How to Fix Windows Sandbox Error 0x80070005 (Access Is Denied)

Windows Sandbox error 0x80070005 means “Access is Denied.” The most specific documented cause is a mapped host folder aimed directly at the Sandbox Desktop. Windows Sandbox runs the WDAGUtilityAccount with restrictions, so change the mapping to a new subfolder beneath the Desktop first. If that does not solve it, validate the .wsb file, enable the Windows feature and Hyper-V, verify BIOS/UEFI virtualization, and check nested virtualization when Sandbox runs inside a virtual machine.

What error 0x80070005 means in Windows Sandbox

The code is commonly mistyped as 0X800070005; the Windows Sandbox error is 0x80070005. It is an access-denied result, not a diagnosis of one single fault. Windows Sandbox uses the restricted WDAGUtilityAccount. Microsoft documents that mapping a host folder directly to the Sandbox Desktop can trigger this error, while mapping the same content to a newly created subfolder of the Desktop avoids that particular restriction.

#	Preview	Product	Price
1		Microsoft Windows 11 (USB)	$128.99	Buy on Amazon
2		Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |...		Buy on Amazon

As an Amazon Associate I earn from qualifying purchases.

The error is generally a configuration or virtualization problem. It does not, by itself, indicate malware, damaged personal files, or that the Sandbox image is unsafe. Use the manual checks below in order so that the most specific and least disruptive fix is attempted first.

Check the supported configuration before changing files

Windows Sandbox needs hardware virtualization and enough system resources. Compare your computer or virtual machine with Microsoft’s listed prerequisites:

#1 Best Overall

Sale

Microsoft Windows 11 (USB)

• Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
• Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
• Make the most of your screen space with snap layouts, desktops, and seamless redocking.
• Widgets makes staying up-to-date with the content you love and the news you care about, simple.
• Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)

$128.99

Buy on Amazon

If your device is inside another virtual machine, the outer Hyper-V host must expose virtualization extensions. A physical PC still requires virtualization to be enabled in its own firmware.

Fix a mapped-folder access error first

This is the direct remedy for Microsoft’s documented 0x80070005 scenario.

1. Close Windows Sandbox.
2. Right-click the .wsb file you use to start it and choose Open with, then select a text editor such as Notepad. Do not double-click it while editing.
3. Find every <MappedFolder> entry. Inspect its <SandboxFolder> destination, not only the host path.
4. If a destination is the Desktop root, create a new folder beneath it, such as C:UsersWDAGUtilityAccountDesktopHostShare, and point the mapping there. The folder name can be different; it must be a subfolder rather than the Desktop root itself.
5. Save the file as XML with the original .wsb extension, then launch it again.

For example, a mapping that targets the Desktop root can be changed to a child folder:

<MappedFolders>
  <MappedFolder>
    <HostFolder>C:WorkSandboxFiles</HostFolder>
    <SandboxFolder>C:UsersWDAGUtilityAccountDesktopHostShare</SandboxFolder>
    <ReadOnly>true</ReadOnly>
  </MappedFolder>
</MappedFolders>

The host path in this example must already exist. If you use several mappings, change each destination that points at the Desktop root and test again. A read-only mapping is safer for examining files; use a writable mapping only when your task requires it.

Validate the .wsb file and Windows Sandbox feature

Check the file and XML

Confirm that the path in the shortcut or command actually exists and that the file is saved with the .wsb extension rather than .wsb.txt. A missing file path produces ERROR_FILE_NOT_FOUND. Invalid XML or unsupported settings produce E_INVALIDARG. Recheck matching opening and closing tags, quotation marks, and the spelling and capitalization of each element. Remove a recently added setting temporarily and test a minimal configuration if you are unsure which entry is invalid.

If Windows says, “The following settings are enforced by your IT administrator,” a group policy is controlling the setting. On a work or school PC, the administrator may need to change that policy; repeatedly editing the local file will not override it.

Enable Windows Sandbox in Optional Features

1. Press Windows, type Turn Windows features on or off, and open that Control Panel result.
2. Select Windows Sandbox, select OK, and allow Windows to apply the files.
3. Restart when Windows requests it. Do not skip the restart if the feature installation reports that one is required.

You can perform the same installation from an elevated PowerShell window. Open Windows Terminal (Admin) or PowerShell (Admin), approve the User Account Control prompt, and run:

Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online

Restart after the command completes if prompted, then test the unmodified Sandbox shortcut before adding mapped folders or other settings.

Resolve “No hypervisor was found”

Windows Sandbox supports the Hyper-V hypervisor. A third-party hypervisor does not satisfy this requirement. If startup reports “No hypervisor was found,” enable Hyper-V and reboot.

Rank #2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

• STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
• OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
• OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
• PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
• GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

Buy on Amazon

1. Open Turn Windows features on or off.
2. Enable Hyper-V and its management components, as available in your Windows edition.
3. Select OK, let Windows install the components, and restart.
4. Launch Sandbox again. If it still reports no hypervisor, continue with the firmware check below.

Do not diagnose this message by changing the .wsb mapping first; the Sandbox virtual machine cannot start until a supported hypervisor is available.

Enable virtualization in BIOS or UEFI

Hyper-V requires processor virtualization exposed by the computer’s firmware. Microsoft’s Windows path to the firmware controls is:

1. Open Settings > System > Recovery.
2. Under Advanced startup, select Restart now.
3. After the recovery menu appears, choose Troubleshoot > Advanced options > UEFI Firmware Settings > Restart. The exact wording can vary by manufacturer.
4. In BIOS or UEFI, enable the vendor’s virtualization option. It may be labeled Intel Virtualization Technology (VT-x), AMD SVM/AMD-V, or a similar term.
5. Save the change and exit firmware setup. Windows will restart.

If the setting is locked or absent, consult the computer manufacturer’s documentation or an administrator. Enabling it does not itself create a Sandbox mapping permission; it only allows the Hyper-V virtual machine to run.

If Sandbox runs inside another virtual machine

Nested virtualization is required when Windows Sandbox is installed in a guest virtual machine. The outer Hyper-V host must expose virtualization extensions to that guest. On the Hyper-V host, open an elevated PowerShell session and substitute the guest’s exact VM name:

Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true
Update-VMVersion <VMName>

Shut down the guest before changing processor settings if Hyper-V requires it, then start the guest and retry Sandbox. These commands apply to a Hyper-V-managed guest; a different virtualization platform needs its own nested-virtualization procedure, and Microsoft does not list third-party hypervisors as supported Sandbox hypervisors.

Check Windows Update, Microsoft Store, and network access

Microsoft identifies Internet connectivity, Windows Update, and Microsoft Store access as relevant to upgrade or Store-related Sandbox failures. If the error began after an upgrade or while Windows is trying to obtain Sandbox components:

• Confirm that the PC can reach the Internet without a captive portal or proxy interruption.
• Open Settings > Windows Update, select Check for updates, and finish any pending restart.
• Open the Microsoft Store and verify that it loads and can sign in if your organization requires an account.
• Retry the Sandbox feature installation after updates have completed.

These checks address acquisition and servicing problems; they do not replace the mapped-folder change when the failure occurs only with a particular .wsb file.

Use the symptom to choose the next layer to test

What changes in Windows 11 version 24H2

Beginning with Windows 11 version 24H2, inbox Store apps including Calculator, Photos, Notepad, and Terminal are unavailable inside Windows Sandbox. Their absence in a new Sandbox session is therefore expected on that release and is separate from error 0x80070005. Do not treat those missing apps as proof that the mapped-folder fix failed.

Final restart and clean test

1. After enabling Windows features, Hyper-V, or firmware virtualization, restart whenever Windows requests it.
2. Start Sandbox with a minimal .wsb file containing no mapped folders. This isolates feature and hypervisor problems from file-access problems.
3. If the clean session opens, add one mapped folder whose destination is a newly created Desktop subfolder, then test again.
4. Add other settings one at a time. The first change that reproduces the error identifies the layer to correct.

This staged test leaves you with a working baseline and a specific setting to repair instead of repeatedly changing several parts of Windows at once.

Quick Recap

SaleBestseller No. 1

Microsoft Windows 11 (USB)

Make the most of your screen space with snap layouts, desktops, and seamless redocking.; FPP is boxed product that ships with USB for installation

$128.99

Bestseller No. 2

Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC | Branded by Microsoft

GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.

As an optional shortcut after trying the manual steps, Outbyte PC Repair can address some common Windows issues, clean temporary and cache files, check selected settings and missing updates, and keep an app-crash log. It complements antivirus software rather than replacing it; results vary, and no tool repairs every crash. It runs on Windows 11, 10, 8 and 7 and offers a free trial by category for at least two days before a subscription.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

0x80070005Access DeniedHyper-VVirtualizationWindows 11Windows Sandbox