Windows 11 Build 26052 will most likely be available for download on Thursday or later this week, and will include the first public preview of "Sudo for Windows." In a since-deleted blog post, Microsoft confirmed that Sudo for Windows is a new way to "elevate commands directly from an unupgraded console session" and plans to open source the feature on GitHub.
Microsoft describes Sudo for Windows as "an ergonomic and familiar solution that allows users to elevate commands without first opening a new elevated console." Sudo for Windows is in the early stages of development and was recently discovered in a leaked Windows Server 2025 build.
Microsoft noted in a since-deleted blog post that Sudo can be enabled from the Settings > For Developers page and toggled on the "Enable Sudo" option.
You can also enable Sudo for Windows by running the following command in an elevated console session:
As we reported previously, Sudo for Windows currently supports three different configuration options:
In a new window (newWindow): In this configuration, SudoforWindows will open a new advanced console window and run commands in that window. This is the default configuration option when sudo is enabled. For example, if you run
sudonetstat -abA will open a new window and run the command in that window
Input off (disableInput): In this configuration, SudoforWindows will run the elevated process in the current window, but the new process will have its stdinput turned off when spawned. This means that the new process will not accept any user input, so this configuration is not suitable for processes that require further input from the user after being promoted.
Inline (normal): This configuration is most similar to sudo behavior on other operating systems. In this configuration, SudoforWindows will run an elevated process whose stdinput, stdoutput, and stderror are all connected to the current window. This means that the new elevated process can receive input and send output to the current window.
Microsoft explains how Sudo for Windows works
When you use sudo to run a process from the command line, a UAC dialog box appears asking the user to confirm the upgrade. You can also use sudo in the terminal, just like on Linux or macOS.
in new window
In this configuration, sudo.exe will launch a new elevated console window and run commands in that window. The new window's working directory is the same as the current window.
The new window will also use the same environment variables as the current window when it is started. The configuration process is similar to the runas command.
In these configurations, sudo.exe will start a new elevated process, the elevated sudo.exe process, and the original unelevated sudo.exe will establish an RPC connection with the new elevated process.
In other words, information is passed from the unraised sudo instance to the raised sudo instance. Specifically, the console handle of the non-upgraded process is passed to the dimension-upgraded process, allowing the dimension-upgraded process to read the input of the non-dimension-upgraded process and write the output to the non-dimension-upgraded process.
However, if sudo is configured in the "input off" configuration, the elevated process essentially does not get an input handle to the console and therefore cannot read the user's input.
When running sudo in an "inline" or "input-enclosed" configuration, you must be aware of its security implications. It is possible for a medium integrity process to drive the promotion process. In an "input blocking" configuration, this risk is mitigated because the elevated process will not be able to read the user's input.
Microsoft notes that it will also release documentation for Sudo for Windows and will share more details about the security implications of running sudo in an "inline" configuration.
"Our team is open sourcing Sudo for Windows, and we're excited to share more details about our plans in the coming months," the company noted in a now-deleted blog post.