How to Use Windows Sandbox to Test Apps Safely
Every Windows user has faced the same dilemma: an installer you do not fully trust, a free tool from a website you have never visited, or an app a friend sent you that might be fine — or might not. Installing it on your real PC means it can change your settings, drop files anywhere, and in the worst case install malware that is hard to remove. Learning how to use Windows Sandbox solves that problem, because it gives you a clean, disposable copy of Windows to test anything in, and then throws it away.
Windows Sandbox is a built-in feature of Windows 11 Pro, Enterprise, and Education. It creates an isolated desktop that looks and behaves like a fresh Windows install. You can install an app inside it, run it, poke at it, and then close the Sandbox window — everything you did disappears completely, and your real PC is untouched. In this guide, we show you how to check if your PC supports it, how to turn it on, and how to use it to test apps safely, step by step.
What Is Windows Sandbox?
Windows Sandbox is a lightweight virtual machine built into Windows. When you open it, you get a separate Windows desktop running in its own isolated environment, with its own Start menu, File Explorer, and Microsoft Edge. It shares your PC’s system files with the host, which is why it starts in seconds and uses far less disk space than a traditional virtual machine — but nothing you do inside it can reach your real files, your real registry, or your real installed programs.
The key idea is that the Sandbox is disposable. There is no save button and no way to keep changes. Every time you open Windows Sandbox, you get a brand-new, clean copy of Windows. Every time you close it, that copy is deleted, along with every file you created, every app you installed, and every change you made. That makes it the perfect place to test a suspicious installer, open a strange email attachment, or try out a program before you commit to installing it on your real PC.
Windows Sandbox is different from a full virtual machine like Hyper-V or VirtualBox. A traditional virtual machine keeps its state between sessions, needs its own Windows licence and a large virtual hard disk, and takes minutes to boot. Sandbox needs no licence, no virtual disk, and boots in seconds — but it also forgets everything when you close it. Use Sandbox for quick, throwaway testing, and a real virtual machine when you need a system that remembers things.
Requirements: Does Your PC Support Windows Sandbox?
Before you try to enable Windows Sandbox, check that your PC meets all four requirements. First, you need Windows 11 Pro, Enterprise, or Education. Windows Sandbox is not included in Windows 11 Home — if you have Home, skip to the alternatives section near the end of this article. You can check your edition in Settings, then System, then About, under Windows specifications.
Second, your processor must support virtualization, and virtualization must be turned on in your BIOS or UEFI settings. Most modern processors support it, but it is often switched off by default. You can check quickly: open Task Manager with Ctrl + Shift + Esc, go to the Performance tab, select CPU, and look for “Virtualization: Enabled” at the bottom right. If it says Disabled, you need to restart into your BIOS or UEFI settings and turn on Intel VT-x or AMD-V — the exact menu name depends on your motherboard, but it is usually under Advanced, CPU Configuration, or Security.
Third, you need at least 4 GB of RAM, though 8 GB or more is strongly recommended, because the Sandbox shares memory with your host PC. And fourth, you need at least 1 GB of free disk space and a processor with two or more cores. Any PC built in the last five years that runs Windows 11 Pro will almost certainly meet the hardware requirements — the edition of Windows and the virtualization setting are the two things that usually catch people out.
How to Enable Windows Sandbox
There are two ways to turn on Windows Sandbox. The graphical method is the easiest. Press the Windows key, type “Turn Windows features on or off”, and open that Control Panel item. Scroll down the list until you find Windows Sandbox, tick its checkbox, and click OK. Windows will install the feature, which takes a minute or two, and then ask you to restart your PC. After the restart, Windows Sandbox is ready to use.
If you prefer the command line, or the checkbox is missing, you can enable it with PowerShell instead. Right-click the Start button and choose Terminal (Admin) or Windows PowerShell (Admin). Then type the following command and press Enter:
Enable-WindowsOptionalFeature -Online -FeatureName Containers-DisposableClientVM -All
PowerShell will install the feature and ask you to restart. Type Y and press Enter to restart immediately, or N to restart later. Either way, Windows Sandbox will not work until you have restarted, so do it before you go any further.
If the feature will not enable at all, check the two usual causes first: virtualization disabled in BIOS or UEFI, and the wrong Windows edition. The PowerShell command will fail with an error if your PC does not support virtualization, and the Windows Sandbox checkbox simply does not appear in the features list on Windows 11 Home. If you are on Pro and virtualization is enabled but the install still fails, run Windows Update first — Sandbox depends on up-to-date system files — and try again.
Opening Windows Sandbox for the First Time
Once it is enabled and your PC has restarted, press the Windows key and type “Windows Sandbox”. Click the result, and if a User Account Control prompt appears, click Yes. The Sandbox window opens after a few seconds, showing a clean Windows desktop with a plain blue wallpaper. It looks like a fresh install because it is one: the only apps inside are the ones that ship with Windows, plus Microsoft Edge.
Notice the window itself. Windows Sandbox always runs in a window on your real desktop, with a title bar that says “Windows Sandbox”. You can maximise it to fill your screen, or keep it in a window so you can see your real desktop at the same time. There is a menu in the top-right corner of the Sandbox window with just a few options — full screen, and the ability to shut the Sandbox down. Keep the Sandbox windowed the first time you use it, so you can drag files into it easily.
One thing you will notice immediately is that the Sandbox has no antivirus prompts, no setup screens, and no Microsoft account sign-in. It is a throwaway environment, so Microsoft does not waste time personalising it. That is also why you should never sign in to anything important inside the Sandbox, or type a real password there: the whole point is that the Sandbox is untrusted and temporary, so treat anything you type inside it as if it could be seen.
Testing an App in Windows Sandbox: Step by Step
Here is the basic workflow for testing any app safely. First, open Windows Sandbox from the Start menu. Second, open Microsoft Edge inside the Sandbox and download the installer from the app’s official website, exactly as you would on your real PC. Downloading inside the Sandbox is important: if the download itself is malicious, it lands in the Sandbox, not on your real PC.
Third, run the installer inside the Sandbox and follow its setup steps. Watch what it does. Does it try to install extra toolbars or bundled software? Does it ask for administrator permission for no good reason? Does it change your browser homepage or search engine? All of these are warning signs, and in the Sandbox they cost you nothing — you can simply close the window and they are gone.
Fourth, run the app itself and try its main features. Does it open without errors? Does it look like the app you expected, or does it look like a fake? Does it immediately ask you to sign in or enter payment details? A legitimate app should work normally in the Sandbox. If the app misbehaves, crashes, or asks for something suspicious, you have your answer without risking your real PC.
Fifth, decide. If the app is good, close the Sandbox, download the same installer on your real PC, and install it there — but only from the official website. If the app is bad, just close the Sandbox window. Click the X, confirm that you want to close it, and everything inside is deleted permanently. There is nothing to uninstall and nothing to clean up, which is the whole advantage over testing on your real machine, where you might later need to uninstall programs that won’t delete.
Moving Files Into and Out of the Sandbox
Sometimes you do not want to download an installer inside the Sandbox — you already have a file on your real PC that you want to test. Windows Sandbox supports copy and paste between the host and the Sandbox, and that is the easiest way to move a file in. Select the file on your real PC, copy it with Ctrl + C, click inside the Sandbox window, and paste it with Ctrl + V. The file appears inside the Sandbox, and you can run it there.
Be careful in the other direction. You can also copy files out of the Sandbox, but you should almost never do it. If you copy a file out of the Sandbox, it leaves the protected environment and lands on your real PC — which defeats the purpose of testing it in isolation. The only files worth copying out are things you created yourself inside the Sandbox, such as a screenshot or a text file of notes. Never copy an executable, installer, or document you do not trust out of the Sandbox.
The clipboard works the same way: you can copy text from your real PC and paste it inside the Sandbox, which is handy for pasting a download link or a licence key. But again, avoid copying passwords or sensitive text into the Sandbox. The Sandbox is safe because it is disposable, not because it is secret — treat it as a public computer that you throw away after each use.
Using a Configuration File (.wsb) to Customise the Sandbox
By default, every Sandbox session starts clean, with networking on and no shared folders. If you test apps often, you can create a small configuration file to change that behaviour. A Windows Sandbox configuration file is a plain text file with a.wsb extension, written in XML, and double-clicking it opens the Sandbox with your chosen settings.
Here is a useful example that turns networking off, so the app you are testing cannot reach the internet at all, and shares a folder from your real PC in read-only mode, so you can get files in without copy and paste:
<Configuration>
<Networking>Disable</Networking>
<MappedFolders>
<MappedFolder>
<HostFolder>C:\SandboxTest</HostFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
</Configuration>
Save that text as test.wsb on your desktop (create the folder C:\SandboxTest first), then double-click the file. The Sandbox opens with no network access and your test folder available inside it. Disabling networking is the safest way to test an app you genuinely distrust, because even if it is malicious, it cannot send your data anywhere or download anything else.
Other settings you can put in a.wsb file include vGPU (to share your graphics card with the Sandbox for testing games or graphics apps), memory in megabytes (to limit how much RAM the Sandbox can use), and a logon command (to run a script automatically when the Sandbox starts). You do not need any of these for basic testing, but they are worth knowing about if Sandbox becomes a regular part of your workflow. Microsoft’s official documentation lists every available setting, and each one is a single line of XML.
Windows Sandbox Limitations You Should Know
Windows Sandbox is powerful, but it has limits. The biggest one is that nothing persists. If you install an app, configure it, and close the Sandbox, all of that work is gone. Sandbox is for testing, not for running an app you want to keep. If you need a virtual machine that remembers things, use Hyper-V or VirtualBox instead.
The second limit is the Windows edition. Sandbox is not available on Windows 11 Home at all, and there is no official way to add it. If you are on Home, the alternatives section below gives you free options that work on any edition. The third limit is performance: the Sandbox shares your CPU and memory with your host PC, so testing a heavy app — a large game, a video editor, a full development environment — can slow your real PC down while the Sandbox is open. Close the Sandbox when you are done testing, and your PC goes back to normal.
Finally, Sandbox is not a perfect security boundary. It is designed to isolate apps from your PC, and it does that well, but a highly sophisticated piece of malware could in theory escape any virtual machine. Sandbox is an excellent tool for testing ordinary untrusted software, and combined with a best free antivirus software for Windows on your real PC, it covers the realistic risks. But it is not a substitute for caution: do not deliberately run known malware in Sandbox just to see what happens, because some malware can detect a virtual environment and behave differently there than it would on a real PC.
Troubleshooting: When Windows Sandbox Will Not Start
The most common problem is the error “No hypervisor was found” or a message that virtualization is not available. This almost always means virtualization is switched off in your BIOS or UEFI. Restart your PC, enter the BIOS or UEFI setup (usually by pressing Del, F2, or F10 during boot), and turn on Intel Virtualization Technology (VT-x) or AMD-V. Save, exit, and try again.
The second common problem is that Windows Sandbox is greyed out in the Windows Features list. That usually means another virtualization feature is conflicting with it — for example, if you have Hyper-V, VirtualBox, or VMware installed with certain settings, or if the Windows Hypervisor Platform is disabled. Try enabling both Windows Sandbox and the Windows Hypervisor Platform in the same features list, restart, and test again.
A third issue is that Sandbox opens but immediately crashes or shows a black screen. This is often a graphics driver problem. Update your graphics driver from the manufacturer’s website (NVIDIA, AMD, or Intel), restart, and try again. If Sandbox still will not start, check that you have at least 4 GB of free RAM — close other apps and try with nothing else running. And if you see an error about the Sandbox needing an update, run Windows Update and install all pending updates before trying again.
Alternatives for Windows 11 Home Users
If you have Windows 11 Home, you cannot use Windows Sandbox, but you still have good free options for testing apps safely. The best is VirtualBox, a free virtual machine app from Oracle. Install VirtualBox, create a virtual machine, install a copy of Windows or Linux inside it, and take a snapshot before you test anything. After testing, restore the snapshot and the virtual machine is clean again. It takes longer to set up than Sandbox, but it works on every edition of Windows and it remembers your snapshots.
VMware Workstation Player is another free option for personal use, with a simpler interface than VirtualBox and good performance. And if you only need to test a website or a browser extension rather than a full app, your browser’s built-in tools can help: open the site in a private browsing window, or use a disposable browser profile, so cookies and extensions from your main profile are not exposed.
For testing a single suspicious file, you can also upload it to VirusTotal, a free service that scans a file with more than seventy antivirus engines and shows you the results in seconds. That does not tell you what the app does, but it tells you whether any antivirus engine already thinks it is malicious — which is often all you need to know before you decide not to install it.
Frequently Asked Questions
Is Windows Sandbox free?
Yes. Windows Sandbox is included free with Windows 11 Pro, Enterprise, and Education. There is no extra download, no subscription, and no licence key. It is not available on Windows 11 Home.
Does Windows Sandbox protect my real PC from malware?
Yes, for normal use. Anything you install or run inside the Sandbox stays inside it, and closing the Sandbox deletes it completely. Your real files, settings, and installed programs are isolated from the Sandbox. No security tool is perfect, so avoid deliberately running known malware, but Sandbox is a strong layer of protection for testing untrusted software.
Can I save files from Windows Sandbox?
You can copy files out of the Sandbox with copy and paste, or share a folder through a.wsb configuration file, but there is no built-in save feature. Everything in the Sandbox is deleted when you close it, so copy out anything you created before you close the window.
Does Windows Sandbox need the internet?
No. The Sandbox works without networking, and you can disable networking entirely in a.wsb configuration file. With networking off, you cannot download anything inside the Sandbox, so copy the installer in from your real PC first — or leave networking on for downloads and turn it off for the actual test.
Can I run Windows Sandbox and a virtual machine at the same time?
Usually yes, as long as your PC has enough RAM and CPU cores. Both use the same hypervisor, so they do not conflict the way two different virtualization tools sometimes do. If your PC slows down, close one of them — Sandbox plus a full virtual machine is a heavy load for most laptops.
Conclusion
Windows Sandbox turns a risky decision — should I install this app? — into a safe experiment. Enable it once in Windows Features, open it when you need it, test the app inside, and close the window when you are done. The app, the installer, and every change it made disappear with the Sandbox, and your real PC never knew it was there.
Make it a habit: any installer from a website you do not know, any tool a stranger recommends, any file you are unsure about — test it in the Sandbox first. It takes thirty seconds to open, and it can save you hours of cleaning up a bad install, or worse. That is a trade worth making every single time.
