- Windows Sandbox allows you to create virtual, disposable environments on Windows Pro and Enterprise for secure testing.
- Advanced customization is done through .wsb files, which adjust RAM, network, shared folders, and other key parameters.
- .wsb scripts make it possible to automate program execution, protect data, and define the exact behavior of the Sandbox for each need.
In the world of Windows security and experimentation, few resources are as useful as the Windows Sandbox environment . This feature, available for the professional and enterprise editions of Windows, allows you to create a completely isolated space for testing, opening suspicious files, or installing software without fear of damaging the main system.
However, the true magic of Windows Sandbox lies in its advanced customization capabilities through scripts with the .wsb extension . These files allow you to define specific settings, adapt resources, and, above all, transform Sandbox into your own customizable laboratory. Throughout this article, you'll discover all the keys to mastering this tool and getting the most out of it, whether you're a curious user or need to protect yourself from potentially dangerous software.
What is Windows Sandbox and what is it for?
Windows Sandbox is a feature exclusive to Windows 10 Pro, Enterprise, and Windows 11 Pro that creates a disposable virtual environment on top of the operating system. This space runs a clean, temporary instance of Windows, completely separate from your regular files and programs. Here, you can test applications, open suspicious attachments, or visit risky websites without anything that happens inside the sandbox affecting your real computer.
When you close the Sandbox window, everything you did is automatically deleted , so any potential threats are confined and destroyed within that virtual environment. It's a kind of "ephemeral laboratory" designed for security, experimentation, and risk-free learning.
Supported Windows editions and prerequisites
To access this feature, you absolutely need a Pro or Enterprise edition of Windows . Home versions do not include this feature by default. Additionally, your computer must meet certain requirements to ensure Sandbox starts up and runs smoothly:
- Windows 10 Pro or Enterprise (1903 or higher) or Windows 11 Pro/Enterprise
- 64-bit processor with virtualization support (Intel VT-x or AMD-V)
- At least 4 GB of RAM (8GB recommended for best performance)
- Free disk space: Minimum 1 GB, more depending on usage
- 2 CPU cores minimum (better with 4 or more cores)
- Virtualization enabled in the BIOS/UEFI
If your system meets the requirements, you can activate Sandbox from Control Panel > Programs > Turn Windows features on or off , by checking the "Windows Sandbox" box and restarting your computer when prompted.
Basic Operation: What Happens Inside the Sandbox
When you run Windows Sandbox, you'll see a sort of clean, mini Windows environment, usually in English and unlicensed. By default, it doesn't have access to your files or programs, and every time you restart it, everything is restored to its original state. Only what you do inside, stays inside.
This allows you to safely open software you're untrusting, examine suspicious email attachments, or even tinker with system settings. It's perfect for both security-conscious users and developers who need disposable testing environments.
Why use .wsb files to customize Windows Sandbox?
While the standard Sandbox provides basic isolation, its default options are limited. .wsb files allow you to go much further: you can allocate more RAM, share specific host folders, enable or block network or GPU access, and automatically launch scripts or programs at startup. This transforms Windows Sandbox into a customized environment tailored to your specific use case.
.wsb files are simple XML text documents that Windows uses to create custom settings for each sandbox session. Running them automatically opens a new sandbox instance with all the parameters you've defined.
How to create and use a .wsb file step by step
Creating a .wsb file is as simple as following these steps:
- Open a simple text editor, such as Notepad or Visual Studio Code.
- Write the basic structure of the file:
- Fill in the fields according to your needs (we'll go into detail about each parameter later).
- Save the file with the extension .wsbEg MyCustomSandbox.wsbIt's important to enclose the name in double quotes when saving from Notepad to prevent it from adding the .txt extension by default.
To launch the custom sandbox, simply double-click the .wsb file . If this is your first time, you may be prompted to select the "Windows Sandbox" application as the default for opening these files.
Parameters and configuration options in .wsb files
Each .wsb file can contain different sections to fine-tune the Sandbox's functionality. Here are the most important ones with usage examples:
- vGPU: Allows you to enable or disable graphics acceleration using virtual GPU.
- Networking: Controls whether the Sandbox has network access or not.
- MappedFolders: Map folders on the primary computer within the isolated environment, with read-only or write-only options.
- LogonCommand: Execute commands, scripts or programs automatically when starting Sandbox.
- MemoryInMB: Defines the amount of RAM the Sandbox can use.
- AudioInput, VideoInput: Enables or blocks audio (microphone) or video (webcam) input.
- ClipboardRedirection: Allows or blocks copying and pasting between the Sandbox and the host.
- PrinterRedirection: Controls whether host printers can be used within the Sandbox.
- ProtectedClient: Enables an extra layer of security through AppContainer Protected Mode.
Basic example of a .wsb file to test a downloaded file without network connectivity and with read-only access to the Downloads folder :
Disable Disable C:\Users\Public\Downloads C:\temp true explorer.exe C:\temp
This file launches a sandbox without network access, without GPU access, with the Downloads folder in safe mode and automatically opening that folder on startup.
Digging into each key parameter of .wsb files
To further tailor your environment, it is helpful to understand each option:
- vGPU: Uses Enable to enable virtual GPU (more graphics performance), or Disable to improve isolation (especially useful against potential threats that could attack the GPU). For more details, see How to use Winget on Windows.
- Networking: Enable gives access to the Internet and the local network, while Disable prevents any connection, ideal for avoiding information leaks.
- MappedFolders: You can assign as many folders as you need. The parameter ReadOnly Determines whether the contents of the shared folder can only be read from the Sandbox or also modified. Example for sharing a project folder:
C:\MyWork\Projects C:\SandboxProjects false <;/MappedFolders>
- LogonCommand: For automatic execution of scripts, programs or even installations.
C:\SandboxProjects\InstallMySoftware.cmd
- MemoryInMB: Specifies the amount of memory, for example 8192 for 8 GB of RAM in the Sandbox. If you set it to less than 2048 GB, Windows automatically increases it to the minimum required.
- AudioInput and VideoInput: Controls whether the microphone or camera is shared. By default, the microphone is enabled, the camera is disabled.
- ClipboardRedirection and PrinterRedirection: Allow or block copying and pasting and the use of printers.
- ProtectedClient: Enables AppContainer mode for extra security; useful in highly sensitive scenarios.
Practical and advanced examples using .wsb scripts
One of the advantages of mastering .wsb files is that you can adapt the environment to a wide variety of tasks . Here are some useful scenarios:
1. Share projects and run complex scripts
Do you need to install Visual Studio Code and work with projects assigned from the host? Use a .wsb file with multiple mapped folders and an automated installation script :
C:\SandboxScripts C:\temp\sandbox true C:\CodingProjects C:\temp\Projects false C:\temp\sandbox\VSCodeInstall.cmd
In this case, VSCodeInstall.cmd would be a script that automatically downloads and installs VS Code in the sandbox environment. For more help, you can visit our guide on how to use Windows Sandbox.
2. Automate administrative tasks with PowerShell
Suppose you need the Sandbox to automatically adapt a system configuration, such as swapping mouse buttons only within the Sandbox. You can share the folder and launch a PowerShell script as the startup command:
C:\sandbox C:\sandbox True powershell.exe -ExecutionPolicy Bypass -File C:\sandbox\SwapMouse.ps1
Tips and warnings for use
Anything you add to a shared folder from the Sandbox in read-write mode can affect the host. If you delete a file from the Sandbox and the mapping is set to write, that file will also be deleted from your host machine. Use the read-only option when you want to protect your data.
When you close Sandbox, all its contents disappear . There is no way to save its state or take snapshots: it is designed as an ephemeral and secure environment, ideal for quick tests.
Internet access can be useful for installing programs or testing downloads, but it carries an added risk. If you only want to experiment with specific files, disable the internet whenever possible.
Don't forget to reserve enough RAM and CPU resources. If your environment is running slow, adjust the memory settings in your .wsb scripts.
Finally, remember that there are sample .wsb files ready to download and adapt, as well as a growing community sharing configurations for different uses on technical forums and specialized blogs.
Windows Sandbox, managed through .wsb files, is much more than a simple testing box: it's your guarantee of security against unknown software and an indispensable ally for those who want to experiment without risk. If you combine its customization options with responsible practices (such as using read-only mappings and limiting connectivity), you'll turn any compatible computer into a safe, agile space ready to learn or protect yourself.
Passionate writer about the world of bytes and technology in general. I love sharing my knowledge through writing, and that's what I'll do on this blog, show you all the most interesting things about gadgets, software, hardware, tech trends, and more. My goal is to help you navigate the digital world in a simple and entertaining way.