Test Installers in Windows Sandbox Before You Trust Them

TL;DR

Enable **Windows Sandbox**, map a folder into it with a `.wsb` config, and start the session with `WindowsSandbox.exe`. Closing the window discards every change the installer made.

Before you start

Requirements

Windows 11 Pro or Enterprise
Virtualization in the BIOS
8 GB RAM
Fifteen minutes

Step by step

Instructions

Check the edition first

The sandbox ships with Pro, Enterprise and Education only. On a Home machine the feature name is not present in the image and the enable command fails with an unknown feature error, which is not a bug.

Get-ComputerInfo -Property WindowsProductName, HyperVRequirementVirtualizationFirmwareEnabled

Enable the optional feature

One command adds the container-based desktop. The executable appears after a reboot, not before.

Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All

tipCore isolation and Credential Guard already use the hypervisor. The sandbox reuses it instead of fighting for it, so the reboot is enough.

Understand what is disposable

Every start boots a fresh copy of the installed build. Files, registry keys and services the installer creates disappear when the window closes, which is exactly what makes it useful for an untrusted setup file.

tipThe image is taken from your installed Windows, not downloaded. Starting a session costs seconds, not gigabytes.

Write the config file

A .wsb file maps a host folder into the guest and can switch networking off. Put the installer into that folder and the guest sees it as an ordinary drive.

<Configuration><MappedFolders><MappedFolder><HostFolder>C:\Users\Public\Sandbox</HostFolder><SandboxFolder>C:\share</SandboxFolder><ReadOnly>false</ReadOnly></MappedFolder></MappedFolders><Networking>Disable</Networking><ClipboardRedirection>Disable</ClipboardRedirection></Configuration>

Start the session with the config

Passing the .wsb path applies it to that one session. Without the argument the sandbox starts clean, with no shared folder and full network access.

C:\Windows\System32\WindowsSandbox.exe C:\Users\Public\Sandbox\test.wsb

Inspect what the installer created

Install inside the guest, then list the auto-start services and scheduled tasks it added. Anything you would refuse on the real machine is the answer you needed, and nothing has to be uninstalled to get it.

Get-Service | Where-Object StartType -eq Automatic | Sort-Object Name | Select-Object -First 20 Name,DisplayName

tipWith ReadOnly false the guest can write a short report back into the shared folder. Set it to true for a test that must not touch the host at all.

Troubleshooting

Common issues

The feature name is unknown

Windows Home. The sandbox is not available there, so a virtual machine is the replacement.

The window opens and closes at once

Virtualization is off in the BIOS. Check Task Manager > Performance > CPU for the Virtualization line before you change anything.

Mapping a folder fails

The host path must exist, be a local folder and must not be a cloud placeholder. Create the folder before the first start.

The guest has no internet

Expected with Networking Disable. Turn it back on only when the test needs a download.

FAQ

Frequently asked

Is it a real security boundary?

It is built for software you do not trust and is disposable by design, but it shares the host kernel. Do not use it to analyse targeted malware.

Do I need an ISO to start it?

No. The image comes from the installed Windows build.

How to undo this

Disable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM, then reboot. The .wsb file and the shared folder are ordinary files you can delete.

Changelog · 1 entry

2026-10-31
First version

Interactive version: checklist, feedback, related guides →

Free · no account needed · tracks your progress