Run in sandbox

Applies to client 2.0.x and later. For tenant admins.

Run in sandbox starts an .exe, .msi or .ps1 inside Windows Sandbox: a disposable virtual machine that is wiped when it closes. The program never gets administrator rights on the device itself, and the device’s files are not reachable from inside. It is useful for trying an unknown installer or a downloaded tool.

How a sandbox run is checked and started

Requirements

Windows 10 or 11 Pro, Enterprise or Education (not Home), with hardware virtualization.
The Windows feature Windows Sandbox (Containers-DisposableClientVM). With Manage the Windows feature on the device on (the default), the device turns it on when you allow Run in sandbox and off again when you stop, and needs one restart. The device never restarts by itself. A Windows Sandbox that an administrator turned on is never turned off by AdminExplorer.
The device’s capability is shown on its page under Windows Sandbox (available, feature off, needs restart, not supported).

What the user sees

When allowed, a Run in sandbox entry appears next to Run with AdminExplorer in the right-click menu for the allowed file kinds, and Run a program in the sandbox… in the tray menu. With Offer “Run in sandbox instead” when an elevation is denied, the denial message offers it as a button. The tray status shows “Sandbox: available”, “needs restart”, “not supported” or “off by policy”.

Switches

Setting	Default	Notes
Allow “Run in sandbox”	off	The master switch
Offer “Run in sandbox instead”	off	After a denied elevation
Networking	off	Inside the sandbox
Clipboard	off	Between the sandbox and the desktop
Virtual GPU, microphone, camera, printers	off
Time limit	120 minutes	0 = no limit, at most 1440; the sandbox is closed when reached
File kinds	exe, msi, ps1	At least one
Users must type a reason	on	Uses your minimum reason length
Limit to Entra groups	everyone	Enterprise, with group targeting on
Manage the Windows feature	on	Off leaves the feature as it is

Networking and clipboard let a program in the sandbox reach your network or exchange data with the desktop; keep them off unless needed.

{
  "enabled": true,
  "offerWhenDenied": true,
  "networking": false,
  "clipboard": false,
  "vGpu": false,
  "audioInput": false,
  "videoInput": false,
  "printerRedirection": false,
  "maxMinutes": 60,
  "kinds": ["exe", "msi"],
  "requireReason": true,
  "assignedGroups": [],
  "manageFeature": true
}

How a run is protected

The same path guard as for elevation applies (local fixed drive, no links, no network paths). Denied paths do not apply: untrusted downloads are what the sandbox is for.
Only the selected file is copied into a protected run folder; the copy is hashed and must match the checked file. The sandbox sees that folder read-only.
Windows Sandbox runs as the user, never as an administrator on the device. One sandbox per session; at most 6 requests per minute.
While Run in sandbox is allowed, AdminExplorer also writes the Windows Sandbox policy values for your switches, so a sandbox the user opens by hand gets the same restrictions. Values set by Group Policy are left alone.
Every run is audited with kind “sandbox”, the switches in force, the duration and the hash.

Limits

Not on Home editions; needs virtualization and the feature (one restart).
One sandbox at a time per session, including one the user opened outside AdminExplorer.
Nothing persists: closing the sandbox discards everything.
Only the selected file is copied in. Installers that need files next to them (an .msi with external cabinet files, a setup.exe with a payload folder) do not work in the sandbox yet.
A user who is not in the assigned groups can still start Windows Sandbox by hand once the feature is on (with your restrictions, but without reason, audit or time limit). Block WindowsSandbox.exe with App Control if that matters.
On a Standard license, group scoping is not available; if a stored group list remains after a drop to Standard, devices get the sandbox turned off.

AdminExplorer documentation, published by Circle of Bytes ApS. Customers sign in at portal.adminexplorer.circleofbytes.com.