Free tools Windows power users keep installed
One-click scans. No signup required.
Windows Sandbox is a built-in, disposable Windows desktop for short-lived testing. It uses Microsoft’s hypervisor to isolate a separate Windows kernel and deletes the session’s software, files, and settings when you close it. That makes it useful for checking an installer, script, document, or configuration change without permanently altering your main installation—but it is not an invulnerable malware shield or a replacement for a fully managed virtual machine.
Networking and clipboard sharing are enabled by default, and mapped host folders can expose or modify data. Configure those integration points before opening anything genuinely suspicious.
What Windows Sandbox actually does
Sandbox starts a clean Windows environment inside your existing Windows installation. Hypervisor-backed isolation, a separate kernel, smart memory management, and virtual GPU support (where available) make it more like a lightweight virtualized system than a protected folder or “safe mode.” See Microsoft’s architecture overview at Microsoft’s Windows Sandbox overview.
Install software, change settings, or run a test inside the session. Closing the Sandbox discards its installed programs, files, and state. On supported Windows 11 versions beginning with 22H2, a restart initiated inside the session can preserve state long enough for software that requires rebooting; that state is still destroyed when the Sandbox window is closed.
Recommended Free Tools
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
Sandbox is therefore a fast, disposable test bench—not a persistent VM with normal snapshots, restore points, or a long-term image.
Who can use Windows Sandbox?
Microsoft’s documented requirements are:
- Windows 10 version 1903 or later, or Windows 11.
- Supported editions: Pro, Enterprise, Education, and applicable IoT Enterprise editions. Windows Home is not supported by the official feature.
- AMD64 hardware, or Arm64 on Windows 11 version 22H2 and later.
- Hardware virtualization enabled in BIOS or UEFI.
- At least 4 GB of RAM (8 GB recommended), 1 GB of free disk space, and two CPU cores. Four cores with hyper-threading and an SSD are recommended.
- If Windows itself runs in a virtual machine, nested virtualization must be enabled.
These are minimums, not a performance promise. A host running browsers, security software, development tools, and Sandbox simultaneously needs additional memory and CPU headroom. Full requirements and supported editions are listed in Microsoft’s installation documentation.
Install Windows Sandbox
Graphical installation
- Open Start and search for Turn Windows features on or off.
- Open the Optional Features dialog.
- Select Windows Sandbox, then select OK.
- Restart Windows if prompted.
- Search Start for Windows Sandbox and launch it.
Administrator PowerShell
Open PowerShell as an administrator and run:
Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -OnlineRestart if requested, then launch Windows Sandbox from Start. Do not use unofficial scripts to force the feature onto unsupported Home editions.
If the feature is missing
Check the Windows edition and version, CPU architecture, firmware virtualization, available RAM and disk space, nested virtualization (if applicable), organization policy, and whether Hyper-V-related components are disabled or damaged.
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
Default settings—and why they matter
Without a custom configuration, Microsoft documents these defaults:
| Feature | Default |
|---|---|
| Memory | Up to 4 GB capacity |
| vGPU | Enabled on non-Arm64 devices |
| Networking | Enabled |
| Audio input | Enabled |
| Video input | Disabled |
| Protected Client | Disabled |
| Printer redirection | Disabled |
| Clipboard redirection | Enabled |
Networking and clipboard are the most important safety concerns. A suspicious program can communicate with networks through the virtual adapter, and clipboard redirection creates a host-to-guest and guest-to-host sharing path.
A safer workflow for an unknown file
- Create a dedicated host folder such as
C:SandboxInput. Put only the test file there. - Create a
.wsbconfiguration that disables networking, clipboard redirection, and vGPU unless the test specifically needs them. - Map that folder read-only. Do not map Desktop, Documents, browser profiles, password stores, cloud-sync folders, or your entire user profile.
- Open the file inside Sandbox and perform the test.
- Close Sandbox when finished. Do not treat a mapped folder as harmless: a writable mapping allows software in Sandbox to modify the host folder.
Microsoft’s sample for an unknown download is documented at the Windows Sandbox sample-configuration page. A more restrictive starting point is:
<Configuration>
<VGpu>Disable</VGpu>
<Networking>Disable</Networking>
<ClipboardRedirection>Disable</ClipboardRedirection>
<MappedFolders>
<MappedFolder>
<HostFolder>C:SandboxInput</HostFolder>
<SandboxFolder>C:Input</SandboxFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
<LogonCommand>
<Command>explorer.exe C:Input</Command>
</LogonCommand>
</Configuration>Save it as UnknownFile.wsb (use Notepad’s Save as type: All files, or enter "UnknownFile.wsb"), then double-click it. Mapped-folder paths must be absolute. The complete element reference is in Microsoft’s .wsb configuration documentation.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Useful .wsb controls
Networking
<Networking>Disable</Networking>Networking is enabled through a Hyper-V virtual switch by default. Disable it for unknown executables, suspicious documents, and offline installer tests. Keep it enabled only when internet access is part of the test, and understand that DNS, proxies, VPNs, authentication, and corporate policy can still affect results.
Virtual GPU
<VGpu>Disable</VGpu>Disabling vGPU uses software rendering (WARP), which can reduce graphics performance but removes a virtualization feature that may increase attack surface. Leave it enabled for applications that genuinely require acceleration.
Clipboard, microphone, and camera
<ClipboardRedirection>Disable</ClipboardRedirection>
<AudioInput>Disable</AudioInput>
<VideoInput>Disable</VideoInput>Clipboard and audio input are enabled by default; video input is disabled. Disable these channels when the test does not need them, especially if the host handles sensitive data.
Protected Client and printers
<ProtectedClient>Enable</ProtectedClient>
<PrinterRedirection>Disable</PrinterRedirection>Protected Client adds AppContainer and additional credential, device, file, network, process, and window isolation, but can restrict copying files into or out of Sandbox. Printer redirection is already disabled by default; leave it that way unless printing is required.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Memory and startup commands
<MemoryInMB>4096</MemoryInMB>
<LogonCommand>
<Command>explorer.exe C:Input</Command>
</LogonCommand>Memory is specified in megabytes. If a value is too low to boot, Windows automatically raises it to the required minimum of 2,048 MB. A logon command can open a mapped folder or run a mapped setup script. Environment variables in paths are supported beginning with Windows 11 version 23H2.
Windows 11 version 24H2 changes
Windows 11 24H2 introduces a newer Store-delivered Sandbox experience. It has a WinUI 3 interface, Microsoft Store updates, runtime controls under the top-right … menu, and controls for clipboard, audio/video input, and folder sharing. Early command-line functionality is also available. The device must already have Sandbox installed, run the applicable 24H2 update, and reach Microsoft Store and Windows Update. Details are in Microsoft’s version documentation.
There is also a compatibility difference: Microsoft’s 24H2 installation notes say inbox Store apps such as Calculator, Photos, Notepad, and Terminal are not available inside Sandbox yet. Check your build with winver, and account for Store access or organizational Store controls.
Security boundaries and limitations
Sandbox reduces the chance that a test permanently changes the host; it does not guarantee protection from every vulnerability, configuration mistake, integration channel, or hypervisor escape. Networking, clipboard, audio/video, printers, and mapped folders are possible data paths. A writable mapped folder can be changed by code running in Sandbox.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsBest Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
For high-assurance malware research, use a dedicated isolated research system or professional analysis environment rather than a normal personal PC. Disabling networking alone is not sufficient. Sandbox is also different from Windows Defender Application Guard: Sandbox supplies a disposable Windows desktop, while Application Guard targets narrower browser or document-isolation workflows.
When Sandbox is the right tool
- Quickly checking an installer or browser download.
- Trying a script, registry change, or system utility.
- Reproducing a short-lived Windows-only problem.
- Demonstrating software without retaining changes.
Choose another tool for persistent development, multi-machine labs, complex virtual networks, kernel-driver work that must survive shutdown, another guest operating system, or specialist malware analysis.
Windows Sandbox versus a full virtual machine
| Requirement | Windows Sandbox | Full VM |
|---|---|---|
| Fast disposable test | Excellent | Usually slower to configure |
| State after closing | Deleted | Persistent |
| Snapshots | Not a normal feature | Common |
| Guest operating systems | Windows Sandbox environment | Windows, Linux, BSD, and others depending on hypervisor |
| Virtual hardware and networking | Limited | Extensive |
| Long-term environment | Poor fit | Good fit |
| Malware research | Not sufficient alone | Better foundation, still requires specialist controls |
Use Hyper-V when you want Microsoft-native persistent VMs and virtual switches; VMware Workstation Pro or VirtualBox when you need cross-platform desktop virtualization; and a managed cloud or Dev Box environment when a team needs centrally controlled, repeatable systems. Mac users need a Mac virtualization product such as Parallels Desktop, not Windows Sandbox.
Troubleshoot common failures
Sandbox does not appear
Verify edition, Windows version, architecture, firmware virtualization, RAM, free disk space, nested virtualization, and organization policy. Hyper-V components may also be disabled.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Sandbox will not start
- Restart Windows.
- Launch Sandbox without a custom
.wsbfile. - Validate XML capitalization and structure.
- Confirm every mapped host path exists.
- Remove mapped folders and logon commands, then retry.
- Check Hyper-V and nested-virtualization settings.
- On 24H2, allow Store and Windows Update access if the app is attempting an upgrade.
Microsoft lists errors such as ERROR_FILE_NOT_FOUND and other startup causes in its troubleshooting guide.
The .wsb file opens incorrectly
Typical causes are a hidden .txt extension, invalid XML, wrong element capitalization, a relative path, a nonexistent host folder, or an invalid command. Save with an explicit .wsb extension and test a minimal configuration first.
Internet or clipboard access is missing
Check for <Networking>Disable</Networking> or <ClipboardRedirection>Disable</ClipboardRedirection>, Protected Client mode, enterprise policy, and the 24H2 runtime controls. Policy changes may require restarting Sandbox.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
