Windows 11 can elevate one command from a normal, unelevated console with sudo. You need Windows 11 version 24H2 or later: open Settings > System > Advanced, turn Enable sudo on, then prefix the command with sudo, such as sudo netstat -ab. Windows shows a User Account Control (UAC) verification prompt before starting the target process with administrator permissions.
The default mode opens the elevated command in a separate window. That is the safest starting point for most users. Windows also offers an input-closed mode and an inline mode for cases where the command must remain in the current console, but both require more attention to the security implications.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Microsoft Windows 11 (USB) | $128.99 | Buy on Amazon |
| 2 |
|
Microsoft System Builder | Windоws 11 Home | Intended use for new systems | Install on a new PC |... | Buy on Amazon |
As an Amazon Associate I earn from qualifying purchases.
What Windows Sudo does
Windows Sudo is a built-in Windows 11 feature for elevating a command from the current unelevated console. Instead of opening an Administrator console first, you place sudo before the one command that needs higher privileges. The rest of the console remains unelevated.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Elevation is still controlled by User Account Control. Sudo does not silently bypass UAC, grant permanent administrator rights to your shell, or turn every command in the session into an administrator command. Windows asks you to verify that the target process should continue with administrator-level permissions, and only that launched process is elevated.
#1 Best Overall
- Less chaos, more calm. The refreshed design of Windows 11 enables you to do what you want effortlessly.
- Biometric logins. Encrypted authentication. And, of course, advanced antivirus defenses. Everything you need, plus more, to protect you against the latest cyberthreats.
- Make the most of your screen space with snap layouts, desktops, and seamless redocking.
- Widgets makes staying up-to-date with the content you love and the news you care about, simple.
- Stay in touch with friends and family with Microsoft Teams, which can be seamlessly integrated into your taskbar. (1)
This is useful when a mostly ordinary session contains one administrative task: inspecting protected networking information, editing a protected system file, installing a package globally, or opening an administrative utility. It is not a replacement for every form of Windows account switching. Sudo currently elevates a command as administrator from the current unelevated console; it does not run a program as another user.
Check that your Windows version supports Sudo
Sudo for Windows is available in Windows 11 version 24H2 and later. If the Enable sudo control is missing or the command is not recognized, verify the Windows release before changing anything else.
- Press
Win, typewinver, and open the result. - Confirm that the dialog identifies Windows 11 version 24H2 or a later release.
- For managed-device troubleshooting, also note the build. Microsoft’s Sudo policy documentation covers build
10.0.26100and later.
The policy documentation lists Windows 11 Pro, Enterprise, Education, and IoT Enterprise for administrative Sudo policy control. A work or school device can impose a policy even when the underlying Windows version supports Sudo, so edition and device management both matter when a setting is unavailable.
Version checking is worth doing before reinstalling shells, changing PATH entries, or assuming the command has been typed incorrectly. Sudo is an operating-system feature; an older Windows 11 release cannot gain it merely by installing a separate command-line package.
Enable Sudo in Settings
- Open Settings.
- Go to System > Advanced.
- Find Enable sudo and switch it to On.
- Leave the configuration at the default new-window mode unless you have a specific reason to keep the elevated process in the current console.
After it is enabled, use Sudo only on commands that actually need administrator rights. The setting enables the feature; it does not make your current command prompt an administrator prompt.
If the switch is unavailable on a personal computer that meets the version requirement, check the Windows edition and restart Settings after any recent feature update. On a managed computer, the explanation may be a device policy rather than a local configuration error.
Run one command as administrator
Use this syntax in your normal, unelevated console:
sudo command-and-arguments
For example:
sudo netstat -abWindows displays a UAC verification prompt. Confirm it when you recognize the command and understand what it will do. The command then starts with administrator-level permissions according to the selected Sudo mode. If you reject the prompt, the elevated process is not started.
Prefix only the command that needs elevation. Do not add sudo automatically to every command: administrator processes can modify protected files, services, networking settings, disks, and other system resources, and a mistake made with those rights has a larger impact.
Think of the prefix as applying to the command that follows it, including that command’s arguments. For a file-editing example, the editor is the elevated target, not the entire console session. Once that process exits, commands you type afterward remain subject to the original, unelevated context.
Choose how the elevated command runs
Windows provides three Sudo configurations. You can select them in Settings > System > Advanced. Microsoft also documents changing the configuration from an elevated command line with sudo config --enable <configuration_option>. The option names are shown below.
| Configuration | Option value | Where the elevated command runs | Console input | When to choose it |
|---|---|---|---|---|
| In a new window | forceNewWindow |
A separate window | The elevated process uses the new window | Default choice; Microsoft recommends it unless you are comfortable with the risks of the other modes |
| Input closed | disableInput |
The current window | The input handle is closed, so the elevated command cannot receive input from that console session | When you want inline execution while reducing the ability of unelevated processes to send input |
| Inline | normal |
The current window | The elevated process accepts input from the current console session | When the command must interact with the existing console and you understand the additional exposure |
Default: in a new window
forceNewWindow separates the elevated process from the console in which you typed the command. This is the easiest mode to reason about: the command appears in a new window, and interactive input is handled there. It is the recommended starting point because it avoids the extra input and output connection between an unelevated console and an elevated process.
A new window is not an indication that the command failed or that Sudo was ignored. It is the expected behavior of the default configuration. Look for the UAC confirmation first, then interact with the elevated window that opens.
Input closed
disableInput keeps the elevated command in the current window but closes its input handle. The command cannot accept keyboard input from that console session. Microsoft describes this as preserving some inline convenience while mitigating part of the risk associated with passing input from an unelevated process to an elevated one.
Use this only for commands that do not need interactive input. A program that waits for you to type a response can appear stuck because its console input is intentionally unavailable. It is useful when seeing output inline matters but supplying answers at the keyboard does not.
Recommended Free Tools
Inline
normal runs in the current window and allows the elevated process to receive input from that console. It is the most convenient mode for interactive command-line tools, but it has the greatest exposure among the three configurations. Choose it only when current-console interaction is necessary and you understand which unelevated processes share that console.
Changing a mode from the command line
Microsoft documents the following configuration form for an elevated command line:
sudo config --enable forceNewWindow
sudo config --enable disableInput
sudo config --enable normalUse one option at a time. The names correspond directly to the three Settings choices. If you are only learning Sudo, changing the setting in Settings is easier to verify visually; the command-line form is useful for administrators or repeatable setup after the feature is already available.
Understand the security trade-off
Sudo creates a connection between an unelevated sudo.exe process and the elevated process it launches. Microsoft warns that the input-closed and inline configurations can expose that connection to malicious processes. In disableInput, closing the input handle limits the ability of unelevated processes to send input. In normal, a process in the same console may be able to send input to the elevated process or obtain information from its output.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMicrosoft’s warning is explicit: Sudo for Windows can be used as a potential escalation of privilege vector when enabled in certain configurations.
That does not make Sudo unsafe by definition; it means the convenience of sharing a console with an elevated process has a security cost.
- Keep
forceNewWindowunless inline behavior solves a real problem. - Review the complete command before accepting the UAC prompt.
- Use elevation for the smallest possible operation rather than running a long script as administrator.
- Do not paste commands from an untrusted source into an elevated prompt.
- Use
disableInputonly for commands that can run without console input. - Use
normalonly when interactive input or output in the existing console is worth the additional risk.
UAC is the authorization boundary, not a decoration. A prompt that names an unexpected executable, path, or action is a reason to cancel and inspect the command again. Enabling Sudo does not remove that verification step.
Useful one-command examples
Inspect network connections and owning processes
Some details requested by netstat require administrator access. Run:
sudo netstat -abThe -a option asks for active connections and listening ports, while -b requests the executable involved. Sudo supplies the elevation for this invocation without making the entire console administrative.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Open the hosts file for editing
To open the Windows hosts file in Notepad with the required rights, use:
sudo notepad C:WindowsSystem32driversetchostsNotepad itself is the elevated target process. Save only the intended changes; an elevated editor can write to protected system locations. Microsoft advises considering a development environment or another alternative for work in system directories instead of routinely editing protected files.
Install a package globally with npm
A global package installation may need administrator rights on a particular setup:
Rank #2
- STREAMLINED & INTUITIVE UI, DVD FORMAT | Intelligent desktop | Personalize your experience for simpler efficiency | Powerful security built-in and enabled.
- OEM IS TO BE INSTALLED ON A NEW PC with no prior version of Windows installed and cannot be transferred to another machine.
- OEM DOES NOT PROVIDE SUPPORT | To acquire product with Microsoft support, obtain the full packaged “Retail” version.
- PRODUCT SHIPS IN PLAIN ENVELOPE | Activation key is located under scratch-off area on label.
- GENUINE WINDOWS SOFTWARE IS BRANDED BY MIRCOSOFT ONLY.
sudo npm install -g package-nameReplace package-name with the package you intend to install. If your development environment can be configured to use a user-writable package location, that can avoid elevation altogether. Sudo is the fallback for the individual installation that genuinely requires it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Start DiskPart
DiskPart is an administrative disk-management tool:
sudo diskpartDisk operations can change partitions and volumes, so verify the selected disk and command before confirming UAC. When a tool is interactive, the default new-window mode gives it a separate elevated console; inline input behavior depends on the mode you selected.
Sudo versus Runas
Sudo and runas solve different elevation problems. Choose Sudo when you are already in the correct user account and need to elevate one command from the current unelevated console. Choose runas when the key requirement is running a program as another user.
| Capability | Windows Sudo | runas |
|---|---|---|
| Starting point | Elevates a command from the current unelevated console context | Runs a program under a specified user account |
| Run as another user | Not supported | Supported |
| Verification mechanism | Uses a UAC verification prompt | May prompt for a password on the command line |
| Typical use | One administrator-level command for the current user | Launching a program with another account’s identity or permissions |
Sudo therefore is not a general replacement for runas. If you need a different account, use the account-switching capability of runas rather than trying to force Sudo to provide it.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat managed Windows devices can change
Administrators can control Sudo through the device policy ./Device/Vendor/MSFT/Policy/Config/Sudo/EnableSudo. The policy can disable Sudo or restrict which mode is allowed.
If the policy is disabled or not configured, users can normally enable Sudo in Settings and use it. A managed policy can instead remove the ability to enable the feature or prevent selection of a particular configuration. This explains why two Windows 11 24H2 devices can show different Sudo controls even when both meet the version requirement.
On a work or school computer, contact the device administrator if Enable sudo is missing, a mode is locked, or a policy message appears. Do not attempt to work around an organizational restriction by replacing Sudo with an unrelated elevation method.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common problems
The Enable sudo setting is missing
- Confirm that the device is running Windows 11, version 24H2 or later.
- Check whether the device is managed and whether the Sudo policy is disabling the feature or restricting its modes.
- Verify that you are looking under System > Advanced, not a similarly named developer or security page.
“sudo” is not recognized
The most likely causes are an unsupported Windows release or Sudo being disabled by device policy. Check the version and build, then review the Enable sudo control. If the setting is present but the command is still unavailable, a managed-device restriction may be preventing normal use.
The command opens somewhere unexpected
Check the selected configuration. forceNewWindow intentionally opens a separate window. disableInput and normal stay in the current window, but they differ in whether the elevated process can receive console input.
An interactive command does not respond
If you selected disableInput, the input handle is closed by design. Switch to the default new-window mode or, when the security implications are acceptable, use normal for a command that must receive input from the current console.
The UAC prompt does not appear
Check that Sudo is enabled, that the command is actually prefixed with sudo, and that policy has not disabled the feature. Sudo elevation uses UAC verification; it is not expected to elevate silently.
The command still fails after elevation
Administrator rights do not correct an invalid command, a missing executable, an incompatible argument, or a tool-specific failure. First test the command syntax without Sudo when safe, then add Sudo only if the error indicates that access rights are the problem. For destructive utilities such as DiskPart, stop rather than guessing when the target disk or volume is unclear.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →A practical decision guide
- Need one administrator command and no interaction with the current console: enable Sudo and keep
forceNewWindow. - Need the command displayed inline but it does not require keyboard input: consider
disableInput. - Need an interactive tool to read and write in the current console: consider
normalonly after accepting its input and output risks. - Need to run as a different Windows account: use
runas, because Sudo does not support changing users. - Need to work repeatedly in a protected system directory: first consider a development environment or user-writable alternative, then elevate only the operation that truly requires it.
Five-minute setup checklist
- Run
winverand confirm Windows 11 24H2 or later. - Open Settings > System > Advanced and enable Sudo.
- Keep
forceNewWindowunless a current-console requirement justifies another mode. - Test with a known, limited command such as
sudo netstat -ab. - Read the UAC prompt, verify the target, and cancel if anything is unexpected.
This checklist separates feature availability, configuration, and authorization. A successful setting change does not authorize a command by itself, and a successful UAC confirmation does not repair a command whose syntax or target is wrong.
For most Windows 11 users, the complete workflow is short: verify version 24H2 or later, turn on Settings > System > Advanced > Enable sudo, leave the default new-window mode in place, and prefix only the required command with sudo. The UAC prompt is the point at which you authorize that one elevated process.
Frequently Asked Questions
Which Windows 11 versions include Sudo?
Windows Sudo is available in Windows 11 version 24H2 and later. Microsoft’s policy documentation identifies build 10.0.26100 and later; use winver to check your release and build.
Where is the Enable sudo switch?
Open Settings > System > Advanced, then turn Enable sudo on. If the control is absent, check the Windows version, edition, and any work or school device policy.
Does Sudo make the whole terminal administrator-level?
No. It elevates only the command that follows the sudo prefix. Your existing console and later commands remain in their original unelevated context.
Why does Sudo open another window?
The default forceNewWindow configuration intentionally launches the elevated process in a separate window. This is Microsoft’s recommended starting mode and avoids sharing the current console connection.
Which mode should I use for an interactive command?
Use forceNewWindow for the safest general behavior. If the command must interact in the existing console, normal accepts input there, while disableInput deliberately prevents input and can make interactive programs wait indefinitely.
Is Windows Sudo the same as Linux sudo?
It serves the similar purpose of elevating a command, but Windows Sudo uses a UAC verification prompt and has three Windows-specific console modes. It also does not run programs as other users.
When should I use runas instead?
Use runas when you need to launch a program under another Windows account. Sudo elevates the current user’s command and does not provide account switching.
Can an organization disable Windows Sudo?
Yes. Administrators can use ./Device/Vendor/MSFT/Policy/Config/Sudo/EnableSudo to disable Sudo or restrict its allowed mode. On a managed device, contact the administrator instead of trying to bypass the policy.
Why is an elevated command still failing?
Elevation only changes permissions. It does not fix an invalid command, missing executable, incompatible argument, or tool-specific error. Check the command itself and use elevation only when the failure is actually permission-related.
The Bottom Line
On Windows 11 24H2 or later, enable Settings > System > Advanced > Enable sudo, keep the default forceNewWindow mode, and prefix only the command that needs administrator rights. Confirm the UAC prompt carefully; use disableInput or normal only when their console behavior is genuinely required.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
