🛡️ Windows Sandbox Hardening

Secure your Windows Sandbox environment by disabling unnecessary features and blocking network access.

This tool hardens Windows Sandbox, restricting local network access and disabling features commonly exploited by malware. Use this page to download the EXE or PowerShell script without exposing your internal network to the sandbox.


You can download a pre-configured Windows Sandbox launcher here. Any Sandbox launched via this file will auto-load this page, allowing you to download and run the hardening script/executable.

📌 Choose a Hardening Profile

Two self-contained editions share the same goal — a browse-only, attack-surface-minimised sandbox — but take different defensive approaches. Each ships as a one-click EXE or an auditable PowerShell script.

🛡️ Classic

Lockdown by removal & restriction. Strips out networking components and locks down the shell to deny attacker footholds outright.

  • ✅ Black-hole routes for private networks (RFC1918)
  • ✅ Disables IPv6, NetBIOS & network discovery
  • ✅ Software Restriction Policies w/ SHA-256 process allow-list
  • ✅ PowerShell execution policy → Restricted
  • ✅ Disables cmd, Task Manager & registry tools
  • ✅ Edge SmartScreen, no-JIT & locked-down downloads

🦊 Fable Newest

Lockdown by containment. Assumes code may run and starves it — default-deny egress, exploit mitigations and a constrained shell.

  • ✅ Firewall outbound default-deny + minimal browse-only allow-list
  • ✅ Malware-filtering DNS (Quad9); LLMNR/mDNS/NetBIOS off
  • ✅ Defender ASR rules + system-wide DEP/SEHOP/ASLR/CFG
  • ✅ Neuters LOLBins (mshta, certutil, regsvr32…) via IFEO
  • ✅ PowerShell Constrained Language Mode for new sessions
  • ✅ Idempotent, with per-section pass/skip/fail summary