Tag: Sandbox

HCSDiag.exe - Hyper-V Host Compute Service Diagnostics Tool

HCSDiag.exe – Hyper-V Host Compute Service Diagnostics Tool

As you know, Hyper-V is not just a server virtualization software anymore. Today, you can find Hyper-V technology across different operating systems, products, and services, like Windows Defender Application Guard, Windows Sandbox, Hyper-V Containers, or many more. Thanks to Ben Armstrong from the Hyper-V team, I found out that there is a tool in Windows to troubleshoot these Hyper-V containers called hcsdiag.exe or Hyper-V Host Compute Service Diagnostics Tool. The Hyper-V Host Compute Service Diagnostics Tool (HCSDiag.exe) is available in Windows 10 and Windows Server 2019 if you have the Hyper-V roles or virtualization features enabled, and can be helpful to troubleshoot Hyper-V containers, virtual machines (VMs), Windows Sandbox, Windows Defender Application Guard, Windows Subsystem for Linux 2 and more.

HCSDiag.exe - Hyper-V Host Compute Service Diagnostics Tool

HCSDiag.exe – Hyper-V Host Compute Service Diagnostics Tool

Let’s have a look at the HCSDiag.exe, which you can find in C:\Windows\System32. It provides you with a couple of different commands and options. However, keep in mind that not all features work with every type of container. Some features are limited to scenarios where the VM is being used under the same user context as the host, where it is all about protecting the host from the guest and not the guest from the host like in the server version of Hyper-V.

To install Hyper-V, check out the following posts:

HCSDiag.exe

hcsdiag <command> [options…]

  • list
    Lists running containers and VMs.
  • exec [-uvm] <id> <command line>
    Executes a process inside the container.
  • console [-uvm] <id> [command line]
    Launches an interactive console inside the container.
  • read [-uvm] <id> <container file> [host file]
    Reads a file from the container and outputs it to standard output or a file.
  • write [-uvm] <id> [host file] <container file>
    Writes from standard input or a host file to a file in the container.
  • kill <id>
    Terminates a running container.
  • share [-uvm] [-readonly] [-asuser] [-port <portnumber>] <id> <host folder> <container folder>
    Shares a host folder into the container.
  • vhd [-uvm] <id> <host vhdx file> <container folder>
    Shares a virtual hard disk file into the container.
  • crash <id>
    Forces a crash of the virtual machine hosting the container (only works for containers hosted in a virtual machine).

I will give you some examples of how you can use hcsdiag.exe to interact with some of the Hyper-V containers. Now again, this focuses mostly on technologies like Windows Sandbox, Docker Hyper-V Containers, WSL 2, and similar features.

You can find more documentation on Hyper-V on Windows Server or Hyper-V on Windows 10 on Microsoft Docs.

List all containers and Hyper-V VMs

With the hcsdiag list command, you can create a list of containers and Hyper-V virtual machines running on the host. Including Windows Sandbox, Windows Subsystem for Linux 2, and Application Guard.

hcsdiag.exe list

hcsdiag.exe list

Connect Console to Hyper-V containers and Windows Sandbox

You can also directly connect to the console of containers or the Windows Sandbox. Remember that it only works for Hyper-V containers where the guest is not protected from the host. Not for containers like Hyper-V VMs, where the guest is also protected from the host. If you need to remote into want console access or run commands against a Hyper-V VM from the host, check out PowerShell Direct for Windows VMs and hvc.exe for Linux VMs.

hcsdiag console connect

hcsdiag console connect

Here is an example where I am connected to a Windows Sandbox container using hcsdiag.exe.

hcsdiag Windows Sandbox

hcsdiag Windows Sandbox

But that also works with Dockers container (Hyper-V containers) running Windows and Linux.

hcsdiag Linux Container

hcsdiag Linux Container

HCSDiag console provides you with an interactive connection to interact with the container.

Additional HCSDiag.exe features and commands

The HCSDiag.exe also provides you with a couple of additional commands you can use. For example, the read command to read a file from the container and output it to the host or as a file to the host.

hcsdiag read

hcsdiag read

You can use the “share” command to share a host folder into the container or use “vhd” to mount a virtual disk file (VHD) file to a container. The hcsdiag kill command terminates a running container.

Conclusion

HCSDiag.exe – Hyper-V Host Compute Service Diagnostics Tool is excellent if you need to troubleshoot these Hyper-V containers, virtual machines (VMs), Windows Sandbox, Windows Defender Application Guard, Windows Subsystem for Linux 2 and more. If you have any questions, feel free to leave a comment.



Windows Sandbox

How to configure Windows Sandbox

With the latest release of Windows 10 (1903), Microsoft introduced a new feature called Windows Sandbox. Windows Sandbox is based on Hyper-V technology and allows you to spin up an isolated, temporary, desktop environment where you can run untrusted software. In this blog post, I will show you how you can set up and configure Windows Sandbox in Windows 10. I will also cover how you can do an advanced configuration of your Windows Sandbox using Windows Sandbox config files.

The sandbox is great for demos, troubleshooting or if you are dealing with malware. If you close the sandbox, all the software with all its files and state are permanently deleted. It is a Windows 10 virtual machines, with the advantage that it is built into Windows 10, so it leverages the existing OS, which gives you faster startup, less footprint, better efficiency, and easier handling, without losing security.

Dynamic Image

Source: Microsoft

Windows Sandbox is a lightweight virtual machine with an operating system. The significant advantage which makes it so small is the usage of existing files from the host, for data which cannot change. For the files which can change, it uses a dynamically generated image, which is only ~100MB in size.

There are much more exciting things happening with the Windows Sandbox like smart memory management, Integrated kernel scheduler, Snapshot and clone, Graphics virtualization and Battery pass-through. If you want to find out more about the Windows Sandbox, check out the official blog post.

Prerequisites

Windows Sandbox comes with a couple of requirements. How more powerful your machine is, the better the experience will be.

  • Windows 10 (1903) Pro or Enterprise build 18362 or later
  • 64-bit architecture
  • Virtualization capabilities enabled in BIOS
  • At least 4GB of RAM (8GB recommended)
  • 1GB of free disk space (SSD recommended)
  • 2 CPU cores (4 cores with hyperthreading recommended)


Windows Sandbox

Windows Sandbox – Isolated Windows Desktop

Today Microsoft announced a new feature called Windows Sandbox. Windows Sandbox is built based on Windows Container technology, which allows you to spin up an isolated, temporary, desktop environment where you can run untrusted software. The software you run and install in the Windows Sandbox does not affect the host. If you shut down the Windows Sandbox all changes and all software you installed in the Sandbox are gone again. This sounds very similar to the technology Windows Defender Application Guard already used to build a sandbox environment for Microsoft Edge.

Windows Sandbox Overview

Windows Sandbox

Windows Sandbox has the following properties:

  • Part of Windows – everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD!
  • Pristine – every time Windows Sandbox runs, it’s as clean as a brand-new installation of Windows
  • Disposable – nothing persists on the device; everything is discarded after you close the application
  • Secure – uses hardware-based virtualization for kernel isolation, which relies on the Microsoft’s hypervisor to run a separate kernel which isolates Windows Sandbox from the host
  • Efficient – uses integrated kernel scheduler, smart memory management, and virtual GPU

Windows Sandbox brings the advantages of Windows Containers and also adds a desktop. If you compare this to a Windows 10 Virtual Machine, the Windows Sandbox will consume much fewer resources, it starts up match faster and will be much more efficient with hardware resources. You can think of it like a lightweight virtual machine, which can share the same hardware but also the same kernel and memory as the host system (like a container).