Is Kernel Stack Protection disabled for Sandboxed programs?

[ghost]

Template.ini says:

CallEnclave causes a BSOD when kernel stack protection is enabled

DisableWinNtHook=CreateEnclave
DisableWinNtHook=LoadEnclaveData
DisableWinNtHook=InitializeEnclave
DisableWinNtHook=CallEnclave
DisableWinNtHook=TerminateEnclave

Does that mean that while Sandboxie does not allow Kernel Stack Protection to function inside sandboxes? Sandboxie executable image itself does have Kernel Stack Protection (CET) flag.

[DavidXanatos]

No we don't have the ability to disable Stack Protection in the kernel, hence we disable the hooks for the enclave functions.

[ghost]

Off-topic, but what would you recommend for hardware-level isolation? Windows Sandbox?