Windows 10: Windows Sandbox - How to configure in Windows 10

How to: Windows Sandbox - How to configure in Windows 10


Information A quote from Ten Forums tutorial Enable Windows Sandbox Feature in Windows 10 Home Edition

Windows Sandbox does not contain any third party software, and uses a default theme. It looks quite plain by default:




By creating a configuration file, users can change the theme, switch to Dark Mode, add software and so on. This tutorial will show how to do that.



Contents [/i] Click links to jump to any part [table][tr][td]Part One:[/td] [td]Sample Windows Sandbox Configuration File[/td] [/tr] [tr][td]Part Two:[/td] [td]Virtual GPU[/td] [/tr] [tr][td]Part Three:[/td] [td]Networking[/td] [/tr] [tr][td]Part Four:[/td] [td]Shared Folders[/td] [/tr] [tr][td]Part Five:[/td] [td]Startup script[/td] [/tr] [/table]



Part One [/i] Sample Windows Sandbox Configuration File
1.1 A Windows Sandbox configuration file contains information about vGPU (virtualized GPU), networking, folders on host shared with Sandbox, and can run a startup script to execute commands:



(Image from Thomas Maurer's blog on Microsoft Tech Community.)

1.2 All four modules are optional. If user wants to run Sandbox with default settings, only adding a shared folder, only that module is required.

1.3 Here's the configuration file I use to enable vGPU and networking, map a host folder %userprofile%\OneDrive\Sandbox, and run a batch file SBConfig.bat (see step 1.5) to apply a custom Windows theme, install Chrome, Firefox and Opera browsers, and set Windows to use dark mode:

Code:

1.4 A Sandbox configuration file must have extension .wsb (Windows SandBox). I have saved the above file as Browsers and theme.wbs in folder %userprofile%\OneDrive\Sandbox, and can start Windows Sandbox with a custom theme and dark mode, vGPU and networking enabled, three third party browsers installed, and host folder Sandbox shared with Sandbox simply by double clicking the .wsb file on host:



(Click screenshots to enlarge.)

1.5 The batch file SBConfig.bat run from <LogonCommand> tags in configuration file, which I have also saved in %userprofile%\OneDrive\Sandbox folder:

Code:

The first command in batch file applies my custom Windows Theme Pack file. When a theme is applied, Settings app will automatically open in Personalization page.

The last command in batch then closes the Settings app. Because Settings App opens with a slight delay, if the TASKKILL command to close it would have been executed just after applying the theme, Settings would have not been completely opened, therefore causing TASKKILL command to fail.


Let's break the configuration file in parts and look into each module.


Part Two [/i] Virtual GPU
2.1 By default, vGPU (virtualized GPU) is enabled in Sandbox. The vGPU tags in configuration file can be used to disable vGPU and make Sandbox use software rendering instead. Especially when testing possible malware, this reduces the risk for host to get infected, at the same time making rendering somewhat slower.

2.2 Allowed values for vGPU tags are Enabled (default) and Disabled.

2.3 If you want to accept all other defaults, just disable vGPU, a simple three line configuration file is enough:

Code:

2.4 I save this as %userprofile%\OneDrive\Sandbox\VGPUDisabled, and can run Sandbox with vGPU sisabled by double clicking it.


Part Three [/i] Networking
3.1 By default, Networking is enabled in Sandbox. The Networking tags in configuration file can be used to disable networking. Disabling networking, together with disabled vGPU is recommended when testing possible malware. These two settings make Sandbox completely isolated from host and network.

3.2 Allowed values for Networking tags are Default (network enabled) and Disabled.

3.3 If you want to accept all other defaults, just disable networking, use the following configuration file. I save it as %userprofile%\OneDrive\Sandbox\NoNetwork.wsb:

Code:

3.4 To completely isolate Sandbox from host and network, use the following configuration file. I save it as %userprofile%\OneDrive\Sandbox\Isolated.wsb:
Code:

Part Four [/i] Shared Folders
4.1 All host folders can be shared with Sandbox. When shared, each folder will be added to desktop of Sandbox default user profile WDAGUtilityAccount.

4.2 To share a host folder is done in <MappedFolders> tags. Inside the <MappedFolders> tags (notice the plural s at the end of the tag name), each shared folder is then given in <MappedFolder> (singular).

Having user profiles stored on E: drive, to share my host folder E:\Users\Kari\Downloads with Sandbox, I use the following configuration file, saving it as %userprofile%\OneDrive\Sandbox\Downloads.wsb:

Code:

4.3 In addition, I want to share my custom Sandbox folder, located in my OneDrive. With following configuration script I can share both:

Code:

4.4 The <ReadOnly> tags with value true used for both shared folders tell Sandbox that I want it not to have right to write to these folders, not to save anything on them nor edit their content. Changing the <ReadOnly> value to false gives Sandbox full access.


Part Five [/i] Startup Script
5.1 The <LogonCommand> tags can contain any Windows command, or run an executable file, batch file or script.

5.2 If the command is not an internal, native Windows command, Sandbox must find its target in a shared folder. For instance, if I want to accept all other defaults, just run my SBConfig.bat batch file when Sandbox is started (see Step 1.5), I would first save the batch in folder shared in configuration script, then run it from <LogonCommand> tags:

Code:

5.3 In above code sample, I first share host folder E:\Users\Kari\OneDrive\Sandbox with Windows Sandbox, which will be added to its default user profile's desktop. The folder contains the batch file SBConfig.bat, which Windows Sandbox runs from this mapped network share.

Important to remember: if the command given is not an internal, native Windows command, Sandbox must be able to find it in a shared folder. If you run an application installer, a PowerShell script, a batch file, a Java script and so on from <LogonCommand> tags, the target, executable or script itself must be accessible to Sandbox.


5.4 To automatically install software in Windows Sandbox, download its offline installer, and find out which switches need to be used for a silent unattended install. For instance, if you want Google Chrome to be available every time Sandbox starts. download its offline installer from here: Google Chrome - The New Chrome & Most Secure Web Browser

5.5 In my case, I saved the Chrome installer in my custom Sandbox folder, shared that folder, and run the silent installer from mapped drive in Windows Sandbox with following configuration file. It starts Windows Sandbox with default settings, and installs Chrome silently in the background:

Code:

That's about it. Looking at my OneDrive\Sandbox folder, it contains all my .wsb scripts to start Windows Sandbox in a different way. I can run any of them to start Windows Sandbox in a way I want to. It also contains the offline software installers, a batch file to install software and apply theme, the theme file itself naturally saved in same folder:




Please post your possible issues and questions about configuring Windows Sandbox in this thread.

Kari


Related Tutorials

• How to Enable or Disable Windows Sandbox in Windows 10
• How to Enable Windows Sandbox Feature in Windows 10 Home Edition

:)

 

Windows 10 Tweaks

Pressing “Windows+Pause Break” (it’s up there next to scroll lock) opens the “System” Window.

Windows 10: In the new version of Windows, Explorer has a section called Quick Access. This includes your frequent folders and recent files. Explorer defaults to opening this page when you open a new window. If you’d rather open the usual This PC, with links to your drives and library folders, follow these steps:

• Open a new Explorer window.
• Click View in the ribbon.
• Click Options.
• Under General, next to “Open File Explorer to:” choose “This PC.”
• Click OK

credit to Lifehacker.

 

Unlocked Realtek HD Audio Drivers Windows 7 & 8 (With Dolby Digital Live and DTS Interactive)

DTS supported natively by Windows 8/8.1 and it should work on windows 10 too just DDL require to unlock your driver .

 

Is it time for Windows 10 already?

Here's a good step by step guide on doing a fresh install.

How to clean install Windows 10 from a USB drive - Software - Feature - HEXUS.net

 

windows sandbox Not working

Hi,



Thank you for writing to Microsoft Community Forums.



There is a possibility that the feature is corrupted or not set up properly. I would advise you to disable Windows Sandbox first and then enable it. Please follow the steps mentioned below:

1. Open Control Panel.
   
2. Then click on all Control Panel Items.
   
3. Then click on Programs and features.
   
4. Then on the left hand side, click on Turn Windows features on or off.
   
5. Then uncheck the option: Windows Sandbox.
   
6. Then restart your computer.
   
7. After restart, please enable it and check if the sandbox is working.
   

Also make sure that you meet all the requirements for Windows Sandbox.

Regards,

 

Windows Sandbox not enble

Windows Sandbox not enble

Windows Sandbox not appear in the start menu. I tried to enable it from "Turn Windows features on or off" but the Windows Sandbox appears in grey there and when I roll over it the message "Virtualization support is disabled in firmware" pop up. Please help
on this issue.

before installing Windows sandbox check to see if virtualization is enable by right clicking over taskbar and going to task manager then click the performance tab go down to Logical Processors under that is Virtualization which should say enabled,

if not enabled virtualization in the bios refer to your computer guide for motherboard make and model,

If Virtualization is enabled in the bios then you have issue with Windows 10 services under Administrative Tools.

follow this below should get you going.

For Windows 10 1903 sandbox wont start errors all you do is just restart the following service under Administrative tools



Container Manager Services.



then reopen sandbox should start up like normal.

If it does not start up do the following below.



If you have Hyper-V installed and Virtual disk is turned on under Administrative tools you must restart all these services

1. Container Manager Services
2. HV Host
3. Virtual Disk
4. Hyper-V Virtual Machine Manager
5. Hyper-V Host Compute Service
6. Network Virtualization Service

Do this in the following order

1. Right click over (Network Virtualization Service) click restart and wait.
2. Right click over (Virtual Disk) click restart and wait.
3. Right click over (Hyper-V Virtual Machine Manager) click restart and wait
4. Right click over (Hyper-V Host Compute Service) click restart and wait
5. Right click over (Container Manager Services) click restart and wait

Check these services are still on

Application Guard Container Service (If installed)

Remote Procedure Call (RDC) (""This must be running as most of the others rely upon its function it should never be disabled"")



Once they are checked start sandbox and it should open up if it does restart your computer to ensure the services are still functional are a restart of computer this should also be done if sandbox does not start up once these services are restarted
and checked.



Created By Eric O'Malley

17th June 2019

follow this guide if the sandbox program wont start or failures to open.

Windows Sandbox failed to start

A Work Around

To get

Windows Sandbox

Working again

Created

By

Eric O’Malley

10/06/2019





Well I work out a solution to get Windows Sandbox going again it’s not the best solution but work around follow the steps below and hope it works for all of you guys.

1. The first thing you have to do is turn off Windows Defender Random Folder Protection
   or the anti virus random folder protection.
   
2. Next turn off Windows defenders Tamper protection Or the Anti-Virus Tamper protection
   
3. Once that turn off Go to Control Panel open it
   
4. Location Administrative Tools
   
5. Next head to Services and open that
   
6. Scroll down to Container Manager Services
   
7. Turn off Container Manager Service only
   
8. Leave service screen open but minimize it
   
9. Next go to control panel location and open File Explorer Options
   
10. In File Explorer Options Untick the following:
    

1. • Don’t Show Hidden Files, Folders, or Drivers
     
   • Hide Empty Drivers
     
   • Hide Extensions Known Files Types
     
   • Hide Merge Conflicts
     
   • Hide Protected Operating Systems Files
     

1. Now move File Explorer Options to one side of your screen
   
2. Go back to Control Panel
   
3. Locate and open Program and Features
   
4. Go to Turn Windows Features on or Off
   open it
   
5. Scroll down to Windows Sandbox
   
6. Untick Windows Sandbox
   
7. Click ok to uninstall Windows Sandbox
   
8. Close off only the screen that removed Windows sandbox
   
9. Next go to your main drive usually C: Drive
   
10. Location ProgramData
    
    • We need to get to this location (C:\programData\Microsoft\Windows\Containters\Sandboxes)
      

1. Even open it or expand ProgramData
   
2. Locate Microsoft open it or expand
   
3. Scroll down to Windows open it or expand
   
4. Now go to the folder called Containers
   open it or expand
   
5. Now you should see Sandboxes
   
   • You Should be at this location Now
     

(C:\programData\Microsoft\Windows\Containters\Sandboxes)

1. Now in that folder Sandbox is folder that looks like this
   

1. • 4040f074-2ff6-471c-9f38-4836db85fff6
     
   • Inside it is sandbox.vhdx
     

1. What we need do is delete all the strange folders keys that’s in
   

(C:\programData\Microsoft\Windows\Containters\Sandboxes)

1. If it does not delete just wait a few seconds and try again
   

Caution do not delete the folders from recycle bin yet

1. Next go to the folder below it called
   Zygotes
   

(C:\programData\Microsoft\Windows\Containters\Zygotes)



Repeat the steps you did at Sandboxes and delete the strange folder keys with its contents but do not delete what’s in recycle bin.

1. Repeat the step you did at Sandboxes and delete the
   strange folder key with its contents
   
2. If it does not delete just wait a few seconds and try again
   
3. Now move the open explorer screen to one side of the screen
   
4. Head back to control panel
   
5. Locate and open Program and Features
   
6. Go to Turn Windows Features on or Off
   open it
   
7. Scroll down to Windows Sandbox
   
8. This time re-tick Windows Sandbox and close and allow it to reinstall the sandbox
   
9. Close only the install screen
   
10. Go back to services and Restart Container Manager Service
    
11. Leave Services screen open move it to once side again.
    
12. We now head to Start then Settings
    
13. Scroll until you find Windows
    Sandbox click it twice.
    
14. Wait and see how the screen opens if it give you another error
    repeat this process
    
15. When you open Windows Sandbox it should
    hang for 5 to 10 minutes without any error message
    
16. What it’s doing is rebuilding its image then it opens back to what it was in default settings.
    
17. Once you have sandbox reopened and its got the icons load close it pressing the
    red X
    
18. Then reopen Windows Sandbox to see if it opens up again.
    
19. If it does you fixed it.
    
20. Now we can turn back on
    
    • Windows Defender Random Folder Protection
      or the anti virus random folder protection
      

1. • Windows defenders Tamper protection Or the Anti-Virus Tamper protection
     

1. Retest Windows sandbox will open again with the above
   turned on
   
2. If it does the next thing is to restart your computer and
   Repeat the opening of Windows sandbox.
   
3. Once all is well your right to continue
   
4. You can delete the folders in your recycle bin too.
   

Created by

Eric O’Malley

10/06/2019