Windows Defender Antivirus can now run in a sandbox in Windows 10

Steve C said:

Good news but why isn't there an obvious option to turn on this worthwhile security option. Most users will be clueless the option exists.

Is there a command to check what has been set and to turn off the Sandbox option?

It's there, but not really there. Under the hood, the code is available to activate, but has not been generally publicly released. It's currently an Insider thing, with tight control. MS themselves say they are testing/moving cautiously due to performance impacts. Right now, just not enough empirical data to cut it loose on the public. So, no GUI or other setting to tell you if you are or not running it.

From page one article:

---

"How to enable sandboxing for Windows Defender Antivirus today

We’re in the process of gradually enabling this capability for Windows insiders and continuously analyzing feedback to refine the implementation.

Users can also force the sandboxing implementation to be enabled by setting a machine-wide environment variable (setx /M MP_FORCE_USE_SANDBOX 1) and restarting the machine. This is currently supported on Windows 10, version 1703 or later."

f14tomcat said:

It's there, but not really there. Under the hood, the code is available to activate, but has not been generally publicly released. It's currently an Insider thing, with tight control. MS themselves say they are testing/moving cautiously due to performance impacts. Right now, just not enough empirical data to cut it loose on the public. So, no GUI or other setting to tell you if you are or not running it.

From page one article:

---

"How to enable sandboxing for Windows Defender Antivirus today

We’re in the process of gradually enabling this capability for Windows insiders and continuously analyzing feedback to refine the implementation.

Users can also force the sandboxing implementation to be enabled by setting a machine-wide environment variable (setx /M MP_FORCE_USE_SANDBOX 1) and restarting the machine. This is currently supported on Windows 10, version 1703 or later."

I just enabled it on both my Production and Insider partitions on this machine.

0 disables it

Steve C said:

I found 2 instances of MP_FORCE_USE_SANDBOX in the Registry so you can also set it there.

Here's the registry value for this setting.

Code:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"MP_FORCE_USE_SANDBOX"="1"

DS1267 said:

I view through Task Manager > Details tab. Both are running regardless of which browser I have open. Both process show active even if no browser is open. The only way I was able to replicate was by trying to enable other than CMD Prompt.

Wish I could help you more, hopefully someone else can lend better advise.


Edit: If I view with Process Explorer - Sysinternals app it does not show. It is as you described if you run this app without admin privileges. Try to view by running Sysinteranls app with admin privileges, it should show correctly then.

Thanks, DS - it's showing for me in Task Manager > Details tab, just as you suggested. Appreciate the input.

JohnBurns said:

I don't seem to see a content process MsMpEngCP.exe running alongside with the antimalware service MsMpEng.exe, after enabling - anyone else checked this?

I have both under Details, John.

Wynona said:

I have both under Details, John.

Thanks for reply, Wynona - so do I - see post #17 - got it now.