How to configure the Windows Sandbox

Рет қаралды 12,719

Жыл бұрын

Learn how to configure the Windows Sandbox by creating custom configuration files. In this example, I show you how to disable the networking, disable clipboard access, enable folder redirection, as well as running logon scripts within the Sandbox environment.
View the blog post with all the commands and step-by-step instructions here: www.dannymoran.com/windows-sa...
Hi, I’m Danny, a London based IT consultant and sporadic blogger. You can view all my blog posts at: www.dannymoran.com

Пікірлер: 37

@JohnAmerisun 6 ай бұрын

When looking up video's for the sandbox environment, this is exactly what I wanted! To automate installations and do a little more than just the regular video's have been showing so far, thanks for the deeper dive!

@danny_moran 6 ай бұрын

Hope you found it useful! Thanks for watching!

@deemon710 2 ай бұрын

This is great. I was manually setting up a sandbox as my remote work environment every Monday but now I can automate most of it. Thanks! I use this batch file to trigger it from Start > Run using "work start". @echo off REM Check if the first argument is "start" IF "%~1" NEQ "start" ( echo Invalid argument. Expecting "start". Exiting. timeout /t 5 >nul exit /b ) REM Run the sandbox config file start "" "C:\Users\my_user\Scripts\v- Remote Desktop Setup\work-sandbox.wsb"

@danny_moran 2 ай бұрын

Thanks for providing this!

@neccron9956 2 ай бұрын

You have a Typo in your memory example: 4096 should be 4096

@danny_moran Ай бұрын

Thanks for pointing this out! I've just fixed it! Thanks for watching!

@GoodDeal123 Жыл бұрын

Thanks for a great video! You always provide clear instructions, all the relevant files and all of that in a very soothing tone of voice :). Thanks!!

@danny_moran Жыл бұрын

Thanks for watching! Hope you found it useful!

@phobosmoon4643 5 ай бұрын

this is crazy awesome. Hyper-V, windows linux subsystem, and windows sandbox have all blown my socks off from windows 11 (i only had win10 home I was probably really fucking up)

@danny_moran 5 ай бұрын

Thanks for watching!

@RPG_ash Жыл бұрын

Nice, didn't know about this 👍🏻

@danny_moran Жыл бұрын

Thanks for watching!

@MyGees 7 ай бұрын

Thanks Danny, really Appreciate this Tutorial, there one small thing How can I get rid of Internet Explorer on the Sandbox?

@danny_moran 7 ай бұрын

I don't think you can. You might be able to use CMD or PowerShell to remove it but as soon as you quit the sandbox and open a new one, it will be re-added and need to be uninstalled again. Thanks for watching!

@eduardoarg607 9 ай бұрын

Hi there, thank you for this tutorial, it's really useful! I would like to ask you a question: I noticed that when "Protected client" is enabled, you can't copy/paste files or folders from the host to the sandbox anymore, except if you do it from a mapped folder. So, what would be the safest approach? Enabling Protected client and mapping the folder where I have the files that I want to test in the Sandbox (with the "read only" parameter enabled) then opening those files from there in the Sandbox, or disabling Protected client, not mapping any folders and just copying and pasting my files from my host to the Sandbox?

@danny_moran 9 ай бұрын

I think the safest will be to setup a read only mapped folder, as this way the Sandbox environment won't be able to write any data to the host workstation, or contaminate the host workstation clipboard. Thanks for watching!

@eduardoarg607 9 ай бұрын

@@danny_moran that's what I thought too, thank you for your answer! :)

@MaestroDraven 7 ай бұрын

@@danny_moran- Hi Danny, can you give us a scenario where clipboard contamination might occur? From my experience, clipboarding is usually a user-generated thing, but is it possible for, say, an infected file you're trying to test to taint the clipboard somehow? Looking for some theoretical example of how it could happen all on its own, so I can understand if enabling/disabling clipboard is best for me, in particular.

@danny_moran 7 ай бұрын

Applications (and, by extension, viruses) have the ability to read and manipulate the clipboard. This gives it the option to either read potentially confidential information stored on the clipboard or write a dangerous payload to the clipboard in the hopes that it will be executed somehow. How likely is this to actually happen? Probably near a zero chance, but in theory it could happen.

@MaestroDraven 7 ай бұрын

@@danny_moran - Understood, thanks for the clarification.

@HatterTheMadd 9 ай бұрын

How do you enable/allow sandbox to use/have access to a webcam on the host machine? There's a "AllowVideoInput" registry and/or a local group policy, but neither of those worked.

@danny_moran 9 ай бұрын

Try adding the following to the Sandbox wsb config file: enabled I've never tried to use a webcam, however, the docs suggest this should do it: learn.microsoft.com/en-us/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file Thanks for watching!

@skzn2067 Жыл бұрын

Hello! Thanks for the video! I have a question. I have clients on Fiverr and i want to use windows sandbox to ensure that the files i receive are not infected, as there are many scams. Should I copy-paste the file into the sandbox or map a read-only folder? What's the most secure option to prevent malware from reaching my main PC? Also, is there any risk in downloading the file on my main PC and then opening it in the sandbox? Because connecting every time to download a file in the Edge sandbox would be time-consuming x) Thanks a lot, and sorry for my english 😇

@danny_moran Жыл бұрын

In theory, if you download the file on your main computer but not open it/run it, you should be fine. It would be better to download it in the sandbox and then once you've identified it as safe, copy it from the sandbox to your computer. Thanks for watching!

@skzn2067 Жыл бұрын

@@danny_moran Thanks for your answer ! : ) and so if i download on my computer, what is safer copy-paste the file on sandbox or using like you did a mapping folder ?

@danny_moran Жыл бұрын

If you map the drive using read-only permissions, this will be more secure as the sandbox won't be able to write to the host computer.

@skzn2067 Жыл бұрын

@@danny_moran Oh nice ! thanks again !!

@Pootatozz 10 ай бұрын

sir can i run the all wsb at the same time?

@danny_moran 10 ай бұрын

I think you can only run one sandbox instance at once. Thanks for watching!

@savage-qw4gk Жыл бұрын

Can you make a video on how to save sandbox state in windows 11

@danny_moran Жыл бұрын

By design, the Windows Sandbox state cannot be saved. All contents of the Sandbox are designed to destroyed when the session is terminated. If you need state-saving, you should look into virtual machines. Thanks for watching!

@savage-qw4gk Жыл бұрын

@@danny_moran Yes i figured it out now using vm to do testing stuff but windows should provide option to save the state in sandbox

@danny_moran Жыл бұрын

It's not really designed for that type of use. You could always submit a suggestion/idea to Microsoft. Thanks for watching!

@savage-qw4gk Жыл бұрын

@@danny_moran ya i will