How to use Windows Sandbox to test suspicious extensions or executables

If you're worried about installing an extension, an executable, or opening a suspicious attachment, there's a valuable resource at our disposal that we shouldn't overlook: Windows Sandbox, to test extensions or executable programs that raise doubtsIt's like opening a clean session that, when closed, is completely erased: zero waste, zero scares.

The idea is simple: test, debug, or snoop around in an isolated environment It doesn't touch your main installation. It boots quickly, uses Windows' own virtualization, and is designed so that any user with a compatible version can activate it in just a couple of clicks.

What is Windows Sandbox and how does it work?

Windows Sandbox (Windows Sandbox or WSB) is a lightweight, temporary, hardware-isolated desktop It runs like any other app. Underneath, it leverages Microsoft's hypervisor to launch an independent, compartmentalized kernel, completely isolating what happens inside the kernel from the host system.

His proposal is clear: Every time you open it, it starts from a newly installed Windows, with no trace of previous sessions. Any programs or files you install within it are confined; when you close the window, everything disappears, and the next time you open it, you'll have a clean instance.

Compared to classic virtual machines, WSB offers Starts in seconds, lower memory consumption And no system images to manage. It also doesn't require preparing virtual disks or templates: it's a disposable sandbox built into Windows Pro, Enterprise, and Education.

• Included in Windows: is part of the system in compatible editions, without extra image downloads.
• Disposable: whatever happens inside is erased when closing.
• Clean at every start: boots as a clean Windows installation.
• Sure: Isolation through hardware-based virtualization and the Microsoft hypervisor.
• Eficiente: agile start, Virtual GPU optional and intelligent memory management.

For everyday use, this means you can test programs risk-free, visit suspicious websites, or scan attachments without compromising your computer. If something goes wrong, you can close the Sandbox and that's it.

What is sandbox software?

A “sandbox” software creates a virtual and limited environment where you can run processes in a controlled manner. It puts a layer of isolation between what you test and your real system, so that any side effects or malicious behavior is encapsulated.

This technique adds some resource overhead, yes, but in return it ensures that you do not contaminate your main facility You don't even "dirty" the registry or the actual file system. Windows integrates it into WSB to offer it as standard in Pro and Enterprise (both Windows 10 and Windows 11).

In addition to security, a sandbox is very useful for software testing, demos, QA and development. It allows you to reproduce a clean environment, repeat scenarios, and discard changes with a single click.

It is important to be clear about its nature: It is not a “normal” persistent VMThe key here is volatility, allowing you to experiment with ease and return to square one at each start.

Compatible editions and licenses

WSB is enabled in Windows 10/11 Pro, Enterprise and Education ( Windows 11 versions), including variants like Pro Education/SE. In Home, by design, It is not available.

Regarding usage rights, Windows Pro/Pro Education/SE licenses and business plans Enterprise (E3/E5) and educational Education (A3/A5) include the right to use Windows Sandbox. If you're coming from Home and are interested in this feature, a jump to Pro It is usually the most direct route.

Hardware requirements and recommendations

For it to work, you need a 64-bit CPU with virtualization (Intel VT-x or AMD-V), virtualization enabled in BIOS/UEFI, and a compatible operating system. For Windows 10, version 1903 or later is required for Pro/Enterprise editions; for Windows 11, version 1903 or later is required for Pro or Enterprise editions.

At a minimum, Microsoft talks about 4 GB of RAM, 1 GB of free space and 2 cores. Now, to be on top of things, the ideal is to have 8 GB o más de RAM and a modern 6-core/12-thread processor if you're going to be testing heavier software.

Keep in mind that whatever you run inside also consumes resources: if you test demanding apps, reserve RAM and CPU headroom to keep the host running smoothly. SSDs help a lot to keep everything running smoothly.

Installing and activating Windows Sandbox

You can activate it from the Windows interface itself or by consulting how enable and use SandboxGo to Control Panel > Programs > Turn Windows features on or off and select “Windows Sandbox” (or “Windows Sandbox” depending on your language). Accept and restart when prompted.

If you prefer the console, simply open PowerShell as administrator and run: Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online. When finished, restart your computer.

After the reboot, open the Start menu, type “Windows Sandbox” and run it. It takes a little longer the first time due to the initial setup, but subsequent launches will run like a bullet.

When you start, you will see a Clean Windows, in one window, ready to install whatever you want. It's a standalone environment: whatever you have installed on your real PC does not appear insideand vice versa.

The window resolution is adjusts dynamically Whatever size you choose. You don't have to create accounts or activate licenses: the goal is to "open, test, and close" without friction.

Default, WSB starts without accelerated GPU and with a base configuration (in many guides you'll see references to 4 GB for the environment). If you need more memory or to enable vGPU, you can do so with .wsb configuration files, as we'll see later.

How to move files, installers, and extensions to Windows Sandbox

This is the million-dollar question: how do I get my installer or files into the sandbox? There are several ways, and it's best to choose the safest depending on what you want to try, For example test Chrome extensions.

• Option 1: Copy and paste. In most cases you can copy from the host and paste into the Sandbox (typical shortcuts Ctrl+C / Ctrl+V). If you're going to try something risky, it's advisable to combine this with disabled networking or read-only folders to reduce the attack surface.
• Option 2: Download inside the Sandbox. Open Edge in the sandbox and download the EXE/ZIP from the manufacturer's website. This way, you avoid transferring files from the host and keep the circuit 100% sandboxed.
• Option 3: Mapped folders in read-only mode. You can configure a host folder to appear in the Sandbox using a .wsb file and mark it as ReadOnly, so that nothing that happens inside can delete or modify your real files.
• Option 4: Network sharing (if you allow it). Mounting a host share and accessing it from the Sandbox is another way, although for security reasons, is not the favorite for potentially dangerous files.

Important: don't rely on drag and drop as a method for moving files; and, by design, USB flash drives do not mount directly in WSB. If you need a file from a USB drive, copy it to the host first and use one of the methods above.

Advanced configuration with .wsb files

WSB admits XML configuration files that adjust the behavior of the environment: allocated memory, vGPU, network, clipboard, audio/video, and mapped folders. You just need to create a file with an extension .wsb, save it and open it, and Windows will launch it with that configuration.

Memory: To allocate explicit RAM use MemoryInMB. For example, 8192 for 8 GB. This is useful if you are going to run more demanding apps in the isolated session.

<Configuration>
  <MemoryInMB>8192</MemoryInMB>
</Configuration>

GPU: To enable virtual graphics acceleration, add Enable. By default it is disabled thinking about the host security and in reducing the attack surface.

<Configuration>
  <vGPU>Enable</vGPU>
</Configuration>

Mapped folders: with MappedFolders You can expose a host path inside the Sandbox. If you check ReadOnly as true, you avoid deletions or changes on your real PC even if you make mistakes inside the sandbox.

<Configuration>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\Public\Downloads</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Downloads</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Combining options: You can mix memory, vGPU and folders to create test profiles that you open with a double click when you need them. If you're going to run particularly dubious files, consider disable the network in the .wsb and use read-only folders.

Limitations and safety considerations

WSB is not a silver bullet: certain advanced malware It is able to detect virtual environments and “behave” until it reaches the host. However, the hardware isolation and disposable nature make it a very effective layer of protection for most scenarios.

When closing the Sandbox, everything is lost: Perfect for system hygiene, but impractical for long-term tests that require persistence. In that case, you'll still be better off using a VM with snapshots.

There are other limitations to keep in mind: cannot be executed multiple simultaneous instances; inside are not supported certain apps (Microsoft Store and some utilities like Calculator or Notepad); and you can’t load “another Windows” other than the host Windows inside the Sandbox (forget, for example, launching Windows 7 on Windows 11 via WSB).

Regarding USB, printers or other peripherals, WSB does not expose host devices Directly. It prioritizes isolation for security, so the standard approach is to copy/paste, download within, or map folders.

Frequently Asked Questions

• Can I use WSB on Windows Home? No, only in Pro, Enterprise, and Education (including Pro Education/SE). If you're interested, consider upgrading.
• Can I use drag and drop? The reliable method is copy/paste, downloading, or mapping folders. DnD is not the recommended route.
• Is USB supported within Windows Sandbox? By design, USB drives and peripherals are not mounted directly. Keep things moving through mapped folders or internal downloads.
• How much memory does it use by default? Many guides refer to 4 GB as the base configuration; if you're short, use MemoryInMB in your .wsb.
• Can I run it multiple times at once? No, it does not support multiple simultaneous instances in parallel.
• Does it work for all malware? For most tests, yes, but some advanced threats can detect the sandbox. It's a great layer of protection, not a complete shield.

Windows Sandbox has become that “security wildcard” that paves the way for confident testing: gives you a fresh Windows every time, without installing VMs, without configuring images, and with advanced settings per .wsb file to balance RAM, vGPU, network, and read-only folders. If you're working with extensions, executables, or attachments that you're not sure you can install on your PC yet, launch the sandbox, experiment, and close it; your real team will remain as clean as it was before.