Are there PROs and CONs to the new custom tokens (SandboxieLogon)

[bastik-1001]

Are there PROs and CONs to the different tokens compared to the new feature and is it affected by being experimental?

Sandboxie to use custom logon tokens instead of the anonymous

The documentation and what I have been told before, on here, is that the anonymous token, makes Windows reject calls made from such a process. Is that still the case with the custom tokens?

It seems that custom tokens provide isolation against different sandboxes, if I understand that correctly.

[isaak654]

The Sandboxie feature "SandboxieLogon" can be located on the Sandboxie-Plus UI in Options menu -> Global Settings -> Advanced Config:

It seems that custom tokens provide isolation against different sandboxes, if I understand that correctly.

Indeed, that's what it does:

Source (in case the picture disappears): https://www.wilderssecurity.com/threads/sandboxie-plus-v1-2-0.445783/#post-3090427

There is a known limitation about SandboxieLogon=y, which is applied internally by default from v1.2.0 / 5.57.0 to v1.2.6 / 5.57.6:

• SSL connection fails with 3rd party anti malware tools when SSL scanning is enabled, the fix is to set SandboxieLogon=n
  [ESET / Kaspersky] Any website shows a connection error on sandboxed Firefox/Edge #2025 (comment)

Moral of the story: if no one reports the issue (with the most accurate details) in the AVs support forums, it could become a wasted feature for everyone but informed Sandboxie users.

[bastik-1001]

It's useful to know that SandboxieLogon=y can be applied per box, as well. This makes it possible to use that feature for some boxes, even with conflicting AV software installed, when those products only mess with browsers.

[joy-maruyama]

bastik-1001, are you sure that SandboxieLogon can be applied per box ? That would be very good news!

[bastik-1001]

Joy-1101, I have not tested it myself, but David himself stated that in another discussion/documentation/support question.

The SandboxieLogon should be set glboally but can be set per box (...)

Edit: Now I tested it with version 1.2.7, SandboxieLogon=y is globally set (manually) and gets applied to boxes; they get different SIDs. Then I added SandboxieLogon=n to one of the boxes and ProcessExplorer showed that it used the built-in anonymous SID.

[DavidXanatos]

yes it can,
you can even do the following
add SandboxieLogon=y globally
and SandboxieLogon=n to he box you run your browser in,
and et voila boxes are isolated and browser still works with ssl scanning

[joy-maruyama]

That is amazing! Thank you very much!