Run untrusted software in unprivileged containers with Sandboxie-Plus
Caveats:
- This provides better performance than a typical virtual machine. But there's some performance loss, so it's not ideal for resource-intensive games.
- This is only for using programs while isolating them from the internet. If you're an advanced user, feel free to tweak Sandboxie-Plus to be usable while letting the sandbox connect to the internet by blocking read-access to sensitive directories. Or use a virtual machine / non-piracy route, 2 instead.
- Sandboxie-Plus is only available for Windows. So, if you're a MacOS or Linux user, it won't work unless you set up a Windows VM beforehand and install it on there.
- Sandboxie-Plus has premium features and unless you support them, you won't get permanent access to them (only for 5 minutes). You can try to compile the code yourself from their GitHub repo. But if you can't, you're out of luck.
Getting Started
Download Sandboxie-Plus
Download and install the latest version of the software from here.
(Pick the version simillar to this one: Sandboxie-Plus-[Architecture]-[Version Number].exe)
Install Sandboxie-Plus
Install it like any other program. The steps have been listed anyways in case you have issues.
- Select your language and click on
OK
.
- Click on
I accept the agreement
and thenNext
.
- Select
Install Sandboxie-Plus on this computer
if you want it to be a standard application, otherwise select theExtract all files to a directory for portable use
option for portable use.
- You can browse for a new installation folder. Otherwise, click
Next
.
- Give the app a name if you want to. Otherwise, click on
Next
.
- You can check the
Create a desktop shortcut
checkbox to create a desktop shortcut. TheDownload latest Templates.ini and translations
option's not necessary unless you can't understand English. Do not check theInstall (or Update) ImDisk 3.0 driver (for RamDisk and Encrypted Sandboxes)
checkbox unless you have a premium certificate as both of those are paid features. Then, click onNext
.
- Check the options if you want to. Otherwise, click on
Install
.
- Wait for a bit until it finishes installing.
- You can check the
Start Sandboxie-Plus UI
checkbox. Regardless of if you do or do not, click onFinish
.
Setting up Sandboxie-Plus
After opening the app, you'll notice that a new Introduction
window has opened. You can use it to configure the app to your liking. Follow the steps below.
- Select whether you're using it for personal or commercial use. Be sure to double check the selection as it persists on the later installations as well.
- If you have the premium certificate, fill in your personal details and rest of the serial number. Regardless of if you do or do not, click on
Next
.
- If you're an advanced user, select the first option and if you're not, select the second one. Use the third option if you want a more retro feeling while using the app. After that, select
Bright Mode
if you like light mode andDark Mode
if you like dark mode.
- Check the first option if you want the app to automatically start with Windows, the second one if you want to create a sandbox from the Windows context menu, the third one if you want a desktop icon of a browser using Sandboxie and the forth one if you want only apps with admin access to your computer to be able to change the configuration of Sandboxie-Plus. Then click on
Next
.
- Pick the first option if you want stable updates and the second one if you want experimental updates. Then click on
Next
.
- Click on
Finish
.
Create a sandbox
- Click on
Sandbox (located at the top-left side of the screen)
→Create New Box
.
- Give the box a name and select the box type (if you don't have access to the premium features, select
Standard Sandbox
). Be sure to check theConfigure advanced options
checkbox.
- In the next page, the default selections are good enough. If you're an advanced user, feel free to change the settings to your liking. If not, click on
Next
.
- In the next page, change the
Network Acess
selection toBlock network/internet by denying access to Network devices
, checkMake applications think they are running elevated
andDrop rights from Administrators and Power User groups
. Then, click onNext
.
Blocking internet connections is important in this particular setup, because the app you run is allowed to read (not modify) many of the files accessible to your current user, and could potentially upload them to the internet. If you really need internet for a program, consider configuring the sandbox with less privileges, for example by blocking read-access to sensitive directories.
'Make applications think they are running elevated' allows you to install any program without giving administrator (full system control) permissions.
'Drop rights from Administrators and Power User groups' is specially important if your current Windows user is an Administrator account. For extra isolation, you could create a separate Windows user account, a Standard User without admin permissions, but it's not required.
- Click on
Next
.
- Click on
Finish
Confirm settings are correct
The Status
column shows if you correctly blocked admin permissions and internet connections:
Install your app inside the sandbox
The app will not ask you for admin permissions, because it has fake admin permissions. It will be installed in a parallel file system inside the sandbox.
Create a sandbox from the Windows context menu
Right click on the file you want a sandbox for. Then click on Run Sandboxed
.
Windows 10:
Windows 11:
If you're using something to only have the old context menu on Windows 11, it won't work.
Explore the Windows File Explorer from inside the sandbox
- Right click on the sandbox that you want to run. Then, go to
Run
→Standard Applications
→Windows Explorer
- Check the
Don't show this message again.
checkbox and click onOK
.
Run your sandboxed app or game
Run it from the start menu
Right click on the sandbox that you want to run. Then, hover over Run
→ Standard Applications
. After that, click on Run from Start Menu
Create a desktop shortcut
- While the sandboxed app is open, right-click on the main process and select
Create Shortcut
.
- Save it like a normal shortcut.
Take files out of the sandbox
- Right click over the sandbox that you want the files out of. Then, click on
Recover Files
.
- Select the file that you want to take out. If there are multiple files that you want to take out, select the folder. After that, click on
Recover
.
Other interesting settings
Block read-access to cookies directories using closedfilepath
It's important when letting the sandbox connect to the internet. It's meant for advanced users only. So, if you consider yourself one, follow the steps.
- Right click on the sandbox. Then click on
Sandbox Options
.
- Click on
Edit ini Section
. Then click onEdit ini
. After that, add these lines for the following browsers:
For Chromium based browsers: ClosedFilePath=%LocalAppData%\*\*\User Data\Default\*
For Firefox based browsers: ClosedFilePath=%USERPROFILE%\AppData\Roaming\*\Profiles\*
- Click on
Ok
.
You can use 'Windows File Manager' inside the sandbox to verify that you can't access those directories that contain cookies or other sensitive files.
Total access for selected directories using openfilepath
You can let the the sandboxed app directly edit files in some specific directories.
- Right click on the sandbox. Then click on
Sandbox Options
.
- Click on
Edit ini Section
. Then click onEdit ini
. After that, add a line simillar toOpenFilePath=[Directory Path]
which will look something likeOpenFilePath=C:\Downloads\
.
- Click on
OK
.
Credits
The previous owner - Unknown (not a username)
New / Current owner - Clara
(With <3)