跳转至

AlertBeforeStart

AlertBeforeStart is a sandbox setting in Sandboxie Ini, available since Sandboxie Plus 1.14.1 and Sandboxie Classic 5.69.1. It is disabled by default.

[DefaultBox]
AlertBeforeStart=y

When enabled, AlertBeforeStart asks for confirmation before an unsandboxed Start.exe instance restarts itself inside the selected sandbox. It adds a user-consent step to eligible host-side Start.exe launches; it is not a confirmation prompt for every sandboxed process and is not a security boundary.

Covered launch paths

The confirmation applies to the host-side Start.exe sandbox-entry path. Covered examples include:

  • Start.exe /box:<box> program.exe and normal host-side Start.exe launches using the selected or default sandbox;
  • SandMan actions that launch through Start.exe, including Run Program, Run Web Browser, Run Email Reader, and Start Menu;
  • the current Sandboxie Plus Run Sandboxed shell integration, which ultimately launches through SandMan and Start.exe;
  • shortcuts generated by SandMan and shortcuts that invoke Start.exe directly.

This does not mean that every SandMan action is covered. The action must use the eligible Start.exe sandbox-entry path. Control-only operations that finish before that path, such as terminate, reload, and delete operations, are outside this setting. See Start Command Line for the broader command reference.

Launch paths that intentionally start the initial program outside the sandbox, such as the current disable-force and force-children bypass paths, do not reach this confirmation for that initial process.

In-sandbox and forced launches

An already-sandboxed Start.exe instance does not repeat this confirmation for normal in-sandbox launching. The setting therefore does not cover ordinary process creation that already occurs inside a sandbox, including:

  • CreateProcess child processes;
  • normal ShellExecute child launches;
  • browser renderer or GPU processes;
  • game launchers starting games;
  • other ordinary descendants of a sandboxed application.

Direct ForceProcess and ForceFolder launches also do not use this Start.exe confirmation path. Enabling AlertBeforeStart does not mean that all forced programs require confirmation. See Program Start Settings for the separate forced-program and forced-folder behavior.

Confirmation prompts

When the setting is enabled:

  1. Start.exe first asks whether to start a new program in the selected sandbox.
  2. A second warning may be shown when the apparent parent process does not look like a Sandboxie component based on its executable path under Sandboxie's installation directory.

The first prompt identifies the target sandbox. It does not show the executable being started, the full command line, the caller executable, or the caller process ID. Both prompts use Yes and No choices and have no “remember” option.

  • Yes continues to the second warning, when applicable, or to the sandbox launch.
  • No cancels the launch. Start.exe terminates with failure instead of launching the requested sandboxed process, so invoking scripts can observe the failed process result.

No dedicated SBIE denial message is generated solely because the user selected No.

The second warning uses an apparent parent-path check. It is not signature verification, trusted-publisher verification, Sandboxie binary authentication, or caller sandbox-state validation.

Silent and non-interactive use

The /silent switch does not suppress the AlertBeforeStart confirmation dialogs. /hide_window does not suppress them either. These switches affect other Start.exe UI behavior but do not bypass these confirmation prompts.

The feature expects an interactive confirmation dialog and provides no timeout. It should not be treated as a deterministic deny mechanism for non-interactive or service-style launches, and Sandboxie does not provide a separate logging or denial fallback when the dialog cannot be answered.

Elevation

The confirmation occurs before the sandboxed Start.exe instance is created and before the eventual target program's UAC or elevation request. AlertBeforeStart does not control elevation and is not a UAC or privilege boundary.

Security and policy limitations

The option can reduce unnoticed host-side use of Start.exe by requiring user confirmation before an eligible sandbox launch proceeds. It does not:

  • prevent sandbox escape;
  • authenticate Sandboxie components;
  • cover every way a sandboxed process can start;
  • replace StartRunAccess or other launch restrictions.

Confirming the alert does not override normal sandbox policies. If another policy denies the requested launch, selecting Yes does not grant permission. BreakoutProcess and BreakoutFolder are also separate mechanisms.

Sandbox Options

In Sandboxie Plus, open Sandbox Options > Program Control > Start Restrictions and use:

Display a pop-up warning before starting a process in the sandbox from an external source

The checkbox is unchecked by default. Its tooltip reads:

This setting can be used to prevent programs from running in the sandbox without the user's knowledge or consent.

Here, “external source” describes the eligible host-side Start.exe launch path. It is not a formally authenticated category of caller.

Scope and applying changes

The setting can be configured per sandbox, inherited through normal templates, or supplied through GlobalSettings fallback. There is no documented per-program or per-image syntax.

Start.exe reads the setting on each eligible sandbox-entry attempt. After a change is saved, it applies to the next eligible invocation; the short-lived launcher does not cache it between launches. SandMan, SbieSvc, and existing sandboxed programs do not need to restart merely because this option changed. If you edit Sandboxie.ini manually, the normal configuration-reload requirements still apply.

Sandboxie Plus and Classic

The launch behavior is implemented in the shared Start.exe. Sandboxie Plus exposes the checkbox in SandMan, while Sandboxie Classic's Start.exe can honor the INI setting without providing the SandMan interface.

Do not confuse this setting with Alert Process. AlertBeforeStart requests confirmation before eligible Start.exe sandbox entry, whereas AlertProcess is a separate alert feature with different direction and scope.

Version history

AlertBeforeStart was introduced in Sandboxie Plus 1.14.1 and Sandboxie Classic 5.69.1, disabled by default. The SandMan checkbox was added during the same release development cycle. The current behavior continues to use the host-side Start.exe confirmation model.