What’s All the Fuss About?

Inprivate Desktop

What is it?

It’s Microsoft’s new method to let you test software without it harming your computer. It does this by creating a protected area where programs can run isolated from the rest of Windows. In Microsoft’s words, it is a “throwaway sandbox for secure, one-time execution of untrusted software”.

Why is it called a ‘sandbox’?

That’s the term software developers use to describe an environment in which users can analyse a program without it affecting anything else on their computer - just like a sandbox (or sandpit) is a safe place for children to play, notwithstanding toddlers throwing spades at each other. It’s especially useful for trying programs (such as beta versions) that may contain bugs.

Sounds useful. Can I use it?

No. At least, not yet. And when it does arrive, not in the Home version of Windows 10. A message mentioning it (see main screenshot) appeared briefly in the Preview build of Windows 10 Enterprise, which is sold to businesses. The message then disappeared - probably because it was sent by mistake - since when Microsoft has stayed silent about the tool’s existence.

Why would it be in Enterprise only?

To give the heads of IT departments a way of testing new programs without messing up their company’s computers, which is the sort of disaster that gives them sleepless nights.

But doesn’t everyone need that security?

Absolutely, so it’s disappointing that Microsoft isn’t planning to also add it to the Home version. That’s not to say you don’t already benefit from sandboxing, however. Much of the software you use sandboxes code as it runs, restricting what it can do to prevent it from damaging other parts of your computer. And Windows has a kind of sandbox built in anyway.

Oh? What’s it called?

User Account Control. Introduced in Windows Vista and improved for every version since, it asks for your permission to make changes to Windows (as long as you’re the administrator), whether they are requested by programs, other users or malware (see screenshot left).

Similarly, Microsoft Office sandboxes macros, preventing them from causing harm, while Adobe Reader now runs PDF files in isolation. These are all very useful, but if you experiment with lots of software you need a proper sandbox program.

Such as…?

Sandboxie ( www.sandboxie.com), which works for Windows 7, 8.1 and 10. But before running it, check the list of programs it conflicts with ( www.snipca. com/28812), including recent versions of Kaspersky. Another option is to run a program in a virtual desktop like the excellent Virtualbox ( www.virtualbox. org). This will shield your computer from any harm caused.

Does sandboxing work online?

Yes. Your browser sandboxes the web pages you visit, so they access only the online resources they need. This stops them performing unnecessary (and potentially harmful) tasks on your PC, such as taking control of your webcam or reading your files. Without this protection, visiting an infected website would be as bad as installing a virus. It’s also why playing games online is safer in theory than downloading them to play.

Do I also need it on my phone?

You should already have it. Both Android and IOS force apps to ask permission if they want to do something potentially unsafe, such as access your location. Apps are kept in separate sandboxes, so they can’t interfere with each other.