How to allow browsers in sandbox to restore their windows on the correct virtual desktop?

[gexgd0419]

Web browsers allow users to restore their previously closed browser windows or even the whole session.

What's interesting about some browsers (especially chromium-based ones) is that they can remember what virtual desktop each of their browser windows is on. So when you restore a browser window, that window will be opened on the virtual desktop it was opened on before, as long as that virtual desktop still exists.

However, if you open the browser inside a sandbox, the browser will lose the ability to put the restored windows onto their corresponding virtual desktops. All the windows will be left on the current desktop.

So the question is, is there something I can do to allow browsers in a sandbox to restore their windows on the correct virtual desktop?

---

I did some research about that, but without much success.

As far as I know, the only documented API that allows programs to interact with Windows' virtual desktop feature is the IVirtualDesktopManager COM interface. The ability it provides for the programs is just the bare minimum, though.

It only has 3 methods.

• GetWindowDesktopId, which tells programs what virtual desktop one of its top-level windows is on. You will get the virtual desktop's ID (which is actually GUID). As each desktop's ID will not change after system reboot or desktop rename, you can store that ID for later use.
• IsWindowOnCurrentVirtualDesktop, which tells programs whether a top-level window is on the current virtual desktop.
• MoveWindowToDesktop, which allows programs to move one of its top-level windows to a specific virtual desktop. As you can only get the virtual desktop ID through GetWindowDesktopId, usually you just use this method to restore your windows on the desktop it was previously on.

So I wrote a simple program to test it. It can open a window, save the ID of the virtual desktop the window is on, or move the window to the desktop whose ID has been saved.

Outside the sandbox it worked just fine. But when I ran it inside a sandbox with the default settings, it was able to initialize COM environment and create an instance of IVirtualDesktopManager, but showed me an error when trying to get the desktop ID, saying "Class not registered".

Then I enabled the trace log, performed that operation again, and got a ComClass(U) {228826AF-02E1-4226-A9E0-99A855E455A6} ? line in my log. I added this GUID in the OpenClsid setting, and relaunched the program. It still failed to obtain the desktop ID, but showed me a different error message: "Operation aborted".

My system is Windows 10 Home 21H1 64-bit by the way. And the program I wrote is just a C++ program that does nothing except creating windows and invoking IVirtualDesktopManager::GetWindowDesktopId and IVirtualDesktopManager::MoveWindowToDesktop.

For those who are interested, here's my code. A single file C++ program.

VirtualDesktopTest Program Code.cpp

#include <sdkddkver.h>
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <ShObjIdl.h>
#include <string>

// Menu IDs
#define IDM_NEWWINDOW 1000
#define IDM_SAVEDESKTOPID 1001
#define IDM_RESTOREDESKTOP 1002

IVirtualDesktopManager *pDeskMgr;
int nWindowCount = 0;

// Shows the given message + the error description for the error code
void ReportError(LPCWSTR lpMessage, DWORD dwErrorCode)
{
    LPWSTR pDescription;
    FormatMessageW(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM, NULL, dwErrorCode,
        MAKELANGID(LANG_ENGLISH, SUBLANG_DEFAULT), (LPWSTR)&pDescription, 0, NULL);
    MessageBoxW(NULL, (std::wstring(lpMessage) + L"\r\n" + std::wstring(pDescription)).c_str(), NULL, MB_ICONEXCLAMATION);
    LocalFree(pDescription);
}

BOOL NewWindow()
{
    // Prepare a menu for the window.
    // When a window is destroyed, its menu is also destroyed
    // so an HMENU cannot be shared between windows and you must create one for each window

    HMENU hMenu = CreateMenu();

    HMENU hSub = CreatePopupMenu();
    AppendMenuW(hSub, 0, IDM_NEWWINDOW, L"&New window");
    AppendMenuW(hSub, 0, IDM_SAVEDESKTOPID, L"&Save desktop ID");
    AppendMenuW(hSub, 0, IDM_RESTOREDESKTOP, L"&Restore desktop");

    AppendMenuW(hMenu, MF_POPUP, (UINT_PTR)hSub, L"&Action");

    HWND hWnd = CreateWindowW(L"VirtualDesktopTestWnd", L"VirtualDesktopTest", WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, 0, CW_USEDEFAULT, 0, nullptr, hMenu, nullptr, nullptr);

    if (!hWnd)
    {
        return FALSE;
    }

    nWindowCount++;
    ShowWindow(hWnd, SW_SHOW);
    UpdateWindow(hWnd);

    return TRUE;
}

LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
{
    GUID* pGuid;
    switch (message)
    {
    case WM_COMMAND:
    {
        HRESULT hr;
        int wmId = LOWORD(wParam);
        switch (wmId)
        {
        case IDM_NEWWINDOW:
            NewWindow();
            break;
        case IDM_SAVEDESKTOPID:
            pGuid = new GUID;
            hr = pDeskMgr->GetWindowDesktopId(hWnd, pGuid);
            if (SUCCEEDED(hr))
            {
                SetWindowLongPtrW(hWnd, GWLP_USERDATA, (LONG_PTR)pGuid);
                WCHAR szGuid[39];
                StringFromGUID2(*pGuid, szGuid, 39);
                MessageBoxW(hWnd, szGuid, L"Desktop ID saved", MB_ICONINFORMATION);
            }
            else
            {
                ReportError(L"Cannot get desktop ID.", hr);
                delete pGuid;
            }
            break;
        case IDM_RESTOREDESKTOP:
            pGuid = (GUID*)GetWindowLongPtrW(hWnd, GWLP_USERDATA);
            // A window's UserData is always initially zero
            if (pGuid)
            {
                hr = pDeskMgr->MoveWindowToDesktop(hWnd, *pGuid);
                if (FAILED(hr))
                {
                    ReportError(L"Cannot move window.", hr);
                }
            }
            else
            {
                MessageBoxW(hWnd, L"Save a desktop ID for this window first.", NULL, MB_ICONINFORMATION);
            }
            break;
        default:
            return DefWindowProc(hWnd, message, wParam, lParam);
        }
    }
    break;
    case WM_PAINT:
    {
        PAINTSTRUCT ps;
        HDC hdc = BeginPaint(hWnd, &ps);
        RECT rc;
        GetClientRect(hWnd, &rc);
        std::wstring str = L"See the menu bar or right click for options.";
        DrawTextW(hdc, str.c_str(), str.length(), &rc, DT_CENTER | DT_VCENTER | DT_SINGLELINE);
        EndPaint(hWnd, &ps);
    }
    break;
    case WM_CONTEXTMENU:
    {
        POINT pt = { LOWORD(lParam), HIWORD(lParam) };
        if (lParam == 0xFFFFFFFF)
        {
            GetCursorPos(&pt);
        }
        TrackPopupMenu(GetSubMenu(GetMenu(hWnd), 0), 0, pt.x, pt.y, 0, hWnd, NULL);
    }
        break;
    case WM_DESTROY:
        pGuid = (GUID*)GetWindowLongPtrW(hWnd, GWLP_USERDATA);
        if (pGuid)
        {
            delete pGuid;
        }
        if (--nWindowCount <= 0)
        {
            PostQuitMessage(0);
        }
        break;
    default:
        return DefWindowProc(hWnd, message, wParam, lParam);
    }
    return 0;
}

void MyRegisterClass(HINSTANCE hInstance)
{
    WNDCLASSEXW wcex = { sizeof(WNDCLASSEX) };

    wcex.style          = CS_HREDRAW | CS_VREDRAW;
    wcex.lpfnWndProc    = WndProc;
    wcex.hInstance      = hInstance;
    wcex.hCursor        = LoadCursor(nullptr, IDC_ARROW);
    wcex.hbrBackground  = (HBRUSH)(COLOR_WINDOW+1);
    wcex.lpszClassName  = L"VirtualDesktopTestWnd";

    RegisterClassExW(&wcex);
}

int APIENTRY wWinMain(_In_ HINSTANCE hInstance,
    _In_opt_ HINSTANCE hPrevInstance,
    _In_ LPWSTR    lpCmdLine,
    _In_ int       nCmdShow)
{
    UNREFERENCED_PARAMETER(hPrevInstance);
    UNREFERENCED_PARAMETER(lpCmdLine);

    HRESULT hr = CoInitializeEx(NULL, 0);

    if (FAILED(hr))
    {
        ReportError(L"Cannot initialize COM.", hr);
        return hr;
    }

    hr = CoCreateInstance(CLSID_VirtualDesktopManager, NULL, CLSCTX_INPROC_SERVER, IID_IVirtualDesktopManager,
        (LPVOID*)&pDeskMgr);

    if (FAILED(hr))
    {
        ReportError(L"Cannot create VirtualDesktopManager object.", hr);
        return hr;
    }

    MyRegisterClass(hInstance);

    if (!NewWindow())
    {
        return FALSE;
    }

    MSG msg;

    while (GetMessage(&msg, nullptr, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    CoUninitialize();

    return (int)msg.wParam;
}

---

Here's something that may be off topic.

Seems that the sandbox can isolate programs from some Windows system features. The virtual desktop feature mentioned here is one of them. Also, for example, Microsoft Edge will show the media file playing in web pages in SystemMediaTransportControls, i.e. the system media control popup next to the volume popup, but sandboxed Microsoft Edge won't.

Windows has a feature that can display your Microsoft Edge tabs as items in the task switcher, i.e. the Alt-Tab view. As I often have hundreds of tabs and several browser windows open (and yes, I am using Microsoft Edge as my main browser), I turned off the feature in the system settings. However, it seems that this feature cannot be turned off completely, and it's causing bugs like getting your tabs displayed as a window of File Explorer, and displaying lots of stacked minimized ghost tab windows when you switch between virtual desktops, which I'm suffering a lot because I often use Microsoft Edge and the virtual desktop feature.

The worst bug for me though, is that if you have too many Microsoft Edge tabs open, like, a few hundred tabs or over 1,000 tabs, Explorer will be slowed down and will become unstable. (Well you can actually open that many tabs with just 16 GB of memory because the browser will automatically - or you can manually - discard tabs)
When you are having that many Microsoft Edge tabs open, restarting Explorer will take you half a minute. And opening Task View can take several seconds. If you decide to move a Microsoft Edge window full of tabs to another virtual desktop, you may have to wait for a minute - literally.

However, if I run Microsoft Edge in a sandbox, then that bug will disappear. Explorer and the Task View will still be as fast even though I'm having the same amount of Microsoft Edge tabs open. That may be because the isolation from a certain system component prevents Microsoft Edge from telling the system about the open tabs, and the system won't spend lots of CPU resources to process the data each time I open the Task View.
The drawback though, is that the sandbox also prevents Microsoft Edge from putting their windows on the correct virtual desktop.

[DavidXanatos]

I have investigated this issue and it seams not be easy to fix, you need to open the right IPC paths, some dynamic one I can't pinpoint how to do exactly instead of just opening everything.
Also it fails as long as sandboxie uses a restricted token, so making it work would require to break the security.

It might be possible to proxy the request over the service but that would require recreating a dummy IVirtualDesktopManager interface to intercept the calls

[DavidXanatos]

Ok there is an easy fix after all, but I'm not sure about the implications,
OpenClsid={AA509086-5CA9-4C25-8F95-589D3C07B48A}
would do the trick by moving the COM code to the helper service, but as sandboxie is currently set up it only does that for CLSCTX_LOCAL_SERVER not for CLSCTX_INPROC_SERVER as use for the VirtualDesktopManager
So removing the check for CLSCTX_LOCAL_SERVER may cause problems on the other hand individual GUIDs are surely eider used one way or the other so the check is redundant.

[gexgd0419]

I often open several browser windows, each of which may have dozens of tabs, and use virtual desktops to group those windows. I also changed the browser setting so that it will always restore my last browsing session when I launch it.

However, the browser that I mainly use, Microsoft Edge, has a bug that will make the system's Task View slow and make Explorer less stable when I have many open Microsoft Edge tabs (a few hundreds for example) and don't put Microsoft Edge in a sandbox.

So I have a sandbox that has the following settings.

• Do not change window titles or show border around windows of processes running in sandbox
• Allow direct access to %LOCALAPPDATA%\Microsoft\Edge\User Data so changes to browser's user data directory will not be isolated
• Allow direct access to my downloads folder
• The OpenClsid={AA509086-5CA9-4C25-8F95-589D3C07B48A} setting.

That's because I don't really want to isolate my browser profile states. I just want to get rid of that bug caused by the "integration" between Microsoft Edge and Windows 10. But the unawareness of VirtualDesktopManager of previous versions of Sandboxie would break my grouping of browser windows.

So after seeing that a "template for Windows 10 virtual desktop manager" has been added, I installed this version of Sandboxie, closed Edge that was running outside the sandbox, and then relaunch Edge in the sandbox mentioned above. Unfortunately, Edge failed to put the restored windows onto their corresponding virtual desktops. Chrome failed to do so, either.

Then I ran my program mentioned in the question description inside the sandbox to test this feature. It can get the correct virtual desktop ID now. But it couldn't move its window to the virtual desktop with that ID, saying "Access is denied".

After that I tried a program found on GitHub that utilizes Windows' undocumented, internal interfaces like IVirtualDesktopManagerInternal to manipulate virtual desktops. But that program also failed with "Access is denied" when running inside a sandbox.

[DavidXanatos]

hmm.. strange that saving works but restoring not, the operation being done in the sbieservice should have the required privileges, I'll look into that issue and if i can find a better workaround

[DavidXanatos]

Also in build 1.0.0 you will be able to use sandboxes with different levels of isolation that should allow the IVirtualDesktopManager work without OpenClsid so if you box an app not for security a lot of compatybility issues can be avoided.

[offhub]

The drawback though, is that the sandbox also prevents Microsoft Edge from putting their windows on the correct virtual desktop.

This is the reason why I use my main browser outside of the sandbox.