Windows 11 Windows Sandbox: Enable It and Test Safely

The Windows 11 Windows Sandbox feature gives you a clean, disposable copy of Windows in a window. You can install an unfamiliar program, open a suspicious attachment or try a browser extension inside it, and when you close the window everything inside is deleted. Your real desktop, files and settings are untouched. It is one of the most practical features that Windows 11 Pro adds over Home.

This guide covers who can use it, how to turn it on, how to use it safely, how to customise it with a small configuration file, and what to do if the option is missing. It is based on Microsoft’s documentation and applies to Windows 11 version 24H2 and 25H2.

What Windows Sandbox is

Microsoft describes Windows Sandbox as a lightweight, isolated desktop that runs as a disposable virtual machine. It uses the Microsoft hypervisor to run a separate kernel, so software inside it is isolated from your PC. Each launch is as clean as a new Windows installation, it opens in seconds, and it does not need a separate Windows licence or installation.

Three rules sum it up:

• Nothing is kept. Closing the sandbox deletes all software, files and state. (Since Windows 11 version 22H2, data does survive a restart started from inside the sandbox, for installers that need one.)
• Nothing is shared by default except what Microsoft lists. Your installed apps are not available inside; you install what you need each time.
• Only one at a time. You cannot run several sandboxes at once.

Requirements

Requirement	Detail
Edition	Windows 11 Pro, Enterprise, Pro Education/SE or Education. Not supported on Home.
Architecture	x64 (AMD64), or Arm64 on Windows 11 22H2 and later
Virtualization	Enabled in the BIOS/UEFI firmware
Memory	At least 4 GB RAM, 8 GB recommended
Disk	At least 1 GB free, SSD recommended
CPU	At least two cores, four cores with hyper-threading recommended

Check your edition under Settings > System > About. If you have Home, our guide to Windows 11 Pro vs Home explains whether upgrading is worth it. Virtualization is a firmware setting; our guide to BIOS and UEFI settings shows how to reach the firmware menu, where it is usually called Intel VT-x, AMD-V or SVM.

Turn on Windows Sandbox

1. Search Start for Turn Windows features on or off and open it.
2. Tick Windows Sandbox and select OK.
3. Restart the PC if Windows asks.
4. Open Windows Sandbox from the Start menu.

Microsoft also documents an equivalent PowerShell command for administrators who enable it on many PCs; for a single PC the dialog is simpler.

Use it to test a file or program

1. Open Windows Sandbox. A window with a fresh Windows desktop appears.
2. Copy the file on your real desktop and paste it into the sandbox window. Clipboard sharing is on by default, so copy and paste works in both directions.
3. Run or open it inside the sandbox and watch what it does.
4. Close the sandbox window and confirm that you want to discard its contents.

You can also browse to an unfamiliar website inside the sandbox using Microsoft Edge. Note one change in 24H2: Microsoft states that inbox Store apps such as Calculator, Photos, Notepad and Terminal are not available inside Windows Sandbox for now.

Make it safer with a configuration file

By default the sandbox has networking on, clipboard sharing on and microphone input on, while webcam, printer sharing and protected client mode are off. Microsoft warns that networking can expose untrusted applications to your internal network. For testing something you really do not trust, create a configuration file:

1. Open Notepad.
2. Type this:

<Configuration>
  <Networking>Disable</Networking>
</Configuration>

3. Save it as Offline.wsb (type the name in quotation marks in Notepad so it does not become a .txt file).
4. Double-click the file to start a sandbox with those settings.

The same file can switch off clipboard sharing too, with a ClipboardRedirection line set to Disable in the same way; Microsoft’s configuration page lists the exact element names. Without the clipboard you move test files in through a read-only mapped folder instead, which is the safer combination for anything you suspect is malicious. Keep the file somewhere handy, such as your Documents folder, so a locked-down sandbox is always one double-click away.

Configuration files can also map a folder from your PC into the sandbox. Set it to read-only when the folder contains the file you want to test: Microsoft notes that changes made in a mapped folder with write access persist after the sandbox closes, and that exposed folders could be affected by software inside. Other options include memory size, virtual GPU, printer and webcam sharing, and a command to run at sign-in.

If the option is missing or Sandbox will not start

• Not in the features list: you are on Home, or the PC does not meet the requirements.
• Greyed out or an error about virtualization: enable virtualization in the UEFI firmware, save and restart.
• Inside a virtual machine: nested virtualization must be enabled on the host.
• Fails after an update: turn the feature off, restart, turn it on again and restart.

Related isolation tools include Hyper-V, also a Pro feature, for full virtual machines and Smart App Control and Windows Security for everyday protection. For more on what Pro adds, see the Windows 11 Pro hub.