diff --git a/.openpublishing.redirection.windows-security.json b/.openpublishing.redirection.windows-security.json index 04839ec4dda..52233f5ad09 100644 --- a/.openpublishing.redirection.windows-security.json +++ b/.openpublishing.redirection.windows-security.json @@ -5,6 +5,11 @@ "redirect_url": "/windows/security/hardware-security/kernel-dma-protection-for-thunderbolt", "redirect_document_id": false }, + { + "source_path": "windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md", + "redirect_url": "/windows/security/application-security/application-isolation/windows-sandbox/index", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md", "redirect_url": "/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity", diff --git a/windows/security/application-security/application-isolation/toc.yml b/windows/security/application-security/application-isolation/toc.yml index c8ed9511350..c2de68aab37 100644 --- a/windows/security/application-security/application-isolation/toc.yml +++ b/windows/security/application-security/application-isolation/toc.yml @@ -1,20 +1,16 @@ items: - name: Microsoft Defender Application Guard (MDAG) href: microsoft-defender-application-guard/md-app-guard-overview.md -- name: MDAG for Edge standalone mode - href: microsoft-defender-application-guard/md-app-guard-overview.md -- name: MDAG for Edge enterprise mode and enterprise management 🔗 - href: /deployedge/microsoft-edge-security-windows-defender-application-guard -- name: MDAG for Microsoft Office - href: https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46 -- name: MDAG configure via MDM 🔗 - href: /windows/client-management/mdm/windowsdefenderapplicationguard-csp + items: + - name: MDAG for Microsoft Edge standalone mode + href: microsoft-defender-application-guard/md-app-guard-overview.md + - name: MDAG for Microsoft Edge enterprise mode and enterprise management 🔗 + href: /deployedge/microsoft-edge-security-windows-defender-application-guard + - name: MDAG for Microsoft Office + href: https://support.microsoft.com/office/application-guard-for-office-9e0fb9c2-ffad-43bf-8ba3-78f785fdba46 + - name: Configure MDAG via MDM 🔗 + href: /windows/client-management/mdm/windowsdefenderapplicationguard-csp - name: App containers 🔗 href: /virtualization/windowscontainers/about - name: Windows Sandbox - href: windows-sandbox/windows-sandbox-overview.md - items: - - name: Windows Sandbox architecture - href: windows-sandbox/windows-sandbox-architecture.md - - name: Windows Sandbox configuration - href: windows-sandbox/windows-sandbox-configure-using-wsb-file.md + href: windows-sandbox/index.md \ No newline at end of file diff --git a/windows/security/application-security/application-isolation/windows-sandbox/index.md b/windows/security/application-security/application-isolation/windows-sandbox/index.md new file mode 100644 index 00000000000..90957adc4bb --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/index.md @@ -0,0 +1,43 @@ +--- +title: Windows Sandbox +description: Windows Sandbox overview +ms.topic: overview +ms.date: 09/09/2024 +--- + +# Windows Sandbox + +Windows Sandbox (WSB) offers a lightweight, isolated desktop environment for safely running applications. It's ideal for testing, debugging, exploring unknown files, and experimenting with tools. Applications installed within the sandbox remain isolated from the host machine using hypervisor-based virtualization. As a disposable virtual machine (VM), Windows Sandbox ensures reboot persistence, quick launch times, and a lower memory footprint compared to full VMs. Its one-click setup simplifies the user experience. + +The sandbox is temporary; closing it deletes all software, files, and state. Each launch provides a fresh instance. Host-installed software isn't available in the sandbox. Applications needed within the sandbox must be installed there explicitly. + +> [!NOTE] +> Starting with Windows 11, version 22H2, data persists through restarts initiated within the sandbox, useful for applications requiring a reboot. + +Windows Sandbox offers the following features: + +- **Part of Windows**: Everything required for this feature is included in the supported Windows editions like Pro, Enterprise, and Education. There's no need to maintain a separate VM installation. +- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. +- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. +- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. +- **Efficient**: Takes a few seconds to launch, supports virtual GPU, and has smart memory management that optimizes memory footprint. + +> [!IMPORTANT] +> Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](windows-sandbox-configure-using-wsb-file.md#networking). Enabling networking can expose untrusted applications to the internal network. + +WSB can be used without any technical skills in various scenarios where users need a secure, clean environment for testing or running potentially harmful software. Here are some ways in which you can use WSB: + +- **Clean environment for software testing**: Test or debug your applications in WSB's clean environment to identify and resolve bugs or compatibility issues. +- **Secure web browsing**: Use WSB for secure web browsing, especially when accessing unfamiliar or potentially dangerous websites without putting your system at risk of malware infection. +- **Running Untrusted Applications**: Mitigate security risks by opening untrusted applications or files, such as email attachments in WSB. Improve your safety and security by opening a sandbox with networking disabled and mapping the folder with the application or file you want to open to the sandbox in read-only mode. Check [Sample configuration files](windows-sandbox-sample-configuration.md) for more details. +- **Testing or demoing new software for the first time**: Test drive or demo new software, preview versions, extensions, or add-ons without the hassle of installing and then uninstalling on your host machine. +- **Maintaining multiple dev environments**: Streamline your development process by utilizing WSB to maintain multiple sandboxes for different development environments. For example, maintain a sandbox for each python version and its dependencies! + +> [!NOTE] +> Windows Sandbox currently doesn't allow multiple instances to run simultaneously. + + +[!INCLUDE [windows-sandbox](../../../../../includes/licensing/windows-sandbox.md)] + +> [!NOTE] +> Windows Sandbox is currently not supported on Windows Home edition. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/toc.yml b/windows/security/application-security/application-isolation/windows-sandbox/toc.yml new file mode 100644 index 00000000000..9654e55dcd5 --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/toc.yml @@ -0,0 +1,26 @@ +items: +- name: Windows Sandbox + href: index.md +- name: Overview + expanded: true + items: + - name: Windows Sandbox versions + href: windows-sandbox-versions.md + - name: Architecture + href: windows-sandbox-architecture.md +- name: Install Windows Sandbox + href: windows-sandbox-install.md +- name: Use & configure Windows Sandbox + href: windows-sandbox-configure-using-wsb-file.md +- name: Windows Sandbox command line interface + href: windows-sandbox-cli.md +- name: Tutorials + items: + - name: Sample configuration files + href: windows-sandbox-sample-configuration.md +- name: WindowsSandbox Policy CSP 🔗 + href: /windows/client-management/mdm/policy-csp-windowssandbox +- name: Frequently asked questions + href: windows-sandbox-faq.yml +- name: Troubleshooting + href: windows-sandbox-troubleshoot.md \ No newline at end of file diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md index 0da205053ae..fcb9b56ddcd 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-architecture.md @@ -2,7 +2,7 @@ title: Windows Sandbox architecture description: Windows Sandbox architecture ms.topic: conceptual -ms.date: 03/26/2024 +ms.date: 09/09/2024 --- # Windows Sandbox architecture @@ -27,18 +27,10 @@ Traditional VMs apportion statically sized allocations of host memory. When reso ## Memory sharing -Because Windows Sandbox runs the same operating system image as the host, it's enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when *ntdll.dll* is loaded into memory in the sandbox, it uses the same physical pages as those pages of the binary when loaded on the host. Memory sharing between the host and the sandbox results in a smaller memory footprint when compared to traditional VMs, without compromising valuable host secrets. +Because Windows Sandbox runs the same operating system image as the host, it's enhanced to use the same physical memory pages as the host for operating system binaries via a technology referred to as "direct map." For example, when `ntdll.dll` is loaded into memory in the sandbox, it uses the same physical pages as those pages of the binary when loaded on the host. Memory sharing between the host and the sandbox results in a smaller memory footprint when compared to traditional VMs, without compromising valuable host secrets. ![A chart compares the memory footprint in Windows Sandbox versus a traditional VM.](images/3-memory-sharing.png) -## Integrated kernel scheduler - -With ordinary virtual machines, the Microsoft hypervisor controls the scheduling of the virtual processors running in the VMs. Windows Sandbox uses a new technology called "integrated scheduling," which allows the host scheduler to decide when the sandbox gets CPU cycles. - -![A chart compares the scheduling in Windows Sandbox versus a traditional VM.](images/4-integrated-kernal.png) - -Windows Sandbox employs a unique policy that allows the virtual processors of the Sandbox to be scheduled like host threads. Under this scheme, high-priority tasks on the host can preempt less important work in the Sandbox. This preemption means that the most important work is prioritized, whether it's on the host or in the container. - ## WDDM GPU virtualization Hardware accelerated rendering is key to a smooth and responsive user experience, especially for graphics-intensive use cases. Microsoft works with its graphics ecosystem partners to integrate modern graphics virtualization capabilities directly into DirectX and Windows Display Driver Model (WDDM), the driver model used by Windows. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli.md new file mode 100644 index 00000000000..c181a80a915 --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-cli.md @@ -0,0 +1,101 @@ +--- +title: Windows Sandbox command line +description: Windows Sandbox command line interface +ms.topic: how-to +ms.date: 10/22/2024 +--- + +# Windows Sandbox command line interface + +Starting with Windows 11, version 24H2, the Windows Command Line Interface (CLI) offers powerful tools for creating, managing, and controlling sandboxes, executing commands, and sharing folders within sandbox sessions. This functionality is especially valuable for scripting, task automation, and improving development workflows. In this section, you'll explore how the Windows Sandbox CLI operates, with examples demonstrating how to use each command to enhance your development process. + +**Common parameters**: + +- `--raw`: Formats all outputs in JSON format. +- `-?, -h, --help`: Show help and usage information + +## Start + +The start command creates and launches a new sandbox. The command returns the sandbox ID, which is a unique identifier for the sandbox. The sandbox ID can be used to refer to the sandbox in other commands. + +- `--id `: ID of the Windows Sandbox environment. +- `--c, --config `: Formatted string with the settings that should be used to create the Windows Sandbox environment. + +**Examples**: + +- Create a Windows Sandbox environment with the default settings: + + ```cmd + wsb start + ``` + +- Create a Windows Sandbox environment with a custom configuration: + + ```cmd + wsb start --config "Disabled" + ``` + +## List + +The list command displays a table that shows the information the running Windows Sandbox sessions for the current user. The table includes the sandbox ID. The status can be either running or stopped. The uptime is the duration that the sandbox has been running. + +```cmd +wsb list +``` + +## Exec + +The exec command executes a command in the sandbox. The command takes two arguments: the sandbox ID and the command to execute. The command can be either a built-in command or an executable file. The exec command runs the command in the sandbox and returns the exit code. The exec command can also take optional arguments that are passed to the process started in the sandbox. + +> [!NOTE] +> Currently, there is no support for process I/O meaning that there is no way to retrieve the output of a command run in Sandbox. + +An active user session is required to execute a command in the context of the currently logged on user. Therefore, before running this command a remote desktop connection should be established. This can be done using the [connect](#connect) command. + +- `--id ` (REQUIRED): ID of the Windows Sandbox environment. +- `-c, --command ` (REQUIRED): The command to execute within Windows Sandbox. +- `-r, --run-as ` (REQUIRED): Specifies the user context to execute the command within. If the System option is selected, the command runs in the system context. If the ExistingLogin option is selected, the command runs in the currently active user session or fails if there's no active user session. +- `-d, --working-directory `: Directory to execute command in. + +```cmd +wsb exec –-id 12345678-1234-1234-1234-1234567890AB -c app.exe -r System +``` + +## Stop + +The stop command stops a running Windows Sandbox session. The command takes the sandbox ID as an argument. + +The stop command terminates the sandbox process and releases the resources allocated to the sandbox. The stop command also closes the window that shows the sandbox desktop. + +```cmd +wsb stop --id 12345678-1234-1234-1234-1234567890AB +``` + +## Share + +The share command shares a host folder with the sandbox. The command takes three arguments: the sandbox ID, the host path, and the sandbox path. The host path should be a folder. The sandbox path can be either an existing or a new folder. An Additional, `--allow-write` option can be used to allow or disallow the Windows Sandbox environment to write to the folder. + +- `--id ` (REQUIRED): ID of the Windows Sandbox environment. +- `-f, --host-path ` (REQUIRED): Path to folder that is shared from the host. +- `-s, --sandbox-path ` (REQUIRED): Path to the folder within the Windows Sandbox. +- `-w, --allow-write`: If specified, the Windows Sandbox environment is allowed to write to the shared folder. + +```cmd +wsb share --id 12345678-1234-1234-1234-1234567890AB -f C:\host\folder -s C:\sandbox\folder --allow-write +``` + +## Connect + +The connect command starts a remote session within the sandbox. The command takes the sandbox ID as an argument. The connect command opens a new window with a remote desktop session. The connect command allows the user to interact with the sandbox using the mouse and keyboard. + +```cmd +wsb connect --id 12345678-1234-1234-1234-1234567890AB +``` + +## IP + +The ip command displays the IP address of the sandbox. The command takes the sandbox ID as an argument. + +```cmd +wsb ip --id 12345678-1234-1234-1234-1234567890AB +``` diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 0de253e2e94..f1a42226e34 100644 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -1,11 +1,32 @@ --- -title: Windows Sandbox configuration -description: Windows Sandbox configuration +title: Use and configure Windows Sandbox +description: Use and configure Windows Sandbox ms.topic: how-to -ms.date: 03/26/2024 +ms.date: 09/09/2024 --- -# Windows Sandbox configuration +# Use and configure Windows Sandbox + +To launch a Windows Sandbox with default settings, locate and select Windows Sandbox on the Start menu or search for 'Windows Sandbox'. This launches a basic Sandbox with maximum capacity of 4GB memory with the following properties: + +- **vGPU (virtualized GPU)**: Enabled on non-Arm64 devices. +- **Networking**: Enabled. The sandbox uses the Hyper-V default switch. +- **Audio input**: Enabled. The sandbox shares the host's microphone input into the sandbox. +- **Video input**: Disabled. The sandbox doesn't share the host's video input into the sandbox. +- **Protected client**: Disabled. The sandbox doesn't use increased security settings on the Remote Desktop Protocol (RDP) session. +- **Printer redirection**: Disabled. The sandbox doesn't share printers with the host. +- **Clipboard redirection**: Enabled. The sandbox shares the host clipboard with the sandbox so that text and files can be pasted back and forth. + +> [!IMPORTANT] +> +> - Networking is enabled by default. This can expose untrusted applications to the internal network. To launch a Sandbox with networking disabled, use a custom .wsb file. +> - With Clipboard redirection automatically enabled, you can easily copy files from the host and paste them into the Windows Sandbox window. + +You have the freedom to open files, install applications from the web, and perform various other tasks that benefit from an isolated clean environment. + +When you're finished experimenting, close the sandbox. A dialog box prompts you to confirm the deletion of all sandbox content. Select **Ok** to proceed. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. + +## Configure a custom Windows Sandbox Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or Windows 11. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the `.wsb` file extension. @@ -14,7 +35,7 @@ A configuration file enables the user to control the following aspects of Window - **vGPU (virtualized GPU)**: Enable or disable the virtualized GPU. If vGPU is disabled, the sandbox uses Windows Advanced Rasterization Platform (WARP). - **Networking**: Enable or disable network access within the sandbox. - **Mapped folders**: Share folders from the host with *read* or *write* permissions. Exposing host directories might allow malicious software to affect the system or steal data. -- **Logon command**: A command that's executed when Windows Sandbox starts. +- **Logon command**: A command to execute when Windows Sandbox starts. - **Audio input**: Shares the host's microphone input into the sandbox. - **Video input**: Shares the host's webcam input into the sandbox. - **Protected client**: Places increased security settings on the Remote Desktop Protocol (RDP) session to the sandbox. @@ -25,7 +46,7 @@ A configuration file enables the user to control the following aspects of Window > [!NOTE] > The size of the sandbox window currently isn't configurable. -## Creating a configuration file +## Create a configuration file To create a configuration file: @@ -37,10 +58,8 @@ To create a configuration file: ``` -3. Add appropriate configuration text between the two lines. For details, see [examples](#examples). -4. Save the file with the desired name, but make sure its filename extension is `.wsb`. In Notepad, you should enclose the filename and the extension inside double quotation marks, for example, `"My config file.wsb"`. - -## Using a configuration file +3. Add appropriate configuration text between the two lines. For details, see [examples](windows-sandbox-sample-configuration.md). +4. Save the file with the desired name, but make sure its filename extension is `.wsb`. In Notepad, you should enclose the filename and the extension inside double quotation marks, for example, `"MyConfigFile.wsb"`. To use a configuration file, double-click it to start Windows Sandbox according to its settings. You can also invoke it via the command line as shown here: @@ -48,19 +67,21 @@ To use a configuration file, double-click it to start Windows Sandbox according C:\Temp> MyConfigFile.wsb ``` -## Keywords, values, and limits +## Configuration options ### vGPU Enables or disables GPU sharing. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables vGPU support in the sandbox. -- *Disable*: Disables vGPU support in the sandbox. If this value is set, the sandbox uses software rendering, which might be slower than virtualized GPU. -- *Default* This value is the default value for vGPU support. Currently, this default value denotes that vGPU is enabled. +- **Enable**: Enables vGPU support in the sandbox. +- **Disable**: Disables vGPU support in the sandbox. If this value is set, the sandbox uses software rendering, which might be slower than virtualized GPU. +- **Default**: This value is the default value for vGPU support. Currently, this default value denotes that vGPU is enabled. > [!NOTE] > Enabling virtualized GPU can potentially increase the attack surface of the sandbox. @@ -69,20 +90,24 @@ Supported values: Enables or disables networking in the sandbox. You can disable network access to decrease the attack surface exposed by the sandbox. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables networking in the sandbox. -- *Disable*: Disables networking in the sandbox. -- *Default*: This value is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC. +- **Enable**: Enables networking in the sandbox. +- **Disable**: Disables networking in the sandbox. +- **Default**: This value is the default value for networking support. This value enables networking by creating a virtual switch on the host and connects the sandbox to it via a virtual NIC. > [!NOTE] > Enabling networking can expose untrusted applications to the internal network. ### Mapped folders -An array of folders, each representing a location on the host machine that is shared with the sandbox at the specified path. At this time, relative paths aren't supported. If no path is specified, the folder is mapped to the container user's desktop. +An array of folders, each representing a location on the host machine that is shared with the sandbox at the specified path. Currently, relative paths aren't supported. + +When using `` to map folders, the folders are mapped before the execution of the [Logon command](#logon-command). Beginning in Windows 11, version 23H2, you can use environment variables in the path. ```xml @@ -97,12 +122,12 @@ An array of folders, each representing a location on the host machine that is sh ``` -- *HostFolder*: Specifies the folder on the host machine to share into the sandbox. The folder must already exist on the host, or the container fails to start. -- *SandboxFolder*: Specifies the destination in the sandbox to map the folder to. If the folder doesn't exist, it is created. If no sandbox folder is specified, the folder is mapped to the container desktop. -- *ReadOnly*: If *true*, enforces read-only access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. +- **HostFolder**: Specifies the folder on the host machine to share into the sandbox. The folder must already exist on the host, or the container fails to start. +- **SandboxFolder**: Specifies the destination in the sandbox to map the folder to. If the folder doesn't exist, it gets created. If no sandbox folder is specified, the folder is mapped to the container user's desktop. The default user of Sandbox is `WDAGUtilityAccount`. +- **ReadOnly**: If *true*, enforces read-only access to the shared folder from within the container. Supported values: *true*/*false*. Defaults to *false*. > [!NOTE] -> Files and folders mapped in from the host can be compromised by apps in the sandbox or potentially affect the host. +> Files and folders mapped from the host can be compromised by apps in the sandbox or potentially affect the host. Changes made during a Sandbox session to a mapped folder with write-permissions will persist after a Sandbox is disposed. ### Logon command @@ -114,22 +139,24 @@ Specifies a single command that will be invoked automatically after the sandbox ``` -*Command*: A path to an executable or script inside the container that will be executed after signing in. +**Command**: A path to an executable or script inside the container that will be executed after signing in. > [!NOTE] -> Although very simple commands will work (such as launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via the *LogonCommand* directive. +> Although very simple commands will work (such as launching an executable or script), more complicated scenarios involving multiple steps should be placed into a script file. This script file may be mapped into the container via a shared folder, and then executed via ``. ### Audio input Enables or disables audio input to the sandbox. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables audio input in the sandbox. If this value is set, the sandbox can receive audio input from the user. Applications that use a microphone may require this capability. -- *Disable*: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone may not function properly with this setting. -- *Default*: This value is the default value for audio input support. Currently, this default value denotes that audio input is enabled. +- **Enable**: Enables audio input in the sandbox. If this value is set, the sandbox can receive audio input from the user. Applications that use a microphone might require this capability. +- **Disable**: Disables audio input in the sandbox. If this value is set, the sandbox can't receive audio input from the user. Applications that use a microphone might not function properly with this setting. +- **Default**: This value is the default value for audio input support. Currently, this default value denotes that audio input is enabled. > [!NOTE] > There may be security implications of exposing host audio input to the container. @@ -138,30 +165,32 @@ Supported values: Enables or disables video input to the sandbox. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables video input in the sandbox. -- *Disable*: Disables video input in the sandbox. Applications that use video input may not function properly in the sandbox. -- *Default*: This value is the default value for video input support. Currently, this default value denotes that video input is disabled. Applications that use video input may not function properly in the sandbox. +- **Enable**: Enables video input in the sandbox. +- **Disable**: Disables video input in the sandbox. Applications that use video input might not function properly in the sandbox. +- **Default**: This value is the default value for video input support. Currently, this default value denotes that video input is disabled. Applications that use video input might not function properly in the sandbox. > [!NOTE] > There may be security implications of exposing host video input to the container. ### Protected client -When Protected Client mode is enabled, Sandbox adds a new layer of security boundary by running inside an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. +When Protected Client mode is enabled, Sandbox adds a new layer of security boundary by running inside an [AppContainer Isolation](/windows/win32/secauthz/appcontainer-isolation) execution environment. AppContainer Isolation provides Credential, Device, File, Network, Process, and Window isolation. -AppContainer Isolation provides Credential, Device, File, Network, Process, and Window isolation. - -`value` +```xml +value +``` Supported values: -- *Enable*: Runs Windows sandbox in Protected Client mode. If this value is set, the Sandbox runs in AppContainer Isolation. -- *Disable*: Runs the Sandbox in the standard mode without extra security mitigations. -- *Default*: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode. +- **Enable**: Runs Windows sandbox in Protected Client mode. If this value is set, the Sandbox runs in AppContainer Isolation. +- **Disable**: Runs the Sandbox in the standard mode without extra security mitigations. +- **Default**: This value is the default value for Protected Client mode. Currently, this default value denotes that the sandbox doesn't run in Protected Client mode. > [!NOTE] > This setting may restrict the user's ability to copy/paste files in and out of the sandbox. @@ -170,135 +199,36 @@ Supported values: Enables or disables printer sharing from the host into the sandbox. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables sharing of host printers into the sandbox. -- *Disable*: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. -- *Default*: This value is the default value for printer redirection support. Currently, this default value denotes that printer redirection is disabled. +- **Enable**: Enables sharing of host printers into the sandbox. +- **Disable**: Disables printer redirection in the sandbox. If this value is set, the sandbox can't view printers from the host. +- **Default**: This value is the default value for printer redirection support. Currently, this default value denotes that printer redirection is disabled. ### Clipboard redirection Enables or disables sharing of the host clipboard with the sandbox. -`value` +```xml +value +``` Supported values: -- *Enable*: Enables sharing of the host clipboard with the sandbox. -- *Disable*: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox is restricted. -- *Default*: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*. +- **Enable**: Enables sharing of the host clipboard with the sandbox. +- **Disable**: Disables clipboard redirection in the sandbox. If this value is set, copy/paste in and out of the sandbox is restricted. +- **Default**: This value is the default value for clipboard redirection. Currently, copy/paste between the host and sandbox are permitted under *Default*. ### Memory in MB Specifies the amount of memory that the sandbox can use in megabytes (MB). -`value` - -If the memory value specified is insufficient to boot a sandbox, it is automatically increased to the required minimum amount. - -## Examples - -### Example 1 - -The following config file can be used to easily test the downloaded files inside the sandbox. To achieve this testing, networking and vGPU are disabled, and the sandbox is allowed read-only access to the shared downloads folder. For convenience, the logon command opens the downloads folder inside the sandbox when it's started. - -#### Downloads.wsb - ```xml - - Disable - Disable - - - C:\Users\Public\Downloads - C:\Users\WDAGUtilityAccount\Downloads - true - - - - explorer.exe C:\users\WDAGUtilityAccount\Downloads - - -``` - -### Example 2 - -The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. - -Two folders are mapped into the sandbox; the first (SandboxScripts) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (CodingProjects) is assumed to contain project files that the developer wants to modify using Visual Studio Code. - -With the Visual Studio Code installer script already mapped into the sandbox, the LogonCommand can reference it. - -#### VSCodeInstall.cmd - -Downloads VS Code to `downloads` folder and runs installation from `downloads` folder. - -```batch -REM Download Visual Studio Code -curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\users\WDAGUtilityAccount\Downloads\vscode.exe - -REM Install and run Visual Studio Code -C:\users\WDAGUtilityAccount\Downloads\vscode.exe /verysilent /suppressmsgboxes +value ``` -#### VSCode.wsb - -```xml - - - - C:\SandboxScripts - C:\Users\WDAGUtilityAccount\Downloads\sandbox - true - - - C:\CodingProjects - C:\Users\WDAGUtilityAccount\Documents\Projects - false - - - - C:\Users\WDAGUtilityAccount\Downloads\sandbox\VSCodeInstall.cmd - - -``` - -### Example 3 - -The following config file runs a PowerShell script as a logon command to swap the primary mouse button for left-handed users. - -`C:\sandbox` folder on the host is mapped to the `C:\sandbox` folder in the sandbox, so the `SwapMouse.ps1` script can be referenced in the sandbox configuration file. - -#### SwapMouse.ps1 - -Create a PowerShell script using the following code, and save it in the `C:\sandbox` directory as `SwapMouse.ps1`. - -```powershell -[Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null - -$SwapButtons = Add-Type -MemberDefinition @' -[DllImport("user32.dll")] -public static extern bool SwapMouseButton(bool swap); -'@ -Name "NativeMethods" -Namespace "PInvoke" -PassThru - -$SwapButtons::SwapMouseButton(!([System.Windows.Forms.SystemInformation]::MouseButtonsSwapped)) -``` - -### SwapMouse.wsb - -```xml - - - - C:\sandbox - C:\sandbox - True - - - - powershell.exe -ExecutionPolicy Bypass -File C:\sandbox\SwapMouse.ps1 - - -``` +If the memory value specified is insufficient to boot a sandbox, it's automatically increased to the required minimum amount of 2048 MB. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-faq.yml b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-faq.yml new file mode 100644 index 00000000000..ca1408a957d --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-faq.yml @@ -0,0 +1,107 @@ +### YamlMime:FAQ +metadata: + title: Windows Sandbox frequently asked questions (FAQ) + description: Use these frequently asked questions (FAQ) to learn important details about Windows Sandbox. + author: vinaypamnani-msft + ms.author: vinpa + ms.topic: faq + ms.date: 10/23/2024 + +title: Common questions about Windows Sandbox +summary: Windows Sandbox (WSB) provides a lightweight desktop environment to safely run applications in isolation. This Frequently Asked Questions (FAQ) article is intended to help you learn more about Windows Sandbox. + +sections: + + - name: Concepts + questions: + + - question: Who can use WSB? + answer: | + WSB can be used in various scenarios by anyone without any technical skills. Here are some ways in which you can use WSB: + + - **Clean environment for software testing**: Test or debug your applications in WSB's clean environment to identify and resolve bugs or compatibility issues. + - **Secure web browsing**: Use WSB for secure web browsing, especially when accessing unfamiliar or potentially dangerous websites without putting your system at risk of malware infection. + - **Running Untrusted Applications**: Mitigate security risks by running untrusted applications or files, such as email attachments in WSB. + - **Test software features risk-free**: Easily test out software without the need for installing or uninstalling on your host machine. + - **Maintaining multiple dev environments**: Streamline your development process by utilizing WSB to maintain multiple sandboxes for different development environments. + - **Privacy Protection**: Users concerned about online privacy can use Windows Sandbox for activities like social media browsing or online shopping to prevent tracking cookies and other privacy-invading techniques. + + - question: What's the difference between a Hyper-V virtual machine (VM) and Windows Sandbox? + answer: | + 1. **Lightweight and Temporary**: + - Windows Sandbox: It's a lightweight, disposable environment that runs within your existing Windows installation. You can quickly launch it, test applications, and discard it without affecting your main system. + - Hyper-V VMs: Hyper-V VMs are more heavyweight. They require dedicated resources (CPU, memory, disk space) and take longer to set up. + 1. **Security Isolation**: + - Windows Sandbox: Provides a secure, isolated environment for testing untrusted software. Any changes made within the sandbox are discarded when you close it. + - Hyper-V VMs: While VMs also offer isolation, they persistently store changes unless you revert them manually. + 1. **Resource Efficiency**: + - Windows Sandbox: More resource efficient than a full VM. It adjusts memory usage according to the demand. It also reuses many of the host's read only OS files. + - Hyper-V VMs: VMs have fixed resource allocations, which can impact overall system performance. + 1. **Ease of Use**: + - Windows Sandbox: Simple to use—just open it, test your software, and close it. No complex setup or management. + - Hyper-V VMs: Require more configuration, including setting up virtual switches, network adapters, and managing VM snapshots. + + - question: What applications aren't supported inside a Windows Sandbox? + answer: | + Inbox apps (for example, Store, Notepad) and Optional features turned on via 'Turn Windows Features On or Off' aren't supported. + While Store apps can be installed, you can't download them directly from the Store since the Store app isn't available in the Sandbox. However, if you have an `.appx` package, you can still install those apps. + + - name: Usage + questions: + + - question: Why can I not change certain settings using a config file? + answer: | + You can't make changes to properties if they're controlled by Group Policy. Contact your IT Administrator for more details. + + - question: How do I open multiple Sandbox instances? + answer: | + Today, Windows Sandbox only allows users to launch one Sandbox instance at a time. + + - question: Installing the latest version of Windows Sandbox fails. How do I fix this? + answer: | + Ensure that your device has access to the Internet, Windows Update, and Microsoft Store. Beginning from Windows 11 24H2, the old Windows Sandbox app attempts to download the latest version from the Store. If the upgrade fails on the first attempt, subsequent attempts continue in the background. Meanwhile, the app can still be used. Additionally, the update is queued in the "Updates & Downloads" section of the Microsoft Store app for users who wish to manually install. + + + - question: How do I know which version of Windows Sandbox am I running? + answer: | + Run `Get-AppxPackage -Name WindowsSandbox | Select-Object Version` in a PowerShell prompt. If the version is empty, you're running an older version of Windows Sandbox. If it returns a version number, you're running the newer version. + Alternatively, you can run `wsb --version`. If `wsb` is not available, you're running an older version of Windows Sandbox. + The new version of Windows Sandbox also appears in Windows Settings under **System** > **System components**. + + - question: How do I save the Sandbox state? + answer: | + Windows Sandbox is temporary; closing it deletes all software, files, and state. + + - question: How can I open Windows Sandbox with a different OS version? + answer: | + Windows Sandbox only allows you to use the same build as your host OS. This allows us to keep Windows Sandbox 'lightweight'. + + - question: How do I uninstall Windows Sandbox? + answer: | + To remove Windows Sandbox, and all its components, navigate to **Settings > System > Optional features**, then select **More Windows features**, scroll down and unselect Windows Sandbox, then select OK. + + - name: Feedback + questions: + + - question: Where can I provide feedback? + answer: | + You can file a bug in Feedback Hub by: + + 1. Open the Feedback Hub app. + 1. Select **Report a problem** or **Suggest a feature**. + 1. Fill in the **Summarize your feedback** and **Explain in more details** boxes with a detailed description of the issue or suggestion. A useful feedback item includes: + - Short and descriptive issue title. + - Windows version and build number, which can be gathered from a command prompt using the `cmd.exe --version` command. + - Device information (including CPU type, memory, disk etc.) + - Detailed repro steps. What steps do we need to take to reproduce the issue? Provide as much detail as you can. Provide error message text where possible or screenshots of errors if text can't be captured. + - Behavior you were expecting. + 1. Select an appropriate category and subcategory by using the dropdown menus. There's a dedicated option in Feedback Hub to file **Windows Sandbox** bugs and feedback. It's located under **Security and Privacy** category. + 1. Select **Next**. + 1. If you are able to reproduce the issue, please collect traces as follows: Select the Recreate my problem tile, then select Start capture, reproduce the issue, and then select **Stop capture**. + 1. Attach any relevant screenshots or files for the problem, then select **Submit**. + + Alternatively, you can also use the [Windows Sandbox GitHub repository](https://github.com/microsoft/Windows-Sandbox) to: + + - **Search existing issues** to see if there are any associated with a problem that you're having. In the search bar, you can remove "is:open" to include resolved issues in your search. Consider commenting or giving a thumbs up to any open issues that you would like to express your interest in moving forward as a priority. + - **File a new issue**: If you have found a problem with WSB or WSB documentation and there doesn't appear to be an existing issue, you can select the green **New issue** button and then choose **WSB - Bug Report**. Provide a title for the issue, your Windows build number, whether you're running inbox or undocked Windows Sandbox, any other software versions involved, the repro steps, expected behavior, actual behavior, and diagnostic logs if available and appropriate. + - **File a feature request** by selecting the green **New issue** button and then select **Feature request**, then answer the questions describing your request. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install.md new file mode 100644 index 00000000000..32b1aee636a --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-install.md @@ -0,0 +1,59 @@ +--- +title: Install Windows Sandbox +description: Install Windows Sandbox +ms.topic: how-to +ms.date: 09/09/2024 +--- + +# Install Windows Sandbox + +## Prerequisites + +- Arm64 (for Windows 11, version 22H2 and later) or AMD64 architecture +- Virtualization capabilities enabled in BIOS +- At least 4 GB of RAM (8 GB recommended) +- At least 1 GB of free disk space (SSD recommended) +- At least two CPU cores (four cores with hyper-threading recommended) + +> [!NOTE] +> Beginning in Windows 11, version 24H2, inbox store apps like Calculator, Photos, Notepad and Terminal are not available inside Windows Sandbox. Ability to use these apps will be added soon. + +## Installation + +1. Ensure that your machine is using Windows 11 or Windows 10, version 1903 or later. + +2. Enable virtualization on the machine. + + - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. + - If you're using a virtual machine, you need to enable nested virtualization. If needed, also update the VM to support nested virtualization. Run the following PowerShell commands on the host: + + ```powershell + Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true + Update-VMVersion -VMName + ``` + +3. Use the search bar on the task bar and type **Turn Windows Features on or off** to access the Windows Optional Features tool. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. + + If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this analysis is incorrect, review the prerequisite list and steps 1 and 2. + + > [!NOTE] + > To enable Sandbox using PowerShell, open PowerShell as Administrator and run the following command: + > + > ```powershell + > Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online + > ``` + +4. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. + + > [!NOTE] + > Beginning in Windows 11, version 24H2, Windows Sandbox adheres to the mouse settings of the host system. + > + > If you are on an older build and if the host system is set to use a left-handed mouse, you must apply these settings in Windows Sandbox manually when Windows Sandbox starts. Alternatively, you can use a sandbox configuration file to run a logon command to swap the mouse setting. For an example, see [Example 3](windows-sandbox-sample-configuration.md#example-3---mapping-folders-and-running-a-powershell-script-as-a-logon-command). + +## Try WSB preview features by joining the Windows Insider Program + +To try the most recent features or updates to WSB, join the [Windows Insiders Program](https://insider.windows.com/getting-started). After joining the Windows Insiders Program, you can choose the channel you would like to receive preview builds from inside the Windows settings menu. You can choose from: + +- **Dev channel**: Most recent updates, but low stability. +- **Beta channel**: Ideal for early adopters, more reliable builds than the Dev channel. +- **Release Preview channel**: Preview fixes and key features on the next version of Windows just before its available to the general public. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md deleted file mode 100644 index 8d8f873a384..00000000000 --- a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md +++ /dev/null @@ -1,75 +0,0 @@ ---- -title: Windows Sandbox -description: Windows Sandbox overview -ms.topic: conceptual -ms.date: 03/26/2024 ---- - -# Windows Sandbox - -Windows Sandbox provides a lightweight desktop environment to safely run applications in isolation. Software installed inside the Windows Sandbox environment remains "sandboxed" and runs separately from the host machine. - -A sandbox is temporary. When it's closed, all the software and files and the state are deleted. You get a brand-new instance of the sandbox every time you open the application. Note, however, that as of Windows 11, version 22H2, your data persists through a restart initiated from inside the virtualized environment—useful for installing applications that require the OS to reboot. - -Software and applications installed on the host aren't directly available in the sandbox. If you need specific applications available inside the Windows Sandbox environment, they must be explicitly installed within the environment. - -Windows Sandbox has the following properties: - -- **Part of Windows**: Everything required for this feature is included in Windows 10 Pro and Enterprise. There's no need to download a Virtual Hard Disk (VHD). -- **Pristine**: Every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows. -- **Disposable**: Nothing persists on the device. Everything is discarded when the user closes the application. -- **Secure**: Uses hardware-based virtualization for kernel isolation. It relies on the Microsoft hypervisor to run a separate kernel that isolates Windows Sandbox from the host. -- **Efficient:** Uses the integrated kernel scheduler, smart memory management, and virtual GPU. - -> [!IMPORTANT] -> Windows Sandbox enables network connection by default. It can be disabled using the [Windows Sandbox configuration file](/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file#networking). - -[!INCLUDE [windows-sandbox](../../../../../includes/licensing/windows-sandbox.md)] - -## Prerequisites - -- ARM64 (for Windows 11, version 22H2 and later) or AMD64 architecture -- Virtualization capabilities enabled in BIOS -- At least 4 GB of RAM (8 GB recommended) -- At least 1 GB of free disk space (SSD recommended) -- At least two CPU cores (four cores with hyper-threading recommended) - -> [!NOTE] -> Windows Sandbox is currently not supported on Windows Home edition. -> Beginning in Windows 11, version 24H2, all inbox store apps like calculator, photos, notepad and terminal are not available inside Windows Sandbox. Ability to use these apps will be added soon. -## Installation - -1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or Windows 11. - -2. Enable virtualization on the machine. - - - If you're using a physical machine, make sure virtualization capabilities are enabled in the BIOS. - - If you're using a virtual machine, you need to enable nested virtualization. If needed, also update the VM to support nested virtualization. Run the following PowerShell commands on the host: - - ```powershell - Set-VMProcessor -VMName -ExposeVirtualizationExtensions $true - Update-VMVersion -VMName - ``` - -3. Use the search bar on the task bar and type **Turn Windows Features on or off** to access the Windows Optional Features tool. Select **Windows Sandbox** and then **OK**. Restart the computer if you're prompted. - - If the **Windows Sandbox** option is unavailable, your computer doesn't meet the requirements to run Windows Sandbox. If you think this analysis is incorrect, review the prerequisite list and steps 1 and 2. - - > [!NOTE] - > To enable Sandbox using PowerShell, open PowerShell as Administrator and run the following command: - > - > ```powershell - > Enable-WindowsOptionalFeature -FeatureName "Containers-DisposableClientVM" -All -Online - > ``` - -4. Locate and select **Windows Sandbox** on the Start menu to run it for the first time. - - > [!NOTE] - > Windows Sandbox does not adhere to the mouse settings of the host system, so if the host system is set to use a left-handed mouse, you must apply these settings in Windows Sandbox manually when Windows Sandbox starts. Alternatively, you can use a sandbox configuration file to run a logon command to swap the mouse setting. For an example, see [Example 3](windows-sandbox-configure-using-wsb-file.md#example-3). - -## Usage - -1. Copy an executable file (and any other files needed to run the application) from the host and paste them into the **Windows Sandbox** window. -2. Run the executable file or installer inside the sandbox. -3. When you're finished experimenting, close the sandbox. A dialog box will state that all sandbox content will be discarded and permanently deleted. Select **Ok**. -4. Confirm that your host machine doesn't exhibit any of the modifications that you made in Windows Sandbox. diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-sample-configuration.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-sample-configuration.md new file mode 100644 index 00000000000..8d1a0ca697d --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-sample-configuration.md @@ -0,0 +1,112 @@ +--- +title: Windows Sandbox sample configuration files +description: Windows Sandbox sample configuration files +ms.topic: how-to +ms.date: 09/09/2024 +--- + +# Windows Sandbox sample configuration files + +## Example 1 - Mapping Folders and testing an unknown downloaded file in a Sandbox + +The following config file can be used to easily test unknown downloaded files inside a sandbox. To achieve this testing, networking and vGPU are disabled, and the sandbox is allowed read-only access to the downloads folder from the host and is placed inside a 'temp' folder in the sandbox. For convenience, the logon command opens the downloads folder inside the sandbox when it's started. + +### Downloads.wsb + +```xml + + Disable + Disable + + + C:\Users\Public\Downloads + C:\temp + true + + + + explorer.exe C:\temp + + + +``` + +## Example 2 - Installing Visual Studio Code at launch in a Sandbox + +The following config file installs Visual Studio Code in the sandbox, which requires a slightly more complicated LogonCommand setup. + +Two folders are mapped into the sandbox; the first (`SandboxScripts`) contains VSCodeInstall.cmd, which installs and runs Visual Studio Code. The second folder (`CodingProjects`) is assumed to contain project files that the developer wants to modify using Visual Studio Code. + +With the Visual Studio Code installer script already mapped into the sandbox, the `` can reference it. + +### VSCodeInstall.cmd + +This batch file should be created in the `C:\SandboxScripts` directory on the host. It downloads VS Code to `temp` folder inside the sandbox and runs installation from `temp` folder. + +```batch +REM Download Visual Studio Code +curl -L "https://update.code.visualstudio.com/latest/win32-x64-user/stable" --output C:\temp\vscode.exe + +REM Install and run Visual Studio Code +C:\temp\vscode.exe /verysilent /suppressmsgboxes +``` + +### VSCode.wsb + +```xml + + + + C:\SandboxScripts + C:\temp\sandbox + true + + + C:\CodingProjects + C:\temp\Projects + false + + + + C:\temp\sandbox\VSCodeInstall.cmd + + +``` + +## Example 3 - Mapping Folders and running a PowerShell script as a Logon Command + +Beginning in Windows 11, version 24H2, Windows Sandbox adheres to the mouse settings of the host system. If you are on an older build and if the host system is set to use a left-handed mouse, you must apply these settings in Windows Sandbox manually when Windows Sandbox starts. Alternatively, you can use a sandbox configuration file to run a logon command to swap the mouse setting. + +In this example, the `C:\sandbox` folder on the host is mapped to the `C:\sandbox` folder in the sandbox, so the `SwapMouse.ps1` script can be referenced in the sandbox configuration file. + +### SwapMouse.ps1 + +Create a PowerShell script using the following code, and save it in the `C:\sandbox` directory as `SwapMouse.ps1`. + +```powershell +[Reflection.Assembly]::LoadWithPartialName("System.Windows.Forms") | Out-Null + +$SwapButtons = Add-Type -MemberDefinition @' +[DllImport("user32.dll")] +public static extern bool SwapMouseButton(bool swap); +'@ -Name "NativeMethods" -Namespace "PInvoke" -PassThru + +$SwapButtons::SwapMouseButton(!([System.Windows.Forms.SystemInformation]::MouseButtonsSwapped)) +``` + +### SwapMouse.wsb + +```xml + + + + C:\sandbox + C:\sandbox + True + + + + powershell.exe -ExecutionPolicy Bypass -File C:\sandbox\SwapMouse.ps1 + + +``` \ No newline at end of file diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-troubleshoot.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-troubleshoot.md new file mode 100644 index 00000000000..a908b5875ce --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-troubleshoot.md @@ -0,0 +1,21 @@ +--- +title: Troubleshoot Windows Sandbox +description: Troubleshoot Windows Sandbox +ms.topic: troubleshooting +ms.date: 09/09/2024 +--- + +# Troubleshoot Windows Sandbox + +This article lists some common issues with Windows Sandbox and possible solutions. To submit feedback about Windows Sandbox, see [Where can I provide feedback?](windows-sandbox-faq.yml#where-can-i-provide-feedback) + +| Error | Possible Solution | +|--|--| +| `WININET_E_NAME_NOT_RESOLVED`
`WU_E_PT_ENDPOINT_UNREACHABLE` | Upgrade to Windows Sandbox app fails because user isn't connected to internet or network adapter is connected but no internet connection. Check your internet connection. | +| `ERROR_FILE_NOT_FOUND` | `.wsb` config file provided by the user doesn't exist. Make sure that the path to the `.wsb` file is correct. | +| `E_INVALIDARG` | The `.wsb` file provided by the user is invalid or has errors. Check the `.wsb` file. | +| `REGDB_E_IIDNOTREG` | Verify if Windows Sandbox component is enabled under 'Turn Windows features on or off'. For more information, see [Install Windows Sandbox](windows-sandbox-install.md) | +| `The following settings are enforced by your IT administrator.` | `.wsb` file has a setting enabled that is controlled via group policy. | +| `No hypervisor was found. Please enable hypervisor support.` | Windows Sandbox only supports Hyper-V Hypervisor. Third-party hypervisors are not supported. Ensure that Hyper-V is enabled. | +| `Cannot upgrade to the latest version of Windows Sandbox` | Ensure that your device has access to the Internet, Windows Update and Microsoft Store. Beginning with Windows 11, version 24H2, the old Windows Sandbox app attempts to download the latest version from the Store. If the upgrade fails initially, installation continues in the background while the user can still use the app. Additionally, the app is queued in the "Updates & downloads" section of the Microsoft Store app for users who wish to install it manually. | +| `E_FAIL`, or `E_UNEXPECTED` or general failure during installation. | Possible causes:

- Installing Windows Sandbox is disabled via group policy. Check with your IT Admin.
- Timeout error where we can't reach the Microsoft Store. Try again later. | diff --git a/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versions.md b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versions.md new file mode 100644 index 00000000000..42ffe331cce --- /dev/null +++ b/windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-versions.md @@ -0,0 +1,32 @@ +--- +title: Windows Sandbox versions +description: Windows Sandbox versions +ms.topic: conceptual +ms.date: 10/22/2024 +--- + +# Windows Sandbox versions + +Starting with Windows 11, version 24H2, a newer version of Windows Sandbox is available from the Microsoft Store, featuring an improved user experience and new command line functionality. + +- **Faster Updates**: With the app now being updated through the Microsoft Store, you can install the bug fixes and new features as soon as they're available, rather than needing to wait for an update of the Windows operating system. +- **Revamped UI**: The app now features WinUI 3, a modern and sleek user interface built on the Fluent design system. +- **New Runtime Features**: Users can now access clipboard redirection, audio/video input control, and folder sharing directly during runtime using the "…" icon in the top-right corner without needing a preconfigured `.wsb` file. +- **Command Line Preview**: An early version of [command line support](windows-sandbox-cli.md) for Windows Sandbox is now available. + +## Upgrading to the newer version + +### Prerequisites + +- Windows Sandbox must already be installed. If it isn't already installed, [install Windows Sandbox](windows-sandbox-install.md). +- Device must be running Windows 11, version 24H2, with KB10D or later. +- Internet access for Microsoft Store and Windows Update. + +### Upgrade + +- Launch **Windows Sandbox** from the Start menu. +- If the app isn't upgraded to the latest version, a progress dialog appears as it automatically attempts to update. This process typically takes 30 seconds to 2 minutes. +- Once the installation is complete, you're directed to the updated version of the app. + +> [!NOTE] +> If the upgrade fails on the first try, the installation continues in the background while you use the older version of the app. Additionally, the app is queued in the "Updates & downloads" section of the Microsoft Store app for users who wish to install it manually. \ No newline at end of file diff --git a/windows/security/book/includes/windows-sandbox.md b/windows/security/book/includes/windows-sandbox.md index 8e2f55f7473..d8d6385b3f1 100644 --- a/windows/security/book/includes/windows-sandbox.md +++ b/windows/security/book/includes/windows-sandbox.md @@ -14,4 +14,4 @@ Once Windows Sandbox is closed, nothing persists on the device. All the software [!INCLUDE [learn-more](learn-more.md)] -- [Windows Sandbox](/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview) +- [Windows Sandbox](/windows/security/application-security/application-isolation/windows-sandbox) diff --git a/windows/security/index.yml b/windows/security/index.yml index 43817f62277..7b2cccd5aee 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -131,7 +131,7 @@ landingContent: - text: Microsoft Defender Application Guard (MDAG) url: /windows/security/application-security/application-isolation/microsoft-defender-application-guard/md-app-guard-overview - text: Windows Sandbox - url: /windows/security/application-security/application-isolation/windows-sandbox/windows-sandbox-overview + url: /windows/security/application-security/application-isolation/windows-sandbox/ - linkListType: how-to-guide links: - text: Configure Windows Sandbox diff --git a/windows/security/threat-protection/index.md b/windows/security/threat-protection/index.md index 68fce9d0792..0409ddfbb3a 100644 --- a/windows/security/threat-protection/index.md +++ b/windows/security/threat-protection/index.md @@ -25,7 +25,7 @@ See the following articles to learn more about the different areas of Windows th - [Virtualization-Based Protection of Code Integrity](../hardware-security/enable-virtualization-based-protection-of-code-integrity.md) - [Web Protection](/microsoft-365/security/defender-endpoint/web-protection-overview) - [Windows Firewall](../operating-system-security/network-security/windows-firewall/index.md) -- [Windows Sandbox](../application-security/application-isolation/windows-sandbox/windows-sandbox-overview.md) +- [Windows Sandbox](../application-security/application-isolation/windows-sandbox/index.md) ## Next-generation protection