How do you turn off Smart App Control in Windows Sandbox?

Question

How do you turn off Smart App Control in Windows Sandbox?

Justin Sanity 10

Pretty simple, the title is descriptive enough I suppose.
How do you turn off Smart App Control in Windows Sandbox?

Sandbox has been instrumental in our testing phase, but has slowly become useless. To top it off, most settings being removed because they are apparently no longer system components but loosely attached "apps".

idk... sh*t is whack,

j

1 answer

Your answer

Answer 1

Tom Tran (WICLOUD CORPORATION) 3,120 Microsoft External Staff Moderator

Hi @Justin Sanity , Thanks for sharing the details!

Can you turn it off?

Technically yes but not with a normal setting though because there's no "off" button for SAC in Windows Sandbox.

Why?

As far as I know, Sandbox launches as a fresh mini-Windows every time, ignores your main PC settings, and starts with SAC enabled.

Therefore, when you close Sandbox, everything resets, so there’s no permanent toggle. Unfortunately, you’ll need a script each time you start it.

For more details check: Windows Sandbox

There's a workaround you could try, you can disable SAC for the current Sandbox session by adding a script to your .wsb configuration file. This script runs at startup and changes a registry key inside Sandbox:

<Configuration>
  <LogonCommand>
    <Command>reg add "HKLM\SYSTEM\CurrentControlSet\Control\CI\Policy" /v VerifiedAndReputablePolicyState /t REG_DWORD /d 0 /f</Command>
  </LogonCommand>
</Configuration>

This sets VerifiedAndReputablePolicyState to 0, turning SAC off for that Sandbox session. Full guide on .wsb files and LogonCommand: Windows Sandbox configuration

I also managed to find a similar post here: Solution to SAC blocking apps

Hope this helps! If you have any more questions, please feel free to ask. I'll be happy to help out!

Justin Sanity 10 Reputation points

2025-12-02T15:19:57.9366667+00:00

What always makes me laugh, is that no matter what happens most Microsoftians will just say "oh yeah, it was built like this intentionally". SAC shouldn't exist at all in sandbox.
Tom Tran (WICLOUD CORPORATION) 3,120 Reputation points Microsoft External Staff Moderator

2025-12-03T03:09:25.97+00:00

Hi @Justin Sanity ,

Thanks for sharing your thought.

According to Windows Sandbox and Common questions about Windows Sandbox, Windows Sandbox was built to be a clean, disposable environment. Every time you launch it, it starts fresh and throws everything away when you close it. That’s why Smart App Control (SAC) is always on, it’s part of the security baseline. The idea is to keep the sandbox locked down so nothing harmful slips through. From a security perspective, that makes sense.

But honestly? I get why this feels wack. You’re trying to test things, and instead of flexibility, you get a feature that feels glued in with no off switch. It’s confusing because Sandbox is supposed to help with testing, yet SAC makes it harder. I’m scratching my head too like why give us a sandbox and then bolt on something that limits what we can do?

You’re not wrong to feel frustrated. This design choice might be intentional, but it definitely clashes with what most people expect from a sandbox.

Like I said, there is workaround you could try using a .wsb configuration file with a LogonCommand that runs at startup inside the Sandbox.

If you have any questions, I'll be happy to assist you answer them!
Justin Sanity 10 Reputation points

2025-12-03T05:00:25.4433333+00:00

A sandbox should already be locked down by default. SAC provides an unnecessary level of protection inside a closed system. The way in which it is so needlessly implemented with no practical method of removing it leads me to believe that this was an oversight due to the terrible implementation of the Settings "app". Someone just needs to admit this so we can move on.
Tom Tran (WICLOUD CORPORATION) 3,120 Reputation points Microsoft External Staff Moderator

2025-12-03T06:43:54.7333333+00:00

Hi @Justin Sanity ,

I hear you.

Maybe you could share your feedback directly with the product team so they can consider changes in future builds. You can use this link here: https://aka.ms/feedbackhub

Microsoft does review these reports for design improvements from time to time so it's worth a shot.

Sorry for not being able to assist you further, I hope this suggestion is helpful to you!
Justin Sanity 10 Reputation points

2025-12-03T09:52:17.09+00:00

I appreciate the suggestion about the .wsb, but unfortunately it didn't seem to have an effect. Maybe there's something I need to do in order for it to work properly... will mess with it a bit. It's just very discouraging.
Arek Kensy 0 Reputation points

2025-12-05T14:04:55.0666667+00:00

This method doesn't work.

Share via

How do you turn off Smart App Control in Windows Sandbox?

1 answer

Your answer