Windows Sandbox: supported read-only verification of effective session security settings

There is currently no documented, supported, read-only interface that accepts a packaged wsb Sandbox ID and returns the effective ProtectedClient, RDP-redirection, networking, GPU, and mapped-folder state for that same session.

What the supported wsb surface can establish

For Windows 11 24H2 or later, the documented CLI provides:

wsb list --raw
wsb ip --id <sandbox-id> --raw

wsb list reports the current user’s Sandbox IDs, state, and uptime; wsb ip reports an address for a specified Sandbox. The documentation does not define an inspect/get-configuration command or fields linking the Sandbox ID to an RDP object, process, token, HCS compute-system ID, NIC, GPU assignment, or folder mapping ^1^.

The CLI starts with Windows 11 24H2 and remains described as an early command-line implementation. Package [IP Address] is not given a separate inspection contract, so the conclusion applies to the documented 24H2-or-newer CLI surface, including the stated 26H2 installation, but does not assert undocumented package behavior ^2^.

These commands are credential-free and do not alter policy. wsb list is discovery-only. Avoid connect, because it opens a remote desktop session; avoid winapp target as an inspection substitute because most target verbs can prepare or start Sandbox ^3^.

ProtectedClient and AppContainer

<ProtectedClient>Enable</ProtectedClient> is a requested configuration that directs Windows Sandbox to run its client in AppContainer isolation ^4^. At the Windows security layer, evidence that a particular process is inside an AppContainer is its token:

• TokenIsAppContainer, queried with GetTokenInformation
• TokenAppContainerSid, represented by TOKEN_APPCONTAINER_INFORMATION
• typically Low integrity plus package/capability SIDs

AppContainer tokens contain a package identity and capability SIDs ^5^. Reading one requires:

1. A correctly identified enforcing process.
2. A process handle with PROCESS_QUERY_LIMITED_INFORMATION.
3. OpenProcessToken(..., TOKEN_QUERY, ...).
4. GetTokenInformation for the relevant token classes ^6^ ^7^.

This is read-only, but it is not a complete supported Sandbox verification method: no documentation identifies which packaged-client process is the ProtectedClient enforcement subject or maps that PID/token to the public wsb ID. Access may also require SeDebugPrivilege when the process belongs to another account. Therefore, process-name inference, parent/child inference, or inspecting every package process cannot provide the requested supported correlation. No documented difference for this correlation is specified between packaged CLI and native-launcher sessions.

Clipboard, printer, microphone, and camera

The RDP properties are properties of a particular Remote Desktop ActiveX control instance—not a system-wide registry of existing Sandbox clients:

• AudioCaptureRedirectionMode is read/write and reports that control’s audio-capture redirection setting ^8^.
• RedirectClipboard is likewise a control configuration property ^9^.
• Camera configuration is exposed through the control’s nonscriptable interface.
• CorrelationId is a read-only GUID identifying that control’s remote session, available beginning with Windows 11 23H2 ^10^.

However, Microsoft documents no supported mechanism to:

1. obtain the packaged Sandbox client’s existing IMsTscAx object;
2. map its CorrelationId to a wsb ID; or
3. read a single negotiated/enforced redirection result.

Creating another ActiveX control only reads that new object’s requested settings. Available camera configurations similarly do not prove that a device was negotiated or redirected. Thus:

• Requested state: .wsb XML or runtime UI selection.
• Client-object state: getters on the exact originating ActiveX object.
• Negotiated/enforced state: no documented Sandbox-ID-correlated reader for these controls.

Compute system, networking, GPU, and folders

HCS can enumerate existing compute systems and query properties. Enumeration itself does not create or start one ^11^. Opening an existing system also does not start it, but HcsOpenComputeSystem requires GENERIC_ALL, despite the intended query being read-only ^12^. Access is restricted to administrators or members of Hyper-V Administrators ^13^.

HcsGetComputeSystemProperties returns the HCS compute-system ID and type, with optional documented property queries ^14^. The schema includes fields such as Id, Name, Owner, RuntimeId, and GPU assignment modes ^15^. It does not document:

• a wsb public-session-ID field;
• a supported mapping between the two ID domains;
• a Sandbox effective-policy projection;
• a returned property set proving NIC absence, GPU nonassignment, or mapped-folder access mode for that wsb session.

Consequently, matching by timing, owner, count, name, or an empty endpoint list is heuristic rather than supported correlation.

Product-team route

Request a supported effective-state inspection API through Feedback Hub → Report a problem/Suggest a feature → Security and Privacy → Windows Sandbox. Include Windows 26H2 build 26300.9711, package [IP Address], the exact wsb start/list --raw workflow, and the required correlation and state fields. Microsoft also accepts Windows Sandbox issues and feature requests through its public repository ^16^.

Specify that the API should be read-only, take a wsb ID, avoid connecting or starting a session, distinguish requested/negotiated/enforced state, and expose stable correlation to the enforcing client and compute system.

References

1. Windows Sandbox command line interface
2. Windows Sandbox versions | Microsoft Learn
3. CLI Documentation and Usage
4. Use and configure Windows Sandbox
5. Launch an AppContainer
6. OpenProcessToken function (processthreadsapi.h)
7. GetTokenInformation function (securitybaseapi.h)
8. IMsRdpClientAdvancedSettings7::AudioCaptureRedirectionMode property
9. IMsRdpClientAdvancedSettings5 interface
10. IMsRdpClientNonScriptable8::CorrelationId property
11. HcsEnumerateComputeSystems
12. HcsOpenComputeSystem
13. HCS Error Code
14. HcsGetComputeSystemProperties
15. JSON Schema Reference
16. Common questions about Windows Sandbox