How to Enable and Configure Sudo for Windows in Windows 11 for Elevated Command-Line Access

Running administrative commands in the Windows terminal has historically required right-clicking your terminal application and launching a separate “Run as Administrator” window, or relying on third-party utilities like gsudo. This context-switching disrupts command-line workflows, especially when an unelevated script encounters a single command requiring administrator privileges. In Windows 11 (version 24H2 and later), Microsoft introduced Sudo for Windows, an open-source, native command-line elevation tool that lets users execute administrative commands directly from standard unprivileged terminal sessions.

How Sudo for Windows Functions

Unlike Linux sudo, which leverages Unix user ID switching (setuid), Windows relies on security access tokens and User Account Control (UAC). When you execute a command with Sudo for Windows:

• UAC Elevation Prompt: Windows displays a standard UAC consent or credential prompt verifying administrative permission.
• Token Creation: A high-integrity security token is generated specifically for that individual process execution.
• Three Execution Modes: Supports running commands inline within the same window, in a separate hidden input stream, or inside a newly spawned window.

Enabling Sudo for Windows in Settings

Because Sudo is disabled by default for system security, users must explicitly activate it in Developer Settings:

1. Open the Settings app (press Win + I).
2. Navigate to System > For developers.
3. Scroll down to locate the Enable sudo section.
4. Toggle the switch to On.
5. Confirm the User Account Control verification dialogue.

Choosing Your Elevation Configuration Mode

Beneath the main toggle, click the dropdown menu next to Configure how sudo runs applications to choose between three operational modes:

1. Inline (In this window)

This is the most seamless Unix-like experience. Sudo executes the elevated process and redirects standard input, output, and error streams directly into your current terminal pane. Note: Microsoft restricts child process manipulation in this mode to mitigate potential token tampering from unprivileged processes.

2. With input disabled (Input closed)

Executes the elevated process in the current window and streams stdout/stderr back to you, but closes stdin (keyboard input). This prevents any background unelevated process from sending keystrokes into the elevated shell, providing a safer defense against injection attacks.

3. In a new window (Default)

Spawns a distinct, elevated console window to execute the command. Once the command completes, the child window automatically closes.

Enabling Sudo via PowerShell Command Line

You can also enable and configure Sudo directly using administrative PowerShell:

# Enable Sudo in inline mode
sudo config --enable normal

# Enable Sudo in input-closed mode
sudo config --enable disableInput

# Enable Sudo in new-window mode
sudo config --enable forceNewWindow

Practical Everyday Sudo Recipes

Once enabled, prefix any privileged command with sudo from standard PowerShell or Command Prompt:

# Flush DNS cache with elevated privileges
sudo ipconfig /flushdns

# Restart a Windows background service
sudo net stop "wuauserv"

# Edit system hosts file in Notepad
sudo notepad C:\Windows\System32\drivers\etc\hosts

Execution Modes Compared

Mode Flag	Standard I/O Redirection	Security Posture	Best Suited For
Inline (normal)	Full bidirectional (stdin, stdout, stderr)	Requires trusted local environment	Interactive scripts and text editors
Input Closed (disableInput)	Output only (stdin severed)	High security against keystroke injection	Automated commands like disk checks or service restarts
New Window (forceNewWindow)	Executed in new console window	Maximum isolation	Long-running installers and background tasks

Adopting native Sudo for Windows streamlines daily administrative tasks in Windows 11, bringing fast, familiar command-line elevation directly to your developer terminal.