How to Use Windows Sandbox to Test Apps Safely

Windows Sandbox is one of those built-in Windows features that most people walk right past without ever knowing it exists. That is a shame, because it might be the single smartest tool for staying safe when you are curious about a new app, an email attachment, or a sketchy utility you found online.

Here is the problem every Windows user faces at some point. You come across a free tool that promises to fix your PC, speed up your startup, or do something genuinely useful. The website looks okay. Maybe there are even a few decent reviews. But something in the back of your head says: do I really want to install this on my main machine?

Before Windows Sandbox, your realistic options were to either take the risk and install it anyway, spin up a full virtual machine (which takes real effort to configure), or just skip the software entirely. None of those feels great.

Windows Sandbox changes that equation completely. It gives you a clean, disposable copy of Windows that boots in seconds, runs any app you throw at it, and then wipes everything the moment you close the window. No cleanup required. No leftover registry entries. No malware clinging to your real system. Just a fresh start every single time.

In this guide, you will learn exactly what Windows Sandbox is, how to enable it, how to use it effectively, and some advanced tricks that make it even more powerful for regular use.

What Is Windows Sandbox?

Windows Sandbox is a built-in feature introduced with Windows 10 version 1903 (May 2019 Update) that creates a lightweight, isolated virtual environment running a clean copy of Windows. Think of it like Incognito Mode, but for your entire operating system.

When you launch Windows Sandbox, Windows spins up a temporary, self-contained desktop using hypervisor-based virtualization. It is technically a virtual machine, but it is far lighter than a traditional VM. Microsoft engineered it specifically for quick, disposable testing sessions rather than long-running environments.

Here is what makes Windows Sandbox genuinely different from a standard virtual machine:

• It launches in seconds, not minutes. Most users see it ready in under 10 seconds.
• It only takes about 100 MB of storage because it shares core OS files with your host system dynamically.
• It requires zero setup. There is no ISO to download, no OS to install, and no license to worry about.
• It always runs the same version of Windows you are on, which means it is always fully up to date.
• Everything is gone when you close it. All installed apps, downloaded files, registry changes, and any potential malware are permanently erased.

That last point is the real magic here. The isolation is complete. Anything that runs inside Windows Sandbox has no persistent access to your host machine. Even if an app you test turns out to be a full-blown piece of ransomware, your actual computer stays completely untouched.

System Requirements for Windows Sandbox

Before you dive in, make sure your system can actually run Windows Sandbox. The requirements are not demanding, but there are a few things to check.

Operating System Requirements:

Windows Sandbox is available on the following editions:

• Windows 10 Pro, Enterprise, and Education (version 1903 or later)
• Windows 11 Pro, Enterprise, and Education

It is not available on Windows Home editions of either Windows 10 or Windows 11. If you are on a Home edition, you will need to upgrade to Pro or switch to an alternative like a traditional virtual machine.

Hardware Requirements:

• A 64-bit processor with at least 2 cores (4 cores with hyperthreading recommended)
• 4 GB of RAM minimum (8 GB strongly recommended for smooth performance)
• 1 GB of available disk space
• Hardware virtualization must be enabled in your BIOS/UEFI settings

That last requirement is the one most likely to trip people up, so the next section covers how to check and enable it.

How to Enable Windows Sandbox on Windows 10 and 11

Enabling Windows Sandbox is a two-step process: confirming that hardware virtualization is turned on, and then activating the feature through Windows.

Step 1 — Check If Virtualization Is Enabled

Most modern computers come with virtualization enabled by default, but it is worth verifying before you start. Here is how:

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Click the Performance tab.
3. Select CPU from the left panel.
4. Look for "Virtualization" in the lower right corner of the CPU panel.

If it says Enabled, you are good to go. If it says Disabled, you will need to enter your computer's BIOS/UEFI settings and enable it. The setting is typically found under names like "Intel Virtualization Technology (VT-x)", "AMD-V", or "SVM Mode" depending on your processor. The exact steps vary by motherboard manufacturer, but a quick search for your specific BIOS model will get you there in minutes.

Step 2 — Enable Windows Sandbox Through Windows Features

Once virtualization is confirmed, activating Windows Sandbox takes about 30 seconds:

1. Press Windows + S and type "Turn Windows features on or off", then press Enter.
2. Scroll down the list until you find Windows Sandbox.
3. Check the box next to it.
4. Click OK.
5. Let Windows install the required files and then restart your computer when prompted.

After the restart, you can find Windows Sandbox in your Start menu just like any other app. You can even pin it to your taskbar if you use it often.

Note: You may also notice options for Hyper-V and Virtual Machine Platform in the same list. You do not need to enable those just to use Windows Sandbox. Windows handles the required virtualization components automatically.

How to Use Windows Sandbox to Test Apps Safely

Now that Windows Sandbox is enabled, here is the practical workflow for testing any app safely.

Launch Windows Sandbox

Open the Start menu, type "Windows Sandbox", and click the app. A separate window will appear with a clean Windows desktop after a brief loading period. It looks like a fresh Windows installation because that is essentially what it is.

This environment runs completely isolated from your main system. Nothing you do inside it affects your real files, settings, or registry.

Transfer Files Into the Sandbox

Say you downloaded a suspicious executable called setup.exe on your real PC and want to test it before running it on your main system. Here is how to get it into Windows Sandbox:

Method 1 — Copy and Paste (Recommended for Single Files):

1. On your host PC, locate the file you want to test.
2. Right-click the file and select Copy (or press Ctrl + C).
3. Click inside the Windows Sandbox window to bring it into focus.
4. Right-click on the Sandbox desktop and select Paste (or press Ctrl + V).

The file transfers almost instantly for small executables. This works because clipboard redirection is enabled by default in Windows Sandbox.

Important: Drag and drop does not work in Windows Sandbox. Use copy and paste instead.

Method 2 — Use a Configuration File to Map a Folder (For Power Users):

If you regularly test apps, you can create a .wsb configuration file that automatically maps a folder from your host machine into the sandbox environment at launch. See the advanced section below for the full details.

Run and Observe the App

Once your file is inside Windows Sandbox, double-click it and install or run it just as you normally would. Watch carefully for these behaviors that might indicate something is wrong:

• Unexpected pop-ups or browser windows opening — a common sign of adware or PUPs (Potentially Unwanted Programs).
• Multiple background processes spawning — check Task Manager inside the Sandbox (Ctrl + Shift + Esc works there too).
• Attempts to disable Windows Defender — a red flag for malware.
• Unusual network activity — you can also disable networking in the Sandbox if you want to test an app without any internet access.
• Requests for admin privileges beyond what seems reasonable — a legitimate photo editor does not need to disable your firewall.

Because the isolated environment is a real copy of Windows, the app behaves exactly as it would on your main machine. You get an accurate picture of what it actually does, not just what the installer screen claims.

Close and Clean Up

When you are finished testing, simply close the Windows Sandbox window. You will see a prompt asking you to confirm. Click OK, and the entire environment is wiped. Every app you installed, every file you opened, every registry change the app made — all of it is gone permanently. Your real PC remains completely untouched.

This is the core value of Windows Sandbox: zero cleanup, zero residue, zero risk to your main system.

Advanced Windows Sandbox Configuration With .wsb Files

For more control over how Windows Sandbox behaves, you can create a custom configuration file with a .wsb extension. These are simple XML files you can write in Notepad.

Mapping Host Folders Into the Sandbox

One of the most useful tricks is mapping a folder from your real PC into the sandbox environment so you do not have to copy files every time:

<Configuration>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxTesting</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Desktop\Testing</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Save this file with a .wsb extension (for example, TestingLab.wsb). Double-clicking it launches Windows Sandbox with the C:\SandboxTesting folder from your real PC mapped to the Sandbox desktop as read-only. The Sandbox can read from the folder, but it cannot write back to your host machine, which adds an extra layer of security.

Disabling Networking in Windows Sandbox

If you are testing something particularly suspicious and do not want it calling home to a server, you can disable networking entirely:

<Configuration>
  <Networking>Disable</Networking>
</Configuration>

This is especially useful when testing apps that look like they might be spyware or data-harvesting tools. Without a network connection, they cannot transmit anything even if they try.

You can combine both settings in a single .wsb file for maximum control. According to Microsoft's official Windows Sandbox documentation, configuration files support networking, mapped folders, login commands, virtual GPU settings, and more.

Practical Use Cases for Windows Sandbox

Windows Sandbox is useful for far more than just testing sketchy downloads. Here are some real-world scenarios where it genuinely earns its keep:

• Testing software before committing to it. Try that new PDF editor or video converter without cluttering your real PC with a trial version you might never use again.
• Opening suspicious email attachments. That invoice PDF from an unknown sender? Open it inside Windows Sandbox first.
• Safe web browsing in unknown territory. Access a website you are not sure about without risking your real browser's session cookies or saved passwords.
• Developer testing and QA work. Verify how your app installs on a clean Windows environment, or test it against a baseline system without dependencies from your development setup.
• Running multiple development environments. As Microsoft Learn notes, you can maintain separate sandboxes for different Python versions and dependencies by creating multiple .wsb configuration files, each pointing to a different folder.
• Demoing software to clients or colleagues without permanently installing anything on your machine.

Windows Sandbox vs. Traditional Virtual Machines

A common question is: why use Windows Sandbox when you could just spin up a full VM in Hyper-V or VirtualBox?

Feature	Windows Sandbox	Traditional VM
Setup time	Seconds	Minutes to hours
Storage footprint	~100 MB	20–50 GB+
Persistence between sessions	No (by design)	Yes
Configuration complexity	Very low	Moderate to high
Snapshot support	No	Yes
Multiple simultaneous instances	No	Yes
Best for	Quick disposable testing	Long-term dev environments

Windows Sandbox wins on speed and simplicity. A traditional VM wins when you need persistence, snapshots, or the ability to simulate a completely different environment. For the use case of "is this app safe to run?", Windows Sandbox is the right tool almost every time.

Tips and Limitations to Know Before You Start

Windows Sandbox is excellent, but it is not perfect. Here are a few things worth knowing:

• It does not persist between sessions. This is a feature, not a bug, but it means you cannot save work inside the Sandbox. If you need to keep a file generated inside it, copy it out to your host machine before closing.
• Only one instance can run at a time. You cannot have two separate Windows Sandbox sessions open simultaneously.
• It is not available on Windows Home. This is a real limitation for a large portion of Windows users.
• Some system-level scripts may behave differently inside the Sandbox than on a real machine, since it is not a full standalone Windows installation.
• Do not enter sensitive passwords inside the Sandbox when testing unknown apps. Even though the environment is isolated, you do not want a keylogger inside it potentially logging your credentials before you close the window.
• Performance varies by hardware. On older machines, Windows Sandbox can run a little sluggish at first but typically settles in after a couple of minutes.

Conclusion

Windows Sandbox is one of the most underrated built-in tools in Windows 10 and 11, giving you a fast, lightweight, and genuinely secure way to test unknown apps, open suspicious files, and explore new software without putting your real system at any risk. By enabling it through Windows Features, checking that hardware virtualization is active in your BIOS, and learning how to transfer files via clipboard or .wsb configuration files, you can turn what used to be a risky guessing game into a safe, repeatable process. Whether you are a developer, a power user, or someone who just wants to stay safer online, building Windows Sandbox into your regular workflow is one of the simplest and most effective security habits you can develop on Windows.