How to Enable and use Windows Sandbox on Windows 11/10

Windows Sandbox offers a safe environment to run suspicious apps or test changes without risking your main system. It lets you spin up a disposable virtual Windows desktop with just a few clicks. If you work with unknown software, open lots of downloads, or want to test configurations, Sandbox can save you a lot of headaches.

Here’s how you enable Windows Sandbox on Windows 11 or 10, plus tips on getting the most out of it.

What Is Windows Sandbox?

Windows Sandbox is a virtualized, lightweight desktop environment built right into Windows 10 and 11 Pro and Enterprise editions. It creates a temporary Windows instance isolated from your main system. Whatever you do in the Sandbox - run apps, open files, browse the web - stays inside and disappears once you close it. The Sandbox resets every time you launch it, so any malware, changes, or files inside are wiped automatically. That makes it ideal for testing potentially risky software, opening dubious email attachments, or checking website behavior in a controlled space.

This feature uses Microsoft’s Hyper-V virtualization technology, but it’s much easier to set up than a typical VM. There’s no need to download or manage separate virtual disk images. Windows Sandbox uses files from your existing Windows installation, so it takes up less space and launches in seconds.

System Requirements and Limitations

Before you begin, you need to ensure your PC supports Windows Sandbox. It is only available on Windows 10 Pro, Enterprise (build 18305 or later), and all editions of Windows 11 except Home. Windows Home users cannot officially use Sandbox without upgrading or applying unofficial hacks.

• 64-bit architecture: Sandbox does not work on 32-bit systems.
• Virtualization enabled: Your BIOS/UEFI must have Intel VT-x or AMD-V turned on. Most modern PCs have this, but it may be disabled by default.
• At least 4GB RAM: Microsoft recommends 8GB for smoother performance, especially if you plan to multitask.
• At least 1GB free disk space: More is better, as Sandbox consumes disk for the temporary OS instance.
• 2 CPU cores minimum: Again, more improves responsiveness.

Keep in mind that the Sandbox environment is plain - you can’t install Microsoft Store apps or persist any changes. When you close Sandbox, everything vanishes. Shared folders, drag and drop, and clipboard copy/paste are supported, but device redirection and GPU acceleration are limited compared to full virtual machines.

How to Enable Windows Sandbox

Enabling Sandbox is straightforward if your system meets the requirements. You do not need to download anything extra. Here’s what to do:

1. Press Windows + R, type optionalfeatures.exe, and press Enter. This opens the Windows Features dialog.
2. Scroll down and find Windows Sandbox. Check the box next to it.
3. Click OK. Windows will install necessary files. You may be prompted to restart your computer.

If you don’t see Windows Sandbox listed, double-check your Windows edition (Settings → System → About) to confirm you are running Pro or Enterprise. Also ensure virtualization is enabled in your BIOS/UEFI by rebooting and checking your firmware settings. Sometimes, a BIOS update is needed for newer CPUs or chipsets.

Launching and Using Windows Sandbox

Once enabled, opening Sandbox is simple. Click Start, then type Windows Sandbox and select it. A new window opens with a pristine Windows desktop. This is your disposable test system. It looks familiar but has no access to your installed apps or files unless you specifically bring them in.

To test a file or installer, simply copy it from your host system and paste it inside the Sandbox window. Alternatively, use drag and drop. You can run programs as you would on your main desktop. The built-in Edge browser is available for web testing. When finished, close the Sandbox window. You’ll see a warning that all content will be lost - click OK to confirm. The entire environment, including any changes or malware, is wiped instantly.

Transferring Files and Sharing Data

Windows Sandbox aims to isolate the test environment, but Microsoft provides some convenience features to make it practical. Clipboard sharing is enabled by default. You can copy text or files in your main system and paste them into the Sandbox window, and vice versa. This makes it easy to bring installers, scripts, or documents in for testing.

Drag and drop also works for files, but not folders. If you need to transfer a directory, compress it into a .zip file first, move the zip, then extract inside Sandbox. Remember, anything you want to save from a Sandbox session must be copied out before you close the window. Once closed, all changes inside are gone forever. There’s no way to recover lost data from inside a previous session.

Customizing Windows Sandbox with Configuration Files

With Windows 10 version 1903 and later, and all versions of Windows 11, you can tweak Sandbox startup behavior using configuration files (.wsb). These simple XML-based files let you automate certain settings, such as:

• Mounting host folders as read-only or read/write drives inside Sandbox.
• Running scripts or commands automatically at startup.
• Enabling or disabling network access.
• Controlling vGPU (graphics acceleration) support.

To create a config, open Notepad and save your file with a .wsb extension. For example, to automatically share your Documents folder as read-only and disable networking, use:

<Configuration>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\YourName\Documents</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <Networking>Disable</Networking>
</Configuration>

Double-click your .wsb file to launch Sandbox with those settings. Full documentation is available in Microsoft’s official docs. This makes Sandbox much more flexible for automation or repeatable testing.

Troubleshooting Common Windows Sandbox Issues

If Sandbox fails to start, shows errors like "no hypervisor found", or is missing from Windows Features, several causes are likely. First, ensure virtualization support is enabled in your BIOS/UEFI. Look for settings like Intel VT-x, Intel Virtualization Technology, or AMD SVM. Save and exit after enabling. If Hyper-V is not enabled on your system, enable it through the same Windows Features dialog by checking Hyper-V. Some third-party security software or older device drivers may conflict with Hyper-V and Sandbox, so check for updates or temporarily disable them.

Sandbox won’t run inside another VM (like VirtualBox or VMware) due to nested virtualization limits. It also may not work if you use core isolation or memory integrity features in Windows Security - try turning them off if you get persistent errors. Finally, if you’re on Windows Home, Sandbox won’t appear unless you upgrade or patch your OS unofficially, which carries its own risks.

Practical Tips for Safe and Effective Use

Sandbox is best used as a quick, disposable safety net, not a full replacement for a traditional VM. Only run software you truly suspect might be dangerous. For deeply suspicious files, consider using a dedicated malware analysis VM with network isolation. Sandbox does have network access by default, so malware could theoretically try to connect out during testing.

You can use configuration files to disable networking if you want to test apps safely offline. Always remember that nothing inside the Sandbox persists, so back up anything you want to keep before closing. If performance is sluggish, try closing unnecessary apps on your host to free up RAM and CPU. For repeatable testing, script your workspace with .wsb files to automate setup steps.

Frequently asked questions