Wednesday, January 26, 2022

Sandbox: Multiverse of Madness

Must read

Rudy Ooms
Rudy is a Modern workplace architect and currently working for a company in the Netherlands, called Deltacom Steenbergen. He has been working in IT since he was 16 years old. Within these years, he gained a lot of experience in different kinds of expertise. I guess like most of you, he started working with active directory environments. In June 2021 he received the MVP status in the category Enterprise Mobility for the first time. The multi-tenant PowerShell scripted Deltacom-Cloud environment is one of his creations.

After seeing Damien van Robaeys doing some awesome stuff with Windows Sandbox, I noticed I didn’t write anything about Windows Sandbox…. Even while I was using it for a while now. So, I decided to do a blog about it.

I will divide this blog into multiple parts:

1.Information about sandbox
2.Installation of sandbox
3.How to configure Sandbox?
4.Adding files to the sandbox Baseline
5.Improving the use of sandbox
6.What you thought wasn’t working with sandbox?

Windows Sandbox provides a lightweight desktop environment to safely run applications in a nice protected and isolated environment. You can run sandbox on Windows 10 pro/enterprise or education. Software installed inside the Windows Sandbox environment remains “sandboxed” and runs separately and isolated from the host machine.

The sandbox instance is a dynamically generated image that uses the files from the host filesystem itself. Most OS files are immutable and can be freely shared with Windows Sandbox.

More on this (Reparse points) later.

Sandbox doesn’t have persistent storage, so running Windows Sandbox is temporary. When it’s closed, all the software and files and the config is deleted. You get a brand-new sandbox instance every time you open it. But I guess that one is obvious when looking at this warning when closing Sandbox

Afbeelding met tekst

Automatisch gegenereerde beschrijving

When taking a good look at Windows Sandbox you could say it looks much like Application Guard for Office apps. WDAG also launches an Office instance in an isolated environment. And like I told in this blog about Credential Guard: “Virtualization is just like segmentation”

Now we know, Sandbox is almost the same as Windows Defender Application Guard, let’s look at what 3 components it uses to deliver us this fantastic product




You could see it for yourself by opening the task manager and take a look at all the running processes.

And by opening “services.msc” You could take a guess where CMService stands for. If that service isn’t running, Sandbox will not work!

Okay, now we are pretty sure it’s “just” a Virtual Machine, there should be a virtual hard disk somewhere with it. And yes there is, open explorer and browse to:


You will notice when you are not running Sandbox only one folder exists and when starting sandbox it will create a second one

Afbeelding met tekst

Automatisch gegenereerde beschrijving

Let’s try to open/mount the huge 4 MB VHDX to take a look at what’s inside.

Did you notice the nice grey crosses and the attributes?

Afbeelding met tekst

Automatisch gegenereerde beschrijving

These grey crosses are telling us these folders are Reparse Points. A reparse point is best explained as a symbolic link/windows shortcut. It will make sure these folders are linked to the host itself. I guess that’s why the image isn’t that big.

Please note software and applications installed on the host aren’t directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. More on this on what I am missing in Windows Sandbox and how to improve Sandbox…

It’s very nice to know some background information but we still need to test it. Let’s start the installation of Sandbox.

You can open Powershell and run this command to Install Sandbox

Get-WindowsOptionalFeature -online -FeatureName Containers-DisposableClientVM

Or if you prefer the GUI option:

Afbeelding met tekst

Automatisch gegenereerde beschrijving

Of course, when you want to run sandbox inside a VM (just like me) you need to make sure hyper-v nesting is enabled

Set-VMProcessor -VMName <VMName> -ExposeVirtualizationExtensions $true

Now we know it’s very easy to install Sandbox we need to know some background information to understand how to configure sandbox. When launching sandbox without any modifications, it will spin up a default image.

However, many times you want to redirect some folders or make sure a startup script is launched when launching sandbox. When you want to make use of some additional folders and installation media, you can use config files that allow you to customize the sandbox during startup.

The sandbox configuration files are formatted as XML and use the .wsb file extension. Of course, you can specify multiple different settings to configure the Windows Sandbox.

I guess this picture explains it all!

Sandbox Config File

So you can configure all options you want in a WSB config file and just double-click on it to start Windows Sandbox with all your defined settings.

Let’s look at this XML file example and how to configure it

   <Command>explorer.exe C:usersWDAGUtilityAccountDesktopdesktop</Command>

I will point out the 2 most important options you can configure:

Shared Folders – This will share a folder from the host with the guest and you can specify if it has read or write permissions.

Startup Script – This script/command will be launched when a sandbox instance spins up

Let’s explain what happens when we launch sandbox with the XML configuration, I showed you above:

My desktop folder sandbox from my host machine (C:UsersrudyoomsDesktopsandbox) will be read-only redirected/mapped to the wdagutilityaccount desktop folder (C:UsersWDAGUtilityAccountDesktopDesktop) of the sandbox guest instance.

When specifying the command “explorer.exe C:usersWDAGUtilityAccountDesktopDesktop” it will open explorer in the desktop folder.

As you know by now, when you launch sandbox, a new clean instance will be started. If we don’t want to use the “shared folder” option, how are we going to add some files to the baseline? There is always another way.

It will only take 5 little steps

1.We need to stop the CMservice I showed you earlier.

2. Open/mount the baselayer.vhdx inside the C:ProgramDataMicrosoftWindowsContainersBaseImagesguid folder

Afbeelding met tafel

Automatisch gegenereerde beschrijving

3.Add files to a specific existing folder

Afbeelding met tekst

Automatisch gegenereerde beschrijving

4. Make sure when you have copied all the files needed, you unmount the baselayer.vhdx

5.Start the Cmservice and open a sandbox instance and you will notice the files you added are persistent available in the container

As told at the beginning of this blog, I love the possibility of testing an Intunewin file in Windows Sandbox. There could only be one person who created this beautiful tool: Damien!

Download and install it now!

RunInSandbox: Run PS1, VBS, EXE, MSI, intunewin, extract ZIP, share folder directly in Windows Sandbox from a right-click | Syst & Deploy (

The only thing you will need to do after the installation is right-clicking on the file and click on test the intunewin in sandbox and put in the install command.

Afbeelding met tekst

Automatisch gegenereerde beschrijving

It will launch a sandbox instance and it will try to install the package. If it’s not working and you need to start troubleshooting why… just open Powershell as admin and browse to the “run_in_sandbox” desktop folder. You will notice the Intunewin_install script.

Afbeelding met tafel

Automatisch gegenereerde beschrijving

When running this script, it will extract the intunewin file to the c:windowstempintunewin folder and from there you could continue to troubleshoot the installation even further!

I love this tool.

In my opinion not that much, except for one very important Windows Feature! And that one important could be Dot.Net Framework 3.5.

Afbeelding met tekst

Automatisch gegenereerde beschrijving

Or run PowerShell to detect which Dot.Net framework versions are installed.

Get-ChildItem ‘HKLM:SOFTWAREMicrosoftNET Framework SetupNDP’ -recurse |

Get-ItemProperty -name Version,Release -EA 0 |

Where { $_.PSChildName -match ‘^(?!S)p{L}’} |

Select PSChildName, Version, Release

You could ask why I want/need to have framework 3.5 inside my sandbox? There could be only one reason, you would think of PSADT!

So why not installing Dot.Net manually? You will need to make sure you have enabled the trusted installer when you are installing additional features. You could try it for your own (even when I can tell you it’s not going to work)

Set-Service -Name "Trustedinstaller" -Status running -StartupType automatic
md c:install
$download_url = ""
$local_download_url = "c:installdot35.exe"

$wc = New-Object net.webclient
$wc.Downloadfile($download_url, $local_download_url)
c:installdot35.exe /q /norestart

Or use the DISM tool, but both will fail:

Afbeelding met tekst

Automatisch gegenereerde beschrijving

And here is why…. C:windows may not point to a valid Windows folder…

But luckily!!, it’s a good thing when you don’t move or rename the deploy-application.exe, you don’t need to have 3.5 installed!

If you choose to rename or move it, it will prompt you for the requirement. To resume, you could still test win32 applications which are deployed with PSADT. But of course, when you are testing win32 applications with a 3.5 requirement like for example Snelstart, they will give you some framework errors!

Afbeelding met tekst

Automatisch gegenereerde beschrijving

When you are deploying Win32 Apps daily you will know by now what can go wrong but if things go south you will need to know why. Sandbox is the way to go to test the deployment and installation of your win32 packages even when 3.5 is missing

I guess I am going to tell you it once again: Damien his solution is a great addon when using sandbox!

Doctor Strange GIFs | Tenor

More articles

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Latest articles