{"version":"2.1.169","anchor":"windows-sandbox-network-filtering-wfp-srt-win","canonical_anchor":"windows-sandbox-network-filtering-wfp-srt-win","heading":"Windows Sandbox Network Filtering (WFP \/ srt-win )","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.169\/e\/windows-sandbox-network-filtering-wfp-srt-win","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.169","markdown":"### Windows Sandbox Network Filtering (WFP \/ `srt-win`)\n\n**What**\n\nFull Windows Filtering Platform (WFP) integration for the Windows sandbox using the `srt-win` tool. Enables per-process network isolation via Windows discriminator groups and WFP filters, analogous to the macOS sandbox's network control.\n\n**Usage**\n\n`\/\/ In settings.json (windows-specific): { \"windows\": { \"groupName\": \"my-sandbox-group\", \"groupSid\": \"S-1-...\", \"sublayerGuid\": \"...\" } }` **Details** - Requires a one-time installation: `npx sandbox-runtime windows-install` (triggers one UAC prompt) - After install, you must log out and back in so the discriminator group SID enters your token - While the group SID is absent from your token, WFP filter-0 PERMITs all traffic \u2014 no connectivity disruption during setup - Default proxy port range is 60080\u201360089 (configurable); must match the range passed to `srt-win wfp install` - `--group-sid` overrides `groupName` lookup \u2014 use for domain environments where name resolution is unreliable - `SRT_WIN_PATH` environment variable overrides the `srt-win.exe` search path - Windows sandbox commands now run via `srt-win exec` instead of directly through cmd\/PowerShell **Evidence** `srt-win` integration (search for `\"srt-win.exe\"` or `\"Windows sandbox needs a one-time install\"`) \u2014 `$38()`, `YD7()`, `Oh6()` at line ~241773"}