Install Windows 10 or 11 Sandbox

3. Processes used by Windows Sandbox

When Windows Sandbox is open, you will see the "Windows Sandbox" background processes appear in the task manager.

If you go a little further down, you will also find the "Vmmem.exe" process which tends to be resource intensive.
Indeed, it's the instance of the virtual desktop on Windows 10 or 11 Enterprise.

When the Windows Sandbox is open, this is what the task manager looks like on our physical computer.

And here's what happens when it's closed.

However, be aware that the system resources (CPU / RAM) are shared between the Windows 10 and 11 installed on your physical computer and the one running in the virtual desktop (Windows Sandbox).

4. Configure Windows Sandbox

From build 18342 (which corresponds to version 19H1 or 1903) of Windows 10, you can configure the Sandbox using a script with the ".wsb" extension.

Thanks to this configuration file, you will be able to :

• enable or disable the use of a virtualized GPU (graphics card)
• configure networking for sandbox
• map folders from the physical computer to the sandbox. This makes it easier to copy files between the physical computer and the sandbox, but it can also allow viruses to get to your physical computer if you run malware into the sandbox.
• automatically run a command when Windows sandbox starts
• configure the microphone input and the use of the webcam (camera) from the Windows sandbox
• configure security settings for the RDP session in the Windows sandbox
• share your physical computer's printers in the Windows sandbox
• enable clipboard redirection to be able to copy text or files between the physical computer and the sandbox without the physical computer files being easily visible from the Windows sandbox
• configure the amount of memory (in MB) you want to allocate to the Windows sandbox

On the Microsoft site, you will find a script to access the "Public Downloads" folder of your physical computer from the Windows 10 or 11 installed in the Windows sandbox.

Here are some explanations :

• HostFolder : indicates that the "C:\Users\Public\Downloads" folder will be accessible from the Windows sandbox
• SandboxFolder : in the sandbox, the contents of the above folder will be accessible at the location "C:\Users\WDAGUtilityAccount\Downloads".
  WDAGUtilityAccount being the name of the default user in the Windows sandbox.
  This means that you will find the contents of the "Public Downloads" folder in the "Downloads" folder of the current logged in user in the Windows sandbox.
• Readonly : indicates that the folder shared from your physical computer will only be accessible as read-only. This will prevent viruses launched in the Windows sandbox from infecting your physical computer.
• LogonCommand : the "explorer.exe ..." command will be executed when launching the Windows sandbox and in this case will display the contents of the "Downloads" folder of the default Windows sandbox user.

XML

<Configuration>
  <VGpu>Disable</VGpu>
  <Networking>Disable</Networking>
  <MappedFolders>
    <MappedFolder>
      <HostFolder>C:\Users\Public\Downloads</HostFolder>
      <SandboxFolder>C:\Users\WDAGUtilityAccount\Downloads</SandboxFolder>
      <ReadOnly>true</ReadOnly>
    </MappedFolder>
  </MappedFolders>
  <LogonCommand>
    <Command>explorer.exe C:\users\WDAGUtilityAccount\Downloads</Command>
  </LogonCommand>
</Configuration>

Paste this script in Notepad (for example).

Then, click on : File -> Save As.

Specify "Downloads.wsb" (for example, while the extension is ".wsb"), select "Save as type: All files (*.*)" and click : Save.

In the "Public Downloads" folder of our physical computer, we have created a "test file.txt" file.

As you can see, scripts with the ".wsb" extension are recognized automatically by the Windows Sandbox and therefore have a blue and white icon as below.
Double click on it to launch the sandbox with this configuration file.

Once the sandbox is open, you will see that the file explorer will automatically open in the Windows sandbox and that its contents will be that of the "Public Downloads" folder of the physical computer.

For the "WDAGUtilityAccount" user, you can easily see that this is the user you are automatically logged in as in the Windows sandbox.

5. How does Windows 10 or 11 Sandbox work ?

5.1. Windows Sandbox image based on the copy of Windows already installed

Unlike a typical virtual machine, the sandbox doesn't use a separate disk image (virtual hard disk), but is based on the image of Windows installed on your computer.

Indeed, as Microsoft indicates in its official documentation, some Windows files are immutable (= don't change) and can therefore be shared with the Windows Sandbox.
This immutable part of Windows is shown in green in the image below.

For the other part, shown in yellow on the image below, it's the mutable part (= which changes). For these mutable files, Windows therefore has a copy of these files to be able to use them in this Windows Sandbox.
This part of Windows weighs 30 MB in compressed version on your computer and weighs 500 MB once it's unzipped (when you install Windows Sandbox on your computer on Windows 10 or 11).

This greatly reduces the disk space required to store the sandbox on your computer and eliminates the need to download a complete copy of Windows, as would be the case with a classic virtual machine.

5.2. RAM management

Unlike a virtualization solution where you often allocate a fixed amount of RAM, you don't need to manage the RAM allocation for it as the resources are shared transparently between the host and the Windows sandbox.
This is due in part to the fact that the sandbox functions as a container and not as a virtual machine that would be completely independent of the host system.

This technique also reduces the amount of RAM required to run the Windows Sandbox since only the required amount of RAM will be used when needed. (See diagram on the left.)
Unlike a virtual machine to which we should allocate 4GB of RAM all the time (for example). (See diagram on the right).

5.3. RAM sharing

Without going into too much detail, the data (processes, currently open documents, ...) temporarily stored in the random access memory (RAM) of your computer are stored in what are called pages (which you can compare to boxes if you wish it).

Since the RAM of a virtual machine is isolated from the physical computer (host), if you open the same file in the host computer and in the virtual machine, this file will be stored in 2 different places of the RAM (as you can see on the left side of the diagram below).

Regarding this new Windows sandbox, since random access memory (RAM) is shared between the host computer and the sandbox, a single file opened on the host computer and in the sandbox will take a only once the place in random access memory (RAM).
In other words, the page in RAM that this file is in will be shared between the host computer and the Windows sandbox.
This reduces the amount of RAM required to run the Windows sandbox at the same time as the host computer.

5.4. Planning for virtual processors

With a virtual machine, the Windows hypervisor manages the scheduling of the virtual processors for that virtual machine.
For the Windows sandbox, a technology called "Integrated Scheduling" allows the host to decide when the sandbox will get its CPU cycles.

This makes it possible to manage the virtual processors as host threads and thus to better manage the priority of the different processes (whether they are running on the host computer or in the Windows sandbox).

5.5. Graphics card virtualization (WDDM)

Thanks to its partners, Microsoft can integrate modern graphics virtualization features into Microsoft DirectX and WDDM (Windows Display Driver Model).
This allows you to get a smooth user experience and launch graphics-intensive applications smoothly.

For this to work correctly, your graphics and graphics driver must be compatible with WDDM 2.5 or later.
Otherwise, the sandbox will use Windows Advanced Rasterization Platform (WARP).

5.6. Partage des infos de batterie

Thanks to the different operation of this sandbox, it's also able to know the battery status of your laptop PC (if applicable) and it can therefore adapt accordingly to reduce its energy consumption.
This improves the battery life of your laptop PC.

For more information on how this Windows sandbox works, see the "Windows Sandbox architecture | Microsoft Docs" page.