Run untrusted software in unprivileged containers with Sandboxie Plus

Caveats:

  • This provides better performance than a typical Virtual Machine. But there is some performance loss, so it's not ideal for resource-intensive games.
  • This is for only using programs while isolating them from the internet. Advanced users feel free to tweak Sandboxie-Plus to be usable while letting the sandbox connect to the internet by blocking read-access to sensitive directories. Or use a Virtual Machine instead.

Sandboxie-Plus Logo


1 Install Sandboxie-Plus

Download and install the latest version


2 Create a sandbox

Blocking internet connections is important in this particular setup, because the app you run is allowed to read -not modify- many of the files accessible to your current user, and could potentially upload them to the internet. If you really need internet for a program, consider configuring the sandbox with less privileges, for example by blocking read-access to sensitive directories

Make applications think they are running elevated allows you to install any program without giving administrator (full system control) permissions.

Enable Drop rights from administrators

This is specially important if your current Windows user is an Administrator account. For extra isolation, you could create a separate Windows user account, a Standard User without admin permissions, but it's not required.


Confirm settings are correct

The status column shows if you correctly blocked admin permissions and internet connections:


3 Install your app inside the sandbox

The app will NOT ask you for admin permissions, because it has fake admin permissions.
It will be installed in a parallel file system inside the sandbox.

Run the installer for the app inside the sandbox

Explore the file system inside the sandbox to apply the required cracks


4 Run your sandboxed app or game

Run it from the Sandboxie menu

Create a desktop shortcut

to make the sandboxed app launcher easily accessible.
One way to do this is: while the app is open, right-click on the main process and create the shortcut.

Take files out of the sandbox

If you created a file using your app, you might need to take that file out of the sandbox with Recover files



5 Other interesting settings


Block read-access to cookies directories using closedfilepath

(important when letting the sandbox connect to the internet. Advanced users only)
Add these lines to Edit Ini Section in Sandbox Configuration for any particular sandbox

  • For chrome and brave: ClosedFilePath=%LocalAppData%\*\*\User Data\Default\*
  • For firefox and librewolf: ClosedFilePath=%USERPROFILE%\AppData\Roaming\*\Profiles\*

This can also be done through the UI here:

Use the Windows File Manager inside the sandbox to verify that you can't access those directories that contain cookies or other sensitive files.

Or use Privacy Mode but the free version will close programs after 6 minutes since this is a premium feature.


Total access for selected directories using openfilepath

You can let the the sandboxed app directly edit files in some specific directories. This can be convinient for some cases. You do this by adding a line like OpenFilePath=C:\Downloads\ in Edit ini section in the config menu for each sandbox.


Boosting performance

You can configure the sandbox as a App Compartment to significantly reduce the performance loss for heavier apps or games. But with the free version, we can only use this for 6 minutes before the app auto closes and you have to open it again.

Edit
Pub: 16 Aug 2023 18:32 UTC
Edit: 10 Jan 2024 13:50 UTC
Views: 13743