Microsoft introduced Windows Sandbox back in January but shortly after added the support for a simple configuration file that provides some minimal scripting support with a bit customization capability.
If you haven’t used Windows Sandbox before, check this post to get started.
By default, without a config file, Windows Sandbox spins up a default image that mimics the copy of the Windows 10 system installed on your computer. But in many cases, you may need a bit more and that’s why the config file comes in play.
The Windows Sandbox config files are formatted in XML format but with a different extension name .wsb that can be launched in Windows Sandbox directly. As of today, there are 4 components that you can customize in one config file, vGPU, Networking, Shared folders, and Startup script.

Here is a quick overview of the settings you can use right now, kudos to Thomas Maurer:
Name | Setting | SubSetting | Value |
---|---|---|---|
Virtual GPU | <vGPU> | Disable – Disables vGPU | |
Default – vGPU enabled | |||
Networking | <Networking> | Disable – disables Networking | |
Default – Networking enabled | |||
Shared Folder | <MappedFolders> | <HostFolder> | Path to the host (local) folder |
<ReadOnly> | True/False | ||
Startup Script | <LogonCommand> | <Command> | Command that runs like a logon script |
Here is a full example of a config file for your reference:
<Configuration> <vGPU>Disable</vGPU> <Networking>Disable</Networking> <MappedFolders> <MappedFolder> <HostFolder>c:\users\kent\downloads</HostFolder> <ReadOnly>True</ReadOnly> </MappedFolder> </MappedFolders> <LogonCommand> <Command>notepad.exe</Command> </LogonCommand> </Configuration>
Save the config file on your desktop with a .wsb extension name. Now let’s double click and see what happens.
It launches Windows Sandbox that maps my local downloads folder on the desktop with Read-Only rights and opens the notepad at the end with network disabled.

The nice thing about using the config file is that now I can make a bunch of config files with different setups for different scenarios.
Lastly, check out this blog post by Windows Kernal Internals for more details.