Sudo for Windows lets you run a command with administrator rights from a terminal opened normally, for example sudo netstat -ab. When the command does not behave as expected, the message shown almost always points to the cause: Windows too old, feature not turned on, feature blocked by a policy, or an unexpected run mode.
Problem
- sudo "is not recognized" as a command in PowerShell or Command Prompt.
- "Sudo is disabled on this machine. To enable it, go to the Developer Settings page in the Settings app".
- "Sudo is disabled by your organization's policy."
- The command opens in another window that closes immediately, while you expected the output in the current window.
- sudo config replies "You must run this command as an administrator."
Observe before acting
Type winver (Windows key + R, then Enter) and note the version shown. Microsoft states that Sudo for Windows is available from Windows 11 version 24H2. On Windows 10 or Windows 11 23H2, the command does not exist.
| What you see | Most likely cause | Step |
|---|---|---|
| sudo is not recognized, Windows older than 24H2 | Feature missing from this version | Step 1 |
| "Sudo is disabled on this machine" | Feature not turned on in Settings | Step 2 |
| "Sudo is disabled by your organization's policy" | Group Policy or enterprise management | Step 3 |
| New window that closes, output not visible | Default "new window" mode | Step 4 |
| "You must run this command as an administrator" | sudo config run without elevation | Step 4 |
Step 1: check that your Windows supports sudo
When to use it: the sudo command is not recognized at all.
Suggested solution
- Check the version with winver. Below 24H2, first install the updates offered in Settings > Windows Update, if your PC is eligible.
- If you cannot move to 24H2, simply open the terminal as administrator: right-click the Start button, then Terminal (Admin).
- Microsoft also mentions gsudo, an independent community project, for people who need options Sudo for Windows does not have. It is not a Microsoft tool: check where it comes from before installing it.
Expected result: after moving to 24H2 or later, the sudo option appears in Settings (step 2).
Rollback: none, this step changes nothing.
Step 2: turn on sudo in Settings
When to use it: the message "Sudo is disabled on this machine" is shown.
Microsoft warns that, in some configurations, sudo can be used as a potential privilege escalation vector. Only turn it on if you actually need it.
Suggested solution
- Open Settings > System > Advanced (French: Paramètres > Système > Avancé). On some builds the option is still on the For developers page, the one mentioned by the error message.
- Turn on Enable sudo (French: Activer sudo), then accept the User Account Control prompt.
- Close and reopen the terminal, then test with a command that needs administrator rights:
sudo netstat -ab
Expected result: a User Account Control window appears, then the command runs elevated.
Rollback: turn the same option off in Settings.
Step 3: sudo blocked by a policy
When to use it: "Sudo is disabled by your organization's policy", or the option is greyed out in Settings.
The Microsoft policy Configure the behavior of the sudo command (file Sudo.admx, Pro, Enterprise, Education and IoT editions) can disable sudo or force a mode. It relies on the EnableSudo value of the Software\Policies\Microsoft\Windows\Sudo key: 0 = disabled, 1 = force new window, 2 = disable input, 3 = normal.
Suggested solution
- Read the applied value (read-only, nothing is changed):
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\Sudo' -ErrorAction SilentlyContinue
- Work or school PC: the value comes from your organization. Ask your IT department; do not change it yourself.
- Personal PC running Windows Pro: open gpedit.msc, then Computer Configuration > Administrative Templates > System and look for the sudo policy. If it is set to Disabled, set it back to Not Configured, then restart.
Expected result: the command returns nothing (no policy), and the option can be changed again in Settings.
Rollback: set the policy back to the state you noted before the change.
Step 4: choose the right run mode
When to use it: sudo works, but not the way you expect.
Microsoft describes three modes:
| Mode | Behaviour | Microsoft's remark |
|---|---|---|
| forceNewWindow (default) | The command opens in a new window | Most cautious mode |
| disableInput | The command runs in the current window, without reading the keyboard | Reduced risk |
| normal (inline) | Behaviour closest to sudo on Linux and macOS | A non-elevated process can send input to the elevated process |
Suggested solution
- Open Terminal (Admin): configuration requires an already elevated terminal, otherwise it replies "You must run this command as an administrator".
- Choose the mode, for example:
sudo config --enable disableInput
- Replace disableInput with forceNewWindow or normal depending on your need. If a new window closes too fast to read the output, disableInput shows the output in the current window.
Expected result: the next command run with sudo follows the chosen mode.
Rollback: sudo config --enable forceNewWindow (the default mode).
What sudo does not do
- sudo cannot run a command as another user account: Microsoft states that this is the job of runas.
- The User Account Control prompt is still required: sudo does not bypass the confirmation.
- Microsoft's examples launch programs (such as netstat). To chain several PowerShell cmdlets, a Terminal (Admin) is simpler. If a script is refused, see our guide "Running scripts is disabled" in PowerShell.
Final check
- ☐ winver shows Windows 11 version 24H2 or later.
- ☐ The sudo option is turned on in Settings.
- ☐ No EnableSudo policy set to 0 is applied.
- ☐ sudo netstat -ab triggers User Account Control, then shows the output.
Sources
- Microsoft Learn: Sudo for Windows (French version: Sudo pour Windows)
- Microsoft Learn: Policy CSP - Sudo
- Microsoft GitHub: microsoft/sudo
Still having the problem?
Reply to this topic with the version shown by winver, your Windows edition (Home, Pro…), whether the PC is managed by an organization, the command you ran and the exact message. Replace user and machine names with fictitious values.