Windows Sandbox: Test Suspicious Programs with Zero Risk (the “Disposable PC” Already Built into Windows)

🧪 What Windows Sandbox Is

Windows Sandbox is a little-known feature of the Pro editions of Windows 10 and 11. It opens a window with a brand-new Windows, without your files, passwords or programs. Everything you do there stays trapped inside the window.

And the best part: when you close the window, everything disappears. The next time you open it, it starts from scratch again. It’s like having a disposable computer whenever you need to test something risky.

📋 Requirements: Does Your PC Support It?

To see everything from the terminal:

Get-ComputerInfo -Property WindowsEditionId, OsArchitecture, HyperVRequirementVirtualizationFirmwareEnabled

⚙️ Turning On Virtualization in the BIOS

Many PCs ship with virtualization turned off. To enable it:

1. Restart and enter the BIOS (usually Del, F2 or F10 at the start of boot).
2. Look for the option named after your platform: Intel Virtualization Technology (VT-x) on Intel processors or SVM Mode on AMD processors.
3. Set it to Enabled, save (usually F10) and restart.

The option is usually under menus like Advanced, CPU Configuration or Overclocking, depending on the brand. Don’t touch other settings you don’t know.

✅ How to Turn On Windows Sandbox

From the menu:

1. Press Win + R, type optionalfeatures and press Enter.
2. In the “Turn Windows features on or off” list, tick Windows Sandbox.
3. Click OK and restart when asked.

From the terminal (faster):

Enable-WindowsOptionalFeature -Online -FeatureName "Containers-DisposableClientVM" -All

After restarting, search for Windows Sandbox in the Start menu and run it as administrator the first time.

🖱️ How to Use It: Testing a Suspicious Program

1. Open Windows Sandbox. In a few seconds a window with a clean Windows appears.
2. On your computer, copy (Ctrl + C) the file you want to test.
3. Inside the Sandbox window, paste it (Ctrl + V) on the desktop.
4. Run the file inside the Sandbox and watch: does it install extras? Open websites? Ask for strange permissions?
5. Done? Close the window and confirm. Everything that happened inside is deleted.

🔌 Sandbox Without Internet and with a Read-Only Folder

By default, the Sandbox has internet access. To test something very suspicious, it’s better to cut the network — so any malware can’t download more junk or send data out. Create a text file, paste the content below and save it as Safe-Sandbox.wsb:

<Configuration>
  <Networking>Disable</Networking>
  <ClipboardRedirection>Enable</ClipboardRedirection>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\Public\Tests</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Double-clicking that file opens the Sandbox with no internet and with your PC’s C:\Users\Public\Tests folder visible inside in read-only mode — so the tested program can’t change anything in it. Create the folder first and put the file you’ll test there.

👀 Signs the Program Can’t Be Trusted

To see the processes running inside the Sandbox, open Task Manager inside it (Ctrl + Shift + Esc with the Sandbox window active). Anything beyond the Windows basics came from the tested program.

⏱️ A 10-Minute Test Routine

1. Minute 0: put the file in C:\Users\Public\Tests and open Safe-Sandbox.wsb (no internet).
2. Minute 1: inside the Sandbox, open Task Manager on the Processes tab.
3. Minute 2: copy the file from the mapped folder to the Sandbox desktop and run it.
4. Minutes 3 to 7: watch for new processes, windows, warnings and anything the installer tries to add.
5. Minute 8: if the program needs internet to work and you still trust it, repeat with the normal Sandbox (with network) and watch which sites it opens.
6. Minute 10: close the Sandbox. Decide: delete the file or install it on your real PC.

⚖️ Sandbox vs Virtual Machine vs Antivirus

The best setup is using them together: the antivirus blocks what’s already known, and the Sandbox lets you watch the unknown without risk.

🚧 What the Sandbox Does NOT Protect Against

• Malware that detects virtual machines: some viruses notice they’re isolated and stay quiet. Looking harmless in the Sandbox proves nothing.
• Shared folders with write access: if you map a folder from your PC without read-only mode, the program can change or encrypt those files.
• Clipboard: what you copy inside the Sandbox can be pasted on your PC. Be careful bringing text or files back.
• Accounts typed inside: if you sign in to a site inside the Sandbox while spyware is running, the password can be stolen just the same.

🏠 Alternatives for Windows Home

If you think you’ve already run something suspicious on your real PC, see how to find spyware by its connections and how to find out if someone used your PC.

💡 Other Smart Uses for the Sandbox

• Test browser extensions before installing them on your real Chrome or Edge — many steal data, as I showed in browser extensions stealing data.
• See how a program behaves before installing it on the family PC.
• Open an unknown shopping site without leaving cookies and traces in your main browser.
• Practice terminal commands you don’t know yet, without fear of breaking your Windows.
• Show a tutorial on a clean Windows, without exposing your files on screen.

🛠️ Common Problems

FAQ