Run untrusted software in unprivileged containers with Sandboxie Plus
- This provides better performance than a typical Virtual Machine. But there is some performance loss, so it's not ideal for resource-intensive games.
- This is for only using programs while isolating them from the internet. Advanced users feel free to tweak Sandboxie-Plus to be usable while letting the sandbox connect to the internet by blocking read-access to sensitive directories. Or use a Virtual Machine instead.
- 1 Install Sandboxie-Plus
- 2 Create a sandbox
- 3 Install your app inside the sandbox
- 4 Run your sandboxed app or game
- 5 Other interesting settings
Download and install the latest version from their GitHub releases page
Blocking internet connections is important in this particular setup, because the app you run is allowed to read -not modify- many of the files accessible to your current user, and could potentially upload them to the internet. If you really need internet for a program, consider configuring the sandbox with less privileges, for example by blocking read-access to sensitive directories
Make applications think they are running elevated allows you to install any program without giving administrator (full system control) permissions.
This is specially important if your current Windows user is an Administrator account. For extra isolation, you could create a separate Windows user account, a Standard User without admin permissions, but it's not required.
The status column shows if you correctly blocked admin permissions and internet connections:
The app will NOT ask you for admin permissions, because it has fake admin permissions.
It will be installed in a parallel file system inside the sandbox.
to make the sandboxed app launcher easily accessible.
One way to do this is: while the app is open, right-click on the main process and create the shortcut.
If you created a file using your app, you might need to take that file out of the sandbox with Recover files
Block read-access to cookies directories using closedfilepath
(important when letting the sandbox connect to the internet. Advanced users only)
Add these lines to Edit Ini Section in Sandbox Configuration for any particular sandbox
- For chrome and brave:
- For firefox and librewolf:
This can also be done through the UI here:
Use the Windows File Manager inside the sandbox to verify that you can't access those directories that contain cookies or other sensitive files.
Or use Privacy Mode but the free version will close programs after 6 minutes since this is a premium feature.
Total access for selected directories using openfilepath
You can let the the sandboxed app directly edit files in some specific directories. This can be convinient for some cases. You do this by adding a line like
OpenFilePath=C:\Downloads\ in Edit ini section in the config menu for each sandbox.
You can configure the sandbox as a App Compartment to significantly reduce the performance loss for heavier apps or games. But with the free version, we can only use this for 6 minutes before the app auto closes and you have to open it again.