Secure your Windows Sandbox environment by disabling unnecessary features and blocking network access.
This tool hardens Windows Sandbox, restricting local network access and disabling features commonly exploited by malware. Use this page to download the EXE or PowerShell script without exposing your internal network to the sandbox.
You can download a pre-configured Windows Sandbox launcher here. Any Sandbox launched via this file will auto-load this page, allowing you to download and run the hardening script/executable.
Two self-contained editions share the same goal — a browse-only, attack-surface-minimised sandbox — but take different defensive approaches. Each ships as a one-click EXE or an auditable PowerShell script.
Lockdown by removal & restriction. Strips out networking components and locks down the shell to deny attacker footholds outright.
Lockdown by containment. Assumes code may run and starves it — default-deny egress, exploit mitigations and a constrained shell.