Sudo for Windows

Original Article ↗ Hacker News Discussion ↗

Microsoft is adding a native `sudo` command to Windows, letting users run individual commands with elevated privileges from an unelevated terminal instead of opening a separate “Run as administrator” shell. Commenters welcome the move as part of a broader trend of developer‑friendly features (WSL, Terminal, winget), but raise concerns about security, the decision to reuse the `sudo` name without full Unix‑style parity (e.g., sudoers, run‑as‑other‑user), and overlap with the long‑standing `runas` command and third‑party tools like gsudo. Many see it as a useful convenience and a win for developer ergonomics, while arguing that naming, compatibility, and long‑term security implications need careful handling.

Feature overview & initial reactions

  • Sudo for Windows lets users run elevated commands from an unelevated console, avoiding a separate “Run as administrator” window in many cases.
  • Implementation uses two sudo.exe processes: unelevated invokes an elevated one via RPC, passing command line, env vars, and a console handle so the target app can attach to the original console.
  • Many developers are pleased, calling it long‑overdue and consistent with recent dev‑focused improvements (WSL, Windows Terminal, PowerShell, winget). Others see it as redundant given existing tools.

Availability (Windows 10 / Server)

  • Current preview is Windows 11–only, but Microsoft says sudo.exe itself doesn’t depend on new OS features and a Windows 10 backport is actively being worked on; main hurdle is porting Settings UI.

Behavior vs runas and existing tools

  • runas has existed for years but opens a new window and doesn’t propagate working directory or environment; sudo adds options to reuse the current console and env.
  • It currently cannot run as arbitrary users or mimic sudoers-style policy; that’s acknowledged as “on the roadmap” at best.
  • Some ask why these capabilities weren’t added to runas instead of creating a new tool.

Naming and cross‑platform compatibility

  • Large subthread argues “sudo” is misleading since behavior and options differ significantly from Unix sudo and there is no sudoers file.
  • Critics compare this to PowerShell’s historic curl/wget aliases and fear documentation/search confusion; others say name reuse is acceptable if common use cases match and note there’s little chance of the real sudo coexisting on Windows.

Security concerns

  • Sudo is seen as an elevation‑of‑privilege vector by design, so some are surprised it shipped at all.
  • UAC still pops up; by design the UAC dialog shows Microsoft as publisher for sudo.exe, with details showing the actual command line. Several commenters find this misleading.
  • Concerns raised about complexity (multiple processes, RPC, handles) and whether this constitutes a formal “security boundary”; UAC is described as defense‑in‑depth, not a hard boundary.
  • Early third‑party analysis claims multiple issues; maintainers say many are already fixed internally but delayed in Insider builds.

Configuration modes

  • Default “new window” mode starts an elevated console to avoid security issues around mixing integrity levels in one window.
  • Optional “inline” / “disableInput” modes can run elevated commands in the existing console; these are explicitly called out as having extra risk but desired for ergonomics.

Existing alternatives

  • Several tools are cited: gsudo, scoop’s sudo.ps1, win‑sudo wrappers, NirSoft’s elevate, psexec -i -s, PowerShell Start-Process -Verb RunAs.
  • Many say they’ll keep using gsudo for advanced features (e.g., running as SYSTEM/TrustedInstaller); Microsoft’s blog even links to it as complementary.

Broader Windows developer experience

  • Some see sudo as part of a trend making Windows more Unix‑friendly (PowerShell, WSL2, winget) and speculate (often skeptically) about deeper Linux integration or even a future Linux‑kernel Windows.
  • Others argue Windows still feels fragmented (multiple shells, overlapping tools) and that “doing Unix on Windows” via WSL already makes native enhancements like sudo less compelling.

Miscellaneous

  • Discussion touches on corporate migration from Windows 10 to 11, hardware requirements, compliance workloads, and outsourced IT making OS upgrades non‑trivial.
  • A side thread notes Microsoft teams reserving “round-number” GitHub issues for epics/megathreads.