Set Up Windows Sandbox to Test Apps Safely (2026)
Windows Sandbox spins up a disposable, isolated Windows in seconds so you can run sketchy apps and files without risking your real PC. Here is the setup.
That unknown installer, the email attachment you half-trust, the utility from a forum: you should never run any of it on your real PC. Windows Sandbox gives you a throwaway copy of Windows that launches in seconds and vanishes completely when you close it, taking anything you ran with it.
Quick answer
On Windows 11 Pro, Enterprise, or Education, enable virtualization in the BIOS, then turn on Windows Sandbox. The fastest route on recent builds is Settings, System, Advanced, Virtual Workspaces, and toggle Windows Sandbox on. Otherwise press Windows+R, run optionalfeatures, tick Windows Sandbox, and restart. Launch it from the Start menu; anything you run inside is isolated, and everything is wiped the moment you close the window.
Key takeaways
- Windows Sandbox is a disposable, isolated Windows that resets to clean every time you close it.
- It needs Windows 11 Pro, Enterprise, or Education; Home is not officially supported.
- Virtualization must be enabled in BIOS/UEFI for it to work.
- Enable it via Settings (Virtual Workspaces) or
optionalfeatures, then restart. - Nothing inside the sandbox can touch your real files unless you deliberately share a folder.
Why use Windows Sandbox instead of a full VM
A traditional virtual machine works too, but Sandbox is purpose-built for quick, throwaway testing. There is no ISO to install, no license, and no gigabytes of disk permanently reserved. It borrows from your existing Windows install, launches in seconds, and disposes of itself on close.
| Factor | Windows Sandbox | Full VM (Hyper-V, VirtualBox) |
|---|---|---|
| Setup time | Seconds, built in | Download ISO, install OS |
| Persistence | Wiped every close | Persistent by default |
| Disk footprint | Minimal, temporary | Fixed virtual disk |
| Best for | One-off testing of apps and files | Long-lived test environments |
| Edition needed | Pro, Enterprise, Education | Any (with the right hypervisor) |
If you need an environment that survives a reboot, use a real VM. For "run this once and throw it away," Sandbox wins.
Requirements to check first
| Requirement | Detail |
|---|---|
| Windows edition | 11 Pro, Enterprise, or Education |
| CPU | Two or more cores (four recommended) |
| Virtualization | Enabled in BIOS/UEFI |
| RAM | 4 GB minimum, 8 GB recommended |
| Storage | SSD recommended |
To confirm virtualization is on, open Task Manager, go to the Performance tab, select CPU, and check that Virtualization reads "Enabled." If it says disabled, reboot into UEFI and enable Intel VT-x or AMD-V (sometimes labeled SVM).
Enable Windows Sandbox
- Confirm virtualization is enabled in your BIOS/UEFI and shows "Enabled" in Task Manager.
- On recent builds, open Settings, go to System, Advanced, Virtual Workspaces, and toggle Windows Sandbox on. Otherwise, press Windows+R and run
optionalfeatures. - In the Windows Features list, tick Windows Sandbox and click OK.
- Restart your PC when prompted.
- Open the Start menu, search for Windows Sandbox, and launch it.
The first launch takes a little longer while it builds the environment; subsequent launches are near instant.
Warning
Windows Sandbox is strongly isolated, but it is not a magic shield. Do not paste real credentials, log into personal accounts, or connect sensitive drives inside it. Treat anything you run there as hostile and keep it contained.
Using and customizing the sandbox
Inside the sandbox you get a clean Windows desktop with internet access. Copy an installer in from your host by drag-and-drop or clipboard, run it, watch what it does, then close the window to erase everything.
For repeat workflows, you can create a .wsb configuration file to preconfigure the sandbox: map a read-only host folder, disable networking for extra isolation, or run a startup command automatically. This is handy when you regularly test the same category of files and want a consistent setup each time.
Sandbox pairs well with other isolation habits. If you are wary of browser-based threats specifically, our guide to auditing your browser extensions covers the other common infection route that a sandbox alone will not fix.
A simple config file example
A .wsb file is just an XML text file you open with the sandbox. A common setup maps a host folder as read-only and turns networking off, so a suspicious installer cannot phone home or reach the rest of your system. You create the file in Notepad, give it a .wsb extension, and double-click it to launch a sandbox with those settings applied. Inside the XML you specify options such as the folder to map, whether it is read-only, and whether networking is enabled. Keep a couple of these on hand: one "airgapped" profile with networking disabled for the riskiest files, and one with a mapped downloads folder for testing installers you mostly trust.
Real uses beyond malware
Sandbox is not only for scary files. It is genuinely handy for testing an app's installer before committing to it on your main system, trying registry tweaks or scripts you found online without polluting your real settings, opening a document from an unknown sender, or reproducing a bug in a clean environment. Because every session starts identical, it is also a reliable way to check whether a problem is caused by your specific setup or exists in a fresh Windows too.
What to do right now
- Confirm you are on Windows 11 Pro, Enterprise, or Education.
- Enable virtualization in BIOS/UEFI and verify it in Task Manager, Performance, CPU.
- Turn on Windows Sandbox via Settings, Virtual Workspaces, or
optionalfeatures, then restart. - Launch it from Start and test copying a harmless file in and running it.
- Never log into real accounts or attach sensitive drives inside the sandbox.
Frequently asked questions
Can I run Windows Sandbox on Windows 11 Home?
Not officially. Windows Sandbox requires Pro, Enterprise, or Education. Community scripts claim to enable it on Home by adding the feature manually, but this is unsupported and can be unstable, so it is not recommended for anything you rely on.
Does the sandbox keep my files after I close it?
No, and that is the point. Everything inside the sandbox, including anything you installed or downloaded, is deleted the moment you close the window. To keep results, copy them out to your host before closing or use a shared folder.
Is Windows Sandbox safe for testing malware?
It is far safer than running suspicious software on your host, because the sandbox is isolated and disposable. However, treat it as containment, not a guarantee. Disable networking in a .wsb file and never enter real credentials for maximum safety.
Why is the Windows Sandbox option greyed out?
Almost always because virtualization is disabled in your BIOS/UEFI. Reboot into firmware settings, enable Intel VT-x or AMD-V (SVM), save, and try again. Confirm it now reads "Enabled" in Task Manager.
How is this different from Hyper-V?
Windows Sandbox is built on the same virtualization technology but is designed for quick, disposable use with no setup and no persistent disk. Hyper-V is for creating and managing long-lived virtual machines that keep their state.
