Windows Sandbox: Rogue Program Containment!

So I hadn’t realised this feature was released. Windows Sandbox is essentially a clean isolated Windows 10 Pro instance

As described in the video its pretty easy to enable. Theres documentation here about the details of how it works

What I noticed is that is uses part of the Windows Defender Application Guard back-end for some part of it and this is also the same technology used to allow you to run isolated Edge windows (this includes the new Chromium based Edge) under a similar self contained (but seamless) environment within your Windows OS.

I don’t think you captured that part of the sandbox environment in the video @wendell, its pretty cool.

This is enabled via Windows Security > App & Browser Control > Isolated Browsing

image

One thing I noticed is i seem to definitely have some sort of performance hit with both instances of this sandbox environment, i’m not sure why. Could be my computer (which is beefy enough to run it, or perhaps a insiders build bug)

4 Likes

Hi. Is there a way to preserve/save an image of the windows 10 sandbox after shutdown so that I can quickly reload when I need to use it?

1 Like

An interesting type of sandbox. Fits between sandbox per application and virtual machine. :wink:

1 Like

It won’t be better to use a virtual machine in your situation?
Imho typical sandbox should always be temporary, because otherwise we leave the zone typical for sandbox and strongly enter the sphere of VM.

If I’m not mistaken, Comodo sandbox was able to remember the condition of the sandbox, but it is a completely different level per application compared to the sandbox W10.

1 Like

There isnt. This sandbox is destroyed on close and clean on start.

It does the following:

Windows Sandbox has the following properties:

  • Part of Windows – everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD!
  • Pristine – every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows
  • Disposable – nothing persists on the device; everything is discarded after you close the application
  • Secure – uses hardware-based virtualization for kernel isolation, which relies on the Microsoft’s hypervisor to run a separate kernel which isolates Windows Sandbox from the host
  • Efficient – uses integrated kernel scheduler, smart memory management, and virtual GPU

You can configure the sandbox to automatically setup with config files as wendell mentioned.

Microsoft also has an example of running folding@home in the sandbox initiated via powershell.

The code repository is here

2 Likes