How to Use Windows Sandbox to Test Apps Safely

Windows Sandbox is a lightweight virtual machine built directly into Windows 10 and 11 Pro and Enterprise. It spins up a clean, isolated Windows desktop in about five seconds. You run whatever you want inside it — a suspicious installer, a beta app, a tool you only need once — and when you close Sandbox, the entire environment is deleted. No cleanup required, no permanent changes to your main system.

If you have ever run an unknown installer and immediately regretted it, Sandbox is the correct solution. It is not a replacement for a full virtual machine, but for quick, disposable testing it is far faster and easier than setting up VirtualBox or Hyper-V.

Requirements

• Windows 10 or 11 Pro, Enterprise, or Education (not available on Home)
• Virtualization enabled in UEFI/BIOS (most modern PCs have this on by default)
• At least 4 GB RAM (8 GB recommended — Sandbox uses roughly 1 GB)
• At least 1 GB free disk space

Step 1: Enable Windows Sandbox

Sandbox ships with Windows but is not turned on by default. Enabling it takes about two minutes and requires a restart.

1. Open the Start menu and search for Turn Windows features on or off. Click the result.
2. Scroll down to Windows Sandbox in the list. Check the box next to it.
3. Click OK. Windows will install the feature.
4. When prompted, click Restart now.

After the restart, search for "Windows Sandbox" in the Start menu. You will see it listed as an app.

Step 2: Launch and Use Windows Sandbox

1. Search for Windows Sandbox in Start and open it. A clean Windows desktop appears in a window — this is your throwaway environment.
2. To test a file from your main computer, copy it (Ctrl+C in File Explorer), then paste (Ctrl+V) directly onto the Sandbox desktop or into its File Explorer. Files transfer seamlessly through the clipboard.
3. Run the file or installer inside Sandbox as you normally would. It can connect to the internet, install software, and behave exactly as it would on a real system.
4. When you are done, close the Sandbox window. A confirmation dialog warns that all content will be discarded. Click OK.

Every trace of what you did — installed files, registry changes, downloaded content — is gone. Your main Windows installation is untouched.

Step 3: Using Configuration Files (Optional)

Windows Sandbox supports configuration files (extension .wsb) that let you customize the environment before it starts. This is useful if you regularly test the same type of software.

A basic configuration file looks like this:

<Configuration>
  <VGpu>Enable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\YourName\Desktop\TestFiles</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Save this as a .wsb file and double-click it to launch a preconfigured sandbox. The Networking>Disable option is particularly useful when testing malware samples — it prevents anything inside from phoning home.

FAQ

Can malware escape from Windows Sandbox?

Sandbox uses hardware-based virtualization and kernel isolation. No known practical escapes exist for consumer malware. It is not a research-grade containment environment, but it is robust enough for everyday use.

Why does Sandbox not appear in my feature list?

This happens when virtualization is disabled in BIOS/UEFI. Restart your PC, enter UEFI settings (usually Delete or F2 during boot), and enable Intel VT-x or AMD-V.

Can I save anything from inside Sandbox before closing?

Yes — copy files from inside Sandbox to your desktop or a mapped folder before closing. Once you close the window, files inside are gone permanently.

Is Sandbox the same as Hyper-V?

Sandbox uses Hyper-V technology underneath, but it is a separate feature. Enabling Sandbox does not give you the full Hyper-V Manager interface. For persistent virtual machines, enable Hyper-V separately.

How much does Sandbox slow down my host machine?

It uses dynamic memory allocation and only consumes CPU when active. On an 8 GB system you will notice roughly 1–1.5 GB RAM usage while Sandbox is open. Closing it releases those resources immediately.

Windows Sandbox is one of the most underused features in Windows Pro. If you have the right edition, enabling it takes under two minutes and eliminates the risk from testing unfamiliar software. Pair it with the networking disabled option from the configuration file and you have a solid first line of defense for anything you are not sure about.