Microsoft 365 outage: still ongoing. Microsoft reports incremental improvement in several workloads but capacity is not yet back to baseline; email timeout extended to 48 hours. Next update by 11:00 UK time. Latest status
azureblog.co.uk
← cd ~/tools
// tools/sandbox

Windows Sandbox config builder

Build a .wsb file for Windows Sandbox: start from a preset, change any setting, add folders and a start-up command, then download the file or copy the wsb start command. Every setting shows what it exposes, using Microsoft's own security notes.

Runs entirely in your browser. Nothing you paste is sent anywhere.

Start from

Settings

On by default. Can expose untrusted apps to your internal network.
On by default. Off uses slower software rendering, with a smaller attack surface.
On by default. Copy and paste between your PC and the sandbox.
On by default. Shares your microphone with the sandbox.
Off by default. Shares your webcam with the sandbox.
Off by default. Shares your printers with the sandbox.
Off by default. Runs the sandbox in an AppContainer for extra isolation. Can stop copying files in and out.
Values under 2048 are raised to 2048.

Mapped folders

The host folder must already exist, or the sandbox won't start. Leave the sandbox folder empty to map it to the desktop.

Start-up command

Your .wsb file

xml

Double-click the file to start Windows Sandbox with these settings.

Or start it from the command line

Windows 11 version 24H2 and later. wsb start returns the sandbox ID, which exec, share, connect and stop need.

shell

Enforce it with Intune

A .wsb file only applies when someone uses it. To set limits for everyone, use the WindowsSandbox policy CSP in a custom profile. 1 allows a feature and 0 blocks it.

Settings, defaults and security notes are from Microsoft's Windows Sandbox configuration page, the command from the Windows Sandbox CLI and the policies from the WindowsSandbox Policy CSP. Windows Sandbox needs Windows Pro, Enterprise or Education, not Home. More in Windows Sandbox for IT admins.