How to Use Windows Sandbox .wsb Config Files: Custom Sandboxes and Common Errors

Opening Windows Sandbox by hand each time means reinstalling software and resetting the network, only to lose it all when you close it. Testing the same thing over and over gets tedious. A .wsb config file starts a sandbox built to your settings in one double click, then wipes it on close so the next run is clean again. This guide picks up from Run Virtual Machines on Windows and covers the config syntax, isolation tests, and the errors that come up.

What Is a .wsb File

A .wsb file is an XML configuration for Windows Sandbox. Double click it and a sandbox built to your settings starts. It is a startup sheet that spells out the graphics, network, memory, mapped folders, and the command to run after sign-in.

Start with no config and you get the default sandbox, fresh each time, fine for a quick look.
Write a .wsb and you have saved a fixed environment as a file, ready to reuse without rebuilding it.
Close the sandbox and every change is destroyed, leaving no trace on the host, so trying risky things is safe.

Create a text file, change the suffix to .wsb, and edit it in Notepad. No extra tools are needed; right click the file and choose Open with Windows Sandbox to launch it.

What It Does

The config can set a lot, but a handful of options cover most jobs.

Graphics virtualisation. Turn it off for old or faulty graphics drivers, and compatibility often improves.
Network switch. Set it to offline for isolation tests so a sample cannot phone home.
Memory cap. Bound the sandbox so it cannot starve the host of RAM.
Folder mapping. Hang a host directory inside the sandbox, optionally read-only.
Logon command. Automatically install software or open a folder after the desktop appears.
Whether the microphone, camera, and clipboard pass through, switched off as privacy needs.

Combine these and the sandbox becomes a clean testing chamber for checking files and trying installers. For a Linux environment you want to keep between sessions, that is a job for Install and Set Up WSL2 instead.

When to Use

These are the jobs it fits best.

You downloaded a questionable installer and want to see what it changes before putting it on the host.
A document or archive arrived and you want to scan it first, then copy it back if it is safe.
You are testing whether a program runs offline or tries to connect out.
You need to demo or test the same thing repeatedly from a clean start.
You want to cap memory for a heavy task so the sandbox does not slow the host.

For a quick look that you will throw away, nothing beats the sandbox.

Before You Start

Confirm three things first and save a detour.

The system is Pro or Enterprise. Home does not include Sandbox.
Virtualisation is on in the BIOS, either VT-x or AMD-V.
The host folder you will map is ready, with a path free of Chinese characters and spaces.

The mechanism is the same on Windows 10 and Windows 11.

Item	Windows 10	Windows 11
Built-in Sandbox	Pro and above	Same
Virtualisation	BIOS VT-x / AMD-V	Same
Config suffix	`.wsb`	Same

Step-by-Step

Build a sandbox that opens your test package automatically.

Create a text file, paste the template at the end, save it as test.wsb with UTF-8 encoding.
Put the installer you want to check in the host folder C:\Temp\test, matching the path in the config.
Right click test.wsb, choose Open with, and pick Windows Sandbox. It starts to your settings.
At the desktop, the mapped folder appears and opens on its own; run the installer inside it.
When you are done, close the sandbox window. Every change is destroyed and the host is untouched.
To reuse it, double click the same .wsb and you have a clean set again, with nothing to rebuild.

In the template, VGpu and Networking are Disable for compatibility and isolation, MappedFolders mounts the host directory read-only, LogonCommand opens it, and MemoryInMB caps the RAM. Each switch works on its own, so get this template running first, then change one option at a time.

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MemoryInMB>4096</MemoryInMB>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Temp\test</HostFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:\Users\WDAGUtilityAccount\Desktop\test</Command>
  </LogonCommand>
</Configuration>

FAQ

Double clicking the .wsb does nothing or errors

Usually the BIOS has virtualisation off, or Hyper-V is not enabled. Tick Hyper-V and Virtual Machine Platform under Windows features, then restart.

The mapped folder will not open or reports no permission

The host directory has tight permissions. Move it to a more open path, or right click the folder and add yourself under Security with read access.

The sandbox is slow to start or goes black

Try setting VGpu to Disable; it is usually a clash between the graphics driver and the sandbox.

Home edition wants to use it

Home has no built-in Sandbox. Use a light virtual machine from VirtualBox or VMware instead, or see How to Choose Windows Home or Pro to upgrade to Pro when that makes sense for your work.

How It Works

Sandbox is a disposable, lightweight environment. It pulls a clean image from the system at launch, and every write lands in that session only, so closing it throws the whole thing away.

The .wsb is a parameter sheet read before startup, and each switch decides what that environment looks like. Graphics and memory are allocations of virtual hardware; a mapped folder is an entry point for hanging a host directory inside, and the read-only flag stops the sandbox writing back to the host. See that and it is clear the sandbox was never meant to keep state. For a system you want to keep, use Hyper-V or a full virtual machine instead.

Conclusion

A .wsb turns rebuilding an environment by hand into a double click. Graphics, network, memory, mapped folders, and the logon command all go in the file; close it and everything clears, so the next run is clean again. For isolation checks and trying installers it is far lighter than a full VM, and if you need to keep state, a virtual machine is the right tool. Save the template, run it once, then change the switches you need.