The safest general-purpose setup is a custom Windows Sandbox configuration with networking disabled and no mapped host folders. The game then runs in a disposable Windows environment, while your normal files and network remain outside that session. If the game must run on your regular Windows installation, use a Windows Defender Firewall outbound rule for every executable that actually communicates. Neither method guarantees that a particular launcher, graphics stack, account flow, or anti-cheat system will work; compatibility has to be checked for the specific game.
Choose the isolation method that fits the game
There are two materially different ways to separate a game from your data and network:
As an Amazon Associate I earn from qualifying purchases.
| Approach | What it controls | Best fit | Important limitation |
|---|---|---|---|
| Windows Sandbox with networking disabled | Runs the game in a disposable virtualized Windows environment and removes its network connection. | A game or installer that can operate in a temporary guest and does not need online services. | Windows Sandbox is limited to Pro, Enterprise, and Education editions; it is not supported on Windows Home. Game, launcher, graphics, and anti-cheat compatibility is not established generically. |
| Sandbox with a read-only mapped folder | Lets the guest read a specifically selected host directory without permitting writes back to it. | Testing an installer or game that needs files already stored on the host. | The selected files are still exposed to the guest. Map the smallest possible directory, not an entire drive or profile. |
| Windows Defender Firewall outbound program rule | Blocks outbound traffic from a selected executable while the game remains on the normal Windows installation. | A game that requires the host’s graphics performance, launcher, or anti-cheat, but should not be allowed to send traffic. | You must identify the game executable and any launcher, updater, helper service, or child process that also uses the network. The rule does not isolate local files. |
Use Sandbox when disposable state and separation from the host matter most. Use a firewall rule when the game cannot run in a guest or when it needs host-installed components. If the game requires online authentication, multiplayer, cloud saves, or an always-online launcher, blocking networking will intentionally break those features.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesWhat Windows Sandbox actually isolates
Windows Sandbox creates a temporary Windows environment using virtualization. Applications installed or files created inside that environment disappear when the Sandbox session is closed, unless you deliberately expose a host location or copy data back out. This makes it useful for testing an unfamiliar game executable or installer without leaving a permanent installation on the host.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Sandbox is not a promise that every game will run. A title may depend on a graphics feature unavailable in the guest, a launcher that needs an internet connection, an account sign-in, digital-rights software, or an anti-cheat driver that cannot operate in a virtualized disposable session. Treat compatibility as a per-game question rather than a property of Sandbox itself.
A Sandbox instance is also shared among workflows running in that instance. Applications in the same session can observe or interfere with one another, so do not place mutually untrusted games, installers, or utilities in one session when they should be isolated from each other. Close the session and start a fresh one for a clean boundary.
Check prerequisites before creating a Sandbox
- Windows edition: Microsoft documents Windows Sandbox for Pro, Enterprise, and Education editions. Windows Home is not supported.
- A suitable test copy: Keep an installer or game copy that can run without relying on files from your personal folders. If the only copy is tied to a live account or valuable save data, do not expose that data until you understand the game’s behavior.
- A clear network requirement: Decide whether the game must be completely offline, needs a one-time sign-in, or requires continuous connectivity. You cannot both disable networking and use an online feature in the same session.
- A minimal file boundary: Identify the one folder, if any, the game needs. Do not map your whole user profile, Downloads directory, game library, or system drive by default.
On a supported edition, enable the Windows Sandbox optional feature through the Windows Features dialog, then restart if Windows requests it. The exact Settings route can vary between Windows builds; the feature name is Windows Sandbox. If the feature is absent, verify the edition before troubleshooting the game.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Create a network-disabled Sandbox configuration
Windows Sandbox uses a .wsb XML file. The following configuration starts with the narrowest useful boundary: networking is disabled, no host folders are mapped, and clipboard redirection is disabled so ordinary copy-and-paste is not another host-to-guest channel.
<Configuration>
<Networking>Disable</Networking>
<ClipboardRedirection>Disable</ClipboardRedirection>
</Configuration>- Open a plain-text editor.
- Enter the XML exactly as shown, including the opening and closing
Configurationtags. - Save the file with a name such as
GameOffline.wsb. In the Save dialog, choose “All files” if the editor would otherwise append.txt. - Double-click the
.wsbfile. Windows opens a new Sandbox window and applies the settings for that session. - Install or copy only the game components you intend to test. When you close the Sandbox window, the guest is discarded.
Networking is enabled by default when the setting is omitted or set to Default. Microsoft warns: “Enabling networking can expose untrusted applications to the internal network.” For an offline test, explicitly setting Disable is safer than relying on a default.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
With networking disabled and no mapped folders, the guest cannot use your host file system as a normal directory. You still need a way to supply the installer or test files. You can place a non-sensitive copy into the guest through an approved transfer method, or use a narrowly scoped read-only mapping as described next.
Expose only the files the game needs
A mapped folder is a deliberate bridge between the host and guest. The guest can read the selected host directory, so anything placed there should be treated as exposed. A read-only mapping prevents the game from writing changes back to that directory.
<Configuration>
<Networking>Disable</Networking>
<ClipboardRedirection>Disable</ClipboardRedirection>
<MappedFolders>
<MappedFolder>
<HostFolder>C:GameTest</HostFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
</Configuration>- Create a dedicated host directory such as
C:GameTest. - Put only the installer, patch files, or game data required for this test in that directory. Do not use a path that contains documents, browser profiles, password stores, or unrelated game saves.
- Save the XML as a new
.wsbfile and launch it. - Inside Sandbox, open the mapped folder and run the installer or executable from there.
Keep ReadOnly set to true unless you have a specific reason to allow writes. Microsoft documents that changes made through a writable mapped folder persist on the host after the Sandbox session is disposed. A writable mapping therefore defeats much of the disposable-data benefit and can let the guest alter host files.
When the game needs several directories, create separate mappings for the smallest required paths rather than mapping a parent such as your entire user folder. If a game only needs an installer, map the installer directory; do not leave a broad game library available throughout the session.
Control other host-to-guest channels
Clipboard redirection
Basic Sandbox configurations enable clipboard redirection by default. Clipboard contents can therefore become another path for text or data to cross between host and guest. The examples above disable it. If you need to paste a license key or command temporarily, enable it only for a session in which that transfer is acceptable, then return to a disabled configuration for untrusted software.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Protected Client mode
Protected Client is an additional AppContainer isolation setting documented for Sandbox. It can add another layer of process restriction, but it is not a substitute for deciding whether the guest needs networking, mapped folders, or clipboard access. Keep the primary boundary decisions explicit: disable network access, avoid mappings, and turn off clipboard redirection when those channels are unnecessary.
Virtual graphics
Microsoft’s sample for examining an unknown download disables vGPU, demonstrating that the option exists. That sample is not a universal game recommendation. Many games need graphics acceleration, and whether vGPU should be enabled depends on the title and its rendering requirements. Do not copy a “disable vGPU” sample blindly into a game configuration; test the game’s graphics needs separately.
Run and evaluate a game inside Sandbox
- Start with an offline-capable copy. With networking disabled, a launcher cannot download updates, contact an account service, or validate an online license. Use an installer and game build that can complete the required steps without internet access.
- Install only inside the guest. Choose a guest path for the installation. Installation state in the guest disappears when the session closes unless you intentionally use a host mapping.
- Observe the launch chain. A desktop shortcut may start a launcher, which then starts the game and one or more helper processes. Note each component that the game requires; a single executable is not proof that the whole launch chain is self-contained.
- Test the actual feature you care about. If your objective is to inspect an installer, stop after installation. If you need to evaluate offline play, start a local session and verify that saves and configuration behave as expected inside the guest.
- Close the Sandbox when finished. Closing the window discards the guest. Anything you need to keep must be exported deliberately, and anything in a writable mapped folder may already have changed the host.
Do not treat a successful launch as proof that the game is safe or fully compatible. It only shows that this particular build completed this particular test under the selected settings. Anti-cheat drivers, account systems, updates, and multiplayer services may behave differently outside the guest or after a game update.
Block a host-installed game with Windows Defender Firewall
If the game must run on the regular Windows installation, a host-level outbound rule is the practical alternative. Microsoft documents that outbound traffic is allowed by default unless a blocking rule applies. An outbound program rule prevents the selected executable from sending outbound network traffic while leaving the application and its local files on the host.
- Open Windows Defender Firewall with Advanced Security. You can search for that exact name from the Start menu.
- In the left pane, select Outbound Rules.
- In the Actions pane, choose New Rule.
- Select Program, then choose This program path and browse to the executable you want to restrict.
- Select Block the connection.
- Choose the network profiles to which the rule should apply. If you do not have a profile-specific reason to exclude one, apply the rule to the profiles used by the computer.
- Give the rule a name that identifies the exact executable and purpose, such as “Block game client outbound.” Finish the wizard.
- Launch the game and check the feature you intend to use offline. Expect sign-in, update, cloud-save, matchmaking, or telemetry functions to fail if they require outbound access.
The executable path is the critical detail. A game may use a launcher, a separate game binary, an updater, a crash reporter, or a helper service. Create additional outbound rules for components that are permitted to communicate, or for every component you need to block. Do not assume that blocking the visible game executable automatically covers a launcher or child process with a different path.
Recommended Free Tools
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
This method does not protect host files from the game. The game still has the permissions of your Windows account and can read or modify files that those permissions allow. Use Sandbox when file isolation is as important as network isolation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Make the firewall rule maintainable
Confirm the path after updates
Launchers often install new versions in a new directory or replace the executable. A firewall rule tied to an old path may no longer affect the current binary. If the game starts reaching the network after an update, inspect the installed files and create or update the rule for the new executable.
Separate launcher and game decisions
You may want to allow a launcher to authenticate once while blocking the game during play, or you may want both blocked. These are different policies. Create clearly named rules for each executable so that you can disable one without accidentally changing the other.
Undo the restriction
To restore connectivity, return to Outbound Rules, locate the named rule, and disable or delete it. Keep the rule disabled rather than deleting it if you expect to switch repeatedly between offline and online modes.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Troubleshoot the common failure modes
Windows Sandbox is not available
Check the Windows edition first. Microsoft lists Pro, Enterprise, and Education as supported and excludes Home. If the edition is supported but the optional feature is unavailable, verify that Windows is fully updated and that the feature was enabled through the Windows Features dialog before investigating the game itself.
The game or launcher will not start in Sandbox
- The launcher may require internet access, account authentication, or an update.
- An anti-cheat component may not support a disposable virtualized environment.
- The guest’s graphics configuration may not meet the game’s requirements. Do not disable vGPU merely because a security-testing sample does.
- The game may depend on a service or file that was not included in the guest.
Test with a nonessential copy, document which component fails, and decide whether the game belongs on the host with a firewall rule instead. There is no generic Sandbox compatibility guarantee.
The guest can still reach the network
Open the .wsb file and confirm it contains <Networking>Disable</Networking>, then close that session and launch a new one. Changing a file after a session is already running does not retroactively reconfigure the existing guest. If the game is running on the host instead, verify that the firewall rule is an outbound rule for the current executable path and that the rule is enabled for the active network profile.
Files changed on the host
This indicates that the guest had write access to a mapped folder or that you ran the game directly on the host. Replace writable mappings with <ReadOnly>true</ReadOnly>, create a fresh dedicated directory, and do not map broad personal folders. A read-only mapping cannot undo changes that were already made through an earlier writable session.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSaved progress disappears
That is normal for Sandbox: the environment is disposable. Export only the specific save or configuration data you intentionally want to keep, and review it before placing it back on the host. If persistent local saves are essential, the host-plus-firewall approach may be more practical, but it does not provide the same file isolation.
Two test applications interfere with each other
Close the Sandbox and start separate sessions. A Sandbox instance is shared among workflows in that instance, so keeping unrelated or mutually untrusted applications together weakens the separation you intended.
A practical decision checklist
- Choose Sandbox with networking disabled and no mappings when the game can run offline and you want the strongest simple separation from host files.
- Choose Sandbox with one or more read-only mappings when the guest must read a host installer or data set. Treat every mapped file as exposed.
- Choose Sandbox with networking enabled only when the game genuinely needs network access and you accept that the guest can reach the internal network. Microsoft explicitly warns about this exposure.
- Choose a Defender Firewall outbound rule when the game must run on the host. Enumerate the launcher, game binary, updater, helper service, and any other network-using executable instead of relying on one rule.
- Choose separate sessions or separate policies for unrelated untrusted applications, and disable clipboard redirection when copied host data is not needed.
The safest configuration is the one that removes channels the game does not need: no network, no mapped folders, and no clipboard. Add one narrowly scoped capability at a time only when the game requires it, and treat compatibility with graphics, launchers, accounts, and anti-cheat as a case-by-case test rather than an assumption.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
