Exploring Windows Sandbox: Your Safe Space for Testing

In today's digital age, security is a top priority. Whether you're a developer testing new software or just someone wanting to explore unfamiliar web sites or applications, Windows Sandbox provides a safe, isolated environment to do just that. In this post, we'll explore what Windows Sandbox is, how to set it up, and tips for getting the most out of it.




What is Windows Sandbox?

Windows Sandbox is a lightweight virtual machine running Windows that is built into Windows 11 Pro and Enterprise (and Windows 10 Pro and Enterprise, from version 1903 onwards).

It allows you to run applications and access websites in a secure environment without affecting your main operating system. Once you close the Sandbox, all files and changes made inside it are discarded, ensuring a clean slate for each new session.

It can run on more modest hardware than VirtualBox and VMWare Workstation, because it shares the resources and infrastructure of the host. This also means it starts up very quickly.

It requires less maintenance, because it is updated as your main Windows installation is updated.

VirtualBox and VMWare Workstation are more suitable when you want persistence, snapshots and the ability to run alternate operating systems. But they require a lot more resources (memory, processor time, disk space, etc.), configuration and maintenance (updating VirtualBox and VMWare Workstation, guest tools, operating systems and applications).

Key Features:

  • Isolation: Your main system remains unaffected by any changes made in the Sandbox.
  • Easy to Use: No complicated setup is required. It launches like any other application.
  • Lightweight: It runs on the same kernel as your host machine, ensuring minimal resource overhead.
  • Fixed initial status: Returns to a completely clean default state every time it is started. This removes any trace of installed applications and web browsing history

Setting Up Windows Sandbox

Step 1: Check your machine meets the requirements

There only a few requirements for running a Windows Sandbox.
  1. You must be running the Pro or Enterprise editions of Windows 10 or 11.
  2. Hardware virtualisation must be enabled.
  3. Minimum 4GB RAM (8GB or more is recommended).
  4. Minimum 2 CPU (4 or more cores with hyperthreading is recommended).
You can use winver to check your Windows version and Task Manager to check hardware virtualisation, installed RAM and number of CPU cores.

Windows showing Windows edition
winver - showing Windows Edition (Pro, Home, etc.)


Task Manager showing values to check

Step 2: Enable Windows Sandbox

To do this you enable the following Windows Features:
  1. Hyper-V Platform.
  2. Virtual Machine Platform.
  3. Windows Sandbox
These can be enabled by running "Turn Windows features on or off" from the Start Menu and making sure the items listed above are ticked.

Windows Features to enable

If you turn on the above features, the supporting software will be installed and you may need to restart Windows on your computer.

Running the Windows Sandbox

There are 2 ways to run a Windows Sandbox.
  1. Click the Start Menu, type "sandbox" and then click on "Windows Sandbox".

  2. Create a Sandbox configuration file (see later) and double-click on that file in File Explorer or your desktop. 
When the Sandbox starts, you will see a new Windows desktop. This can be resized or moved as needed

The Windows Sandbox can be closed in the same way as any Windows system, by selecting "shut down".



When the Sandbox is terminated, all changes made within it will be lost.

Sandbox Restrictions and Features

There are a few limitations as to what the Windows Sandbox can and cannot do.
Other than these, it should behave like any other Windows installation.

You are allowed to:
  1. Restart the Sandbox.
    The sandbox will not revert to its initial state after it is restarted.
    This allows you to install applications that need a restart.

  2. Use a configuration file to define certain settings when it starts.
    You can set up RAM, shared folders, network access, etc.
    This is explained later in "Recommended Configuration".

It does not allow:

  1. Running more than 1 Windows Sandbox at a time.

  2. Windows Activation.

  3. Windows Updates.
    The sandbox automatically uses the latest binaries from the main Windows installation.
    It is a bit confusing, because the sandbox may not show the same version info as the host.
    There is no need to worry about this discrepancy.

  4. Updating the Microsoft Edge web browser.
    The version of Edge will be the same as the host when the sandbox is started.

  5. Persist changes after shut down.
    When you shut down the Sandbox, all changes will be lost.
    When it is next started it will be in the default clean state.
Generally, provided you keep your main Windows installation regularly updated, then the Windows Sandbox will also be up to date.

Recommended Configuration

There are a few things I would recommend when using a sandbox.
  1. Run Windows Sandbox using a configuration file.
    This allows you to set up the Sandbox the way you want. In terms of memory usage, shared folders, etc.

  2. Create a script to install applications after starting the sandbox.
    You will probably find that you want some applications installed in the sandbox every time it is run.
    For example, you may like to use the Google Chrome or Brave web browser instead of Microsoft Edge.

Sandbox Configuration File

A sandbox configuration file allows you to set memory, network access, shared folders etc.
And even automatically run a batch file (see later).

Several .wsb files may be created, to allow you to run sandboxes with different configurations.
For example, a sandbox for checking websites may require different to a sandbox for testing applications.

To create a sandbox configuration file:
  • Create a text file with a ".wsb" extension to hold the configuration settings.
  • Double-click on the file to open a sandbox with those settings.

Here is an example configuration file that:
  • Sets the memory to 8192 MB.
  • Enables networking (to disable this, set the value to "Disable").
  • Shares the "C:\sandbox\shared" folder on the host computer to "C:\Shared" on the sandbox.
    This is set to writeable (ReadOnly is False)
  • Shares the "user downloads" folder to C:\Downloads on the sandbox.
    This is set to read only (ReadOnly is True)
  • Runs a batch file to install applications.
    <Configuration>
        <MemoryInMB>8192</MemoryInMB>
        <Networking>Enable</Networking>

        <MappedFolders>
            <MappedFolder>
                <HostFolder>C:\sandbox\shared</HostFolder>
                <SandboxFolder>C:\shared</SandboxFolder>
                <ReadOnly>false</ReadOnly>
            </MappedFolder>

    <MappedFolder>
        <HostFolder>C:\Users\%USERNAME%\Downloads</HostFolder>
<SandboxFolder>C:\Downloads</SandboxFolder>
<ReadOnly>true</ReadOnly>
            </MappedFolder>
        </MappedFolders>

<ProtectedClient>Enable</ProtectedClient>

        <LogonCommand>
            <Command>powershell -executionpolicy unrestricted -command "start C:\shared\run_install.bat {-noexit}"</Command>
        </LogonCommand>
    </Configuration>


You may want to change these settings:
  1. Memory
    Allocate more or less RAM depending on the applications to be run in the sandbox.

    I allocate 8192 MB for a general purpose sandbox and 16384 MB when testing local AI Large Language Models.

    You may want to allocate 4GB, if your system does not have much memory.

  2. MappedFolders
    To share other folder(s) on your computer with the sandbox.

    If you do not specify a sandbox folder, the mapped folder will appear on the sandbox desktop.

  3. ProtectedClient
    This adds an extra layer of boundary security     to the sandbox by running it inside an "AppContainer Isolation execution environment".

    You can find more details about this feature here -https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-isolation.

    To disable this feature, change this value to "Default" or "Disable".

    Enabling this feature may impact access to resources (e.g. restricting ability to copy and paste files in and out of the sandbox).

  4. LogonCommand
    The above example show how to run a batch file. Where "run_install.bat" is the batch file.
    A batch file can be thought of as a sequence of instructions.

    You may want to just open a shared folder in File Explorer, to allow you to manually install applications

    In that case the command line would be something like:

        <Command>explorer.exe C:\shared</Command>

  5. Networking
    I recommend leaving Networking enabled until you have installed everything that requires internet access.
    The following section explains how to disable network access once the sandbox is running.

How to Disable Network Access in the Sandbox

To disable network access in the sandbox.
  1. Right-click on the network icon in the system tray.

  2. Click on "Network and Internet Settings".


  3. Click on "Advanced network settings"


  4. Click the "Disable" button.


Installing a set of applications after starting the sandbox

This is split into 2 parts.
  1. Create a batch file to be run automatically when the sandbox starts up.

  2. Create a PowerShell script file to perform the application installation.

Creating a Batch File to Install Applications

The batch file below does 2 things.
  1. Run a PowerShell script to install applications.
  2. Wait for the user to press a key before closing the installation window.
PowerShell has been chosen to perform the actual installation because some of the commands used in the installation will only run in PowerShell.

To create the batch file:
  1. Open a text editor (I recommend using Notepad++).

  2. Paste in the following text and save the file as "run_install.bat" in the shared host folder (e.g. "C:\sandbox\shared".
echo off

:: run file explorer and open the shared folder
:: explorer.exe C:\shared

:: run powershell script to install everything
cd c:\shared
powershell -file "install.ps1"

pause

Note:
  1. :: indicates the line contains a comment and should be ignored.

  2. I have included the instruction to open "C:\shared" in File Explorer.
    To enable this action, remove :: from the start of the "explorer.exe" line

Creating a PowerShell script to install applications

I have split this into 3 parts:
  1. Install "winget".
    This is an application that allows you to install other applications from the command line.

  2. Install the Microsoft Visual C++ redistributables.
    These are library files that many applications depend on.

  3. Install other useful applications via winget.

Here are the instruction on how to create the PowerShell installation script.
  1. Open a text editor (I recommend using Notepad++).

  2. Paste in the following text and save the file as "install.ps1" in the shared host folder (e.g. "C:\sandbox\shared".
# *************************
# * Function declarations *
# *************************

# Function to download and install winget
Function install_winget{
Write-Host 'Installing Windows Package Manager (winget)...' -ForegroundColor Green
$downloadWinget = $true
$progressPreference = 'silentlyContinue'
# if the installers are already downloaded, ask if they want to download the latest versions
if (Test-Path -Path ".\DesktopAppInstaller.msixbundle"){
Write-Host "Winget installer is available."
$choice = Read-Host "Download latest version from the internet? (Y/N)"
if ($choice -ne 'Y' -and $choice -ne 'y') {
$downloadWinget = $false
}
}

# download winget if installers not present or user selected to download latest version
if ($downloadWinget -eq $true){
Write-Host "Downloading winget..." -ForegroundColor Green
Invoke-WebRequest -Uri 'https://github.com/microsoft/winget-cli/releases/download/v1.8.1911/Microsoft.DesktopAppInstaller_8wekyb3d8bbwe.msixbundle' -OutFile 'DesktopAppInstaller.msixbundle'
Invoke-WebRequest -Uri 'https://aka.ms/Microsoft.VCLibs.x64.14.00.Desktop.appx' -OutFile 'VCLibs.x64.14.00.Desktop.appx'
Invoke-WebRequest -Uri 'https://github.com/microsoft/microsoft-ui-xaml/releases/download/v2.8.6/Microsoft.UI.Xaml.2.8.x64.appx' -OutFile 'Xaml.2.8.x64.appx'
}

# install winget
Write-Host "Installing winget..." -ForegroundColor Green
Add-AppxPackage VCLibs.x64.14.00.Desktop.appx
Add-AppxPackage Xaml.2.8.x64.appx
Add-AppxPackage DesktopAppInstaller.msixbundle

Write-Host 'Winget installation complete' -ForegroundColor Green
Write-Host ' '
}

# Function to install visual c/c++ redistributables
Function install_visualc_redist {
Write-Host 'Installing MSVC redist x64...' -ForegroundColor Green
winget install Microsoft.VCRedist.2015+.x64
Write-Host 'MSVC redist x64 - installation complete' -ForegroundColor Green
Write-Host ' '

Write-Host 'Installing MSVC redist x86...' -ForegroundColor Green
winget install Microsoft.VCRedist.2015+.x86
Write-Host 'MSVC redist x86 - installation complete' -ForegroundColor Green
Write-Host ' '
}

# Function to install application using winget
#     friendlyName - name displayed to the user when installing
#     packageName - id passed to winget to install the application
Function install_package{
param (
$friendlyName,
$packageName
)

# ask if user wants to install application
Write-Host "Install" $friendlyName" (Y/N)?" -ForegroundColor Green
$choice = Read-Host " "
if ($choice -eq 'Y' -or $choice -eq 'y') {
# install application
        Write-Host "Installing" $friendlyName "using winget ..." -ForegroundColor Green
winget install $packageName
        Write-Host $friendlyName " - installation complete" -ForegroundColor Green
Write-Host " " -ForegroundColor Green
}

# print a blank line
    Write-Host " "
}


# ***********************************
# * script starts running from here *
# ***********************************

# install winget
install_winget

# install visual c/c++ redistributables
install_visualc_redist

# install 7-zip
install_package -friendlyName "7-zip" -packageName "7zip.7zip"

# install notepad++
install_package -friendlyName "Notepad++" -packageName "Notepad++.Notepad++"

# install Firefox
install_package -friendlyName "Firefox web browser" -packageName "Mozilla.Firefox"

# install Google Chrome
install_package -friendlyName "Google Chrome web browser" -packageName "Google.Chrome"

# install Brave
install_package -friendlyName "Brave web browser" -packageName "Brave.Brave"

Write-Host "App installation complete" -ForegroundColor Green

Running the PowerShell Install script

If you used the configuration file described earlier, then the installation will start automatically when you double-click the .wsb file to open the sandbox.

Make sure that the folders names are correct and that the folder containing the PowerShell script is not "read only".

If you decide to run the PowerShell install script manually, you will first need to allow them to execute.
To allow execution, perform the following actions in the sandbox.
  1. Open a PowerShell window (click the Stat Menu, type "powershell" and press Enter).

  2. Paste in the following command and press Enter.

        powershell Set-ExecutionPolicy -ExecutionPolicy Unrestricted

  3. You can now navigate to the folder containing the PowerShell script and run it.

  4. When you have finished running your script(s), type the following and press Enter (to return execution permissions to default).

        powershell Set-ExecutionPolicy -ExecutionPolicy Default

When the install script is running follow the prompts, entering "Y" to accept the agreements and "Y" for each application you want to install..



A Brief Explanation of the PowerShell Script

There are 3 functions declared at the start of the script.
A function is a set of instructions to perform a specific task that can be called by using the function name.

In this case they are "install_winget", "install_visualc_redist" and "install_package".

install_winget
Checks if you have the winget installers available. If they are, it asks if you want to download the latest version.
If the installers are not available or you want to download the latest version, it will download them.
And finally, it will install winget and its dependencies.


install_visualc_redist
Installs the Visual C++ redistributables. These are needed to allow lots of other applications to run.

install_package
Asks if you want to install the specified package and then installs it if you say "Y".

The main part of the script (from the comment "script starts running from here") uses these functions to install winget, the Visual C++ redistributables, and then each listed application..

How to Add Applications to the Installation List

To add an application to the installation, just add an "install package" line.

For example:

Libre Office is an open source equivalent to Microsoft Office.
It includes a word processor (like Word), spreadsheet app (like Excel), presentation app (like PowerPoint), etc.

To add this to the list of applications to be installed, insert the following lines into the install.ps1 file after the last install-package line.

# install Libre Office
install-package -friendlyName "Libre Office" -packageName "TheDocumentFoundation.LibreOffice"

Save the updated file.
When you now start the sandbox using the .wsb file, you will be given the option to install Libre Office.

How to find and install applications manually using winget

  1. Open a command prompt or PowerShell window.

  2. Find the id for the application by typing:
        winget search <app name>
    e.g.
        winget search chrome

  3. You will be presented with a list of matches. Choose the appropriate one and then use the id of that item to install the application.


  4. In this example you can see that best match is "Google Chrome" (as highlighted).
    To install this application type the following and press Enter.

        winget install Google.Chrome

  5. The application will be downloaded and installed.

Conclusion

The Windows Sandbox is a very useful tool for trying out applications and browsing the internet without leaving a trail on your computer.

5 reasons to use it are:
  1. Safe Testing of Applications
    Windows Sandbox allows users to run untrusted applications in an isolated environment, minimizing the risk of malware or system corruption. This is particularly useful for testing new software without affecting the main operating system.

  2. Temporary Environment
    Each time Windows Sandbox is launched, it provides a fresh instance of the operating system. Any changes made within the sandbox are discarded once it's closed, ensuring that your primary system remains clean and clutter-free.

  3. Protection Against Malware
    By isolating applications, Windows Sandbox protects the host machine from potential threats. If malware is executed within the sandbox, it cannot affect the main operating system, allowing users to experiment with potentially harmful software without fear.

  4. Convenient for Development
    Developers can use Windows Sandbox to test their applications in a clean environment, ensuring compatibility and functionality without interference from other installed software or settings on their primary machine.

  5. Exploration of Suspicious Content
    Users can safely open untrusted websites or files within the sandbox. This is beneficial for checking links or attachments from emails that may pose security risks, as any harmful effects will be contained within the sandbox.

Note:
  1. When doing any potentially risky operation in the sandbox, make sure that all shared folders are "read only".

  2. If all shared folders are read only, copy the PowerShell installation script to a writeable folder in the sandbox and run it from there.

Comments

Post a Comment