How to Use Windows Sandbox to Test Apps Safely in Windows 11

Windows Sandbox gives you a disposable Windows desktop for testing software, opening questionable files and experimenting without installing everything directly on your main Windows 11 environment. When you close the sandbox, its apps, files and state are discarded.

Microsoft describes Windows Sandbox as a lightweight isolated environment that uses hardware-based virtualization and a separate kernel. It is useful, but it is not magic: networking is enabled by default, clipboard sharing is normally enabled, and mapped folders can expose host data if configured carelessly.

What Windows Sandbox Is

Windows Sandbox is a temporary virtualized Windows environment built into supported editions of Windows. It launches quickly because it reuses parts of the host operating system rather than requiring you to maintain a full independent virtual machine image.

Each normal launch starts from a clean state. Closing the Sandbox deletes the software, files and changes made inside it.

Which Windows 11 Editions Support Sandbox?

Microsoft’s current documentation lists Windows 11 Pro, Enterprise, Pro Education/SE and Education as supported. Windows Home does not currently support Windows Sandbox.

You also need virtualization support enabled on the PC. If Sandbox will not start, check Windows edition, virtualization settings and available system resources before assuming the feature is broken.

How to Enable Windows Sandbox

1. Search Windows for Turn Windows features on or off.
2. Check Windows Sandbox.
3. Select OK and allow Windows to install the feature.
4. Restart the PC if prompted.
5. Search Start for Windows Sandbox and open it.

After launch, you get a clean Windows desktop inside a window on your normal desktop.

What Happens When You Close It?

Windows Sandbox is designed to be disposable. Closing the application removes the files, applications and state created inside that session.

One nuance in current Windows 11 documentation: restarts initiated inside Sandbox can preserve state through that internal restart on supported newer versions. Closing the Sandbox itself still discards the session.

Good Uses for Windows Sandbox

• Test a utility before installing it on your main PC.
• Open an unfamiliar installer for inspection.
• Test browser extensions or configuration changes.
• Reproduce a software problem in a clean Windows environment.
• Try scripts or command-line tools without cluttering the host.
• Demonstrate software in a disposable environment.
• Test how an application behaves on a relatively clean Windows installation.

Windows Sandbox Is Not a License to Run Anything

Isolation reduces risk, but deliberately executing highly malicious code is still unsafe. Sandbox can have network access, clipboard sharing and other integrations with the host depending on configuration. Advanced malware may also attempt to exploit virtualization or network relationships.

For suspicious files from scams or active malware incidents, use reputable security tooling and professional malware-analysis environments rather than treating a normal consumer Sandbox session as a guaranteed containment lab.

Networking Is Enabled by Default

Microsoft warns that Windows Sandbox normally connects to a virtual network through the Hyper-V default switch. That means an untrusted application may be able to communicate with the internet or devices reachable from the host’s network.

For higher-risk testing, consider a custom Sandbox configuration with networking disabled.

How to Disable Networking With a .wsb File

Windows Sandbox supports XML configuration files using the .wsb extension. A configuration can set <Networking>Disable</Networking> inside a <Configuration> block, then be saved with a .wsb extension and opened to launch Sandbox with networking disabled.

Clipboard Sharing Is Also Enabled by Default

Clipboard redirection makes it convenient to copy text or files between the host and Sandbox, but that convenience creates another path between the two environments.

When testing something genuinely untrusted, disabling clipboard redirection can reduce exposure. Windows Sandbox configuration files support a ClipboardRedirection setting.

Mapped Folders: Useful but Potentially Risky

You can map a host folder into Sandbox. This is convenient when you need to test a file without manually copying it, but write-enabled mapped folders allow changes made inside Sandbox to persist on the host.

Microsoft specifically recommends considering read-only mapped folders for untrusted files. That reduces the chance that software inside Sandbox can modify the host folder.

Safer Mapped-Folder Practice

When using a .wsb file, map only a dedicated test folder rather than broad locations such as Documents. Set the mapped folder’s ReadOnly value to true when the sandbox only needs to inspect or execute a file. If the test does not need internet access, combine that with networking disabled.

Other Sandbox Settings You Can Control

Current Windows Sandbox configuration files can control several integrations, including:

• Virtualized GPU access.
• Networking.
• Mapped folders.
• Commands that run at sign-in.
• Audio input.
• Video input.
• Printer redirection.
• Clipboard redirection.
• Protected Client mode.
• Assigned memory.

Expose only what your test actually requires.

Windows Sandbox vs a Full Virtual Machine

Windows Sandbox	Traditional VM
Disposable by design	Usually persistent
Fast to create and launch	Requires an OS image and more setup
Uses the same Windows build family as host	Can run different operating systems/builds
Great for temporary testing	Better for long-lived labs and snapshots
Limited customization	Much more configurable

If you need a permanent lab, domain testing, multiple snapshots or another operating system, use Hyper-V, VMware, VirtualBox or another full virtualization platform instead.

Performance and Memory

Sandbox is lighter than maintaining a conventional full VM, but it still consumes CPU, memory and storage resources while running. On a PC with limited RAM, running Sandbox alongside many browser tabs and applications can noticeably increase memory pressure.

For broader Windows hardware guidance, see How Much RAM Does Windows 11 Really Need in 2026?.

What to Do if Windows Sandbox Will Not Start

1. Verify you are running a supported Windows edition.
2. Confirm virtualization is enabled in firmware/UEFI.
3. Install current Windows updates.
4. Restart after enabling the Windows feature.
5. Make sure the PC has enough free memory and storage.
6. Disable and re-enable the Windows Sandbox feature if the installation appears corrupted.
7. Check whether another virtualization or security configuration is interfering.

Sandbox and Malware Testing

For ordinary downloaded utilities and unknown installers, Sandbox can be a useful extra layer. For a PC that may already be infected, do not use Sandbox as a substitute for cleanup. Use our Windows 11 malware-removal guide.

If the suspicious item came from a fake security alert or remote-support scam, see Tech Scams Exposed.

Windows Sandbox Safety Checklist

• Use a supported Windows edition.
• Keep Windows updated.
• Do not map sensitive host folders unnecessarily.
• Use read-only mapped folders for untrusted files when practical.
• Disable networking when the test does not need internet access.
• Disable clipboard sharing for higher-risk testing.
• Do not sign in to sensitive accounts inside a suspicious test environment.
• Close Sandbox when the test is finished so the session is discarded.

Microsoft’s current reference is available in the Windows Sandbox documentation.

Bottom Line

Windows Sandbox is one of the most useful security and troubleshooting features available in supported Windows 11 editions. It gives you a fast, disposable environment for testing software without permanently changing the host. For ordinary testing, the default setup is convenient. For untrusted files, reduce integration by disabling networking, limiting clipboard access and using read-only mapped folders.