Test a Suspicious File in Windows Sandbox

Windows Sandbox is not available on Home. The edition string from DISM is the reliable check, and the optional feature list shows whether the sandbox is installable at all.

DISM /online /Get-CurrentEdition
Get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM | Select-Object FeatureName,State
Get-ComputerInfo -Property HyperVRequirementVirtualizationFirmwareEnabled,HyperVisorPresent

**Enable-WindowsOptionalFeature** needs a restart. The sandbox uses the same hypervisor layer as Hyper-V, so a machine with Hyper-V already on can run both.

Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All -NoRestart
Get-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM | Select-Object State
Restart-Computer

The defaults give the sandbox network access and a read-only view of the host through a mapped folder. Both settings change what a sample can do, so set them deliberately.

$cfg = @'
<Configuration>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Samples</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>
'@
$cfg | Set-Content "$env:USERPROFILE\sandbox.wsb" -Encoding UTF8

The sandbox window is a clean Windows desktop. The mapped folder appears on the desktop as **C:\Users\WDAGUtilityAccount\Desktop\Samples** and is read-only by design.

Start-Process "$env:USERPROFILE\sandbox.wsb"
# inside the sandbox:
# open the Samples folder on the desktop
# run the installer or the document there, never on the host

Task Manager and the sandbox's own Event Viewer show the processes and services the sample created. Anything that survives the session is gone at close, but what it tried to reach is worth noting.

# inside the sandbox:
Get-Process | Sort-Object StartTime -Descending | Select-Object -First 10 Name,Id,StartTime
eventvwr.msc
# Windows Logs > Application, look for the sample's process name

Closing the sandbox window discards the state, including files written to its desktop. The next start is a fresh image, which is the entire point of the tool.

# close the sandbox window with the X
Get-Process -Name WindowsSandboxClient -ErrorAction SilentlyContinue
Test-Path "$env:LOCALAPPDATA\Microsoft\Windows\Sandbox"
Start-Process "$env:USERPROFILE\sandbox.wsb"