- Windows Sandbox allows you to create virtual, disposable environments on Windows Pro and Enterprise for secure testing.
- Advanced customization is done through .wsb files, which adjust RAM, network, shared folders, and other key parameters.
- .wsb scripts make it possible to automate program execution, protect data, and define the exact behavior of the Sandbox for each need.
In the world of security and experimentation in Windows, few resources are as useful as the environment Windows SandboxThis feature, available for Professional and Enterprise editions of Windows, allows you to create a completely isolated space for testing, opening suspicious files, or installing software without fear of harming your main system.
However, the real magic of Windows Sandbox is in its Advanced customization capabilities via scripts with a .wsb extensionThese files allow you to define specific settings, adapt resources, and, above all, turn the Sandbox into your own customizable laboratory. Throughout this article, you'll discover all the keys to mastering this tool and getting the most out of it, whether you're a curious user or just need to protect yourself from potentially dangerous software.
What is Windows Sandbox and what is it for?
Windows Sandbox is a feature exclusive to Windows 10 Pro, Enterprise and Windows 11 Pro that creates a virtual and disposable environment about the operating system. This space runs a clean, temporary instance of Windows, completely separate from your usual files and programs. Here, you can test applications, open suspicious attachments, or visit risky websites without anything that happens inside the Sandbox affecting your real computer.
When you close the Sandbox window, everything you did is automatically deleted, so any potential threat is confined and destroyed within this virtual environment. It's a kind of "ephemeral laboratory" designed for security, experimentation, and risk-free learning.
Supported Windows editions and prerequisites
To access this feature you definitely need an edition Windows Pro or Enterprise. Home versions do not include this feature out of the box. In addition, your device must meet certain requirements to ensure the Boot and smooth operation of Sandbox:
- Windows 10 Pro or Enterprise (1903 or higher) or Windows 11 Pro/Enterprise
- 64-bit processor with virtualization support (Intel VT-x or AMD-V)
- At least 4 GB of RAM (8GB recommended for best performance)
- Free disk space: Minimum 1 GB, more depending on usage
- 2 CPU cores minimum (better with 4 or more cores)
- Virtualization enabled in the BIOS/UEFI
If your system meets them, you can activate Sandbox from Control Panel > Programs > Turn Windows features on or off, checking the “Windows Sandbox” box and restarting your computer when prompted.
Basic Operation: What Happens Inside the Sandbox
When you run Windows Sandbox, you'll see a sort of clean, mini-Windows, usually in English and unlicensed. It doesn't have access to your files or programs by default, and every time you restart it, everything remains as if it were just installed. Only what you do inside, stays inside.
This allows you to safely open software you're untrusting, examine suspicious email attachments, or even tinker with system settings. It's perfect for both security-conscious users and developers who need disposable testing environments.
Why use .wsb files to customize Windows Sandbox?
Although the standard Sandbox meets basic isolation requirements, its default options are limited. .wsb files allow you to go much further: You can allocate more RAM, share host-specific folders, enable or block network or GPU access, and automatically launch scripts or programs at startup. This way, you can turn Windows Sandbox into a custom environment tailored to your needs and needs.
.wsb files These are simple text documents in XML format that Windows uses to create the custom settings for each Sandbox session. When you run them, a new Sandbox instance automatically opens with all the parameters you've defined.
How to create and use a .wsb file step by step
Creating a .wsb file is as simple as following these steps:
- Open a simple text editor, such as Notepad or Visual Studio Code.
- Write the basic structure of the file:
- Fill in the fields according to your needs (we'll go into detail about each parameter later).
- Save the file with the extension .wsbEg MyCustomSandbox.wsbIt's important to enclose the name in double quotes when saving from Notepad to prevent it from adding the .txt extension by default.
To launch the custom Sandbox, simply Double-click the .wsb fileIf this is your first time, you may be asked to select the "Windows Sandbox" application as your default for opening these files.
Parameters and configuration options in .wsb files
Each .wsb file can contain different sections to fine-tune the Sandbox's functionality. Here are the most important ones with usage examples:
- vGPU: Allows you to enable or disable graphics acceleration using virtual GPU.
- Networking: Controls whether the Sandbox has network access or not.
- MappedFolders: Map folders on the primary computer within the isolated environment, with read-only or write-only options.
- LogonCommand: Execute commands, scripts or programs automatically when starting Sandbox.
- MemoryInMB: Defines the amount of RAM the Sandbox can use.
- AudioInput, VideoInput: Enables or blocks audio (microphone) or video (webcam) input.
- ClipboardRedirection: Allows or blocks copying and pasting between the Sandbox and the host.
- PrinterRedirection: Controls whether host printers can be used within the Sandbox.
- ProtectedClient: Enables an extra layer of security through AppContainer Protected Mode.
Basic .wsb file example to test a downloaded file without network connectivity and with read-only access to the folder Downloads:
Disable Disable C:\Users\Public\Downloads C:\temp true explorer.exe C:\temp
With this file you launch a Sandbox without network, without access to GPU, with the Downloads folder in safe mode and automatically opening that folder on startup.
Digging into each key parameter of .wsb files
To further tailor your environment, it is helpful to understand each option:
- vGPU: Uses Enable to enable virtual GPU (more graphics performance), or Disable to improve isolation (especially useful against potential threats that could attack the GPU). For more details, see How to use Winget on Windows.
- Networking: Enable gives access to the Internet and the local network, while Disable prevents any connection, ideal for avoiding information leaks.
- MappedFolders: You can assign as many folders as you need. The parameter ReadOnly Determines whether the contents of the shared folder can only be read from the Sandbox or also modified. Example for sharing a project folder:
C:\MyWork\Projects C:\SandboxProjects false <;/MappedFolders>
- LogonCommand: For automatic execution of scripts, programs or even installations.
C:\SandboxProjects\InstallMySoftware.cmd
- MemoryInMB: Specifies the amount of memory, for example 8192 for 8 GB of RAM in the Sandbox. If you set it to less than 2048 GB, Windows automatically increases it to the minimum required.
- AudioInput and VideoInput: Controls whether the microphone or camera is shared. By default, the microphone is enabled, the camera is disabled.
- ClipboardRedirection and PrinterRedirection: Allow or block copying and pasting and the use of printers.
- ProtectedClient: Enables AppContainer mode for extra security; useful in highly sensitive scenarios.
Practical and advanced examples using .wsb scripts
One of the advantages of mastering .wsb is that you can adapt the environment to very diverse tasksHere are some useful scenarios:
1. Share projects and run complex scripts
Need to install Visual Studio Code and work with projects mapped from the host? Use a .wsb with multiple mapped folders and a script automated installation:
C:\SandboxScripts C:\temp\sandbox true C:\CodingProjects C:\temp\Projects false C:\temp\sandbox\VSCodeInstall.cmd
In this case, VSCodeInstall.cmd would be a script that automatically downloads and installs VS Code in the sandbox. For more help, you can visit How to use Windows Sandbox.
2. Automate administrative tasks with PowerShell
Suppose you need the Sandbox to automatically adapt a system configuration, such as swapping mouse buttons only within the Sandbox. You can share the folder and run a script to PowerShell as a startup command:
C:\sandbox C:\sandbox True powershell.exe -ExecutionPolicy Bypass -File C:\sandbox\SwapMouse.ps1
Tips and warnings for use
Anything you add in read-write mode to a shared folder from the Sandbox can affect the host. If you delete a file from the Sandbox and have the mapping set to write mode, that file will also be deleted from your real computer. Use the read-only option when you want to protect your data.
When closing Sandbox, all its content disappearsThere's no way to save your state or take snapshots: it's designed as a secure, ephemeral environment, ideal for quick tests.
Internet access can be useful for installing programs or testing downloads, but it carries an added risk. If you only want to experiment with specific files, disable the internet whenever possible.
Don't forget to reserve enough RAM and CPU resources. If your environment is running slow, adjust the memory settings in your .wsb scripts.
Finally, remember that there are sample .wsb files ready to download and adapt, as well as a growing community sharing configurations for different uses on technical forums and specialized blogs.
Windows Sandbox, managed through .wsb files, is much more than a simple testing box: it's your guarantee of security against unknown software and an indispensable ally for those who want to experiment without risk. If you combine its customization options with responsible practices (such as using read-only mappings and limiting connectivity), you'll turn any compatible computer into a safe, agile space ready to learn or protect yourself.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.