How to Use Windows Sandbox to Test 'Sketchy' Files Safely

A Disposable Windows Install, on Demand

Windows Sandbox spins up a temporary, lightweight desktop environment that shares your machine's kernel through hardware virtualization but keeps its own isolated file system, registry, and memory space. Anything you run inside it — a suspicious installer, an email attachment you're not sure about, an executable from a forum post — cannot touch your real files, registry, or network shares. Close the sandbox window and everything inside it, malware included, is permanently discarded. There's no snapshot to restore and no VM disk image to manage; it just resets to blank every time.

Requirements

• Windows 10 or 11 Pro, Enterprise, or Education — Home edition does not support Windows Sandbox at all.
• A CPU with virtualization extensions (Intel VT-x or AMD-V) enabled in firmware/BIOS.
• At least 4 GB of RAM (8 GB+ recommended — the sandbox uses your real system's resources dynamically).
• At least 1 GB of free disk space.
• A 64-bit version of Windows.

Step 1: Enable Windows Sandbox

Option A: Windows Features Dialog

1. Press Win, type Turn Windows features on or off, and open it.
2. Scroll down and check Windows Sandbox.
3. Click OK and let it install the required components.
4. Restart when prompted.

Option B: PowerShell (faster, scriptable)

Run this from an elevated PowerShell prompt:

Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All

Reboot when it completes.

Step 2: Launch It

1. Press Win, type Windows Sandbox, and open it.
2. Wait 10-30 seconds for the sandboxed desktop to boot — it's a fresh, clean Windows session with no installed apps beyond the defaults.

Step 3: Get the File Inside

The simplest way is copy-paste: copy the file on your real (host) desktop with Ctrl+C, click into the Sandbox window, and paste with Ctrl+V directly onto its desktop. Clipboard sharing is enabled by default. You can also drag-and-drop the file straight from your host File Explorer window into the Sandbox window.

Once it's inside, double-click to run or open it exactly as you would normally — you're now looking at its actual behavior with zero risk to your host system.

Step 4: Discard It

Just close the Sandbox window like any other application and confirm the prompt. Every trace — the file you tested, anything it installed or modified, any registry changes it made — is wiped instantly. There is no "save state" option by design.

Customizing the Sandbox With a .wsb Config File

For repeated testing, you can define a config file that controls things like shared folders, networking, or vGPU on launch. Create a text file named, for example, test.wsb:

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\SandboxDrop</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Double-click the .wsb file to launch a sandbox with those settings applied. Setting <Networking>Disable</Networking> is worth doing when testing something you suspect could phone home or attempt to spread — it cuts the sandbox off from your network entirely while still letting you observe its local behavior. MappedFolder with ReadOnly set to true lets you drop a file into a host folder and have it appear inside the sandbox without risking the sandbox writing back to your real disk.

What It's Good For — and What It Isn't

• Good for: testing unfamiliar installers, checking whether a downloaded tool is bundleware/adware, opening an email attachment you're unsure about, trying beta software without cluttering your main install.
• Not good for: long-term testing (nothing persists between sessions), running resource-heavy VMs (it's not meant for that), or deep malware reverse-engineering (use a dedicated isolated VM with snapshot/rollback tooling and no shared kernel for that instead).

Troubleshooting

• "Windows Sandbox failed to start": confirm Hyper-V's underlying virtualization isn't blocked by another product — VMware or VirtualBox running with their own hypervisor active can conflict with the Windows Hypervisor Platform Sandbox relies on.
• Feature missing from the list entirely: you're on Windows Home. Sandbox has no Home-edition equivalent; the only path is upgrading to Pro or using a separate full VM instead.
• Copy-paste not working: click once inside the sandbox window to give it focus before pasting — clipboard sharing only responds when the sandbox has active focus.