The Windows sandbox now uses a dedicated srt-sandbox user account instead of a Windows security group for network isolation. This eliminates the logout-and-back-in step that was previously required after installation.
Details
- WFP (Windows Filtering Platform) egress filter now keys on the sandbox user's SID rather than a group membership token
- Installation still requires one UAC prompt (
srt-win installornpx sandbox-runtime windows-install), but no logout is needed afterward - New
--sandbox-user-sidparameter replaces--group-sidin internal ACL commands - Removed the "discriminator group" concept that caused token-refresh issues
- New WFP egress verification step (
srt-win wfp verify) confirms the fence is active before use
Evidence
(search for "No logout is needed: the WFP filter keys on the dedicated \srt-sandbox\ user", "--sandbox-user-sid")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.