How to Use Windows Sandbox (Test Suspicious Files Safely)

To use Windows Sandbox, turn it on in Windows Features, restart your PC, then open it from the Start menu — you get a clean, disposable copy of Windows in a window, and everything you do inside it is erased when you close it. That makes it the safest place on a Windows PC to open a suspicious attachment, try an unknown installer, or test a setting you are not sure about. The one change most guides skip: networking is on by default inside the sandbox, so for anything untrusted, launch it from a small config file with networking switched off instead.

I verified every step in this guide against Microsoft’s own Windows Sandbox documentation, checked on the day of writing, and I validated the config file below by parsing it as XML locally. One honest limit: this run had no live Windows PC to click through the steps on, so where a menu label or a default comes from Microsoft’s docs rather than my own screen, I say so. The requirements, commands, defaults, and the networking warning are all Microsoft’s own words — not a rewrite of another tutorial.

Windows Sandbox is not a separate download and not a full virtual machine you have to build. Microsoft describes it as “a lightweight, isolated desktop environment for safely running applications,” and it shares most of its system files with your real Windows install, which is why it opens in seconds instead of the minutes a traditional VM takes. Every launch starts pristine — the same clean Windows, every time — and closing it deletes all software, files, and state. It is built into Windows 11 Pro, Enterprise, and Education, and it is not available on Windows 11 Home, which is the first thing to check before you start.

Can your PC run Windows Sandbox?

Check the edition first — it is the most common reason the feature is missing. Open Settings > System > About and look at the Edition line. If it says Home, stop here and jump to the Windows 11 Home section below; no setting or registry tweak adds Sandbox to Home. Then check the hardware against Microsoft’s minimums:

Virtualization is the one that trips most people up. If Task Manager says “Virtualization: Disabled,” restart into your BIOS or UEFI settings and turn on Intel VT-x or AMD-V (the exact name varies by motherboard — it is usually under Advanced, CPU Configuration, or Security). Save, boot back into Windows, and re-check. If Windows itself is running inside a virtual machine, the host has to enable nested virtualization first. Arm64 PCs need Windows 11 version 22H2 or later.

How do I enable Windows Sandbox?

There are two routes, and they do the same thing. The graphical route is the one most people should use:

1. Press Windows key + R, type optionalfeatures, and press Enter. (You can also search the taskbar for “Turn Windows features on or off.”)
2. Scroll down the list, tick Windows Sandbox, and click OK.
3. Wait for Windows to install the files, then restart when prompted.
4. Open the Start menu, type Windows Sandbox, and launch it. The first launch takes a little longer than later ones.

If you prefer the command line, open PowerShell as administrator and run Microsoft’s own command:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

If the Windows Sandbox checkbox is greyed out or missing entirely, Microsoft says the PC does not meet the requirements — re-check the edition and virtualization lines in the table above before assuming the install is broken. One more thing to know before you open it: starting with Windows 11 version 24H2, the inbox Store apps — Calculator, Photos, Notepad, and Terminal — are not available inside the sandbox. Microsoft says support for them will be added later, so do not be surprised when the sandbox desktop looks emptier than your real one.

How do I open and use Windows Sandbox?

Using it feels like using a second, simpler Windows PC in a window. Open the Start menu, search for Windows Sandbox, and a clean desktop appears. From there:

• Move a file in: copy it on your real desktop, then paste it inside the sandbox window. Clipboard sharing is on by default, so files and text move both ways.
• Test an app: paste the installer into the sandbox, run it, and use the app normally. Nothing you install appears on your real PC.
• Browse a risky site: open Edge inside the sandbox. The browser runs isolated from your real profile, history, and saved passwords.
• Finish and wipe it: close the sandbox window. Windows asks you to confirm that all sandbox content will be deleted — click OK, and it is gone. Your host PC shows none of the changes you made inside.

Three behaviors catch first-time users out. First, only one sandbox can run at a time — opening a second one while the first is running is not possible. Second, software installed on your host is not available inside the sandbox; you have to install anything you need there explicitly, every launch. Third, a restart started from inside the sandbox no longer wipes it: since Windows 11 version 22H2, data persists through restarts initiated within the sandbox, which matters for installers that demand a reboot. Closing the window still deletes everything.

What does a default Sandbox session actually allow?

A plain launch from the Start menu gives you a sandbox with up to 4 GB of memory and the defaults below, straight from Microsoft’s configuration documentation. Read the networking line carefully — it is the reason the safe-testing workflow in the next section exists.

Microsoft’s own warning, verbatim from its documentation, is blunt: “Networking is enabled by default. This can expose untrusted applications to the internal network.” A suspicious file that phones home, scans your LAN, or tries to reach a shared drive can do all of that from a default sandbox session. The default launch is fine for testing a trusted app you simply do not want installed. For anything actually untrusted, use the offline config below.

How do I test a suspicious file safely?

This is the workflow the default launch does not give you, and it is the whole point of learning Sandbox properly. The idea is simple: start the sandbox with no network, give it exactly one folder to read from, and nothing else.

1. Make a staging folder on your real PC, for example C:\SandboxTest, and put only the file you want to inspect in it. Nothing else — no documents, no downloads folder, no credentials.
2. Create the config file. Open Notepad and paste the text below, changing the folder path to your own staging folder. This is a .wsb file — a small XML document that tells Sandbox how to start. It switches networking off, disables the virtual GPU, maps your folder as read-only, and turns clipboard sharing off, so nothing can leak out while you look at the file.

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxTest</HostFolder>
      <SandboxFolder>C:\TestFiles</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <ClipboardRedirection>Disable</ClipboardRedirection>
</Configuration>

3. Save it as a .wsb file. Use File > Save As, set the file type to All Files, and type the name in quotes — "SafeTest.wsb" — so Notepad does not silently add .txt to the end. Save it on your desktop for easy access.
4. Double-click the .wsb file. Sandbox opens with your settings: no internet, and your staging folder appears inside at C:\TestFiles. Open the file from there and watch what it does.
5. Decide, then close. If the file looks clean, close the sandbox and handle it on your real PC. If it misbehaves — unexpected installs, odd prompts, attempts to change settings — close the window and it is gone. Because the folder was mapped read-only, nothing inside the sandbox could write back to your real files.

Two rules make this workflow actually safe. First, never map a folder with write access for an untrusted file: Microsoft warns that changes made in a sandbox to a mapped folder with write permissions persist after the sandbox is disposed — your “disposable” test just wrote to your real disk. Second, never sign in to anything inside a sandbox session you do not trust, and never paste a password into it. A sandbox isolates the operating system, not your credentials — anything you type inside it belongs to whatever is running there. The same caution applies to the folder-protection methods I tested earlier: isolation only helps if you do not hand the isolated environment the keys.

You can reuse the same file for every test, and you can make variations: one config with networking on for testing an app that needs to download updates, one with <MemoryInMB>8192</MemoryInMB> added for a heavy app (Microsoft raises any value below the 2,048 MB minimum automatically), and one with a <LogonCommand> that opens a specific program the moment the sandbox starts. Since Windows 11 version 24H2, the newer Store-based Sandbox app also lets you change clipboard, audio/video input, and folder sharing from its menu while a session is running — handy, but a saved .wsb file is still the reliable way to start every test with the same safe settings.

Sandbox vs virtual machine vs antivirus: which one do you need?

These three tools answer different questions, and most guides treat them as interchangeable. They are not:

The practical rule: Sandbox is for “what happens if I open this?” Antivirus is for “stop the bad thing I already have.” A VM is for “I need this environment again next week.” Microsoft is explicit that Sandbox is not a replacement for antivirus, and it is not one — a sandbox tells you what a file does, it does not scan your downloads for you. If you regularly open attachments you do not trust, use Sandbox and keep Defender on; the two cover different failure modes. And if you have ever had to undo damage from a bad download, the recovery methods I tested for deleted files are the fallback for when isolation was not used in time.

What if you’re on Windows 11 Home?

Windows Sandbox is not supported on Windows Home — Microsoft’s edition table lists Pro, Enterprise, Pro Education/SE, and Education only. You have two honest options. The first is upgrading to Pro through the Microsoft Store, which unlocks Sandbox along with BitLocker and Hyper-V. The second is a virtual machine: VirtualBox is a capable option for a one-off test environment on Home, and it runs on all editions. It is slower to set up — you install the hypervisor, create a VM, install Windows inside it, and update it — but it keeps working after you close it, which Sandbox deliberately does not. What you should not do is follow the registry or script “unlocks” for Home that circulate online: they copy system files from other editions, break with Windows updates, and Microsoft does not support them. If a guide promises Sandbox on Home with one script and no upgrade, that is the tell.

Sandbox won’t start? Fix it in this order

Work through these before reinstalling anything — the cause is almost always one of the first two:

1. Check the edition. Settings > System > About. Home means no Sandbox, full stop — see the section above.
2. Check virtualization. Task Manager > Performance > CPU. If it says Disabled, enable VT-x or AMD-V in BIOS/UEFI and reboot.
3. Re-enable the feature. Turn Windows Sandbox off in Windows Features, restart, turn it back on, restart again. A clean re-enable fixes a surprising number of launch failures.
4. Check for a conflicting hypervisor. Sandbox uses Hyper-V, and third-party virtualization tools can conflict with it. If you run another hypervisor, close it fully before launching Sandbox.
5. Check the .wsb file if you use one. A mapped folder that does not exist on the host stops the container from starting — Microsoft is explicit about that. Verify the path, and remember that relative paths are not supported in mapped folders.
6. Check Windows Update. On version 24H2 and later, Sandbox is updated through the Microsoft Store; an outdated Store app can behave differently from the documented version.

If you use Sandbox alongside Microsoft’s other Copilot+ safety features, the same “test first, trust later” habit applies — Recall’s snapshot controls and Click to Do’s on-demand actions are both worth setting up deliberately rather than accepting their defaults, just like Sandbox’s networking switch.

Frequently asked questions