Is there a lightweight, programmable Sandbox API for the Windows platform? [closed]
Google's Chrome is using 4 windows mechanisms to achieve this:
A restricted tokenThe Windows job objectThe Windows desktop objectWindows Vista only: The integrity levelsHave a look at:https://sites.google.com/a/chromium.org/dev/developers/design-documents/sandbox
They have a detailed description of what they're doing.
No, there is not.
I mean, you can use a different Windows account (with whatever permissions you consider appropriate), but then you need to be comfortable that the untrusted app can't break out of that. But you do have that same problem with VMWare (it has had bugs in the past that let you break out). Best thing to do is run in a Virtual Machine.
You may also be interested in Google's Native Client (also known as NaCl). This is a project that aims to be able to run (verifiable) x86 code inside a sandbox.