How to use Windows Sandbox to open a risky file

Windows Sandbox is a temporary, disposable Windows environment (available on supported Pro/Enterprise/Education editions) where you can open a suspicious attachment or installer with less risk to your main system—closing Sandbox discards its state. Enable it via Windows Features, copy the file in, inspect, then close without keeping the sandbox. This how-to is about Sandbox for risky files—not BitLocker, not a keep-files reset, and not hijacker cleanup after you already ran malware on the host.

1. Requirements and limits

Sandbox needs a compatible Windows edition, virtualization enabled in firmware, and enough RAM/disk. It is not on typical Home SKUs. Sandbox reduces risk; it is not a guarantee against every escape technique. Prefer deleting obvious malware without opening it. Never enter banking passwords inside Sandbox while testing unknown software.

Forum posts sometimes say to turn off antivirus inside Sandbox for “accurate” malware tests. For home users inspecting a random attachment, leave protections on; your goal is safe triage, not malware research. If the file is clearly unwanted, delete it without opening.

2. Sandbox vs neighboring tools

3. Steps: enable Sandbox and open a risky file

1. Confirm edition: Settings → System → About—look for Pro/Enterprise/Education. Home users should scan on the host with Defender or use a separate spare PC instead.
2. Enable virtualization in BIOS/UEFI if Windows Features gray out Sandbox (OEM docs vary).
3. Open Turn Windows features on or off, check Windows Sandbox, OK, reboot.
4. Download or save the suspicious file to a normal folder on the host (do not run it yet). Prefer keeping the original in quarantine until inspected.
5. Start Windows Sandbox from the Start menu. Copy-paste or drag the file into the Sandbox window (clipboard/file share as your build allows).
6. Inside Sandbox only, open the file with appropriate viewers. Watch for unexpected network installers or macros—close Sandbox immediately if behavior is hostile.
7. Do not copy “cleaned” mystery executables back to the host as trusted. If you need the real document, obtain a re-sent copy from the sender through a verified channel.
8. Close Sandbox to wipe the environment. On the host, delete the risky file and run a Defender scan. A trusted primary suite such as Norton or Bitdefender can supplement—avoid stacking full suites. TotalAV, McAfee, and Avast are other on-site comparison options.

4. If you opened the file on the host by mistake

1. Disconnect from networks if ransomware behavior appears; power off if encryption of files starts.
2. Run Defender full scan; review Protection history.
3. Change passwords from another device if credential theft is possible.
4. Escalate to Reset this PC — Keep my files if the host remains unclean.
5. Do not call phone numbers from fake virus screens—see fake BSOD support scam.

FAQ

Is Sandbox available on Windows 11 Home?

Generally no. Microsoft documents Sandbox for Pro/Enterprise/Education with virtualization support.

Does closing Sandbox always delete malware remnants on the host?

Sandbox state is discarded, but the original file on the host remains until you delete it. Never assume the host copy is safe to run.

Can I use Sandbox instead of antivirus?

No. Keep real-time protection on the host. Sandbox is an isolation tool for inspection.

Is this the same as a virtual machine I keep forever?

No. Sandbox is disposable by design. Persistent VMs need their own hardening and snapshots.

If you still want a paid suite

Avoiding how to use Windows Sandbox to open a risky file does not require paid antivirus. Careful habits and official support paths are a valid buy-nothing stack. If you want multi-device paid protection later, use only these on-site paid links: TotalAV (paid link), Norton (paid link), Bitdefender (paid link), McAfee (paid link), Avast (paid link).