Testing an unfamiliar installer on your main Windows account can leave behind unwanted settings, files, or software. Windows Sandbox offers a cleaner option: it opens a temporary Windows desktop where you can inspect a file, try an app, and then discard the session.
Here’s how to use Windows Sandbox, check whether your PC supports it, and reduce the guest session’s access to your files and network. It’s a useful layer of protection for ordinary testing, but it isn’t a guarantee that a dangerous file can’t affect your computer.
What Windows Sandbox does and when to use it
Windows Sandbox runs a separate, temporary Windows environment on your PC. It behaves like a fresh desktop, with its own window and a clean installation state. When you close Sandbox, its session and the changes made inside it are discarded. Open it again and you start with a fresh environment.
This makes Sandbox convenient for tasks such as:
- Checking an installer from a source you’re still evaluating.
- Trying an application without changing your everyday Windows setup.
- Opening a document or script you want to inspect in a disposable session.
- Testing a setting or installation process before applying it to your main system.
Sandbox is not a replacement for antivirus software, careful downloads, or a dedicated virtual machine for in-depth testing. Network access is enabled by default, and files you copy into the session can still be opened and run there. Avoid using it for highly suspicious malware, sensitive documents, or anything that requires strong forensic isolation.
It also helps to understand the difference between the host and guest. The host is your regular Windows installation, where your personal files and settings live. The guest is the temporary desktop inside Sandbox. Keep your testing activity in the guest, and be careful when transferring files between the two environments.
Check whether your Windows PC supports Sandbox
Windows Sandbox is included with some editions of Windows, including Pro, Enterprise, and Education. It isn’t included as a built-in feature in Windows Home. To check your edition, open Settings > System > About and look under Windows specifications.
Your PC also needs hardware virtualization support. On many computers, virtualization is already enabled, but it may be turned off in the system’s UEFI or BIOS settings. The option can have a name such as Intel Virtualization Technology or SVM Mode, depending on the processor and manufacturer.
Sandbox uses system resources while it runs. Close demanding applications first if your PC has limited memory or storage. If the feature is unavailable or won’t start, check that virtualization is enabled and that Windows is up to date before trying again. On a managed work or school computer, an administrator may control whether virtualization features are available.
Enable Windows Sandbox
- Save your work and open the Start menu. Search for Turn Windows features on or off, then open the matching Control Panel result.
- In the list of features, find and check Windows Sandbox.
- Select OK and let Windows apply the change. Restart your PC if prompted.
- After the restart, open Start, search for Windows Sandbox, and launch it.
The first launch may take a little longer while Windows prepares the environment. You’ll see a separate Windows desktop in a window. You can resize it or use it alongside your regular desktop, but keep track of which environment is active before opening or installing anything.
Before starting a test, decide what you need to learn. For example, you might want to see whether an installer launches, inspect an app’s basic behavior, or check whether a document opens as expected. A specific question helps you avoid unnecessary steps, such as signing in or giving the software access to more data than the test requires.
Use Windows Sandbox to inspect a file or installer
Once the Sandbox desktop appears, move a copy of the file you want to test into it. You can usually copy a file in File Explorer on the host and paste it into the Sandbox window. The file remains on your main PC as well, so make sure you’re working with a copy rather than moving your only copy of something important.
For an installer, check its file name, publisher details, and any prompts before proceeding. Install the app inside Sandbox and try the specific feature you want to examine. If it asks for an unexpected password, requests access to sensitive information, or behaves suspiciously, close the session rather than continuing.
Don’t assume that a familiar-looking name proves a file is safe. Check that the download came from the software publisher or another source you trust, and scan it with your usual security software when appropriate. Sandbox is useful for reducing changes to your main Windows setup, but it doesn’t replace checking the file’s source or exercising caution.
Keep in mind that Sandbox can access the internet by default. That may be necessary to download an app or test an online feature, but it also means an app in the session can communicate over the network. Don’t sign in to personal accounts, enter payment details, or expose credentials while testing software you don’t trust.
When you’re done, close the Sandbox window. Windows will warn you that the session’s contents will be discarded. Confirm that you’re finished before closing it. If you need to keep a harmless test result, copy that specific file back to the host first, then consider scanning it with your usual security software. Avoid copying executable files or scripts back unless you have a clear reason and have checked them.
Limit Sandbox access to files and the network
For a quick, low-risk check, the default session may be enough. For more control, Windows Sandbox can use a configuration file with the .wsb extension. This lets you disable networking or expose a particular host folder to the guest session. Be deliberate: a mapped folder gives the Sandbox access to content on your real PC.
To create a restricted example, make a folder such as C:Sandbox-Input on the host and place only the test file inside it. Open Notepad, paste the following configuration, and save the file with a name such as RestrictedTest.wsb. In the Save As dialog, set the file type to All files so Notepad doesn’t add a .txt extension.
<Configuration>
<Networking>Disable</Networking>
<MappedFolders>
<MappedFolder>
<HostFolder>C:Sandbox-Input</HostFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
</Configuration>
Replace the folder path if you chose a different location. Double-click the .wsb file to start Sandbox with those settings. Networking is disabled, and the mapped folder is read-only from the guest session, so the test app can read its contents but shouldn’t be able to modify them through that mapping.
A read-only mapping is safer than exposing a folder with write access, but it still reveals every file in that folder to the Sandbox. Use a new folder containing only the material needed for the test. Don’t map your entire user profile, Downloads folder, or a drive containing personal documents.
Configuration files can also make a test easier to repeat. Keep a separate file for a particular testing setup, and review its contents before launching it. A configuration that disables networking is useful for examining an app that doesn’t need an internet connection, but it will also prevent online features and downloads from working.
Common problems and practical fixes
Windows Sandbox doesn’t appear in the feature list
Check your Windows edition first. If you’re using Windows Home, the built-in Sandbox feature isn’t available there. On a supported edition, install available Windows updates and restart, then check the feature list again.
Sandbox won’t start
Confirm hardware virtualization is enabled in UEFI or BIOS. If you changed a firmware setting, save it and restart the computer. Also close other virtual machines or resource-heavy applications and try again. If your organization manages the PC, an administrator may have disabled virtualization features.
The app needs internet access
A configuration that disables networking will prevent online features from working. You can use the normal Sandbox launch for a test that genuinely requires internet access, but weigh that convenience against the added exposure. Don’t enter personal credentials just to make the test work.
Make Sandbox part of a cautious testing routine
Windows Sandbox is most useful when you treat it as a disposable inspection space, not as permission to run anything. Verify where a file came from, share only the test material needed, and close the session when you’re finished. For routine experiments with apps or installers, those habits can help keep your main Windows environment separate from the test.