Open a second Windows desktop, install something you don't trust on it, poke at it, then close the window. Closing it deletes the apps and files kept inside that temporary desktop.
Windows Sandbox comes with Windows Pro, Enterprise, Education and Pro Education/SE at no extra charge. Home doesn't get it. Microsoft ships it turned off, so you have to tick a box before it shows up in the Start menu.
Switch it on in Windows
Search for Turn Windows features on or off from the taskbar. Tick Windows Sandbox and click OK. Restart your PC if Windows asks.
Your PC needs 4 GB of memory, two processor cores, 1 GB of free disk space and virtualization switched on in your PC's firmware settings, often called BIOS or UEFI. You need Windows 11 or Windows 10 version 1903 or later, on an AMD64 or Arm64 system. Arm64 requires Windows 11 version 22H2 or later.
Virtualization lets Windows run a second system inside your PC. Microsoft recommends 8 GB of memory and a solid-state drive. If the Windows Sandbox check box is missing, check your Windows edition and the hardware requirements.
That enables the feature. On Windows 11 24H2 and later, the first launch may also download an updated Sandbox app from the Microsoft Store.
A full Windows virtual machine needs its own Windows installation. Windows Sandbox reuses many of the Windows files already on your PC. Microsoft puts its base files at about 500 MB, though you need at least 1 GB free to use it. Apps and files you add during a session need space too.
Memory works the same way. When the sandbox loads a core Windows file, it points at the same spot in memory where your real Windows already holds that file instead of loading a second copy. Microsoft calls that direct map. That cuts memory use. Windows Sandbox also uses hardware isolation to separate the temporary desktop from your real Windows.
Microsoft Windows Sandbox architecture, Microsoft Windows Sandbox install steps, Windows Sandbox app updates
Open a link you don't trust
Someone sent you a link you'd rather keep away from your main browser? Start Windows Sandbox from the Start menu. Right-click the link and copy its address without opening it, then paste it into the browser inside the sandbox.
A normal session has internet access. The settings file below turns that off, so use a normal session for websites. Keep browser warnings on and leave any downloads inside the temporary desktop.
Isolation won't protect a password you type into a fake login page. Don't sign in to personal accounts or enter payment details while checking a suspicious link. Sandbox also uses your PC's network connection, so it isn't anonymous browsing or a guarantee that a site is harmless.
Windows Sandbox FAQ, Sandbox networking settings, How phishing steals personal information
Open downloads with networking off
Out of the box the sandbox has internet access and shares your clipboard with your real desktop. Your local folders aren't automatically shared, but files you copy through the clipboard can reach the sandbox.
You can build a settings file aimed at a specific job by writing a few lines in Notepad and saving the file with .wsb at the end. Double-click it and the sandbox starts with your settings already applied.
The example below adapts Microsoft's download-testing settings. It turns networking off and opens the C:\Users\Public\Downloads folder from your PC. Apps inside can read that folder but can't change its files. Create that folder on your PC if it doesn't exist, then put the file you want to test in it.
Save the code below in Notepad as techwalrus.wsb, choosing All files so it doesn't get a .txt ending. Double-click the saved file to open your offline test desktop. The shared Downloads folder stays on your real PC after you close the sandbox.
<Configuration>
<Networking>Disable</Networking>
<VGpu>Disable</VGpu>
<ClipboardRedirection>Disable</ClipboardRedirection>
<MappedFolders>
<MappedFolder>
<HostFolder>C:\Users\Public\Downloads</HostFolder>
<SandboxFolder>C:\temp\Downloads</SandboxFolder>
<ReadOnly>true</ReadOnly>
</MappedFolder>
</MappedFolders>
<LogonCommand>
<Command>explorer.exe C:\temp\Downloads</Command>
</LogonCommand>
</Configuration>Shared access deserves care. Networking is on unless you turn it off, and an untrusted app with a live connection can reach the rest of your home or office network. An app can read files in any folder you share. Giving that folder write access also lets the app change your real files, and closing the sandbox won't undo those changes.
This example also switches off clipboard sharing and access to your graphics card. Put the test files in the shared Downloads folder, since copying and pasting files into this session is disabled. Turning off graphics sharing may reduce performance in apps that need it.
Microsoft .wsb configuration reference, Microsoft sample .wsb files
Close it to start fresh
In a normal session, copy any files you intend to keep to your real desktop before closing. The offline example above blocks clipboard transfers and writes to the shared folder, so it has no configured way to export new files. You can try an app without having to uninstall it afterward, then close the window and start clean tomorrow. You don't need a settings file for a normal session. The file above is for applying your own settings each time.
The animation below illustrates two downloads and a note kept inside the temporary desktop, with no shared folder. Closing the window brings up a warning. After you click OK, that session's files and apps are discarded.
Two gaps are worth knowing before you lean on it. Microsoft currently allows one sandbox at a time, so you can't compare two test desktops side by side. Microsoft's install guide also lists Notepad, Calculator, Photos and Terminal as unavailable inside the sandbox starting with Windows 11 24H2. It says support will return. Check which apps you need before using it for a test.
