[REQ-PAW-074] Configure Sandbox Execution Environment for PAWs

Target Scope

• Applicable Systems: Privileged Access Workstations (PAWs) used for Tier 0 directory administration.
• Operating Systems: Windows 10 Enterprise (1607+) and Windows 11 Enterprise.

Implementation Details

• Priority: High
• GPO Path / Registry Location:
  • GPO Path: Computer Configuration\Preferences\Windows Settings\Environment
  • Registry Location:
    • HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment
      • MP_FORCE_USE_SANDBOX = 1 (REG_SZ)

Rationale

Forcing the Windows Defender scanning service (MsMpEng.exe) to run in a restricted AppContainer sandbox prevents privilege escalation. If an attacker exploits a parsing vulnerability in the engine, the compromise is contained inside the sandbox.

Legacy Impact & Compatibility

A system reboot is required to initialize the scanning process within the AppContainer sandbox.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

1. Navigate to: Computer Configuration\Preferences\Windows Settings\Environment
2. Right-click and select New -> Environment Variable
3. Configure Action: Update, Type: System, Name: MP_FORCE_USE_SANDBOX, Value: 1

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Download Script: Configure-PawDefenderSandbox.ps1

# Configure-PawDefenderSandbox.ps1
$EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
if (-not (Test-Path $EnvPath)) { New-Item -Path $EnvPath -Force | Out-Null }
Set-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -Value "1" -Type String -Force

To audit the hardening status: Download Script: Get-PawDefenderSandboxStatus.ps1

# Get-PawDefenderSandboxStatus.ps1
$EnvPath = "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Environment"
$SandboxVar = Get-ItemProperty -Path $EnvPath -Name "MP_FORCE_USE_SANDBOX" -ErrorAction SilentlyContinue
if ($SandboxVar -and $SandboxVar.MP_FORCE_USE_SANDBOX -eq "1") {
    Write-Output "Compliant"
    exit 0
} else {
    Write-Output "Non-Compliant"
    exit 1
}

Sources & Compliance References

• CIS Microsoft Windows 10 Benchmark: Section 18.9 (Windows Defender Antivirus configuration parameters)
• ANSSI Active Directory Hardening Guide: Protective controls baselines on Privileged Access Workstations