Windows gets Linux’s sudo superpower: Here’s how to turn it on

The sudo command stands for “superuser do” and is one of the most important commands to know in Unix and Linux-based operating systems. (See the most important Linux commands for beginners.)

Sudo allows you to execute programs with the security rights of another user—usually the superuser or administrator/root—without having to acquire administrative rights for the entire system.

This is particularly useful for administrative tasks that require elevated privileges without you needing to constantly log on and off as an administrator or root user.

Now, this nifty command is also being introduced in Windows.

The use of sudo increases overall system security in two ways: first, by reducing the need for you to log in with a full administrator account with unchecked privileges, and second, by creating detailed logs of all the commands used with sudo.

Typical examples of sudo usage involve the installation of software packages and the adjustment of security authorizations. Thanks to its fine-grained control and logging, sudo ensures that administrative tasks are carried out securely and traceably.

Sudo complements RunAs

Microsoft has recognized the advantages of sudo and is now bringing the command to Windows 11 systems with the Windows 11 version 24H2 update. It’s not yet clear whether Windows Server 2022/2025 will also receive sudo, but it’s unlikely.

Dubbed Sudo for Windows, the source code is available on Github.

If you’re on an administrator account, you already have administrative rights anyway so sudo is of little use. Plus, in Windows, there’s already the RunAs command, which lets you start a command in the command line using another user account.

However, RunAs is cumbersome and not as effective as sudo.

The RunAs command is used in the format runas /user program, where the password of the specified user must be entered. For example, runas /user cmd starts the Command Prompt with administrator rights.

RunAs allows you (User A) to start a program in the user context of User B. In other words, User A can launch an application as if they were User B, and the respective application then runs completely in the context of User B, NOT in the context of User A with elevated rights.

In comparison, the sudo command offers similar functionality but with some differences in application and administration. For now, it isn’t possible with sudo to start a program as if you were someone else; sudo allows you to execute commands as superuser/administrator/root. (However, Microsoft is planning to add this functionality.)

While RunAs allows temporary elevation of permissions for a specific program or script, sudo provides more comprehensive and flexible control over permissions and logging. The sudo command also supports the delegation of specific commands without full administrator rights, allowing finer control of system administration.

Ultimately, sudo offers more options than RunAs. However, Microsoft has so far implemented very few of the functions available in the original sudo command in Windows, so Sudo for Windows currently has little in common with sudo in Linux.

Enabling sudo in Windows 11 version 24H2

Sudo isn’t enabled by default on all systems, which may or may not change in the future. While Sudo for Windows is pre-installed starting with Windows version 24H2, you’ll have to enable it yourself.

When you enter the sudo command on the command line, in the terminal, or in PowerShell, Windows 11 version 24H2 says that the command must first be activated:

In the Windows 11 settings, the corresponding option can be found under System > For developers at Enable Sudo. Before final activation, you must confirm via the User Account Control message.

You can also activate Sudo for Windows using the sudo command itself, where various options are available to you:

1. In a new window (forceNewWindow)
2. In the same window (normal)
3. Disable input (disableInput)
4. Deactivate sudo (disable)
5. Enable sudo (enable)

When starting sudo, you can already specify the configuration in which you want to use the tool, for example with:

sudo config --enable forceNewWindow (note the two dashes)

The option forceNewWindow is useful as it allows you to quickly recognize when a command with sudo runs with elevated rights.

You must run the activation once with administrator rights in Windows and confirm the User Account Control.

After activation, you can start programs with Sudo, for example with:

sudo netstat -ab

This command will open in a new window (if you used the forceNewWindow option during activation).

Author: Thomas Joos, Contributor