Windows Sandbox
Disposable Windows desktop built into Windows Pro, Enterprise and Education, running on the Microsoft hypervisor with a separate kernel and wiped on close. A free, well-isolated throwaway Windows desktop for single-agent or manual use, not a platform for running agents at scale.
Overview
Windows Sandbox (WSB) is an optional Windows feature that launches a lightweight, disposable Windows desktop in a Hyper-V virtual machine with its own kernel. Everything needed ships with Windows Pro, Enterprise and Education (not Home); you enable the Containers-DisposableClientVM feature, click Windows Sandbox in the Start menu and get a pristine instance in a few seconds, with 4 GB of memory, vGPU, networking and clipboard redirection on by default. Closing the window deletes all software, files and state. Host-installed software is not visible inside, so an agent or tool has to be installed in the sandbox or mapped in from a host folder.
Configuration is through XML .wsb files (Windows 10 build 18342 or Windows 11) that control vGPU, networking, mapped folders with read-only or write access, a logon command, audio and video input, printer and clipboard redirection, Protected Client (AppContainer) mode and memory in MB (minimum 2048 MB). Prerequisites are AMD64 or Arm64 (Windows 11 22H2+), virtualisation enabled in firmware, at least 4 GB RAM, 1 GB of disk and two CPU cores. Only one sandbox instance can run at a time, which rules it out as a fleet runtime; its value for agents is a free, OS-vendor-maintained throwaway Windows machine with a scripted startup command.
Notable
- Built into Windows 10 version 1903 and later and Windows 11 Pro, Enterprise and Education; not supported on Windows Home
- Since Windows 11 version 22H2 data persists through restarts initiated inside the sandbox; since 24H2 inbox store apps such as Notepad and Terminal are temporarily unavailable inside it
- Microsoft Learn page last updated 29 March 2026
Windows Sandbox specifications
| Attribute | Details |
|---|---|
| Isolation | Hyper-V based lightweight virtual machine with its own kernel, isolated from the host by the Microsoft hypervisor; optional Protected Client mode adds AppContainer isolation to the RDP session |
| Deployment | Local / OS-level |
| Open source | No |
| SDKs and interfaces | CLI |
| Cold start (vendor claim) | Docs: "takes a few seconds to launch" |
| Max session length | No limit documented; the sandbox lives until the window is closed, and since Windows 11 22H2 survives reboots initiated inside it |
| Persistence | None: closing the sandbox deletes all software, files and state and each launch is a pristine instance; only writes to mapped host folders with write permission persist |
| GPU | Yes — virtualised GPU (vGPU) enabled by default on non-Arm64 devices; can be disabled in favour of WARP software rendering |
| Networking | Enabled by default through the Hyper-V default switch and a virtual NIC; can be disabled per launch in a .wsb configuration file (the docs warn that networking can expose untrusted applications to the internal network) |
| Pricing | Included with Windows Pro, Pro Education/SE, Enterprise (E3/E5) and Education (A3/A5); not available on Windows Home |
| Free tier | Included in the Windows licence |
| Compliance | Not documented |
| Regions | Not documented |
Facts from Windows Sandbox’s public documentation, verified November 9, 2026. Performance numbers are vendor claims.
Strengths and trade-offs
Strengths
- You want a disposable Windows environment with no separate VM image to maintain
- You need GPU-accelerated graphics or a real Windows desktop for a computer-use agent
- You want a one-file
.wsbconfiguration that maps a project folder in and runs a startup script - You are on a Windows Pro or Enterprise fleet and need something IT can enable without new software
Trade-offs
- Only one instance can run at a time and there is no API, so it cannot back parallel agent runs
- Nothing persists between launches except writes to mapped folders
- Networking and clipboard sharing are on by default and must be disabled explicitly for hostile workloads
- Windows Home is not supported and the feature requires virtualisation enabled in firmware (nested virtualisation inside a VM)
Good fit for: Running an untrusted Windows application or a Windows-targeting coding agent on a disposable copy of the host OS.
Use cases Windows Sandbox fits
- Local agents: A disposable Hyper-V copy of the host Windows OS for untrusted applications or Windows-targeting agents.
How Windows Sandbox compares
| Sandbox | Isolation | Open source | Self-host / BYOC | Cold start (vendor) | Max session | Snapshots / pause | GPU | SDKs |
|---|---|---|---|---|---|---|---|---|
| Windows Sandbox | Hyper-V lightweight VM | No | No / No | A few seconds | Until closed | No / No | Yes | CLI |
| Apple container | Lightweight VM per container | Yes | No / No | Sub-second (claimed) | Not documented | No / No | Not documented | CLI |
| Docker Sandboxes | MicroVM | No | Yes / No | Not documented | Until removed (local) | Yes / Yes | Yes | sbx CLI, TypeScript (cloud), REST API (cloud) |
| Anthropic Sandbox Runtime | OS-level (Seatbelt / bubblewrap) | Yes | Yes / Not documented | Process start | Not documented | No / No | Not documented | CLI (srt), TypeScript (npm) |
| Microsandbox | MicroVM (libkrun) | Yes | Yes / Yes | <100 ms | Not documented | Yes / Not documented | No | TypeScript, Python, Rust, Go, Ruby, CLI, MCP server |
| Kasm Workspaces | Docker container | No | Yes / No | Not documented | Admin-defined | No / Not documented | Yes | REST API |
Frequently asked questions
What is Windows Sandbox?
How does Windows Sandbox isolate code?
Is Windows Sandbox open source?
How much does Windows Sandbox cost?
What are the alternatives to Windows Sandbox?
Sources
- learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/
- learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install
- learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file
Cite this page
Agent Sandboxes. (2026). Windows Sandbox. agentsandboxes.org. Last reviewed November 9, 2026. https://agentsandboxes.org/sandboxes/windows-sandbox/
Found an error or a missing sandbox? Submit a correction — every entry links to the sources it relies on.