Introducing Sudo for Windows 11

We’re excited to announce the release of Sudo for Windows in Windows 11 Insider Preview Build 26052! Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session. It is an ergonomic and familiar solution for users who want to elevate a command without having to first open a new elevated console.

We are also excited to announce that we are open-sourcing this project here on GitHub! We’re working hard to add more information about the project in the GitHub repo and will be sharing more details about our plans in the coming months! If you’re looking for additional functionality that Sudo for Windows does not provide, check out Gerardo Grignoli’s gsudo which has a number of additional features and configuration options.

How to enable Sudo for Windows​

To enable Sudo for Windows, navigate to the Settings > For Developers page in Windows Settings and toggle on the “Enable Sudo” option:




You can alternatively enable Sudo for Windows by running the following command in an elevated console session:

sudo config --enable <configuration_option>

How to configure Sudo for Windows​

Sudo for Windows currently supports three different configuration options:

1. In a new window (forceNewWindow)
2. Input closed (disableInput)
3. Inline (normal)

To change the configuration option, use the drop-down menu in the Settings > For Developers page in Windows Settings:



You can alternatively change the configuration option by running the following command in an elevated console session:

sudo config --enable <configuration_option>

Configuration Option 1: In a New Window​

In this configuration, Sudo for Windows will open a new elevated console window and run the command in that window. This is the default configuration option when sudo is enabled. For example, if you run:

sudo netstat -ab

A new window will open and the command will be run in that window:

Configuration Option 2: Input Closed​

In this configuration, Sudo for Windows will run the elevated process in the current window, but the new process will be spawned with its stdin closed. This means that the new process will not accept any user input, so this configuration will not work for processes that require further user input after elevation.

Configuration Option 3: Inline​

This configuration is most similar to the behavior of sudo on other operating systems. In this configuration, Sudo for Windows will run the elevated process with its stdin, stdout, and stderr all connected to the current window. This means the new elevated process can take in input and route output to the current window.

How does it work?​

When elevating a process from the command-line with sudo, a UAC dialog will appear asking the user to confirm the elevation:



Once the user confirms the elevation, the process will be elevated based on the configuration option selected by the user.

You can check out the optional parameters for the sudo command by running sudo -h in your console.

Once the user confirms the elevation, the process will be elevated based on the configuration option selected by the user.

You can check out the optional parameters for the sudo command by running sudo -h in your console.

In a New Window​

In this configuration, sudo.exe will launch a new elevated console window and run the command in that window. The new window will be launched with the same working directory as the current window. The new window will also be launched with the same environment variables as the current window. This configuration has a similar flow to the runas command.

Input Closed and Inline​

In these configurations, sudo.exe will launch a new elevated process, an elevated sudo.exe process, and the original unelevated sudo.exe will establish an RPC connection with the new elevated process. In other words, information is passed from the unelevated sudo instance to the elevated one. Specifically, the console handles from the unelevated process are passed to the elevated process which allows the elevated process to read input from the unelevated process and write output to the unelevated process. However, when sudo is configured in the “Input Closed” configuration, the elevated process will essentially not be passed the console’s input handle, so it will not be able to read input from the user.

Here is a diagram of how the process hierarchy looks:



It is important when running sudo in the “Inline” or “Input Closed” configurations to be aware of the security implications. It is possible that a medium integrity process can drive the elevated process. This risk is mitigated in the “Input Closed” configuration because the elevated process will not be able to read input from the user.

Over the coming months we will be working on expanding documentation for Sudo for Windows and will be sharing more details about the security implications of running sudo in the “Inline” configuration.

What’s next?​

Our team is working on open-sourcing Sudo for Windows and we’re excited to share more details about our plans in the coming months. In the meantime, we’d love to hear your feedback! Please share your feedback directly in the GitHub repository.