Try an app in Windows Sandbox without keeping the install

You have found a small Windows utility that looks useful. Before giving it a place on your everyday PC, you want to see what its installer asks for and whether it can do the job.

Windows Sandbox gives supported Windows 11 PCs a separate, disposable desktop for that first look. Install the app there, try it with throwaway files, then close the session to discard its local changes. Your normal Windows installation is the host; the temporary Windows environment is the sandbox.

For this guide, we will switch off networking and clipboard sharing, provide one small folder as read-only input, and work on copies inside the sandbox. This is a documentation-based walkthrough for Windows 11 Pro, Enterprise and Education, using Microsoft's published Sandbox controls. It is not a malware certification test.

What Windows Sandbox is useful for

Sandbox is a good fit when your question is modest: does a portable utility open, what choices does an installer offer, or can an app handle a few disposable sample files? Microsoft describes these clean-environment testing uses in its Windows Sandbox overview .

It is a poor fit for judging gaming performance, testing a complete everyday setup, or keeping a project between sessions. Apps installed on your host are not automatically available inside it, and this guide deliberately removes internet access and hardware-accelerated graphics. An app that needs an online account or additional downloads may stop before you can evaluate it.

Choose software from its publisher's official source and keep Windows and your security protection up to date. If a download is already flagged as malicious, or arrived through a suspicious message, leave it alone. You do not need to run it to decide against using it.

Check that your PC supports it

Windows Sandbox is included in supported editions such as Windows 11 Pro, Enterprise and Education. Windows Home is not supported. You can check your edition under Settings → System → About.

Microsoft's installation requirements include:

• An AMD64/x64 processor, or Arm64 on Windows 11 version 22H2 or later.
• Hardware virtualisation enabled in the computer's firmware.
• At least 4 GB of RAM; Microsoft recommends 8 GB.
• At least 1 GB of free storage, with an SSD recommended, and at least two CPU cores.

Those are the feature's prerequisites. Leave additional room for the application and files you intend to try.

Search Start for Turn Windows features on or off, select Windows Sandbox, and choose OK. Restart if Windows requests it. On a managed work or school PC, use your organisation's approved route. If the feature is missing or cannot start, check the edition and virtualisation requirements instead of using an unofficial Windows Home workaround. Running Windows inside another virtual machine also requires nested virtualisation.

Make a small input folder

On your main PC, create:

C:\Sandbox-Input

This will be the only host folder shared by the configuration below. Start with a harmless text file named marker.txt, created on the host. Later, add only the installer or portable app and disposable sample files you actually need.

Do not share your whole Downloads folder, Documents folder or user profile. Read-only access still lets an application read what is there. A folder full of invoices, password exports or private photographs is unnecessary exposure even when writing is blocked.

The folder must exist before you launch the configuration. If you choose a different location, replace the HostFolder path below with that folder's complete path. Microsoft's original configuration guide explains the mapping and its read-only option.

Create your offline Sandbox launcher

Launching Windows Sandbox normally enables networking and clipboard sharing; microphone input is enabled too. Those conveniences are not needed for this first look. The relevant settings are documented in Microsoft's configuration reference .

Open Notepad on your main PC and paste this configuration:

<Configuration>
  <Networking>Disable</Networking>
  <ClipboardRedirection>Disable</ClipboardRedirection>
  <vGPU>Disable</vGPU>
  <AudioInput>Disable</AudioInput>
  <VideoInput>Disable</VideoInput>
  <PrinterRedirection>Disable</PrinterRedirection>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Sandbox-Input</HostFolder>
      <SandboxFolder>C:\Input</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
</Configuration>

Save it as Offline-App-Test.wsb. In Notepad's Save As dialogue, choose All files as the file type so that the name does not become Offline-App-Test.wsb.txt. Save this launcher somewhere convenient on the host, outside the input folder. Microsoft's Sandbox customisation walkthrough also explains launching a configuration file and the controls it can set.

Close any existing Sandbox session, then double-click the .wsb file. Opening the ordinary Start-menu shortcut instead does not select this configuration.

The configuration requests an offline session without host clipboard, microphone, camera or printer sharing. Disabling vGPU selects software rendering, which can be slower. The mapped C:\Input folder is readable but not writable from the sandbox.

Microsoft's sample configuration uses the same core approach of disabled networking, disabled vGPU and read-only input. Here, we narrow the shared folder and leave app launching to you rather than starting an executable automatically.

Keep the shared input separate from your working copy

Inside the Sandbox window, open File Explorer and enter C:\Input in its address bar. You should see the host's marker.txt file.

That folder is a view of the host folder. It is not an independent copy that you can freely change. Create a separate folder named C:\Work inside the sandbox, then copy the input files there using File Explorer within that window. This local copy operation does not need clipboard sharing between the two Windows environments.

The distinction matters when an app saves settings beside its executable, extracts additional files, or edits a sample document. Give it the working copy, leaving the host mapping read-only.

The diagram below follows the same input file from its host location to a separate working copy.

An app can read the shared input, but changes to the working copy stay in the temporary session. Closing Sandbox discards that copy; it does not delete the original host folder.

Rehearse once with the harmless file

Before adding an unfamiliar app, check the workflow with marker.txt. These are basic checks for setup mistakes, not a complete security audit of the virtual machine.

1. Check the input. In the sandbox's C:\Input, confirm that marker.txt is visible. Try renaming it to marker-renamed.txt. With the read-only mapping in effect, that rename should be denied. Do not change permissions to make it succeed.
2. Check the working copy. Create C:\Work inside the sandbox, copy marker.txt into it, and rename that copy to marker-renamed.txt. This copy should be writable.
3. Check the host. On your main PC, confirm that the original file in C:\Sandbox-Input is still named marker.txt.
4. Check disposal. Close Windows Sandbox and accept the discard prompt. Double-click Offline-App-Test.wsb again. The previous session's C:\Work folder and renamed copy should be gone, while C:\Input should again show the unchanged host file.

If the shared original can be renamed, stop before testing an app. Check that you launched the intended .wsb file and that its mapping contains <ReadOnly>true</ReadOnly>.

Microsoft's installation notes say Windows Sandbox starting with Windows 11 24H2 does not include several familiar Store apps, including Notepad and Terminal. That is why this exercise uses File Explorer rather than asking you to edit the marker inside the sandbox.

Try one specific task

Once the rehearsal behaves as expected, close the session. Put the selected app and a few throwaway inputs into the host's C:\Sandbox-Input folder, relaunch your .wsb file, and copy them to a new C:\Work inside the sandbox.

For example, suppose you are evaluating a file-renaming utility. Use three disposable files with obvious names and decide what you want it to do before opening it. Does its preview show the intended changes? Does it rename only the selected files? Is there a clear way to cancel?

Launch the app or its installer from the copy inside C:\Work, keeping your attention on which Windows window you are using. Read the installer choices, perform the small task, and write down the result on your host separately. There is no need to sign into personal accounts or supply real documents for this exercise.

If an installer needs the internet, look for an official offline installer. If none exists, this configuration cannot complete that evaluation. Turning networking on changes the test conditions and exposes the sandbox to reachable networks; it should be a deliberate decision, not the automatic answer to a failed installation.

Likewise, do not enable a writable host folder simply because the app wants to save a result. For this first evaluation, save inside C:\Work and inspect the result there. Copying an executable or document back to the host creates a new trust decision; running it in Sandbox has not cleaned or approved it.

What the result actually tells you

A successful trial gives you a useful but narrow observation: this particular app completed this particular task in this environment. Keep that observation separate from claims about safety, compatibility or speed.

That last distinction is essential. Microsoft has documented malware that delays its activity or reacts to analysis tools . An uneventful run is not sufficient evidence to approve an unknown file, especially when an offline environment prevents some behaviour from occurring.

Use Sandbox to learn about an app while reducing what you expose to it. Continue judging the publisher, download source, security warnings and permissions before installing anything on your normal PC.

Close the session when you are done

Closing Windows Sandbox discards its own installed apps, local files and session state. A restart inside the sandbox is different: Windows 11 22H2 and later can preserve that session through a guest restart .

The disposable boundary also has limits. Microsoft explicitly warns that changes made through a writable mapped host folder persist after Sandbox closes . Actions performed against an online account or remote service would be outside the local reset too. Our example keeps the host mapping read-only and networking disabled to avoid those routes.

After closing, your host's C:\Sandbox-Input folder and .wsb launcher remain. Remove unneeded test files from the host folder deliberately, then keep the launcher for the next small trial.

A useful first test ends with a specific answer: the installer offered these choices, the app handled these sample files, or the offline setup could not exercise the feature you needed. That is enough to decide what to investigate next without turning your everyday Windows installation into the test environment.

Sources

• Microsoft Learn: Windows Sandbox overview , updated 29 March 2026.
• Microsoft Learn: Install Windows Sandbox , updated 29 March 2026.
• Microsoft Learn: Use and configure Windows Sandbox , updated 29 March 2026.
• Microsoft Learn: Windows Sandbox sample configuration files , updated 24 January 2025.
• Microsoft Windows Sandbox team: Windows Sandbox — Config Files , first published 21 February 2019.
• Microsoft ITOps Talk: Customize Windows Sandbox , first published 28 April 2021, updated 12 July 2025.
• Microsoft Security: Hawkeye Keylogger — Reborn v8: An in-depth campaign analysis , published 11 July 2018.