How to test suspicious programs without getting infected using Windows Sandbox

Informatec Digital » Resources » How to test suspicious programs without getting infected using Windows Sandbox

Running unknown programs on Windows is one of the most common ways to install malware, adware, or unintentionally corrupt your system. You download something "quick" from the internet, open it without thinking twice, and before you know it, your system is slow, your browser is full of strange extensions, or pop-up windows are appearing everywhere.

To avoid these situations, Microsoft includes a powerful feature called Windows Sandbox in Windows 10 and Windows 11 Pro, Enterprise, and Education (if you need to migrate from Windows 10 to Windows 11 ). Essentially, it's like having a clean, temporary, and disposable Windows environment within your own PC, ideal for testing suspicious programs without risking your main system. Let's take a closer look at exactly what a "sandbox" is, how Windows Sandbox works, its requirements, how to activate it, and how it differs from other solutions like Sandboxie, VirtualBox, or Hyper-V.

What is a Sandbox software and what is it used for?

Sandbox software creates an isolated environment within the main operating system, using virtualization or system-level isolation techniques. This environment, known as a "sandbox," acts like a bubble: everything that runs inside is separated from the rest of the system, so any changes, files, or settings modified do not affect the "real" Windows.

In practice, this means we can run potentially dangerous applications , suspicious email attachments, or beta tools without fear of damaging anything. If the program turns out to be malicious, it remains confined to the sandbox, and upon closing or restarting it, everything that happened within it is completely discarded.

To achieve this, sandbox solutions typically rely on an abstraction layer that functions as a virtual machine or a filter that intercepts system calls. This involves extra resource consumption (CPU, RAM, storage) because the system has to "simulate" or isolate this additional environment, but in return, we avoid modifying the host operating system, either for better or for worse.

This approach is not only useful for those who want to test suspicious programs without viruses , but also for any user who wants to test applications, configurations, or scripts without leaving a trace of changes, or for developers who need to constantly reproduce clean scenarios without reinstalling Windows each time.

Furthermore, modern sandboxes are a key security tool in both home and professional environments. They allow for the containment of threats, the study of malware behavior, the validation of installers downloaded from dubious sources, and, in general, a significant reduction in the risk of a quick test ending in forced formatting or data loss.

Windows Sandbox: the disposable environment built into Windows

Windows Sandbox is Microsoft's implementation of this concept within Windows 10 and Windows 11. It is an isolated desktop environment that runs using Hyper-V virtualization technology, but in a fully integrated and simplified way: there is no need to create virtual disks or install a separate operating system, everything comes "out of the box".

Opening Windows Sandbox launches a clean instance of Windows that behaves as if it were freshly installed: only the default applications (like Microsoft Edge) and default settings are present. There are no third-party programs, no leftover software, and no customizations. Perfect for testing from scratch to see if something behaves well.

The key point is that every time you close the Windows Sandbox window , everything that happened inside is erased with no possibility of recovery: installed programs, registry changes, downloaded files, settings, etc. The next time you run it, you'll have a completely fresh Windows installation, with nothing inherited from previous sessions.

This feature is available in Windows 10 version 1903 or later and in Windows 11 , provided you have the Pro, Enterprise, or Education edition. Home versions do not officially include this feature, so in that case, you'll need to use other external alternatives.

Requirements and prerequisites for using Windows Sandbox

Before you can enjoy this isolated environment, it's essential to verify that your computer meets certain requirements . Simply having a relatively modern version of Windows isn't enough; the system edition, hardware, and BIOS/UEFI configuration all play a role.

Regarding the operating system, you need Windows 10 Pro or Enterprise (1903 or later) or any Pro, Enterprise, or Education edition of Windows 11 (see the Windows 11 initial setup if you're a new user). Home versions are not officially supported, as Microsoft reserves Windows Sandbox for the "professional" versions of the system.

In terms of processor, the minimum requirement is a 64-bit CPU with at least two cores and virtualization support (Intel VT-x or AMD-V, among other similar extensions). However, for a smooth experience, a modern mid-range or high-end processor with multiple cores and threads is recommended, such as an Intel Core or a recent AMD Ryzen with, for example, 6 cores and 12 threads.

RAM is another critical factor: Microsoft recommends a minimum of 4 GB to run Windows Sandbox, but that's just the starting point. The sandbox environment consumes some of the available RAM, and you also have to continue using the main system simultaneously. Therefore, it's advisable to have at least 8 GB for comfortable use, and even 12 GB or more if you plan to run demanding applications within the sandbox or perform intensive multitasking.

Regarding storage, Windows Sandbox occupies relatively little space , as it reuses components from the host system. Even so, you need sufficient disk space for temporary files and any programs you install within the environment. If you're running low on space, you'll experience some performance issues when creating and deleting sessions.

Finally, hardware virtualization must be enabled in the BIOS/UEFI . On many computers, it comes enabled by default, but on others, you need to access the firmware settings and enable the Intel VT-x, Intel VT-d, AMD-V, or similar options. Without this support, Windows Sandbox will not be able to use Hyper-V and will not function.

How to install and activate Windows Sandbox on Windows

Once your computer meets the requirements, enabling Windows Sandbox is quite simple . You can do it via the command line using PowerShell or through the classic "Windows Features" graphical interface. Both methods achieve the same result.

If you prefer the command prompt, open PowerShell with administrator privileges . To do this, type "PowerShell" in the Start menu search box, right-click the result, and choose "Run as administrator." Elevated permissions are important because this will activate a system feature.

With the PowerShell window open, you just need to run the following command to enable the necessary component:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

After completing the process, the system will prompt you to restart. Windows Sandbox will not be available until you restart your computer , so save anything you have open and accept the restart. On modern computers, this process usually takes no more than a couple of minutes.

If you're not comfortable with the command line or simply don't feel like typing commands, you can activate Windows Sandbox from the graphical interface . In the Start menu, search for "Turn Windows features on or off" and open it. A window will appear with a long list of optional system components.

Within that list, scroll down to find "Windows Sandbox" or "Windows Isolated Space ," depending on your installation language. Check the corresponding box, click OK, and let Windows install the feature. Again, you will be prompted to restart your system for the changes to take effect.

Getting started: how to use Windows Sandbox on a daily basis

With the feature now enabled, opening Windows Sandbox is as simple as launching any other application . Just go to the Start menu and type "Windows Sandbox" or "Windows Sandbox" in the search bar and run the result that appears with the Microsoft icon.

The first time you launch it, startup may take a little longer than usual , as the system needs to finish configuring the virtual environment. Don't worry if you see a blank screen for a few seconds; on subsequent runs, the loading time is significantly reduced, and you'll have your virtual desktop ready in just a few moments.

Upon logging in, you'll see a fully functional Windows desktop , usually in English and unactivated (it's a temporary license for this environment). You'll notice only the basic system applications are present, with no trace of your usual programs, personal data, or customizations. It's like a "fresh out of the box" Windows installation.

One of the advantages is that the Sandbox window automatically adapts to your size: when you resize the window, the internal screen resolution adjusts, and it behaves like a very lightweight virtual machine. You don't have to mess with graphics drivers or complicated settings.

Within this isolated desktop, you can browse the internet, download files, install programs, and open suspicious documents almost exactly as if you were on your main Windows system. The environment has network access through a virtual interface, which makes it easy to download installers or perform quick checks. However, this also means that any malware with network capabilities can communicate externally, so it's wise to use common sense. If you're concerned about privacy, you can enable DNS over HTTPS in Windows 11.

To move files from your system to the sandbox, you can use the Windows clipboard . Simply copy a file on the host (Ctrl + C) and paste it onto the sandbox desktop (Ctrl + V). That's it, the executable or document is now inside the sandbox, ready for testing. Advanced users can also create .wsb configuration files to mount folders from the host directly in the sandbox, but that's a bit more technical.

When you've finished testing what you needed, simply close the Windows Sandbox window using the "X" in the corner, just like in any other program. A clear warning will appear indicating that everything within the environment will be deleted. Upon confirmation, the virtual machine will shut down, and all changes, files, and installed programs will be permanently destroyed.

If you have generated any files within the Sandbox that you want to keep (for example, a clean document generated by a program you didn't trust ), remember to copy them back or consult data backup guides before closing the window, otherwise they will disappear along with the temporary environment.

Alternatives and comparison: Windows Sandbox, Sandboxie and virtual machines

While Windows Sandbox is very practical, it's not the only way to isolate software in Windows . Depending on your needs, you might be interested in using other tools like Sandboxie or a full virtual machine with VirtualBox, VMware, or Hyper-V itself.

Sandboxie is a long-standing solution that works at the operating system level instead of running a full Windows environment within another. Essentially, it intercepts application access to the registry, file system, and other resources, redirecting them to an isolated area. This way, the changes the program makes aren't actually written to the system, but rather to a "sandbox" that can be easily cleaned.

The advantage of Sandboxie is its very low resource consumption , allowing it to be used even on Home editions of Windows or older versions of the system. Furthermore, it allows you to isolate specific programs (for example, just the browser or just an installer) without needing to boot a full operating system, and it's possible to run multiple Sandboxie environments in parallel.

Complete virtual machines, on the other hand, such as those from VirtualBox, VMware, or Hyper-V , create an independent virtual computer with its own disk, emulated hardware, and installed operating system. Here, the isolation is even stronger because the guest system behaves like a separate machine, which can even be a different system altogether (another version of Windows, a Linux distribution, etc.).

Its greatest strength is the ability to preserve the state of the virtual system between sessions . You can permanently install programs, maintain complex configurations, set up servers, or create lab environments with multiple interacting machines. Furthermore, it offers features like snapshots, which allow you to freeze the machine's state at a specific point and return to it whenever you want.

The downside is that virtual machines consume significantly more RAM and storage , because each VM needs several gigabytes of disk space for the system and data, in addition to reserving memory at startup. They also require a bit more patience during initial setup: you have to create the machine, mount an ISO, install the operating system, update it, and maintain it just like a physical computer.

In contrast, Windows Sandbox prioritizes immediacy and simplicity : you open it in seconds, test anything, and when you close it, everything disappears without you having to manage virtual disks or saved states. It's ideal for quick tests and analysis of suspicious files or programs that you'll only open once or very briefly.

Hyper-V and persistent testing laboratories

If you already have Windows 10 or 11 Pro or Enterprise, you also have access to the Hyper-V virtualization platform , which is the basis on which Windows Sandbox works, but with many more customization options for advanced scenarios.

With Hyper-V, you can create one or more fully customized virtual machines , configuring how much CPU, memory, disk space, and virtual network cards you want to allocate to each one. It's even possible to completely disconnect a machine from the internet, isolating it from the network—ideal for dissecting highly dangerous malware without the risk of it communicating with the outside world.

After creating the virtual machine, you'll need to install an operating system (Windows, Linux, etc.) on it , using an ISO image or a pre-made system template. Once installed, the VM behaves like a standalone PC that you can turn on and off as needed, keeping your data and applications intact between sessions.

One of Hyper-V's greatest strengths is the ability to create checkpoints . This allows you to take a snapshot of the virtual machine's state (system, programs, files, and configuration) at a specific moment. You can then install software, test configurations, or even infect the machine in a controlled manner, and if something goes wrong, you simply restore the checkpoint and return to the initial clean state.

This philosophy is quite similar to that of a sandbox, but with the advantage of being able to save and manage several different states : one with the system freshly installed, another with certain updates, another with a specific set of applications, etc. However, each checkpoint occupies additional disk space, so it's advisable to have ample storage capacity.

In professional or advanced user environments, it is very common to set up complete virtual labs with Hyper-V : one machine with Windows 10 without a network connection for malware testing, another with Windows Server to test service configurations, a third with Linux for development, and so on, all running on the same physical computer as long as the hardware allows it.

To get started, simply enable Hyper-V from "Turn Windows features on or off" , very similar to what was done with Windows Sandbox, and then open the "Hyper-V Manager" console, from which you can create and manage your virtual machines and their checkpoints.

When to use Windows Sandbox and when to use other solutions

In everyday use, Windows Sandbox is perfect for those quick situations where you receive a suspicious attachment, download an installer from an unclear source, or want to try out an application you don't plan to use long-term. You open it, test it, close the window, and forget about it, knowing your main system remains untouched.

For users who don't want to deal with complex configurations, this feature provides an immediate "safe zone" without the need for external tools or a second computer. Especially in work or production environments, it can be a very useful extra layer of security for filtering software before installing it on the live system.

On the other hand, if your goal is to maintain a test environment for a long time , with programs you want to keep installed between reboots, specific configurations, or even test servers, you'll probably be more interested in opting for a classic virtual machine with Hyper-V, VirtualBox, or VMware, where you decide when to delete or restore states.

Tools like Sandboxie can be the ideal option when you only want to isolate specific applications without running an entire system within another system, or when you're working with Home editions of Windows that don't include Windows Sandbox. In that case, isolating the browser or email client can reduce the impact of many everyday attacks without consuming many resources.

With all this in mind, the smartest approach is to combine several strategies depending on the scenario: use Windows Sandbox for one-off tests, employ virtual machines for persistent labs, and, if necessary, complement it with application-level sandboxing tools like Sandboxie. This way, you'll have everything covered for both quick, day-to-day use cases and more complex development or analysis environments.

Thanks to this set of options, any user with Windows Pro or Enterprise can drastically reduce the risk when testing suspicious programs or dangerous files , taking advantage of Windows Sandbox as a quick and easy first barrier, and relying on Hyper-V or third-party solutions when something more robust and durable is needed.