Sudo for Windows

Yep, it&#x27;s really happening. Sudo is coming to Windows. It&#x27;s obviously not just a fork of the linux sudo - there&#x27;s enough that&#x27;s different about the permissions structure between OS&#x27;s that just a straight port wouldn&#x27;t make sense. But the dream of being able to run commands as admin, in the same terminal window - that&#x27;s the experience we&#x27;re finally bringing to users.<p>I&#x27;ve been working on this for the last few months now and I&#x27;m pretty excited to talk about it or answer any questions!

This smells like when PowerShell aliased curl and wget to a completely different command, with incompatible arguments.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;PowerShell&#x2F;PowerShell&#x2F;pull&#x2F;1901">https:&#x2F;&#x2F;github.com&#x2F;PowerShell&#x2F;PowerShell&#x2F;pull&#x2F;1901</a>

I already use <a href="https:&#x2F;&#x2F;github.com&#x2F;lukesampson&#x2F;psutils">https:&#x2F;&#x2F;github.com&#x2F;lukesampson&#x2F;psutils</a> which has a sudo.ps1, which I install via scoop (I know that&#x27;s a mouthful, but I just install scoop and run `scoop install sudo`). I used it from powershell literally just before I opened this article (after copy-pasting a password, I copy some random text laying around in the browser, like &quot;com&quot;, then run `sudo restart-service -name &#x27;cbdhsvc*&#x27;` to clear the clipboard history -- does not clear the current value). There is a UAC prompt, but it&#x27;s perfectly adequate for interactive work.

Side note that I&#x27;ve always found interesting: <i>sudo</i> is almost entirely maintained by one dude: <a href="https:&#x2F;&#x2F;github.com&#x2F;sudo-project&#x2F;sudo&#x2F;graphs&#x2F;contributors">https:&#x2F;&#x2F;github.com&#x2F;sudo-project&#x2F;sudo&#x2F;graphs&#x2F;contributors</a>

Well, sudo for Windows has been a thing for, like, a few years now?... <a href="https:&#x2F;&#x2F;github.com&#x2F;gerardog&#x2F;gsudo">https:&#x2F;&#x2F;github.com&#x2F;gerardog&#x2F;gsudo</a><p>Not sure if this is the same thing, but this definitely should have shipped with the very first implementation of &quot;oh, sure, you&#x27;re an Administrator, but not really, since we&#x27;re ignoring that bit&quot; a.k.a. User Account Control.<p>That would have saved about a metric ton of misguided &quot;here&#x27;s how to turn off UAC&quot; tutorials, but, ehm, yeah, anything to inject some life into the moribund Windows Insiders Program (the one where <a href="https:&#x2F;&#x2F;blogs.windows.com&#x2F;windows-insider&#x2F;" rel="nofollow">https:&#x2F;&#x2F;blogs.windows.com&#x2F;windows-insider&#x2F;</a> proudly headlines &quot;What’s coming for the Windows Insider Program in 2023&quot;), right?

When I was at Microsoft we did not use to consider UAC as a security boundary, since there were ways to bypass it. (I used to work on windows kernel security). I wonder how security team let this feature get shipped. Or perhaps now they consider UAC as a security boundary.

Considering the way PowerShell commands go, I assume this will be:<p><pre><code> RunWithAllTheElevatedPermissionsPossible --YesEvenThose .\inthisfolder.folder\. grep : The term &#x27;grep&#x27; is not recognized....</code></pre>

<a href="https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;sudo&#x2F;issues&#x2F;11">https:&#x2F;&#x2F;github.com&#x2F;microsoft&#x2F;sudo&#x2F;issues&#x2F;11</a><p>Interesting<p>&gt; Reserved<p>&gt; not blank!<p>&gt; We like to camp nice round number issues like this one, for future use.<p>Can you reuse GitHub issue numbers, or what could be their intention here?

I guess this is a thing on Windows now. However at the moment, it seems to be a very insecure thing. But hey it&#x27;s early days... I predict they&#x27;ll eventually get it right 125 patch Tuesdays from now.<p><a href="https:&#x2F;&#x2F;fosstodon.org&#x2F;@serghei@mastodon.social&#x2F;111900986825278831" rel="nofollow">https:&#x2F;&#x2F;fosstodon.org&#x2F;@serghei@mastodon.social&#x2F;1119009868252...</a>

Good. Although &quot;elevate&quot; from Nirsoft[0] generally worked well for me, it&#x27;s nice to have something more integrated into the system.<p>[0] <a href="http:&#x2F;&#x2F;nircmd.nirsoft.net&#x2F;elevate.html" rel="nofollow">http:&#x2F;&#x2F;nircmd.nirsoft.net&#x2F;elevate.html</a>

Sad that it&#x27;s Windows 11 only. I can&#x27;t upgrade. I have a normal, recent PC that I dual boot with Linux, and Microsoft wants me to keep Windows 10 in that constellation. Upgrading is prevented by a silly if statement, and there&#x27;s nothing I can do. It&#x27;s the first time a software vendor actively doesn&#x27;t want me to to have their latest software, but it is what it is.

Here&#x27;s hoping that &quot;Windows 12&quot; will be just a Window manager + Desktop running on Linux, with all existing bugs meticulously replicated to maintain backwards compatibility with Windows 95&#x2F;7&#x2F;8&#x2F;10&#x2F;11.

Windows tries to improve the developer experience… why not call it wudo or something funny since devex on windows is obviously a joke.

How do you wax lyrical for an entire article about the excellently engaging ergonomics of sudo and not mention Linux&#x2F;Unix family of OSes

Just pointing out that this is a really good tweet by the co-creator of sudo: <a href="https:&#x2F;&#x2F;twitter.com&#x2F;BobCoggeshall&#x2F;status&#x2F;1755681410596192604" rel="nofollow">https:&#x2F;&#x2F;twitter.com&#x2F;BobCoggeshall&#x2F;status&#x2F;1755681410596192604</a>

If it&#x27;s just an alias for &quot;runas&quot; that presents a UAC prompt window I will be disappointed.

Can&#x27;t wait for new malware to sudo-up the calculator &amp;&amp; bitsadmin.

Is this going to be a fully proper implementation with a sudoers config such that something like<p><pre><code> sudo c:\some\path\to\normally_needs_elevation_to_function.exe </code></pre> will work for my user in my current desktop session without an elevation prompt?

So Microsoft implicitly admits DOS sucks and creates a PowerShell prompt.<p>Then Microsoft doubles down and introduces a better prompt called WSL - the Windows Subsystem for Linux because the Windows command prompt still sucks... and this is just a Ubuntu VM in Windows.<p>And now they implement Sudo?<p>Microsoft hasn&#x27;t learned the first lesson of holes - when you find yourself in one, stop digging.

Ironic, didn&#x27;t we find out they had patented sudo a decade ago?<p><a href="https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2009&#x2F;11&#x2F;microsofts-psuedo-sudo-patent-doesnt-really-cover-sudo&#x2F;" rel="nofollow">https:&#x2F;&#x2F;arstechnica.com&#x2F;information-technology&#x2F;2009&#x2F;11&#x2F;micro...</a>

What&#x27;s the difference from opening a Terminal (Admin) window? Just that you can run a single command as admin? I must be missing something here

Scoop provides <a href="https:&#x2F;&#x2F;github.com&#x2F;lukesampson&#x2F;psutils">https:&#x2F;&#x2F;github.com&#x2F;lukesampson&#x2F;psutils</a>, which works really well, I am sure there are a million things people will tell me I am missing.

We already have runas for years now.<p>This looks like one of those KPI fulfilling projects.

&quot;Those who do not understand Unix are condemned to reinvent it, poorly.&quot; -Henry Spencer

Can you draw the part of the diagram in the blog post based off of these sentences? <a href="https:&#x2F;&#x2F;devblogs.microsoft.com&#x2F;commandline&#x2F;introducing-sudo-for-windows&#x2F;#input-closed-and-inline" rel="nofollow">https:&#x2F;&#x2F;devblogs.microsoft.com&#x2F;commandline&#x2F;introducing-sudo-...</a><p>In these configurations, sudo.exe will launch a new elevated process, an elevated sudo.exe process, and the original unelevated sudo.exe will establish an RPC connection with the new elevated process. In other words, information is passed from the unelevated sudo instance to the elevated one.

Do caffeinate next!<p>That reminds me, I have a half-written implementation here:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;AustinWise&#x2F;caffeinate">https:&#x2F;&#x2F;github.com&#x2F;AustinWise&#x2F;caffeinate</a>

There&#x27;s already a tool out there that works just fine: <a href="https:&#x2F;&#x2F;github.com&#x2F;gerardog&#x2F;gsudo">https:&#x2F;&#x2F;github.com&#x2F;gerardog&#x2F;gsudo</a>

If it were anyone but windows this sentence wouldn&#x27;t alarm me like it does:<p>&gt; Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session

While this looks more secure than the original, I don&#x27;t think modern operating systems should be investing resources into making privilege escalation easier for users to do. Considering UAC already exists it&#x27;s not like the additon of sudo is much worse to include so overall it may be better, but I feel investing resources to get rid of the need of users needing to elevate things would be time better spent.

If anyone on older Windows version, `elevate` tool is similar. Also if it isn&#x27;t the normal sudo command maybe call it something else as well.

I wrote a Node.js module that implemented similar feature years ago. <a href="https:&#x2F;&#x2F;github.com&#x2F;atom-archive&#x2F;node-runas">https:&#x2F;&#x2F;github.com&#x2F;atom-archive&#x2F;node-runas</a> (An updated fork can be found at <a href="https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;runas-redux" rel="nofollow">https:&#x2F;&#x2F;www.npmjs.com&#x2F;package&#x2F;runas-redux</a>)

One of the most important aspects of ‘sudo’ is that it takes the password of the user who started it, not the admin password. Will this ‘sudo’ work like that, or does it need the user to know an administrator password? If it needs an admin password, it shouldn’t be called ‘sudo’ (it would be an analog of ‘su’)

This will be a very controversial prediction, but mark my words: Windows will eventually use the Linux kernel.

Why is Inline not the default option?

Good news.<p>But I&#x27;m also bracing for millions of windows users that will now be able to sudo pip install.

Interesting. I&#x27;ve been pretty happy with all the Unix-related updates they&#x27;ve put out lately. WSL has been a godsend and the new terminal and powershell have worked a treat. Glad they seem to be continuing with it.

One day they&#x27;ll replace the kernel with Linux and nobody notices

Windows should just run Linux. For apps that really need the Windows OS, use something akin to macOS parallels. I really like WSL of course, but would prefer an inverted paradigm.

I&#x27;ve tried several times to code on Windows. It&#x27;s nearly impossible for a person used to Unix based systems. Seems it&#x27;s getting slightly better. Nice.

sudo on windows has a different risk profile given the malware ecosystem and lack of educated&#x2F; trained users.<p>95% of linux users are developers who understand risk -- though are prone to mistakes<p>99% of windows users are casual consumers .<p>Let&#x27;s keep this functionality narrowly accessible : restricted to developer mode and very formal consent. I suggest disabling it if it&#x27;s unused for a few days<p>this will only rejuvenate the malware market.

Next: systemd for windows?

Is it April 1st already?

what about &quot;runas&quot; :-) or this is considered psuedo-sudo?

… Checking the date… Nope it’s probably real (and makes sense!)

Should be ado (admin do), since superuser is a Linux thing

Can someone detail the differences between this and runas plz?

This adds a factor of enshittification for NT, NT doesn&#x27;t need 88 line PowerShell scripts, this &quot;sudo for Windows&quot; thing makes Windows seem like a teenager&#x27;s high school project. Windows NT already has runas, let NT be NT and let POSIX have sudo&#x2F;doas. Previously Microsoft hired the best of the best operating systems engineers in the USA who were from Digital and they proved to be people capable of making an operating system able to scale from MIPS to PowerPC&#x2F;DEC Alpha&#x2F;IA-32&#x2F;amd64&#x2F;Itanium with any combination of hardware and peripherics, now they&#x27;re allowing random people to push 88 line scripts and calling it a day. Very few people in this world deserve the privilege of touching any Windows NT code and even more few people deserve the possibility of pushing things to the build lab of Windows NT 10&#x2F;11 builds

The new command is named “sudo” because customer feedback and because MUSCLE MEMORY:<p>I hear you! We thought about some of the options you’re calling out here. <i>A lot of customers voiced having the muscle memory of doing similar flows on various operating systems was more important to them and that’s where we landed</i>. I totally understand your perspective and I do really appreciate the feedback. I’m always trying to learn from people like you so I can help to build things that will make your life better.<p>From <a href="https:&#x2F;&#x2F;devblogs.microsoft.com&#x2F;commandline&#x2F;introducing-sudo-for-windows&#x2F;#comment-6032" rel="nofollow">https:&#x2F;&#x2F;devblogs.microsoft.com&#x2F;commandline&#x2F;introducing-sudo-...</a>

alternative name suggestions:<p><pre><code> * asadmin * admindo * adminrun * admrun * elevate * privelev</code></pre>

This is good, but runas already exists. Its interface is shit. Improve it to make it not shit please. Don&#x27;t hijack the name of an existing command unless you&#x27;re going to re-implement its interface 100% compatibly.<p>This is like when PowerShell hijacked curl all over again...

After long 40+ years Windows has caught up.

missed opportunity to call it suwoop

hmmm, so I no longer need to right click on cmd and run as administrator?

Eh, nothing wrong with psexec.exe -i -s<p>Guess it&#x27;s good to have more options though.

reinventing Unix, poorly.

sudo make me a sandwich!

sudo cmd.exe<p>the new &quot;sudo bash&quot;

sudo deltree c:\

I just hope Windows sudo is not as braindead as PowerShell&#x27;s wget!

Get over it, Microsoft and migrate to a Unix kernel ;)

If you&#x27;d like to use sudo, it&#x27;s available in Linux.

If everyone thinks this is so great (just judging by the number of times it&#x27;s appeared in the HN top 30), why don&#x27;t they just run linux, instead of some sh!t immitation?<p>Everyone knows, if you can C colon, your running a M$ product...