Windows Sandbox: Run EXE Files Safely on Windows 10

Updated 7 November 2026 · Standard formula, shown below

Yes, Windows Sandbox is a simple and effective solution to run untrusted EXE files on Windows 10, provided you have the right edition (Pro or Enterprise) and hardware. It creates a temporary, isolated desktop environment where you can open any executable without risking your main system. This article explains how it works, how to enable it, and what its limitations are.

What Is Windows Sandbox?

Windows Sandbox is a built-in Microsoft feature that launches a lightweight virtual machine using the same kernel as your host system. It gives you a clean, disposable Windows desktop that starts in a few seconds, uses very little disk space, and is completely wiped when you close it. Unlike a traditional VM, it does not require a separate operating system license or a hypervisor setup—everything is handled by Windows itself.

The key point is that any software you run inside the sandbox is isolated from your real files, registry, and network settings (unless you explicitly enable networking). When you close the sandbox, all changes—files you downloaded, programs you installed, malware that executed—are permanently deleted. This makes it ideal for testing suspicious EXE files, opening email attachments you are unsure about, or trying out software you do not fully trust.

How Windows Sandbox Works

Windows Sandbox uses a technology called nested virtualization and a smart memory management system. It creates a minimal, read-only copy of Windows that shares the host’s kernel. This is why it starts so quickly (often under 10 seconds) and uses only about 100 MB of disk space initially. The sandbox runs in a separate memory space, and any writes to the virtual disk are stored in a temporary file that is discarded on exit.

Because it is a full Windows environment, you can copy and paste files between your host and the sandbox, run installers, and even use the command prompt. However, by default, the sandbox has no network access. You can enable networking via a configuration file, but doing so reduces isolation because the sandbox can then communicate with the internet (and potentially spread malware). For maximum safety, keep networking off when testing unknown EXE files.

How to Enable Windows Sandbox

Windows Sandbox is not enabled by default. You must turn it on manually. Here are the exact steps:

Press Windows Key + R, type optionalfeatures, and press Enter.
In the Windows Features dialog, scroll down and check the box next to Windows Sandbox.
Click OK and restart your computer when prompted.
After reboot, click the Start button, type “Windows Sandbox,” and open the app.

If you do not see the option, your Windows edition is not Pro or Enterprise. Windows 10 Home does not include Windows Sandbox. Also, your CPU must support virtualization (VT-x or AMD-V) and have it enabled in the BIOS/UEFI. You can check by opening Task Manager > Performance > CPU and looking at the “Virtualization” line.

What to Do If Windows Sandbox Won’t Start

If you enable the feature but the sandbox fails to launch, the most common causes are:

Virtualization disabled in BIOS. Restart, enter BIOS (usually by pressing Del or F2 during boot), find the virtualization setting (often called Intel VT-x or AMD SVM), enable it, and save.
Hyper-V is not installed. Windows Sandbox depends on Hyper-V. Go to optionalfeatures again and ensure “Hyper-V” and “Windows Hypervisor Platform” are also checked.
Insufficient RAM. The sandbox needs at least 4 GB of free RAM. If your system has less, it will not start.
Conflicting third-party virtualization software. Some older versions of VirtualBox or VMware can interfere. Temporarily uninstall them or disable their hypervisor drivers.

If none of these work, check the Windows Event Viewer for errors under “Microsoft-Windows-Sandbox” and search the exact error code online.

How to Run an EXE Inside the Sandbox

Once the sandbox is open, you have two ways to get an EXE file into it:

Copy and paste: Right-click the EXE on your host, select Copy, then inside the sandbox right-click and paste. The file appears inside the virtual desktop.
Drag and drop: Drag the file from your host window into the sandbox window. This works for single files, but not for folders.

After the file is inside, double-click it to run it. You can also install it if it is an installer. Watch the behavior—if it tries to access the network (you will see a prompt if networking is off), or if it modifies system files, you can simply close the sandbox and all traces vanish. To close, click the X button on the sandbox window and confirm that you want to discard the session.

Common Misconceptions and Limitations

Windows Sandbox is powerful, but it is not a magic bullet. Here are important facts to keep in mind:

It does not protect against all malware. Some advanced malware can detect that it is running inside a sandbox and refuse to execute, or it can exploit a vulnerability in the hypervisor itself (though rare). For high-value targets, use a dedicated VM with snapshots.
Network is off by default. This is good for safety, but it means you cannot download files directly inside the sandbox unless you enable networking via a .wsb configuration file.
It is not a replacement for antivirus. The sandbox isolates execution, but it does not scan files. Always use a reputable antivirus as your first line of defense.
Performance is limited. The sandbox uses your host’s CPU and RAM, but graphics and heavy applications may run slower. It is not meant for gaming or video editing.
You cannot save files from the sandbox. Anything you create inside is lost when you close it. If you need to keep a result, copy it back to the host before closing.

Alternatives to Windows Sandbox

If you do not have Windows 10 Pro/Enterprise, or if you need more control, consider these alternatives:

Third-party sandboxing software: Tools like Sandboxie allow you to run programs in an isolated environment on Windows 10 Home. They are generally free for personal use and offer more granular control over file and registry access.
Virtual machines: Oracle VirtualBox or VMware Workstation Player (both free for personal use) let you create a full virtual PC. They take longer to set up and use more disk space, but they offer snapshots and network control, making them better for testing complex malware.
Windows Defender Application Guard: This is built into Windows 10 Pro and uses a similar isolation technique, but it is designed for browsing untrusted websites, not for running EXE files.
Built-in “Run as different user” or “AppLocker”: These are not true sandboxes; they restrict privileges but do not isolate the system from malicious code.

Frequently Asked Questions

Is Windows Sandbox available on Windows 10 Home?

No, Windows Sandbox is only available on Windows 10 Pro, Enterprise, and Education editions. Home users can use third-party tools like Sandboxie or a free VM instead.

Does Windows Sandbox protect against ransomware?

Yes, for the most part. If you open a ransomware EXE inside the sandbox, it will only encrypt files within the virtual disk, which is discarded on exit. Your real files remain untouched. However, if the ransomware can detect the sandbox and wait for you to copy files in, it might attempt to encrypt them when you later open them on your host—so always scan files with antivirus before moving them out.

Can I run 64-bit and 32-bit EXE files in the sandbox?

Yes, the sandbox runs a full copy of your Windows architecture. If your host is 64-bit, the sandbox is 64-bit and can run both 32-bit and 64-bit applications.

How much disk space does Windows Sandbox use?

The initial virtual disk is about 100 MB, but it can grow as you install software inside. However, because it is discarded on exit, the disk space is freed immediately after you close the sandbox.

Can I enable networking in Windows Sandbox?

Yes, you can create a .wsb configuration file with the line <Networking>Enable</Networking> and run that file to launch the sandbox with network access. This is useful for downloading files inside the sandbox, but it increases the risk of malware spreading to your network.

Does Windows Sandbox work on Windows 11?

Yes, Windows Sandbox is also available on Windows 11 Pro and Enterprise editions, with the same requirements and limitations.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.