What Windows Sandbox is and what it needs
Technically the Sandbox is a lightweight VM on top of hardware virtualization, but it feels like an app: it boots a pristine Windows in a couple of seconds, shares your clipboard and internet connection, and wipes itself completely when closed. There is no disk image to maintain, no license question, nothing to update — each launch starts from the same clean snapshot.
The price of that convenience is a hardware list. The feature only appears on Windows 11 Pro, Enterprise and Education; Home edition cannot install it at all. And the PC itself must be ready to virtualize.
- Windows 11 Pro, Enterprise or Education — Home edition cannot install it
- Virtualization enabled in UEFI/BIOS: Intel VT-x or AMD-V
- At least 4 GB of RAM, comfortably 8 GB
- A CPU with at least two cores and 1 GB of free disk space
- Administrator rights for enabling the feature
Enabling the Sandbox and testing a file
Press Win+R, type optionalfeatures and hit Enter — or open Settings → Apps → Optional features → More Windows features. In the list tick Windows Sandbox, confirm, and restart when asked; Windows installs the virtualization foundations along with it. The scripted route in an elevated PowerShell does the same: Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All.
After the reboot, type sandbox in the Start menu and open Windows Sandbox. Copy the suspicious file on the host, paste it into the sandbox window — drag-and-drop is not supported, the clipboard is — and run it. Watch what it does: Task Manager inside the sandbox (Ctrl+Shift+Esc) shows processes, and since networking is on by default the file can download or activate and you still do not care. Close the window, confirm that everything will be discarded, and this copy of Windows is gone as if it never existed.
Locking it down with a .wsb file — and where the limits are
For genuinely hostile files, cut the network before you start. Create a text file with the extension .wsb containing <Networking>Disable</Networking>, save it, and double-click it: the Sandbox then starts with internet off, so the sample can neither phone home nor scan your LAN. The same file can map a folder read-only — a <MappedFolders> block with <HostFolder> and <ReadOnly>true</ReadOnly> — or cap memory with <MemoryInMB>4096</MemoryInMB>.
Know the limits, too. With networking on, the sandbox shares your network; the clipboard is shared by default as well, so for anything truly nasty disable both. Determined malware can also detect that it runs in a VM and behave — for serious analysis nothing beats a dedicated offline VM. For the everyday question “is this installer from a random site safe”, though, it is the fastest honest answer there is. And if you end up testing programs on the host itself, their leftovers in %TEMP% and AppData are exactly what a tool like Kleaner PRO sweeps out.
Questions and Answers
Is Windows Sandbox available on Windows 11 Home?
No — it needs Pro, Enterprise or Education. On Home, a classic virtual machine such as VirtualBox is the working alternative.
Does Windows Sandbox keep anything after I close it?
No. The moment you close the window, the whole sandbox — files, registry changes, downloads — is discarded. Every launch starts from a clean snapshot.
Is Windows Sandbox safe for testing malware?
Reasonably, with networking disabled via a .wsb file. Be aware that sophisticated malware can detect virtual machines, so serious analysis belongs in a dedicated offline VM.
Know what is included before you buy.
The one-time 30-minute trial covers core tools. PRO-labelled features stay locked until a paid license is activated.
Read next
Write to us: [email protected]