Test unfamiliar apps in Windows Sandbox
Check Windows 11 Sandbox eligibility, setup, networking, and file-sharing limits before using its disposable desktop to inspect an unfamiliar app.
Publication & corrections: infostoa · Editorial standards
Individual author and specialist reviewer information is not provided for this article.
Windows Sandbox is a disposable virtual desktop for testing apps on Windows 11 Pro, Enterprise, and Education. It runs a separate kernel and discards its session files when closed, but does not guarantee perfect isolation or prove a file is safe. Review network and folder-sharing settings as well.
What Sandbox does
Microsoft lists Windows 11 Pro, Enterprise, and Education as supported editions; Windows Home is unsupported. The feature page also covers behavior and configuration.
The page also applies to Windows 10, whose ordinary support ended in October 2025. Extended Security Updates vary by device, so this walkthrough uses a supported Windows 11 PC.
Enable it and test an app
Check that hardware virtualization is enabled in firmware. Search Windows for “Turn Windows features on or off,” select “Windows Sandbox,” and restart if asked. Launch Sandbox from Start. If it is missing or will not start, check the edition, updates, and firmware setting. Enabling the feature may require administrator access.
Windows Central editor Mauro Huculak’s usage guide demonstrates enabling the feature and running an installer inside it. It also shows transferring an installer from the host. Bring over only what you need and check its origin and signature.
Expert perspective
Huculak’s article is a practical setup and usage walkthrough: it describes installing an app in Sandbox and closing the window to discard the instance. Its file-transfer example is useful, but crossing the host boundary is itself a sharing decision. The guide does not claim to provide malware analysis or perfect isolation. Read that workflow alongside Microsoft’s technical limits on networking and read-only folder mapping.
Limit networking and sharing
Sandbox networking is on by default, so an app inside can reach the internet and potentially the internal network. Microsoft says networking can be disabled in a .wsb configuration file. For an untrusted file, consider turning networking off and mapping only a required folder as read-only. Check the actual configuration instead of assuming folder or clipboard sharing defaults.
Move logs or results you need to a trusted destination before closing. Avoid bringing the suspicious executable back to the host; read-only folder mapping can reduce changes to the original. Disabling networking and minimizing sharing reduce exposure but cannot guarantee protection from every vulnerability or escape. Do not test dangerous files on a sensitive work device; follow your organization’s security process. Close the window to discard the session.