How to Enable Sudo in Windows 11 and Pick the Safest Mode

If you use the command line, you know the routine: a command fails with “access denied”, so you close the terminal, open a new one as administrator, navigate back to the right folder and run it again. Sudo for Windows removes those steps. This guide shows how to enable sudo in Windows 11, explains the three modes and which one is safest, and covers how it differs from sudo on Linux and from the older runas command.

Sudo needs Windows 11 version 24H2 or later, so it works on 24H2, 25H2 and 26H2. On earlier versions the setting does not exist.

What Sudo for Windows does

Microsoft describes Sudo for Windows as a way to run elevated commands, as an administrator, directly from an unelevated console session. You type sudo in front of a command in an ordinary Terminal, PowerShell or Command Prompt window, approve a User Account Control (UAC) prompt, and only that command runs with administrator rights. The rest of your session stays a normal, limited one.

That is safer than the habit many people fall into of running every terminal as administrator “just in case”. Elevating one command at a time limits what a mistake or a malicious script can do.

Check your Windows version

Press Windows key + R, type winver and press Enter. The window shows your version, for example 24H2 or 25H2. If you are on an older version, update Windows first; our guide to checking your Windows 11 version explains what the numbers mean.

How to enable sudo in Windows 11

1. Open Settings (Windows key + I).
2. Go to System > Advanced. In Windows 11 version 25H2 and later, Microsoft moved the developer options onto this page. On 24H2, look for System > For developers instead.
3. Find Enable sudo and switch it On. Approve the UAC prompt.
4. Below it, choose how sudo runs applications (see the modes below). Leave the default if you are unsure.

You can also change the mode later from an administrator terminal with sudo config —enable followed by forceNewWindow, disableInput or normal.

If the switch is greyed out on a work or school PC, your organisation manages it. Microsoft notes that managed devices may disable toggles on the Advanced settings page; ask your IT team rather than trying to work around it.

The three sudo modes

• In a new window (setting name: force new window). The command runs in a separate elevated window, similar to runas /user:admin. Risk: lowest; Microsoft’s recommended default.
• Input closed (setting name: disable input). The command runs in your current window, but cannot receive keyboard input from it. Risk: moderate.
• Inline (setting name: normal). The command runs in your current window and can receive input, like sudo on Linux or macOS. Risk: highest.

The convenience of the last two modes comes with a catch that Microsoft spells out: in Input closed and Inline modes, a malicious process could try to drive the elevated process through the connection between the unelevated and elevated sudo processes. Input closed reduces that risk by cutting off input. Inline allows an unelevated process to send input to the elevated one, or read its output, in the same console window.

Our advice matches Microsoft’s: keep In a new window unless you have a specific reason and understand the risk. If you often need to type answers into an elevated command, Input closed will not work for that, and opening a dedicated admin terminal is a cleaner choice than switching to Inline.

Using sudo: examples

Put sudo before the command you want to elevate:

• sudo netstat -ab shows which program owns each network connection, which needs administrator rights.
• sudo notepad followed by the full path of the hosts file (it sits in the drivers\etc folder inside C:\Windows\System32) opens the hosts file in Notepad with permission to save it.
• sudo winget upgrade —all updates apps that need elevation in one go (if you use the Windows Package Manager).
• sudo sfc /scannow runs System File Checker without opening a separate admin window. See SFC /scannow in Windows 11 for what it checks.

Each time, a UAC prompt asks you to confirm. In the default mode, the output appears in a new window that closes when the command finishes; add a pause or redirect output to a file if you need to read it afterwards.

Sudo for Windows vs Linux sudo vs runas

Sudo for Windows will feel familiar if you use Linux or macOS, but there are real differences:

• No password in the terminal. Elevation goes through UAC, the same prompt you see when installing software. You can still choose how often UAC prompts appear in Control Panel, but do not turn it off to avoid them.
• No other users. Microsoft states that sudo on Windows does not currently support running programs as another user. The older runas command does, and it can prompt for a password at the command line.
• No sudoers file. There is no per-command configuration; the only choice is the mode.

If you need more features, Microsoft’s own documentation points to community alternatives, but for most people the built-in version is enough.

When to use an admin terminal instead

Sudo is best for one-off commands. For longer administrative sessions, such as working through a repair checklist or running several DISM and SFC commands in a row, an administrator terminal is simpler: right-click Start and select Terminal (Admin). Our Windows Terminal guide shows how to set it up and how to open admin tabs.

Developers who also use Linux tools may want WSL2 on Windows 11, where the normal Linux sudo works inside the Linux distribution, separately from Sudo for Windows.

If sudo does not work

“sudo” is not recognised as a command. Your Windows version is older than 24H2, or the feature has not been set up. Check winver and install pending updates in Settings > Windows Update. If an update is stuck, see Windows 11 update stuck.

Sudo says it is disabled. The Enable sudo switch is off. Turn it on as shown above; on a managed PC, ask your administrator.

The window flashes and closes. In the default mode the command runs in its own window, which closes when the command ends. Redirect the output to a file, for example by adding a greater-than sign and a file name after the command, or switch that task to an admin terminal.

A command still says access denied. Some actions are blocked even for administrators, such as changing files that Windows protects or settings fixed by your organisation. Sudo does not bypass those protections, and you should not try to.

Turning sudo off again

Go back to Settings > System > Advanced (or For developers) and switch Enable sudo off. Commands that start with sudo then fail with a message that sudo is disabled, and nothing else on the PC changes. It is a reasonable switch to leave off on a shared family PC.

For more safety settings worth checking, see the Windows 11 security guide.