What is Windows Sandbox?
Windows Sandbox is a lightweight, isolated and disposable Windows environment. Software, files and state inside it are discarded when you close the Sandbox.
Learn Windows Sandbox ↗Microsoft documentation ↗Sandbox questions?
Dig in.
Short answers about Windows Sandbox, Build My Sandbox, dependencies, host sharing and the optional fixes.
How do I install Windows Sandbox?
On a supported Windows edition, open Turn Windows features on or off, enable Windows Sandbox and restart if prompted.
Installation guide ↗Why are some tools added automatically?
Some applications need another component to run. Those components are dependencies. CMTrace Open, for example, requires Microsoft Edge WebView2 Runtime, so WebView2 is added automatically rather than being selectable as a normal tool.
Can I access my host Downloads folder?
Yes. Enable Map host Downloads in the advanced sandbox options. Build My Sandbox maps C:\Users\%username%\Downloads into Windows Sandbox. The mapping is read-only by default. You can separately enable writes when you need to copy files back to the host.
Writable mappings expose host files to processes running in the Sandbox, so only enable write access when you need it.
What are the optional fixes?
They are targeted workarounds for problems that can occur in some Windows Sandbox environments. Both are off by default and only run when you explicitly enable them.
DNS recovery
Use this when: the Sandbox has IP connectivity but DNS resolution is broken and downloads fail.
The fix checks whether www.microsoft.com resolves. If DNS is broken, Build My Sandbox first tries the Windows networking PowerShell cmdlets to set 8.8.8.8. If those cmdlets fail, it falls back to netsh, then waits until name resolution works before provisioning continues.
Azure's 168.63.129.16 address is not a general public DNS resolver; it is intended for Azure virtual-network platform services, so Build My Sandbox does not use it here.
App Control performance fix
Use this when: installations inside Windows Sandbox become extremely slow while App Control / Smart App Control is active.
The fix sets VerifiedAndReputablePolicyState to 0 inside the disposable Sandbox and calls CiTool.exe -r to refresh Code Integrity before provisioning applications.
Sandbox only. This deliberately reduces an application-control protection inside the disposable test environment. Do not copy this workaround to normal managed endpoints.
What is the provisioning window?
Generated Sandboxes open a small playful status window while provisioning runs. Each selected tool and optional fix shows Pending, Installing, Ready or Failed, so you can immediately see what is happening.
Does Build My Sandbox upload my configuration?
No. The core builder generates the .WSB, PowerShell and bundle locally in your browser. No account or application backend is required.
What happens if one tool fails?
Provisioning isolates installation steps. A failed item is shown as Failed while the remaining tools continue. You can inspect the generated PowerShell before launch to see exactly what will run.
Can I request another tool?
Yes. Use Request a tool below the Toy Box search field. It opens a GitHub issue form. Requests are reviewed before anything is added to the catalog.
Request a tool ↗