you to customize the behavior of the sandboxed environment without needing to touch advanced internal system settings.
A basic .wsb file consists of a root tag and its closure These settings include various configuration blocks. Among other things, you can control vGPU usage, network, shared folders, startup commands, audio, video, enhanced security, printers, clipboard, and allocated memory.
To create one, simply open a plain text editor like Notepad or Visual Studio Code , write the configuration structure you need, and save the document with the .wsb extension (for example, "MySandbox.wsb"). It's important that when saving in Notepad, you enclose the name in quotation marks so that it respects the extension.
When you want to launch a sandbox with that specific configuration, simply double-click the .wsb file . Windows will open an isolated environment applying all the parameters you defined in the file. You can also run it from the command line by entering the path to the file.
This system makes it easy to have several "templates" of isolated spaces, for example one with a disabled network and a read-only downloads folder, another with more memory for heavy testing, or a third with a startup script that automates software installation each time.
Most important configuration options
One of the key elements of the .wsb file is the <vGPU> directive, which allows you to enable or disable the virtualized GPU . Using “Enable” gives the Sandbox access to the host's graphics acceleration, while “Disable” forces the use of software rendering (WARP), which is more secure but generally slower.
The <Networking> tag controls network behavior. “Enable” assigns full connectivity; “Disable” creates a completely disconnected sandbox, ideal for running malware that attempts to communicate with the outside world; and “Default” applies the standard configuration, which enables networking via a virtual Hyper-V switch.
Through You can specify a collection of host folders to be shared with the sandbox. Each includes the path on the host ( ), the destination folder within the Sandbox ( ) and, optionally, a label to establish read-only or read/write access.
With `<LogonCommand>` and `<Command>`, you can define a command or script that runs automatically when you log in to the Sandbox. This is very useful for launching installers, configuration scripts, or testing tools without having to do it manually at every startup.
In addition, you have options to manage audio input ( ), video ( ), protected client mode ( ), printer redirection ( ) and the clipboard ( ), thus adjusting the balance between comfort and insulation according to what you need in each scenario.
Adjust Sandbox memory and resources
The <MemoryInMB> tag allows you to specify the amount of RAM that the sandbox can use , expressed in megabytes. For example, 4096 for 4 GB, 8192 for 8 GB, 12288 for 12 GB, or 16384 for 16 GB, provided your hardware has enough memory.
If you set a value that's too low for the Sandbox to start, Windows will automatically increase it to the minimum required, which is usually 2048 MB . Even so, it's advisable not to set too low to avoid lag when running resource-intensive applications.
Keep in mind that the memory allocated to the Sandbox is temporarily subtracted from the host's available memory, so it's advisable to adjust the value based on the actual installed RAM . On a computer with 8 GB, for example, it might make sense to allocate 4096 MB to avoid overloading the main system.
Combining With vGPU and network configuration, you can build different usage profiles: from a lightweight and ultra-secure environment, with network and GPU disabled, to a powerful Sandbox with many resources reserved for demanding tests.
This level of control makes Windows Sandbox a fairly flexible tool, capable of adapting to both users who just want a quick "sandbox" and professionals who need to reproduce very specific test environments.
Thanks to this approach, Windows Sandbox has become one of the easiest ways to set up real isolation for testing in Windows , combining the convenience of being integrated into the system with the robustness of hardware isolation and the flexibility of .wsb configuration files.
