25 ms·

Sudo for Windows

587 points by zadjii 3y ago

zadjii 3y ago
Yep, it's really happening. Sudo is coming to Windows. It's obviously not just a fork of the linux sudo - there's enough that's different about the permissions structure between OS's that just a straight port wouldn't make sense. But the dream of being able to run commands as admin, in the same terminal window - that's the experience we're finally bringing to users. I've been working on this for the last few months now and I'm pretty excited to talk about it or answer any questions!
- litheon 3y ago
  Great to see this on Windows! Hopefully this is much easier than using the runas command. Any particular reason the source code for sudo.exe wasn’t able to be open sourced along with the announcement of this feature?
- SushiHippie 3y ago
  Can you share if this will ever come to Windows 10, or will it be a Windows 11+ exclusive thing?
  - starik36 3y ago
    Same here. Would love it on Windows 10 and Windows Server 2016+.
    - blactuary 3y ago
      My left leg for Windows Terminal on Server 2016
  - vidanay 3y ago
    I'm not even sure Win11 is on my company roadmap, much less anything cutting edge like an insiders release. Windows 10 Enterprise compatibility is pretty much required for widespread adoption of Sudo for Windows.
    - pixel16 3y ago
      Windows 10 is EOl next year. I would bet your company has plans to move to 11 at some point in the near future. I work with customers daily to help to move to 11
      - FirmwareBurner 3y ago
        > I work with customers daily to help to move to 11 What issues are your customers having that they need profesional help to upgrade to a new Windows OS?
        Sakos 3y ago
        Is this a serious question?
        FirmwareBurner 3y ago
        Did I stutter?
        Sakos 3y ago
        Apparently, because you can't seriously be asking that question. You've clearly never worked in any kind of customer support position, because businesses and individuals need all kinds of help with a transition like that.
        FirmwareBurner 3y ago
        >Apparently, because you can't seriously be asking that question. YEs I was asking seriously. You still haven't explained what those challenges could be. All you do is mock people for their genuine questions without providing any actual answers/information to back up your vage statements. >You've clearly never worked in any kind of customer support position Then if that's clear for you I haven't never done that, why would you not understand I was being serious? Why are you being disingenuous here? Or you just enjoy being a troll? > because businesses and individuals need all kinds of help with a transition like that. Mate, 12 year-olds in my developing country can run Windows 11 updates/installs for you, including installing pirated licenses and cracks for you if you pay them 5 bucks. What could be so complicated that the internal IT of a company can't figure out the transition from Windows 10 to 11 that they need to pay outside help for that? Especially that backwards compatibility is one of Microsoft's fortes to make life easier for admins and convince companies to stay in their ecosystem.
  - zadjii 3y ago
    Already working on it :) You can follow https://github.com/microsoft/sudo/issues/2 https://github.com/microsoft/sudo/issues/2 for updates. Honestly, the hardest part will be porting the Settings app changes to the Windows 10 styles. `sudo.exe` itself doesn't really depend on any OS platform changes, and if it did, we'd have a _very_ compelling case to bring those features with us downlevel.
    - starik36 3y ago
      Where exactly is sudo.exe? It doesn't appear to be in the repo. I don't need the Settings portion. The exe itself would be immensely useful.
- ktpsns 3y ago
  Nice to see the author here! I have to say: I really like whats going on in Windows world from a developer perspective in the recent years. I am a hardcore Linux fanboy for decades but I have to admit that PowerShell, WSL, vscode, Windows Terminal and the recent open source strategy sounds very appealing to me. This is something MS/Win does much better in recent days compared to, for instance, Apple/Mac OS. I would love to see a tighter integration of winget into Windows. I recently used a fresh MS Windows Server 2023 installation and had a bad day to even get winget installed. I really hope that the current strategy does not turn out as somewhere between "embrace" and "extend"...
  - zadjii 3y ago
    Thanks! I think the team we're on has a very clear focus on making developers happy. Like, we're all ourselves, developers, so a lot of it is very self-serving. Anything we can do to make our own lives better is probably going to be a good thing for a lot of other developers too.
    - mixmastamyk 3y ago
      Shame the rest of the company is dedicated to making users unhappy to scrounge a few extra pennies. Users include developers of course. (See the transcript of Security Now 958 for recent details.)
  - yndoendo 3y ago
    Windows change is welcoming, yet still not quality. As stated by someone below, sudo is https://www.sudo.ws/ https://www.sudo.ws/. Microsoft should give it a proper distinctive name lie wsudo or psudo. Little thinks like is compounds the issues with Windows / Microsoft. Even continually sticking to old design patterns causes issues in development and deployment. Big name companies do not trust applications running on hosted Windows because of their current business practices. Microsoft does not even have a means to provided ease of deployment for air-gap system. This is the only way some big business will let products hosted on Windows to be in their facilities. Windows as become more problematic for me because of all the layers of security that need to be applied for companies to trust Windows. This causes issues such as having to stop typing because Visual Studios or VSCode cannot process key strokes in real time. Localization translation text standard still does not allow for containing singular and plural in the same key. Translations should be easily to update so the client can improve wording on the fly. Microsoft still recommends using resx and compiling a DLL. .....
- deleted 3y ago
  [deleted]
- mappu 3y ago
  Does the UAC prompt always say "Verified publisher: Microsoft"? Even without controlling stdin, malware at medium integrity could prompt to run a malicious command, and users will only see Microsoft's good name in the popup. Does this elevate within your own account token (i.e. will not work for non-Administrator users), or does it actually switch user (e.g. to LOCAL SYSTEM)?
  - dist-epoch 3y ago
    Putting Microsoft in the UAC prompt is indeed weird. It should be the info of the target binary. This feature sounds a bit rushed, and it's early preview, maybe they fix it by the final release.
    - zadjii 3y ago
      Yea, that's a limitation of UAC at this point, and probably not one we can avoid. The "Show details" dropdown on the dialog does however show the commandline you requested, so at least that's one way of making sure it's the thing you ran
      - SushiHippie 3y ago
        The best way would be, if it could say something like: Allow $PARENT_PROCESS_NAME to run $COMMAND with administrator rights. So if you would enter the following in cmd.exe: sudo notepad.exe ... It would say: Allow Command Processor Shell to run notepad.exe ... with administrator rights.
        zadjii 3y ago
        Maybe for Windows 2025 we can work with the UAC folks to get something like that. I'm still shocked to this day that we managed to ship this at all. One step at a time :)
        jraph 3y ago
        > I'm still shocked to this day that we managed to ship this at all Why?
- vimsee 3y ago
  > ..there's enough that's different about the permissions structure between OS's that just a straight port wouldn't make sense. Does this mean that the feature set of sudo for Windows can't be similar to the feature set found on sudo for *nix e.g. for BSD, MacOS, Linux..?
  - Joker_vD 3y ago
    Does sudo supports ACLs (which are the basis of Windows security model)?
    - deleted 3y ago
      [deleted]
    - vimsee 3y ago
      Sorry, I don't know.
    - marwis 3y ago
      It has it's own config file and can be configured to do just about anything: https://www.sudo.ws/docs/man/1.8.15/sudoers.man/ https://www.sudo.ws/docs/man/1.8.15/sudoers.man/
- darksfall 3y ago
  [flagged]
  - dijit 3y ago
    that’s rude and unfair. I really dislike windows but there’s a decent amount of good stuff in there. it’s just buried under the popups, ads, strange behavior and terrible business practices that are hostile to interop. This helps change that b IOCP is dope.
- neurostimulant 3y ago
  I think they should've named it something else to avoid confusion, especially if it doesn't have the same behavior as unix sudo. If it has different arguments and features, imagine the confusion of unsuspecting users searching how to use sudo in the future.
  - Springtime 3y ago
    > especially if it doesn't have the same behavior as unix sudo... imagine the confusion of unsuspecting users searching how to use sudo in the future. It's hard to imagine a company that size would name it so deliberately without realizing it would cause confusion in search engine results and such. A good faith assumption would be they wanted to make Windows more familiar to users of both but it also means that Windows will get mentioned in more Linux results over time to disambiguate it.
    - timnetworks 3y ago
      >It's hard to imagine a company that size would name it so deliberately without realizing it would cause confusion in search engine results and such. same microsoft as where I'm from?
    - herbst 3y ago
      So it's just some black hat SEO to seem more relevant to Linux users?
  - blibble 3y ago
    that's the standard microsoft way embrace (copy sudo), extend (add incompatible options), extinguish
    - Anon1096 3y ago
      I can say with 100% certainty that Microsoft is not going to extinguish sudo
      - 3y ago
- NikkiA 3y ago
  I've been using the 'sudo' that scoop offers for a while, and it has always done exactly what I wanted and completely removed the hassle of having to open a new cmd/powershell with 'run as administrator'. Plus it means I don't have to leave the comfort of Tabby.
  - earthwalker99 3y ago
    Back when I used scoop, I uninstalled that right away because I didn't like how scoop installed it on its own.
- VagabundoP 3y ago
  ha, thank you! I don't need it often but I have cursed for the want of it in Windows powershell.
- Repulsion9513 3y ago
  Why can't you do this with the tool that already exists to do the exact same thing, called runas?
  - debugnik 3y ago
    Also 'start -Verb runas' in Powershell.
    - westurner 3y ago
      Is there anything shorter than `powershell.exe -executionpolicy unrestricted -file`? powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages setup_windows.ps1: https://github.com/westurner/dotfiles/blob/develop/scripts/setup_windows.ps1 https://github.com/westurner/dotfiles/blob/develop/scripts/s...
      - jve 3y ago
        The executionpolicy merely allows you to write unsigned scripts. Not that it runs them elevated.
      - jodrellblank 3y ago
        powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages powershell -ex bypass -f ./setup_windows.ps1 -I -UpdateW -UpdateC (or whatever are short enough to uniquely identify parameter names for your script)
        westurner 3y ago
        Thx
    - janosdebugs 3y ago
      I really hope that sudo is going to allow one to capture the output of the thing running in sudo and handle errors better. I recently wrote an installer script in PowerShell and had to go through severe contortions to support privilege elevations for only a minimal part of the script. I needed to use start with runas to relaunch the same script with different options to continue the installation process and there's not much in the way of proper error handling either.
- tiff_seattle 3y ago
  Does this mean that I can run PSWindowsUpdate in a remote PowerShell session? If so, this is going to save me a lot of time. Also, AD management tools never work vie Enter-PSSession. Will stuff like that work as well?
- ocdtrekkie 3y ago
  I haven't seen anyone ask the important question: Is the mascot coming along for the ride? https://www.reddit.com/r/linuxmasterrace/comments/u4xeoy/in_case_you_didnt_know_sudo_has_its_own_logo/ https://www.reddit.com/r/linuxmasterrace/comments/u4xeoy/in_...
- dmead 3y ago
  Why don't you guys just use a regular shell? People just want a unix like command line. Windows seems to be doing a lot of work to avoid this.
- 29athrowaway 3y ago
  sudo (1980) is older than Linux (1991). I am not asking questions about sudo to someone assuming sudo is specifically Linux software.
- Affric 3y ago
  I am a Linux user but am interested in the architectural decisions you have made. I use doas and I know there are other alternatives. When coming up with your sudo what were your inspirations and what does sudo do that you decided you wanted to avoid?
- JaggedJax 3y ago
  The real question is, where will incidents be reported to if you're not in the sudoers file?
  - rezonant 3y ago
    The people demand to know.
  - teekert 3y ago
    So harsh right? I felt bad the first couple of times even if it was my own computer!
  - SLWW 3y ago
    I still to this day feel like I'm being snitched on, even if I own the hardware directly. Probably some MS server =|
    - DANmode 3y ago
      They collect and send the filenames on your disk, and other arbitrary stuff. Why not?!
  - numpad0 3y ago
    You'll be asked to enable .NET and Simple TCPIP services, and a mailbox file created under C:\ will open on Notepad every logins thereafter.
  - Pikamander2 3y ago
    Santa Claus, if XKCD is to be believed https://xkcd.com/838/ https://xkcd.com/838/
  - codetrotter 3y ago
    billg@microsoft.com
  - easyThrowaway 3y ago
    The boring answer would be the event viewer snap-in. Alternatively, a stern yet extremely polite mail from Raymond Chen asking what you were actually trying to accomplish.
- stuaxo 3y ago
  This is good, while I know RunAS exists, I'm more likely to run another terminal with admin than learn how to use it, if sudo is there I'll use that. Every little bit of friction removed is a good thing.
- hatenberg 3y ago
  didn't runas exist for ages?
- bArray 3y ago
  It seems interesting to me that Windows integrates more and more elements of Unix. Linux is open source and free, Apple develop an OS that sells specific hardware, and historically Windows has sold the software for generic hardware. Windows is unlikely to become a better Linux than Linux. Where is Microsoft's new business model going? Historically Office was a money maker, but Office online is a shambles and many users interact with Office via this interface - I see Office slowly dying in favour of open source options. I see Windows licenses being sold less and less in the future. Microsoft Lens is essentially buried at this point. There are the Surface laptops/tablets which are good but not special. Dedicated games console hardware will likely become less attractive as they slowly become glorified desktop PCs. I don't see Microsoft with big user shares in the software or hardware industries? There were a few good purchases such as Minecraft, GitHub (+), etc [1]. Is there something I'm missing? [1] https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Microsoft#Acquisitions https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio... (+) GitHub's new security model is outright hostile - to the point I no longer want to use it.
  - jodrellblank 3y ago
    What?? "Microsoft revenue was $198 billion in 2022, up $30.2bn (+18%) from a year earlier. When we do a breakdown by product streams, the largest source of Microsoft’s revenue was Office, with $44.9 billion (23% of the total). Just behind in the second place was Azure with $44bn of revenue (22% of total)." - https://www.kamilfranek.com/microsoft-revenue-breakdown/ https://www.kamilfranek.com/microsoft-revenue-breakdown/ Office alone increasing by $5Bn revenue in a year, increasing by $24Bn in ~3 years, being the largest chunk of revenue of the most valuable market-cap company on the planet, that's what counts as "slowly dying"??
- jaylittle 3y ago
  Isn't running commands as admin, in the same terminal window, already possible via the use of runas.exe? Granted I haven't daily driven Windows in years but IIRC that does the job albeit with clunkier syntax.
  - WorldMaker 3y ago
    runas doesn't support "same terminal window", it always has launched a new window. It's possible this sudo could have been implement as yet more clunky flags to runas, but it seems like making it a separate tool has benefits: off by default, whereas runas is a nearly always-on required built-in; more importantly a nicer less clunky syntax.
- ElMocambo_x4 3y ago
  What are the common points with Linux, and the differences?
- Xelbair 3y ago
  the real question is... isn't it pointless if you still get UAC prompt and cannot just log in via CLI? and what's the point of switching when gsudo basically does the same?
- nimbius 3y ago
  i guess id say thanks for all your hard work, but i dont use windows. exactly how is 'sudo for windows' different than the existing model in windows 10 where privilege elevation is a popup window and you click through it? arguably the current model is just sudo with nopasswd. how do you reconcile the idea that your effort --without principled reform of the windows security model at a fundamental level-- is just cargo-culting a more successful projects security model? 'Start-Process powershell -Verb runAs' is the same or different than this? Thanks for caring about security and trying to make things better. its hard, thankless and frustrating (and thats just the windows part ;))
- HeavyStorm 3y ago
  scoop install sudo. Sorry, this has been lacking for so long that you know... Late to the party.
- asveikau 3y ago
  I think there can be harm done when a re-implementation, especially a heavily divergent one, takes the name of an existing program. There's a reason OpenBSD introduced "doas" instead of calling their new thing "sudo". Reminds me of when PowerShell decided to have "wget" and "curl" cmdlets that didn't have any of the advanced features of the originals. Naively it sounds helpful. But it introduces confusion.
SushiHippie 3y ago
https://github.com/microsoft/sudo/issues/11 https://github.com/microsoft/sudo/issues/11 Interesting > Reserved > not blank! > We like to camp nice round number issues like this one, for future use. Can you reuse GitHub issue numbers, or what could be their intention here?
- TheCleric 3y ago
  You can edit the issue to be whatever you want later. But I’ve never seen anyone pre-reserve issue numbers like this.
  - zadjii 3y ago
    We've actually done that for a few years on the Terminal repo. It's great for things like megathreads / scenarios / epics. For example, I can tell you off the top of my head that microsoft/terminal#8888 is for "quake mode", and #4000 is the extensions thread. We even used to have a bot that would auto-camp anything that was a multiple of 1000 or 1111 :D
    - seabass-labrax 3y ago
      That's a rather fun hack for issue numbers. Of course, a more robust strategy would be to have a specialised short-link generator for special issues!
      - SushiHippie 3y ago
        As they work at Microsoft, they all have aka.ms and can generate any short link they like. But it won't work if another user talks about issue 1234, and you only have the short links in your head.
- djbusby 3y ago
  > nice round number issues But the number is 11? Is this Spinal Tap?
JohnMakin 3y ago
If it were anyone but windows this sentence wouldn't alarm me like it does: > Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session
- belltaco 3y ago
  Why is that?
  - SCHiM 3y ago
    In all honesty, I have the same reservations. If you look at the authz schemes between the different flavors of operating systems you see that the 'set-uid' concept is comparatively ancient, battle hardened and based on well understood mechanisms. This new functionality in Windows looks complicated. There's an architectural picture that involves: * Multiple processes * Windows RPC (On the basis of RPC? DCOM?) * Handle inheritance * Process integrity(?) * Token privileges(?) When UAC was introduced, there was a slew of bugs in the underlying RPC mechanism. I wonder if it will be the same. Can't wait to take a look at this in the debugger :) I also wonder if MSRC will consider this a "security boundary". Based on the fact that the text references process integrity(UAC), and that _is not_ a security boundary, I'm going to guess not. That means that this could potentially introduce bugs, but MSRC will not be handing out bounties to fix things. Which means that any bugs people find are less likely to be reported, and more likely to find their way into ransomware down the line.
alyandon 3y ago
Is this going to be a fully proper implementation with a sudoers config such that something like sudo c:\some\path\to\normally_needs_elevation_to_function.exe will work for my user in my current desktop session without an elevation prompt?
SteveNuts 3y ago
This will be a very controversial prediction, but mark my words: Windows will eventually use the Linux kernel.
- init2null 3y ago
  Why not just keep the existing kernel running with a small team? Drivers and backwards compatibility are critical to many of Microsoft's enterprise customers. Now that isn't necessarily true for Windows running in the cloud. Drivers don't matter as much there.
- righthand 3y ago
  I don’t disagree. How I think it will happen: Backwards compatibility will start to stray at Microsoft (their last bastion), leading to WINE becoming the go to tool for backwards compat support. Microsoft will create a linux variant or maybe just a DE and the rest will be history (just as Libre Office has begun to supersede MS Office). It is a matter of will and time that C-Suite will want to eliminate labor around Windows to maximize profits as it becomes more and more hardened in it’s feature set. Why maintain when you can utilize FOSS?
  - a_vanderbilt 3y ago
    In what business segment is Libre Office superseding MS Office? Furthermore, NT supports "personalities". Why bother with a full Linux kernel when they could adopt the personality a la SUA?
    - righthand 3y ago
      Superseding in compatibility. I’m not talking about business segments. They don’t have to adopt it, they will probably fork it.
      - bogantech 3y ago
        > Superseding in compatibility. It's going to be more compatible with Word than Word is?
ronniefalcon 3y ago
what about "runas" :-) or this is considered psuedo-sudo?
matthews2 3y ago
This smells like when PowerShell aliased curl and wget to a completely different command, with incompatible arguments. https://github.com/PowerShell/PowerShell/pull/1901 https://github.com/PowerShell/PowerShell/pull/1901
- moviuro 3y ago
  OpenBSD's team has already reacted and added Word to OpenBSD * https://marc.info/?l=openbsd-tech&m=170742832804260&w=2 https://marc.info/?l=openbsd-tech&m=170742832804260&w=2 * https://news.ycombinator.com/item?id=39309638 https://news.ycombinator.com/item?id=39309638
- skohan 3y ago
  Yes terrible move which will lead to much confusion and consternation in the future. But honestly I'm most amazed by the fact that there wasn't previously a way to run commands with elevated permissions in Windows. How did people work like that? Just run everything in an admin terminal super unsafely?
  - quickthrower2 3y ago
    You have to think about what terminal you need before opening it. I rarely need an admin terminal. That software is often installed by downloading and double click helps as that cuts out the command line. Devops is tricky though! You sometimes have to spawn other processes to get the elevated permissions.
    - skohan 3y ago
      I guess the reason it strikes me as strange is, on linux the usage of `sudo` helps you understand which operations might be dangerous in a fine-grained way So like if you are executing a series of commands, the one requiring admin privileges tends to be one you might want to be more careful about (i.e. altering system configs, or doing a potentially insecure operation) So if you are running everything in an admin terminal, it seems like you wouldn't have that extra check to remind you to be extra mindful of a particular operation, since everything you do in that terminal is in the same bucket
PreInternet01 3y ago
Well, sudo for Windows has been a thing for, like, a few years now?... https://github.com/gerardog/gsudo https://github.com/gerardog/gsudo Not sure if this is the same thing, but this definitely should have shipped with the very first implementation of "oh, sure, you're an Administrator, but not really, since we're ignoring that bit" a.k.a. User Account Control. That would have saved about a metric ton of misguided "here's how to turn off UAC" tutorials, but, ehm, yeah, anything to inject some life into the moribund Windows Insiders Program (the one where https://blogs.windows.com/windows-insider/ https://blogs.windows.com/windows-insider/ proudly headlines "What’s coming for the Windows Insider Program in 2023"), right?
- zadjii 3y ago
  gsudo is great! It's got a lot of features for power users, it's got a great community, and I can't recommend it highly enough. There's room here for us to be better together - Sudo for Windows can cover a number of in-box scenarios, with OS-side support for things like GPO, event logging, etc. But then for power users who need access to some of the wilder features of gsudo (running as TrustedInstaller?), that's always available too.
  - PreInternet01 3y ago
    I would love it if I, as a lifelong Windows fanboy, could offer anything but a snarky reply to the author of a new OS feature. Yet, good luck with that and don't look at the headstones of those who came before you is all I can muster.
- JoshTriplett 3y ago
  The blog post links gsudo right at the top: > If you’re looking for additional functionality that Sudo for Windows does not provide, check out Gerardo Grignoli’s gsudo which has a number of additional features and configuration options.
pjmlp 3y ago
We already have runas for years now. This looks like one of those KPI fulfilling projects.
- justusthane 3y ago
  That requires you to open an new terminal window. You've never been working in a standard terminal, tried to run a command that requires elevation, and been annoyed that you have to open a new window losing your command history? Or forgot to Run As and opened a non-elevated terminal by accident?
  - dwattttt 3y ago
    I believe the new window is to prevent SHATTER attacks (https://en.m.wikipedia.org/wiki/Shatter_attack https://en.m.wikipedia.org/wiki/Shatter_attack), to ensure that a higher privileged process has a higher privileged Window. Is that not a concern anymore with this new sudo, or is there some other mitigation involved not? EDIT: from the linked wiki page, "By design, all services within the interactive desktop are peers, and can levy requests upon each other. As a result, all services in the interactive desktop effectively have privileges commensurate with the most highly privileged service there."
  - pjmlp 3y ago
    "In this configuration, Sudo for Windows will open a new elevated console window and run the command in that window. This is the default configuration option when sudo is enabled"
    - famouswaffles 3y ago
      That's the default option but you apparently can still run the elevated command in the current window if you want.
      - pjmlp 3y ago
        Just like when using runas. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11) https://learn.microsoft.com/en-us/previous-versions/windows/...
oflebbe 3y ago
Next: systemd for windows?
- cogman10 3y ago
  Already there. Windows has had services for a long time managed pretty similarly to systemd/launchd.
  - madspindel 3y ago
    Well, compare how to start syncthing automatically on Windows: https://docs.syncthing.net/users/autostart.html https://docs.syncthing.net/users/autostart.html On Debian I could just type: systemctl --user enable --now syncthing.service Native systemd on Windows would be awesome. Microsoft should hire the creator of systemd...
    - bigstrat2003 3y ago
      Looking at that page, it looks like syncthing chooses to not provide a Windows service. That is where 100% of the complexity is coming from. If they did provide a Windows service, then it would be as simple as opening the service manager, and setting the startup type from "manual" to "automatic". It's not fair to blame Windows for the developers of an app not using its features. Similarly, if syncthing didn't bother to create a unit file on Linux, your example would no longer be a simple one liner. That wouldn't be systemd's fault though.
    - marwis 3y ago
      The manual GUI steps could be replaced with single command line on windows too. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks https://learn.microsoft.com/en-us/windows-server/administrat...
    - pjmlp 3y ago
      Powershell exists.
    - magicalhippo 3y ago
Night_Thastus 3y ago
Interesting. I've been pretty happy with all the Unix-related updates they've put out lately. WSL has been a godsend and the new terminal and powershell have worked a treat. Glad they seem to be continuing with it.
- al_borland 3y ago
  My theory is that Microsoft is working on eventually moving Windows over to the Linux kernel, and all these things they are doing are setting the stage and preparing for an easier transition.
  - Night_Thastus 3y ago
    As I said on the other post, I strongly doubt that. It offers few benefits and many roadblocks. It would be a monstrous amount of work, would throw into question many existing security-related certifications, break Microsoft's love of backwards-compatibility, etc. All MS is trying to do is make it easier for developers to develop on Windows for Windows, which it has ample incentive to do both internally and externally.
    - 0cf8612b2e1e 3y ago
      I have been continually disappointed that Microsoft has not released a seamless Windows virtualization system. WindowsX would run the new, redesigned APIs, but all of the legacy could run inside a sandboxed system to give the world the required decades to finally transition.
      - doubled112 3y ago
        Windows Subsystem for Windows?
        __egb__ 3y ago
        How about, “Winception”
HackerLemon 3y ago
What's the difference from opening a Terminal (Admin) window? Just that you can run a single command as admin? I must be missing something here
- Isthatablackgsd 3y ago
  Opening a terminal in admin window which means any commands you put in that windows will always have admin privilege, no matter what. What does Sudo is to only provide the root/admin privileges for specific inputted command. Once it is done, it goes back to user privileges. This way, the terminal window didn't need to end the session to go back to user privileges.
  - gwervc 3y ago
    That's a very slim proposition value, especially when multiple commands in a row require admin privileges.
    - MattPalmer1086 3y ago
      Sudo also allows you to control which commands can be elevated to admin. It also lets you elevate to admin without knowing the admin password, you elevate with your normal account password. Effectively, some commands can execute as admin, but the user generally cannot. So you can allow limited administration without giving everything away.
    - bigstrat2003 3y ago
      That's like saying (in a Linux context) "sudo is dumb because you can just use su". The two tools have different use cases.
    - whywhywhywhy 3y ago
      Good thing they're keeping the admin terminal too so you can just keep using that. Personally I think it's way more likely the admin command is the one off like installing something, changing a setting and then everything else before and between it are user commands that don't need to be in admin space most of the time.
scrlkrunner 3y ago
This adds a factor of enshittification for NT, NT doesn't need 88 line PowerShell scripts, this "sudo for Windows" thing makes Windows seem like a teenager's high school project. Windows NT already has runas, let NT be NT and let POSIX have sudo/doas. Previously Microsoft hired the best of the best operating systems engineers in the USA who were from Digital and they proved to be people capable of making an operating system able to scale from MIPS to PowerPC/DEC Alpha/IA-32/amd64/Itanium with any combination of hardware and peripherics, now they're allowing random people to push 88 line scripts and calling it a day. Very few people in this world deserve the privilege of touching any Windows NT code and even more few people deserve the possibility of pushing things to the build lab of Windows NT 10/11 builds
- Conscat 3y ago
  They decided kernel-mode graphics isn't a terrible idea, though.
  - int_19h 3y ago
    At the time that decision was made, it was the only way to get acceptable performance on typical computers on which NT was expected to run.
- zadjii 3y ago
  Thanks? But sudo * isn't a 88 line PowerShell script, it's a 1800 LOC Rust binary * isn't a NT kernel feature, it's a usermode executable * was made by (in my opinion) a perfectly decent engineer. That may be thinking too highly of myself though.
  - scrlkrunner 3y ago
    I see you are one of the heads of sudo for Windows, now based on your comment I see sudo for Windows with non-so unhopeful eyes. The comment about 88 lines PS code is about sudo.ps1 on the repo, thanks for clarifying. I'd like if more consideration is taken over sudo for Windows, as the MSDN docs relate: sudo at the moment has a clear distinction with runas and you must be the one who chooses what's best, I can infere the intention is not replacing runas, but then there's two ways to the same goal and each one with its differences. It's a similar situation than it was with WMIC and WMI for PS, being this case as a longer-standing approach, WMIC is deprecated but you can still use it if you want, however WMI for PS has the same functionality as WMIC and still offering benefits over WMIC, ultimately WMIC will be removed from future Windows releases. I'd be less confusing if this route is planned for runas and sudo
jhickok 3y ago
If it's just an alias for "runas" that presents a UAC prompt window I will be disappointed.
- tester756 3y ago
  Initially I thought ur concern is crazy as hell, because who would implement it in such a painful way? But then I read >When elevating a process from the command-line with sudo, a UAC dialog will appear asking the user to confirm the elevation: LOL But it seems like there are other ways to use it without this dialog >In this configuration, sudo.exe will launch a new elevated console window and run the command in that window. The new window will be launched with the same working directory as the current window. The new window will also be launched with the same environment variables as the current window. This configuration has a similar flow to the runas command.
  - RajT88 3y ago
    There's no way that second use case doesn't show a UAC prompt. The whole point of the split token / UAC elevation is to avoid elevation without user interaction. Imagine malware stuck as standard user just running itself like: cmd.exe /c sudo malware.exe
  - calamari4065 3y ago
    Having the sudo command open an entirely separate terminal as an admin user is absolutely ridiculous and completely on brand for Microsoft. Along with the UAC dialog, I can't think of a worse way for sudo to behave. What's wrong with entering your password for sudo? How is UAC more secure than a password?
    - hughesjj 3y ago
      UAC is less secure than a password right?
    - aksss 3y ago
      If you’re running as local admin you just get the dialog, but you’re not using a local admin as your daily driver user acct, right? ..Right? :) If you’re logged in as a standard user, UAC prompts you for new username and password to authenticate and authorize the privileged operation.
spogbiper 3y ago
sudo cmd.exe the new "sudo bash"
BiteCode_dev 3y ago
Good news. But I'm also bracing for millions of windows users that will now be able to sudo pip install.
tonymet 3y ago
sudo on windows has a different risk profile given the malware ecosystem and lack of educated/ trained users. 95% of linux users are developers who understand risk -- though are prone to mistakes 99% of windows users are casual consumers . Let's keep this functionality narrowly accessible : restricted to developer mode and very formal consent. I suggest disabling it if it's unused for a few days this will only rejuvenate the malware market.
- slaymaker1907 3y ago
  There's still the UAC prompt which should help mitigate risk, plus it's locked behind developer settings.
  - tonymet 3y ago
    that's good news
lostruinsofraku 3y ago
Can you draw the part of the diagram in the blog post based off of these sentences? https://devblogs.microsoft.com/commandline/introducing-sudo-for-windows/#input-closed-and-inline https://devblogs.microsoft.com/commandline/introducing-sudo-... In these configurations, sudo.exe will launch a new elevated process, an elevated sudo.exe process, and the original unelevated sudo.exe will establish an RPC connection with the new elevated process. In other words, information is passed from the unelevated sudo instance to the elevated one.
- zadjii 3y ago
  Yep, that's basically the entire diagram. The information that's passed is basically just the commandline, env vars, and a handle to the console of the unelevated sudo's console. Once it's got a handle to the console, the elevated sudo can spawn the target app attached to the original console, rather than a new one. Simple as that!
charcircuit 3y ago
While this looks more secure than the original, I don't think modern operating systems should be investing resources into making privilege escalation easier for users to do. Considering UAC already exists it's not like the additon of sudo is much worse to include so overall it may be better, but I feel investing resources to get rid of the need of users needing to elevate things would be time better spent.
RadixDLT 3y ago
hmmm, so I no longer need to right click on cmd and run as administrator?
johnea 3y ago
If everyone thinks this is so great (just judging by the number of times it's appeared in the HN top 30), why don't they just run linux, instead of some sh!t immitation? Everyone knows, if you can C colon, your running a M$ product...
- fortran77 3y ago
  Linux is just some [explitive deleted] imitation of Unix, where the sudo command originated. I run Windows as my primary development environment because it's better. Linux and other OSes run in VMs.
  - washadjeffmad 3y ago
    I don't think you should be downvoted for answering parent's question. It's helpful for understanding a mindset that not everyone possesses. Which version of Windows do you currently run, and what do you feel Windows has or does that makes it superior for your development work?
    - fortran77 3y ago
      I run Windows 11. It has first-class support for Linux, with WSL, and the Windows Environment has first-class support for NVIDA graphics, popular productivity and entertainment software. It's reliable, stable, and performs well, with commercial support and scheduled major and minor updates. It's consistant. I can develop software for Windows 11 and be sure that everyone else with Windows 11 can run it.
      - msla 3y ago
        Windows 11 has ads in its file manager, right?
        fortran77 3y ago
        Most of the complaints I hear are from people running an unlicensed copy and complaining it nags them.
niux 3y ago
There's already a tool out there that works just fine: https://github.com/gerardog/gsudo https://github.com/gerardog/gsudo
dundarious 3y ago
I already use https://github.com/lukesampson/psutils https://github.com/lukesampson/psutils which has a sudo.ps1, which I install via scoop (I know that's a mouthful, but I just install scoop and run `scoop install sudo`). I used it from powershell literally just before I opened this article (after copy-pasting a password, I copy some random text laying around in the browser, like "com", then run `sudo restart-service -name 'cbdhsvc*'` to clear the clipboard history -- does not clear the current value). There is a UAC prompt, but it's perfectly adequate for interactive work.
- NikkiA 3y ago
  Same here, and if you look at the output of whoami /priv you'll find that using luke's sudo provides exactly the same priviledge escalation as 'run as administrator' does
- ComputerGuru 3y ago
  Scoop install gsudo is even better (still run as sudo).
- Perz1val 3y ago
  Mind that Windows has clipboard (win+v) history and you may've that enabled
  - dundarious 3y ago
    That is precisely what I'm clearing.
yrro 3y ago
This is good, but runas already exists. Its interface is shit. Improve it to make it not shit please. Don't hijack the name of an existing command unless you're going to re-implement its interface 100% compatibly. This is like when PowerShell hijacked curl all over again...
PeterStuer 3y ago
Can someone detail the differences between this and runas plz?
- mikestew 3y ago
  runas doesn’t pass current directory, or environment (at least the last time I used runas on Windows 10). I vaguely recall that runas has a kinda low limit on command line length, too ( I’m possibly misremembering that one).
avidphantasm 3y ago
sudo deltree c:\
- bigstrat2003 3y ago
  Technically, powershell has a built-in alias of "rm" to the remove-item command. And Windows will happily accept / as the path separator. So you could do "sudo rm /" and it would be a legit command.
1970-01-01 3y ago
Can't wait for new malware to sudo-up the calculator && bitsadmin.
dm319 3y ago
Ironic, didn't we find out they had patented sudo a decade ago? https://arstechnica.com/information-technology/2009/11/microsofts-psuedo-sudo-patent-doesnt-really-cover-sudo/ https://arstechnica.com/information-technology/2009/11/micro...
- seabass-labrax 3y ago
  The article you linked answers your (presumably rhetorical?) question: no, but they probably did patent PolicyKit.
shortformblog 3y ago
Just pointing out that this is a really good tweet by the co-creator of sudo: https://twitter.com/BobCoggeshall/status/1755681410596192604 https://twitter.com/BobCoggeshall/status/1755681410596192604
- deleted 3y ago
  [deleted]
- coggs 3y ago
  I guess if we were on a conquest for universal adoption we can now say we've succeeded.. <pinches self>
deleted 3y ago
[deleted]
codeflo 3y ago
Sad that it's Windows 11 only. I can't upgrade. I have a normal, recent PC that I dual boot with Linux, and Microsoft wants me to keep Windows 10 in that constellation. Upgrading is prevented by a silly if statement, and there's nothing I can do. It's the first time a software vendor actively doesn't want me to to have their latest software, but it is what it is.
- skeaker 3y ago
  What do you mean? If it's the TPM requirement, Rufus can whip up a Win11 installer that bypasses that in like a minute.
  - c-hendricks 3y ago
    Ventoy will also help them, there's absolutely something they could do.
    - yellowapple 3y ago
      You can also boot the normal installer, hit Shift+F10, run regedit, and set HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassTPMCheck to 1.
      - codeflo 3y ago
        Unless there's official documentation that this is officially supported, hacks like these can stop working at any moment. For an unimportant machine, sure, use whatever third-party tool to bypass the installer you want. For a production machine, I don't think that's wise.
- zadjii 3y ago
  We're working on backporting it to Windows 10. For updates, you can follow https://github.com/microsoft/sudo/issues/2 https://github.com/microsoft/sudo/issues/2
- Sidneys1 3y ago
israrkhan 3y ago
When I was at Microsoft we did not use to consider UAC as a security boundary, since there were ways to bypass it. (I used to work on windows kernel security). I wonder how security team let this feature get shipped. Or perhaps now they consider UAC as a security boundary.
- hugryhoop 3y ago
  How can you bypass UAC set on the highest level?
- nightowl_games 3y ago
  Whats the purpose of UAC then?
- withinrafael 3y ago
  UAC still isn't a security boundary, but rather a defense-in-depth measure.
  - soraminazuki 3y ago
    Shouldn't defense-in-depth be about putting multiple meaningful security measures in place?
    - SV_BubbleTime 3y ago
      Shallow is still a depth.
FergusArgyll 3y ago
Considering the way PowerShell commands go, I assume this will be: RunWithAllTheElevatedPermissionsPossible --YesEvenThose .\inthisfolder.folder\. grep : The term 'grep' is not recognized....
- 23jhiu23hui 3y ago
  It's evident that you haven't used PowerShell. Almost all commands in PowerShell have short aliases. For instance, instead of typing 'Get-ChildItem', you can simply use 'gci', which stands for the first letters of each word. Unlike Bash and other shells, where you must learn various Domain-Specific Languages (DSLs) to handle XML, JSON, YAML, etc., PowerShell allows you to use its native language to work with any data type. This is because PowerShell operates on objects rather than plain text. Therefore, PowerShell is significantly more advanced than other shells.
  - whoitwas 3y ago
    lol
  - Woshiwuja 3y ago
    LOL
  - cookiemonster9 3y ago
    Hiyo! Yep, aliases help. Also, verbs are standardized. That example was a bit hyperbolic. Most of my work is in Linux nowadays, but for me, jq, yq, and other text manipulation software and shell features in bash/zsh will always take a back seat to using the standard commands that ship with PowerShell. I wince every time I see a co-worker using a pipeline full of parse-and-pray greps and awks that is fancy af and amazing, but also, maybe not as nice or consistent as working with objects. I will say though, you might say "PowerShell is more convenient in many scenarios," not that it's more advanced.
  - mbs159 3y ago
    powershell stan detected
  - 3y ago
zcbenz 3y ago
I wrote a Node.js module that implemented similar feature years ago. https://github.com/atom-archive/node-runas https://github.com/atom-archive/node-runas (An updated fork can be found at https://www.npmjs.com/package/runas-redux https://www.npmjs.com/package/runas-redux)
squeaky-clean 3y ago
Why is Inline not the default option?
- zadjii 3y ago
  There are security implications for running elevated processes connected to unelevated console/terminal windows. "New window" mode avoids those security concerns. A secure-by-default posture seemed prudent.
practicemaths 3y ago
[dead]
MarkSweep 3y ago
Do caffeinate next! That reminds me, I have a half-written implementation here: https://github.com/AustinWise/caffeinate https://github.com/AustinWise/caffeinate
- brandonfro 3y ago
  I've been using this (https://learn.microsoft.com/en-us/windows/powertoys/awake#command-line-interface-cli https://learn.microsoft.com/en-us/windows/powertoys/awake#co...) on my work computer for a few months and it works similarly to caffeinate.
jimt1234 3y ago
Side note that I've always found interesting: sudo is almost entirely maintained by one dude: https://github.com/sudo-project/sudo/graphs/contributors https://github.com/sudo-project/sudo/graphs/contributors
- bsimpson 3y ago
  If he's in Nebraska, then it's literally https://xkcd.com/2347/ https://xkcd.com/2347/ According to his website, he's been the maintainer for 30+ years.
  - dsalzman 3y ago
    Boulder,CO per his github
- campbel 3y ago
  https://www.sudo.ws/about/history/#quest-sponsorship https://www.sudo.ws/about/history/#quest-sponsorship and apparently he's no longer being paid to work on it as of this week
  - campbel 3y ago
    not to completely stalk this guy, but for linkedin users, might be worth liking / sharing his looking for work post https://www.linkedin.com/posts/millert_after-over-13-years-with-quest-and-one-identity-activity-7161131657196969984-Agyf?utm_source=share&utm_medium=member_desktop https://www.linkedin.com/posts/millert_after-over-13-years-w...
- udev4096 3y ago
  Wow. I thought sudo was maintained by kernel devs. Kudos to the maintainer tho
- M3t0r 3y ago
  There's also https://www.memorysafety.org/initiative/sudo-su/ https://www.memorysafety.org/initiative/sudo-su/
jksmith 3y ago
If you'd like to use sudo, it's available in Linux.
jojobas 3y ago
After long 40+ years Windows has caught up.
broknbottle 3y ago
missed opportunity to call it suwoop
joshxyz 3y ago
sudo make me a sandwich!
slenk 3y ago
Scoop provides https://github.com/lukesampson/psutils https://github.com/lukesampson/psutils, which works really well, I am sure there are a million things people will tell me I am missing.
orev 3y ago
One of the most important aspects of ‘sudo’ is that it takes the password of the user who started it, not the admin password. Will this ‘sudo’ work like that, or does it need the user to know an administrator password? If it needs an admin password, it shouldn’t be called ‘sudo’ (it would be an analog of ‘su’)
shithub 3y ago
[flagged]
msravi 3y ago
Here's hoping that "Windows 12" will be just a Window manager + Desktop running on Linux, with all existing bugs meticulously replicated to maintain backwards compatibility with Windows 95/7/8/10/11.
- herbst 3y ago
  To be fair that would still make windows instantly so much better if you could actually run a less weird desktop environment AND run all the vendor locked software.
- fransje26 3y ago
  And you then get sudo for free! With all the command parameters you know and love. Win-win.
- rollcat 3y ago
  Stop dreaming. Won't happen. Windows is a purely additive effort. WSL is what happened, and when it couldn't do some things they built WSL2. As another commenter pointed out regarding the integration of this new "sudo" and UAC prompts, it will probably be done in a new, separate, different tool, because this new, freshly released "sudo" will now have to remain bug-for-bug compatible for the next four decades.
  - oldgradstudent 3y ago
    > WSL is what happened, and when it couldn't do some things they built WSL2. I always wondered why it wasn't called WslEx.
- soraminazuki 3y ago
  If that ever happens, it'll bring Microsoft dependencies to the Linux ecosystem. In not sure that's a good thing anymore with the endless enshittification going on in Windows. Just imagine the poor distro maintainers constantly battling to disable spyware, ads, nag screens, and unwanted configuration changes caused by Microsoft packages. I feel sorry for them just by thinking about it.
bogota 3y ago
Windows tries to improve the developer experience… why not call it wudo or something funny since devex on windows is obviously a joke.
- whoitwas 3y ago
  I agree. Can pretty much generalize to Windows and not just Windows devex at this point. The OS is like a parody of itself.
teekert 3y ago
… Checking the date… Nope it’s probably real (and makes sense!)
forgotpwd16 3y ago
If anyone on older Windows version, `elevate` tool is similar. Also if it isn't the normal sudo command maybe call it something else as well.
lucidpare 3y ago
[dead]
r366y6 3y ago
Get over it, Microsoft and migrate to a Unix kernel ;)
oleg_antonyan 3y ago
One day they'll replace the kernel with Linux and nobody notices
- alpb 3y ago
  Unlikely. Windows is all about compatibility and that includes all the weird things accumulated in windows over the decades. There is not a real incentive to change this. Think of all the gamers, custom hardware like ATMs and commercial terminals that run on Windows. That’s a huge market.
  - denysvitali 3y ago
    Linux + Wine
  - herbst 3y ago
    Old windows software often runs better or only with Wine instead of recent windows versions. So if they want to keep their 'compatibility' long term, they have no choice but to to include (or worse, fork) wine.
    - TheLoafOfBread 3y ago
      Unless it touches hardware.
      - herbst 3y ago
        It depends. I would argue getting an old scanner or printer running with no current driver is definitely much easier on Linux as well. I am not into Windows enough to have any other examples :)
shmeeed 3y ago
Is it April 1st already?
vergessenmir 3y ago
How do you wax lyrical for an entire article about the excellently engaging ergonomics of sudo and not mention Linux/Unix family of OSes
whoitwas 3y ago
I've tried several times to code on Windows. It's nearly impossible for a person used to Unix based systems. Seems it's getting slightly better. Nice.
- isoprophlex 3y ago
  A chrome plated turd is, underneath the shiny veneer, still a turd.
  - MikusR 3y ago
    But enough about MacOS.
gpvos 3y ago
Good. Although "elevate" from Nirsoft[0] generally worked well for me, it's nice to have something more integrated into the system. [0] http://nircmd.nirsoft.net/elevate.html http://nircmd.nirsoft.net/elevate.html
jaylittle 3y ago
I guess this is a thing on Windows now. However at the moment, it seems to be a very insecure thing. But hey it's early days... I predict they'll eventually get it right 125 patch Tuesdays from now. https://fosstodon.org/@serghei@mastodon.social/111900986825278831 https://fosstodon.org/@serghei@mastodon.social/1119009868252...
- 1970-01-01 3y ago
  Yes! We all knew this was going to ripen into a massive security problem, however overnight was quicker than expected. MS in a nutshell: Ready, fire, aim! Users: "Immediately, there was a problem."
- zadjii 3y ago
  Happy to have the feedback! Most of those I've already fixed internally, there's just a 3-4 week delay between me checking in, and it flowing to Insiders. For the other few things I missed: Very happy for the feedback! I've filed bugs and those'll be the first things I look at come Monday morning.
jeffrallen 3y ago
I just hope Windows sudo is not as braindead as PowerShell's wget!
ChoGGi 3y ago
Eh, nothing wrong with psexec.exe -i -s Guess it's good to have more options though.
- sebazzz 3y ago
  psexec -i -s is more than sudo, it runs as SYSTEM. Basically with kernel level permissions, that is above admin. Still, doesn’t prevent antimalware software from blocking you if you try something naughty.
osigurdson 3y ago
Windows should just run Linux. For apps that really need the Windows OS, use something akin to macOS parallels. I really like WSL of course, but would prefer an inverted paradigm.
- wongarsu 3y ago
  The Windows kernel has a lot of features that Linux lacks. Dropping all those features would make a lot of people very angry, especially admins in big corporations.
  - giancarlostoro 3y ago
    It also has the most insane backwards compatibility.
swamplander 3y ago
So Microsoft implicitly admits DOS sucks and creates a PowerShell prompt. Then Microsoft doubles down and introduces a better prompt called WSL - the Windows Subsystem for Linux because the Windows command prompt still sucks... and this is just a Ubuntu VM in Windows. And now they implement Sudo? Microsoft hasn't learned the first lesson of holes - when you find yourself in one, stop digging.
- hu3 3y ago
  Reducing WSL, which can virtualize multiple Linux in parallel, including Linux GUI programs, use GPU and run Docker at near-native speed, to a mere prompt seems dishonest.
- ramijames 3y ago
  This is a really good illustration for why I hate using Microsoft products. They don't commit to one vision long-term. They build a bunch of competing visions, and all feel half-assed. From a user's perspective this means that if I want to perform some task I likely either have a clunky experience, or worse, I end up having to use multiple similar tools to do it. Very bleh.
- eska 3y ago
  I wish they committed to implementing more of the POSIX standard instead. They only ever implemented an initial version, and then added tiny parts of it in incompatible ways.
- a321neo 3y ago
  This doesn't make any sense. PowerShell and WSL serve entirely different purposes. PowerShell is bash-but-better for Windows. WSL is a developer-oriented way of running Linux/Unix software on Windows.
ilovecurl 3y ago
"Those who do not understand Unix are condemned to reinvent it, poorly." -Henry Spencer
riffic 3y ago
reinventing Unix, poorly.
COMMENT___ 3y ago
The new command is named “sudo” because customer feedback and because MUSCLE MEMORY: I hear you! We thought about some of the options you’re calling out here. A lot of customers voiced having the muscle memory of doing similar flows on various operating systems was more important to them and that’s where we landed. I totally understand your perspective and I do really appreciate the feedback. I’m always trying to learn from people like you so I can help to build things that will make your life better. From https://devblogs.microsoft.com/commandline/introducing-sudo-for-windows/#comment-6032 https://devblogs.microsoft.com/commandline/introducing-sudo-...
lupire 3y ago
Should be ado (admin do), since superuser is a Linux thing
aargh_aargh 3y ago
alternative name suggestions: * asadmin * admindo * adminrun * admrun * elevate * privelev

587 points by zadjii 3y ago

Yep, it's really happening. Sudo is coming to Windows. It's obviously not just a fork of the linux sudo - there's enough that's different about the permissions structure between OS's that just a straight port wouldn't make sense. But the dream of being able to run commands as admin, in the same terminal window - that's the experience we're finally bringing to users. I've been working on this for the last few months now and I'm pretty excited to talk about it or answer any questions!

litheon 3y ago
Great to see this on Windows! Hopefully this is much easier than using the runas command. Any particular reason the source code for sudo.exe wasn’t able to be open sourced along with the announcement of this feature?
SushiHippie 3y ago
Can you share if this will ever come to Windows 10, or will it be a Windows 11+ exclusive thing?
- starik36 3y ago
  Same here. Would love it on Windows 10 and Windows Server 2016+.
  - blactuary 3y ago
    My left leg for Windows Terminal on Server 2016
- vidanay 3y ago
  I'm not even sure Win11 is on my company roadmap, much less anything cutting edge like an insiders release. Windows 10 Enterprise compatibility is pretty much required for widespread adoption of Sudo for Windows.
  - pixel16 3y ago
    Windows 10 is EOl next year. I would bet your company has plans to move to 11 at some point in the near future. I work with customers daily to help to move to 11
    - FirmwareBurner 3y ago
      > I work with customers daily to help to move to 11 What issues are your customers having that they need profesional help to upgrade to a new Windows OS?
      - Sakos 3y ago
        Is this a serious question?
        FirmwareBurner 3y ago
        Did I stutter?
        Sakos 3y ago
        Apparently, because you can't seriously be asking that question. You've clearly never worked in any kind of customer support position, because businesses and individuals need all kinds of help with a transition like that.
        FirmwareBurner 3y ago
        >Apparently, because you can't seriously be asking that question. YEs I was asking seriously. You still haven't explained what those challenges could be. All you do is mock people for their genuine questions without providing any actual answers/information to back up your vage statements. >You've clearly never worked in any kind of customer support position Then if that's clear for you I haven't never done that, why would you not understand I was being serious? Why are you being disingenuous here? Or you just enjoy being a troll? > because businesses and individuals need all kinds of help with a transition like that. Mate, 12 year-olds in my developing country can run Windows 11 updates/installs for you, including installing pirated licenses and cracks for you if you pay them 5 bucks. What could be so complicated that the internal IT of a company can't figure out the transition from Windows 10 to 11 that they need to pay outside help for that? Especially that backwards compatibility is one of Microsoft's fortes to make life easier for admins and convince companies to stay in their ecosystem.
- zadjii 3y ago
  Already working on it :) You can follow https://github.com/microsoft/sudo/issues/2 https://github.com/microsoft/sudo/issues/2 for updates. Honestly, the hardest part will be porting the Settings app changes to the Windows 10 styles. `sudo.exe` itself doesn't really depend on any OS platform changes, and if it did, we'd have a _very_ compelling case to bring those features with us downlevel.
  - starik36 3y ago
    Where exactly is sudo.exe? It doesn't appear to be in the repo. I don't need the Settings portion. The exe itself would be immensely useful.
ktpsns 3y ago
Nice to see the author here! I have to say: I really like whats going on in Windows world from a developer perspective in the recent years. I am a hardcore Linux fanboy for decades but I have to admit that PowerShell, WSL, vscode, Windows Terminal and the recent open source strategy sounds very appealing to me. This is something MS/Win does much better in recent days compared to, for instance, Apple/Mac OS. I would love to see a tighter integration of winget into Windows. I recently used a fresh MS Windows Server 2023 installation and had a bad day to even get winget installed. I really hope that the current strategy does not turn out as somewhere between "embrace" and "extend"...
- zadjii 3y ago
  Thanks! I think the team we're on has a very clear focus on making developers happy. Like, we're all ourselves, developers, so a lot of it is very self-serving. Anything we can do to make our own lives better is probably going to be a good thing for a lot of other developers too.
  - mixmastamyk 3y ago
    Shame the rest of the company is dedicated to making users unhappy to scrounge a few extra pennies. Users include developers of course. (See the transcript of Security Now 958 for recent details.)
- yndoendo 3y ago
  Windows change is welcoming, yet still not quality. As stated by someone below, sudo is https://www.sudo.ws/ https://www.sudo.ws/. Microsoft should give it a proper distinctive name lie wsudo or psudo. Little thinks like is compounds the issues with Windows / Microsoft. Even continually sticking to old design patterns causes issues in development and deployment. Big name companies do not trust applications running on hosted Windows because of their current business practices. Microsoft does not even have a means to provided ease of deployment for air-gap system. This is the only way some big business will let products hosted on Windows to be in their facilities. Windows as become more problematic for me because of all the layers of security that need to be applied for companies to trust Windows. This causes issues such as having to stop typing because Visual Studios or VSCode cannot process key strokes in real time. Localization translation text standard still does not allow for containing singular and plural in the same key. Translations should be easily to update so the client can improve wording on the fly. Microsoft still recommends using resx and compiling a DLL. .....
deleted 3y ago
[deleted]
mappu 3y ago
Does the UAC prompt always say "Verified publisher: Microsoft"? Even without controlling stdin, malware at medium integrity could prompt to run a malicious command, and users will only see Microsoft's good name in the popup. Does this elevate within your own account token (i.e. will not work for non-Administrator users), or does it actually switch user (e.g. to LOCAL SYSTEM)?
- dist-epoch 3y ago
  Putting Microsoft in the UAC prompt is indeed weird. It should be the info of the target binary. This feature sounds a bit rushed, and it's early preview, maybe they fix it by the final release.
  - zadjii 3y ago
    Yea, that's a limitation of UAC at this point, and probably not one we can avoid. The "Show details" dropdown on the dialog does however show the commandline you requested, so at least that's one way of making sure it's the thing you ran
    - SushiHippie 3y ago
      The best way would be, if it could say something like: Allow $PARENT_PROCESS_NAME to run $COMMAND with administrator rights. So if you would enter the following in cmd.exe: sudo notepad.exe ... It would say: Allow Command Processor Shell to run notepad.exe ... with administrator rights.
      - zadjii 3y ago
        Maybe for Windows 2025 we can work with the UAC folks to get something like that. I'm still shocked to this day that we managed to ship this at all. One step at a time :)
        jraph 3y ago
        > I'm still shocked to this day that we managed to ship this at all Why?
vimsee 3y ago
> ..there's enough that's different about the permissions structure between OS's that just a straight port wouldn't make sense. Does this mean that the feature set of sudo for Windows can't be similar to the feature set found on sudo for *nix e.g. for BSD, MacOS, Linux..?
- Joker_vD 3y ago
  Does sudo supports ACLs (which are the basis of Windows security model)?
  - deleted 3y ago
    [deleted]
  - vimsee 3y ago
    Sorry, I don't know.
  - marwis 3y ago
    It has it's own config file and can be configured to do just about anything: https://www.sudo.ws/docs/man/1.8.15/sudoers.man/ https://www.sudo.ws/docs/man/1.8.15/sudoers.man/
darksfall 3y ago
[flagged]
- dijit 3y ago
  that’s rude and unfair. I really dislike windows but there’s a decent amount of good stuff in there. it’s just buried under the popups, ads, strange behavior and terrible business practices that are hostile to interop. This helps change that b IOCP is dope.
neurostimulant 3y ago
I think they should've named it something else to avoid confusion, especially if it doesn't have the same behavior as unix sudo. If it has different arguments and features, imagine the confusion of unsuspecting users searching how to use sudo in the future.
- Springtime 3y ago
  > especially if it doesn't have the same behavior as unix sudo... imagine the confusion of unsuspecting users searching how to use sudo in the future. It's hard to imagine a company that size would name it so deliberately without realizing it would cause confusion in search engine results and such. A good faith assumption would be they wanted to make Windows more familiar to users of both but it also means that Windows will get mentioned in more Linux results over time to disambiguate it.
  - timnetworks 3y ago
    >It's hard to imagine a company that size would name it so deliberately without realizing it would cause confusion in search engine results and such. same microsoft as where I'm from?
  - herbst 3y ago
    So it's just some black hat SEO to seem more relevant to Linux users?
- blibble 3y ago
  that's the standard microsoft way embrace (copy sudo), extend (add incompatible options), extinguish
  - Anon1096 3y ago
    I can say with 100% certainty that Microsoft is not going to extinguish sudo
    - 3y ago
NikkiA 3y ago
I've been using the 'sudo' that scoop offers for a while, and it has always done exactly what I wanted and completely removed the hassle of having to open a new cmd/powershell with 'run as administrator'. Plus it means I don't have to leave the comfort of Tabby.
- earthwalker99 3y ago
  Back when I used scoop, I uninstalled that right away because I didn't like how scoop installed it on its own.
VagabundoP 3y ago
ha, thank you! I don't need it often but I have cursed for the want of it in Windows powershell.
Repulsion9513 3y ago
Why can't you do this with the tool that already exists to do the exact same thing, called runas?
- debugnik 3y ago
  Also 'start -Verb runas' in Powershell.
  - westurner 3y ago
    Is there anything shorter than `powershell.exe -executionpolicy unrestricted -file`? powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages setup_windows.ps1: https://github.com/westurner/dotfiles/blob/develop/scripts/setup_windows.ps1 https://github.com/westurner/dotfiles/blob/develop/scripts/s...
    - jve 3y ago
      The executionpolicy merely allows you to write unsigned scripts. Not that it runs them elevated.
    - jodrellblank 3y ago
      powershell.exe -executionpolicy unrestricted -file ./setup_windows.ps1 -InstallPSWindowsUpdate -UpdateWindows -UpdateChocoPackages powershell -ex bypass -f ./setup_windows.ps1 -I -UpdateW -UpdateC (or whatever are short enough to uniquely identify parameter names for your script)
      - westurner 3y ago
        Thx
  - janosdebugs 3y ago
    I really hope that sudo is going to allow one to capture the output of the thing running in sudo and handle errors better. I recently wrote an installer script in PowerShell and had to go through severe contortions to support privilege elevations for only a minimal part of the script. I needed to use start with runas to relaunch the same script with different options to continue the installation process and there's not much in the way of proper error handling either.
tiff_seattle 3y ago
Does this mean that I can run PSWindowsUpdate in a remote PowerShell session? If so, this is going to save me a lot of time. Also, AD management tools never work vie Enter-PSSession. Will stuff like that work as well?
ocdtrekkie 3y ago
I haven't seen anyone ask the important question: Is the mascot coming along for the ride? https://www.reddit.com/r/linuxmasterrace/comments/u4xeoy/in_case_you_didnt_know_sudo_has_its_own_logo/ https://www.reddit.com/r/linuxmasterrace/comments/u4xeoy/in_...
dmead 3y ago
Why don't you guys just use a regular shell? People just want a unix like command line. Windows seems to be doing a lot of work to avoid this.
29athrowaway 3y ago
sudo (1980) is older than Linux (1991). I am not asking questions about sudo to someone assuming sudo is specifically Linux software.
Affric 3y ago
I am a Linux user but am interested in the architectural decisions you have made. I use doas and I know there are other alternatives. When coming up with your sudo what were your inspirations and what does sudo do that you decided you wanted to avoid?
JaggedJax 3y ago
The real question is, where will incidents be reported to if you're not in the sudoers file?
- rezonant 3y ago
  The people demand to know.
- teekert 3y ago
  So harsh right? I felt bad the first couple of times even if it was my own computer!
- SLWW 3y ago
  I still to this day feel like I'm being snitched on, even if I own the hardware directly. Probably some MS server =|
  - DANmode 3y ago
    They collect and send the filenames on your disk, and other arbitrary stuff. Why not?!
- numpad0 3y ago
  You'll be asked to enable .NET and Simple TCPIP services, and a mailbox file created under C:\ will open on Notepad every logins thereafter.
- Pikamander2 3y ago
  Santa Claus, if XKCD is to be believed https://xkcd.com/838/ https://xkcd.com/838/
- codetrotter 3y ago
  billg@microsoft.com
- easyThrowaway 3y ago
  The boring answer would be the event viewer snap-in. Alternatively, a stern yet extremely polite mail from Raymond Chen asking what you were actually trying to accomplish.
stuaxo 3y ago
This is good, while I know RunAS exists, I'm more likely to run another terminal with admin than learn how to use it, if sudo is there I'll use that. Every little bit of friction removed is a good thing.
hatenberg 3y ago
didn't runas exist for ages?
bArray 3y ago
It seems interesting to me that Windows integrates more and more elements of Unix. Linux is open source and free, Apple develop an OS that sells specific hardware, and historically Windows has sold the software for generic hardware. Windows is unlikely to become a better Linux than Linux. Where is Microsoft's new business model going? Historically Office was a money maker, but Office online is a shambles and many users interact with Office via this interface - I see Office slowly dying in favour of open source options. I see Windows licenses being sold less and less in the future. Microsoft Lens is essentially buried at this point. There are the Surface laptops/tablets which are good but not special. Dedicated games console hardware will likely become less attractive as they slowly become glorified desktop PCs. I don't see Microsoft with big user shares in the software or hardware industries? There were a few good purchases such as Minecraft, GitHub (+), etc [1]. Is there something I'm missing? [1] https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitions_by_Microsoft#Acquisitions https://en.wikipedia.org/wiki/List_of_mergers_and_acquisitio... (+) GitHub's new security model is outright hostile - to the point I no longer want to use it.
- jodrellblank 3y ago
  What?? "Microsoft revenue was $198 billion in 2022, up $30.2bn (+18%) from a year earlier. When we do a breakdown by product streams, the largest source of Microsoft’s revenue was Office, with $44.9 billion (23% of the total). Just behind in the second place was Azure with $44bn of revenue (22% of total)." - https://www.kamilfranek.com/microsoft-revenue-breakdown/ https://www.kamilfranek.com/microsoft-revenue-breakdown/ Office alone increasing by $5Bn revenue in a year, increasing by $24Bn in ~3 years, being the largest chunk of revenue of the most valuable market-cap company on the planet, that's what counts as "slowly dying"??
jaylittle 3y ago
Isn't running commands as admin, in the same terminal window, already possible via the use of runas.exe? Granted I haven't daily driven Windows in years but IIRC that does the job albeit with clunkier syntax.
- WorldMaker 3y ago
  runas doesn't support "same terminal window", it always has launched a new window. It's possible this sudo could have been implement as yet more clunky flags to runas, but it seems like making it a separate tool has benefits: off by default, whereas runas is a nearly always-on required built-in; more importantly a nicer less clunky syntax.
ElMocambo_x4 3y ago
What are the common points with Linux, and the differences?
Xelbair 3y ago
the real question is... isn't it pointless if you still get UAC prompt and cannot just log in via CLI? and what's the point of switching when gsudo basically does the same?
nimbius 3y ago
i guess id say thanks for all your hard work, but i dont use windows. exactly how is 'sudo for windows' different than the existing model in windows 10 where privilege elevation is a popup window and you click through it? arguably the current model is just sudo with nopasswd. how do you reconcile the idea that your effort --without principled reform of the windows security model at a fundamental level-- is just cargo-culting a more successful projects security model? 'Start-Process powershell -Verb runAs' is the same or different than this? Thanks for caring about security and trying to make things better. its hard, thankless and frustrating (and thats just the windows part ;))
HeavyStorm 3y ago
scoop install sudo. Sorry, this has been lacking for so long that you know... Late to the party.
asveikau 3y ago
I think there can be harm done when a re-implementation, especially a heavily divergent one, takes the name of an existing program. There's a reason OpenBSD introduced "doas" instead of calling their new thing "sudo". Reminds me of when PowerShell decided to have "wget" and "curl" cmdlets that didn't have any of the advanced features of the originals. Naively it sounds helpful. But it introduces confusion.

SushiHippie 3y ago

https://github.com/microsoft/sudo/issues/11 https://github.com/microsoft/sudo/issues/11 Interesting > Reserved > not blank! > We like to camp nice round number issues like this one, for future use. Can you reuse GitHub issue numbers, or what could be their intention here?

TheCleric 3y ago
You can edit the issue to be whatever you want later. But I’ve never seen anyone pre-reserve issue numbers like this.
- zadjii 3y ago
  We've actually done that for a few years on the Terminal repo. It's great for things like megathreads / scenarios / epics. For example, I can tell you off the top of my head that microsoft/terminal#8888 is for "quake mode", and #4000 is the extensions thread. We even used to have a bot that would auto-camp anything that was a multiple of 1000 or 1111 :D
  - seabass-labrax 3y ago
    That's a rather fun hack for issue numbers. Of course, a more robust strategy would be to have a specialised short-link generator for special issues!
    - SushiHippie 3y ago
      As they work at Microsoft, they all have aka.ms and can generate any short link they like. But it won't work if another user talks about issue 1234, and you only have the short links in your head.
djbusby 3y ago
> nice round number issues But the number is 11? Is this Spinal Tap?

JohnMakin 3y ago

If it were anyone but windows this sentence wouldn't alarm me like it does: > Sudo for Windows is a new way for users to run elevated commands directly from an unelevated console session

belltaco 3y ago
Why is that?
- SCHiM 3y ago
  In all honesty, I have the same reservations. If you look at the authz schemes between the different flavors of operating systems you see that the 'set-uid' concept is comparatively ancient, battle hardened and based on well understood mechanisms. This new functionality in Windows looks complicated. There's an architectural picture that involves: * Multiple processes * Windows RPC (On the basis of RPC? DCOM?) * Handle inheritance * Process integrity(?) * Token privileges(?) When UAC was introduced, there was a slew of bugs in the underlying RPC mechanism. I wonder if it will be the same. Can't wait to take a look at this in the debugger :) I also wonder if MSRC will consider this a "security boundary". Based on the fact that the text references process integrity(UAC), and that _is not_ a security boundary, I'm going to guess not. That means that this could potentially introduce bugs, but MSRC will not be handing out bounties to fix things. Which means that any bugs people find are less likely to be reported, and more likely to find their way into ransomware down the line.

alyandon 3y ago

Is this going to be a fully proper implementation with a sudoers config such that something like sudo c:\some\path\to\normally_needs_elevation_to_function.exe will work for my user in my current desktop session without an elevation prompt?

SteveNuts 3y ago

This will be a very controversial prediction, but mark my words: Windows will eventually use the Linux kernel.

init2null 3y ago
Why not just keep the existing kernel running with a small team? Drivers and backwards compatibility are critical to many of Microsoft's enterprise customers. Now that isn't necessarily true for Windows running in the cloud. Drivers don't matter as much there.
righthand 3y ago
I don’t disagree. How I think it will happen: Backwards compatibility will start to stray at Microsoft (their last bastion), leading to WINE becoming the go to tool for backwards compat support. Microsoft will create a linux variant or maybe just a DE and the rest will be history (just as Libre Office has begun to supersede MS Office). It is a matter of will and time that C-Suite will want to eliminate labor around Windows to maximize profits as it becomes more and more hardened in it’s feature set. Why maintain when you can utilize FOSS?
- a_vanderbilt 3y ago
  In what business segment is Libre Office superseding MS Office? Furthermore, NT supports "personalities". Why bother with a full Linux kernel when they could adopt the personality a la SUA?
  - righthand 3y ago
    Superseding in compatibility. I’m not talking about business segments. They don’t have to adopt it, they will probably fork it.
    - bogantech 3y ago
      > Superseding in compatibility. It's going to be more compatible with Word than Word is?

ronniefalcon 3y ago

what about "runas" :-) or this is considered psuedo-sudo?

matthews2 3y ago

This smells like when PowerShell aliased curl and wget to a completely different command, with incompatible arguments. https://github.com/PowerShell/PowerShell/pull/1901 https://github.com/PowerShell/PowerShell/pull/1901

moviuro 3y ago
OpenBSD's team has already reacted and added Word to OpenBSD * https://marc.info/?l=openbsd-tech&m=170742832804260&w=2 https://marc.info/?l=openbsd-tech&m=170742832804260&w=2 * https://news.ycombinator.com/item?id=39309638 https://news.ycombinator.com/item?id=39309638
skohan 3y ago
Yes terrible move which will lead to much confusion and consternation in the future. But honestly I'm most amazed by the fact that there wasn't previously a way to run commands with elevated permissions in Windows. How did people work like that? Just run everything in an admin terminal super unsafely?
- quickthrower2 3y ago
  You have to think about what terminal you need before opening it. I rarely need an admin terminal. That software is often installed by downloading and double click helps as that cuts out the command line. Devops is tricky though! You sometimes have to spawn other processes to get the elevated permissions.
  - skohan 3y ago
    I guess the reason it strikes me as strange is, on linux the usage of `sudo` helps you understand which operations might be dangerous in a fine-grained way So like if you are executing a series of commands, the one requiring admin privileges tends to be one you might want to be more careful about (i.e. altering system configs, or doing a potentially insecure operation) So if you are running everything in an admin terminal, it seems like you wouldn't have that extra check to remind you to be extra mindful of a particular operation, since everything you do in that terminal is in the same bucket

PreInternet01 3y ago

Well, sudo for Windows has been a thing for, like, a few years now?... https://github.com/gerardog/gsudo https://github.com/gerardog/gsudo Not sure if this is the same thing, but this definitely should have shipped with the very first implementation of "oh, sure, you're an Administrator, but not really, since we're ignoring that bit" a.k.a. User Account Control. That would have saved about a metric ton of misguided "here's how to turn off UAC" tutorials, but, ehm, yeah, anything to inject some life into the moribund Windows Insiders Program (the one where https://blogs.windows.com/windows-insider/ https://blogs.windows.com/windows-insider/ proudly headlines "What’s coming for the Windows Insider Program in 2023"), right?

zadjii 3y ago
gsudo is great! It's got a lot of features for power users, it's got a great community, and I can't recommend it highly enough. There's room here for us to be better together - Sudo for Windows can cover a number of in-box scenarios, with OS-side support for things like GPO, event logging, etc. But then for power users who need access to some of the wilder features of gsudo (running as TrustedInstaller?), that's always available too.
- PreInternet01 3y ago
  I would love it if I, as a lifelong Windows fanboy, could offer anything but a snarky reply to the author of a new OS feature. Yet, good luck with that and don't look at the headstones of those who came before you is all I can muster.
JoshTriplett 3y ago
The blog post links gsudo right at the top: > If you’re looking for additional functionality that Sudo for Windows does not provide, check out Gerardo Grignoli’s gsudo which has a number of additional features and configuration options.

pjmlp 3y ago

We already have runas for years now. This looks like one of those KPI fulfilling projects.

justusthane 3y ago
That requires you to open an new terminal window. You've never been working in a standard terminal, tried to run a command that requires elevation, and been annoyed that you have to open a new window losing your command history? Or forgot to Run As and opened a non-elevated terminal by accident?
- dwattttt 3y ago
  I believe the new window is to prevent SHATTER attacks (https://en.m.wikipedia.org/wiki/Shatter_attack https://en.m.wikipedia.org/wiki/Shatter_attack), to ensure that a higher privileged process has a higher privileged Window. Is that not a concern anymore with this new sudo, or is there some other mitigation involved not? EDIT: from the linked wiki page, "By design, all services within the interactive desktop are peers, and can levy requests upon each other. As a result, all services in the interactive desktop effectively have privileges commensurate with the most highly privileged service there."
- pjmlp 3y ago
  "In this configuration, Sudo for Windows will open a new elevated console window and run the command in that window. This is the default configuration option when sudo is enabled"
  - famouswaffles 3y ago
    That's the default option but you apparently can still run the elevated command in the current window if you want.
    - pjmlp 3y ago
      Just like when using runas. https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc771525(v=ws.11) https://learn.microsoft.com/en-us/previous-versions/windows/...

oflebbe 3y ago

Next: systemd for windows?

cogman10 3y ago
Already there. Windows has had services for a long time managed pretty similarly to systemd/launchd.
- madspindel 3y ago
  Well, compare how to start syncthing automatically on Windows: https://docs.syncthing.net/users/autostart.html https://docs.syncthing.net/users/autostart.html On Debian I could just type: systemctl --user enable --now syncthing.service Native systemd on Windows would be awesome. Microsoft should hire the creator of systemd...
  - bigstrat2003 3y ago
    Looking at that page, it looks like syncthing chooses to not provide a Windows service. That is where 100% of the complexity is coming from. If they did provide a Windows service, then it would be as simple as opening the service manager, and setting the startup type from "manual" to "automatic". It's not fair to blame Windows for the developers of an app not using its features. Similarly, if syncthing didn't bother to create a unit file on Linux, your example would no longer be a simple one liner. That wouldn't be systemd's fault though.
  - marwis 3y ago
    The manual GUI steps could be replaced with single command line on windows too. https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks https://learn.microsoft.com/en-us/windows-server/administrat...
  - pjmlp 3y ago
    Powershell exists.
  - magicalhippo 3y ago

Night_Thastus 3y ago

Interesting. I've been pretty happy with all the Unix-related updates they've put out lately. WSL has been a godsend and the new terminal and powershell have worked a treat. Glad they seem to be continuing with it.

al_borland 3y ago
My theory is that Microsoft is working on eventually moving Windows over to the Linux kernel, and all these things they are doing are setting the stage and preparing for an easier transition.
- Night_Thastus 3y ago
  As I said on the other post, I strongly doubt that. It offers few benefits and many roadblocks. It would be a monstrous amount of work, would throw into question many existing security-related certifications, break Microsoft's love of backwards-compatibility, etc. All MS is trying to do is make it easier for developers to develop on Windows for Windows, which it has ample incentive to do both internally and externally.
  - 0cf8612b2e1e 3y ago
    I have been continually disappointed that Microsoft has not released a seamless Windows virtualization system. WindowsX would run the new, redesigned APIs, but all of the legacy could run inside a sandboxed system to give the world the required decades to finally transition.
    - doubled112 3y ago
      Windows Subsystem for Windows?
      - __egb__ 3y ago
        How about, “Winception”

HackerLemon 3y ago

What's the difference from opening a Terminal (Admin) window? Just that you can run a single command as admin? I must be missing something here

Isthatablackgsd 3y ago
Opening a terminal in admin window which means any commands you put in that windows will always have admin privilege, no matter what. What does Sudo is to only provide the root/admin privileges for specific inputted command. Once it is done, it goes back to user privileges. This way, the terminal window didn't need to end the session to go back to user privileges.
- gwervc 3y ago
  That's a very slim proposition value, especially when multiple commands in a row require admin privileges.
  - MattPalmer1086 3y ago
    Sudo also allows you to control which commands can be elevated to admin. It also lets you elevate to admin without knowing the admin password, you elevate with your normal account password. Effectively, some commands can execute as admin, but the user generally cannot. So you can allow limited administration without giving everything away.
  - bigstrat2003 3y ago
    That's like saying (in a Linux context) "sudo is dumb because you can just use su". The two tools have different use cases.
  - whywhywhywhy 3y ago
    Good thing they're keeping the admin terminal too so you can just keep using that. Personally I think it's way more likely the admin command is the one off like installing something, changing a setting and then everything else before and between it are user commands that don't need to be in admin space most of the time.

scrlkrunner 3y ago

This adds a factor of enshittification for NT, NT doesn't need 88 line PowerShell scripts, this "sudo for Windows" thing makes Windows seem like a teenager's high school project. Windows NT already has runas, let NT be NT and let POSIX have sudo/doas. Previously Microsoft hired the best of the best operating systems engineers in the USA who were from Digital and they proved to be people capable of making an operating system able to scale from MIPS to PowerPC/DEC Alpha/IA-32/amd64/Itanium with any combination of hardware and peripherics, now they're allowing random people to push 88 line scripts and calling it a day. Very few people in this world deserve the privilege of touching any Windows NT code and even more few people deserve the possibility of pushing things to the build lab of Windows NT 10/11 builds

Conscat 3y ago
They decided kernel-mode graphics isn't a terrible idea, though.
- int_19h 3y ago
  At the time that decision was made, it was the only way to get acceptable performance on typical computers on which NT was expected to run.
zadjii 3y ago
Thanks? But sudo * isn't a 88 line PowerShell script, it's a 1800 LOC Rust binary * isn't a NT kernel feature, it's a usermode executable * was made by (in my opinion) a perfectly decent engineer. That may be thinking too highly of myself though.
- scrlkrunner 3y ago
  I see you are one of the heads of sudo for Windows, now based on your comment I see sudo for Windows with non-so unhopeful eyes. The comment about 88 lines PS code is about sudo.ps1 on the repo, thanks for clarifying. I'd like if more consideration is taken over sudo for Windows, as the MSDN docs relate: sudo at the moment has a clear distinction with runas and you must be the one who chooses what's best, I can infere the intention is not replacing runas, but then there's two ways to the same goal and each one with its differences. It's a similar situation than it was with WMIC and WMI for PS, being this case as a longer-standing approach, WMIC is deprecated but you can still use it if you want, however WMI for PS has the same functionality as WMIC and still offering benefits over WMIC, ultimately WMIC will be removed from future Windows releases. I'd be less confusing if this route is planned for runas and sudo

jhickok 3y ago

If it's just an alias for "runas" that presents a UAC prompt window I will be disappointed.

tester756 3y ago
Initially I thought ur concern is crazy as hell, because who would implement it in such a painful way? But then I read >When elevating a process from the command-line with sudo, a UAC dialog will appear asking the user to confirm the elevation: LOL But it seems like there are other ways to use it without this dialog >In this configuration, sudo.exe will launch a new elevated console window and run the command in that window. The new window will be launched with the same working directory as the current window. The new window will also be launched with the same environment variables as the current window. This configuration has a similar flow to the runas command.
- RajT88 3y ago
  There's no way that second use case doesn't show a UAC prompt. The whole point of the split token / UAC elevation is to avoid elevation without user interaction. Imagine malware stuck as standard user just running itself like: cmd.exe /c sudo malware.exe
- calamari4065 3y ago
  Having the sudo command open an entirely separate terminal as an admin user is absolutely ridiculous and completely on brand for Microsoft. Along with the UAC dialog, I can't think of a worse way for sudo to behave. What's wrong with entering your password for sudo? How is UAC more secure than a password?
  - hughesjj 3y ago
    UAC is less secure than a password right?
  - aksss 3y ago
    If you’re running as local admin you just get the dialog, but you’re not using a local admin as your daily driver user acct, right? ..Right? :) If you’re logged in as a standard user, UAC prompts you for new username and password to authenticate and authorize the privileged operation.

spogbiper 3y ago

sudo cmd.exe the new "sudo bash"

BiteCode_dev 3y ago

Good news. But I'm also bracing for millions of windows users that will now be able to sudo pip install.

tonymet 3y ago

sudo on windows has a different risk profile given the malware ecosystem and lack of educated/ trained users. 95% of linux users are developers who understand risk -- though are prone to mistakes 99% of windows users are casual consumers . Let's keep this functionality narrowly accessible : restricted to developer mode and very formal consent. I suggest disabling it if it's unused for a few days this will only rejuvenate the malware market.

slaymaker1907 3y ago
There's still the UAC prompt which should help mitigate risk, plus it's locked behind developer settings.
- tonymet 3y ago
  that's good news

lostruinsofraku 3y ago

Can you draw the part of the diagram in the blog post based off of these sentences? https://devblogs.microsoft.com/commandline/introducing-sudo-for-windows/#input-closed-and-inline https://devblogs.microsoft.com/commandline/introducing-sudo-... In these configurations, sudo.exe will launch a new elevated process, an elevated sudo.exe process, and the original unelevated sudo.exe will establish an RPC connection with the new elevated process. In other words, information is passed from the unelevated sudo instance to the elevated one.

zadjii 3y ago
Yep, that's basically the entire diagram. The information that's passed is basically just the commandline, env vars, and a handle to the console of the unelevated sudo's console. Once it's got a handle to the console, the elevated sudo can spawn the target app attached to the original console, rather than a new one. Simple as that!

charcircuit 3y ago

While this looks more secure than the original, I don't think modern operating systems should be investing resources into making privilege escalation easier for users to do. Considering UAC already exists it's not like the additon of sudo is much worse to include so overall it may be better, but I feel investing resources to get rid of the need of users needing to elevate things would be time better spent.

RadixDLT 3y ago

hmmm, so I no longer need to right click on cmd and run as administrator?

johnea 3y ago

If everyone thinks this is so great (just judging by the number of times it's appeared in the HN top 30), why don't they just run linux, instead of some sh!t immitation? Everyone knows, if you can C colon, your running a M$ product...

fortran77 3y ago
Linux is just some [explitive deleted] imitation of Unix, where the sudo command originated. I run Windows as my primary development environment because it's better. Linux and other OSes run in VMs.
- washadjeffmad 3y ago
  I don't think you should be downvoted for answering parent's question. It's helpful for understanding a mindset that not everyone possesses. Which version of Windows do you currently run, and what do you feel Windows has or does that makes it superior for your development work?
  - fortran77 3y ago
    I run Windows 11. It has first-class support for Linux, with WSL, and the Windows Environment has first-class support for NVIDA graphics, popular productivity and entertainment software. It's reliable, stable, and performs well, with commercial support and scheduled major and minor updates. It's consistant. I can develop software for Windows 11 and be sure that everyone else with Windows 11 can run it.
    - msla 3y ago
      Windows 11 has ads in its file manager, right?
      - fortran77 3y ago
        Most of the complaints I hear are from people running an unlicensed copy and complaining it nags them.

niux 3y ago

There's already a tool out there that works just fine: https://github.com/gerardog/gsudo https://github.com/gerardog/gsudo

dundarious 3y ago

I already use https://github.com/lukesampson/psutils https://github.com/lukesampson/psutils which has a sudo.ps1, which I install via scoop (I know that's a mouthful, but I just install scoop and run `scoop install sudo`). I used it from powershell literally just before I opened this article (after copy-pasting a password, I copy some random text laying around in the browser, like "com", then run `sudo restart-service -name 'cbdhsvc*'` to clear the clipboard history -- does not clear the current value). There is a UAC prompt, but it's perfectly adequate for interactive work.

NikkiA 3y ago
Same here, and if you look at the output of whoami /priv you'll find that using luke's sudo provides exactly the same priviledge escalation as 'run as administrator' does
ComputerGuru 3y ago
Scoop install gsudo is even better (still run as sudo).
Perz1val 3y ago
Mind that Windows has clipboard (win+v) history and you may've that enabled
- dundarious 3y ago
  That is precisely what I'm clearing.

yrro 3y ago

This is good, but runas already exists. Its interface is shit. Improve it to make it not shit please. Don't hijack the name of an existing command unless you're going to re-implement its interface 100% compatibly. This is like when PowerShell hijacked curl all over again...

PeterStuer 3y ago

Can someone detail the differences between this and runas plz?

mikestew 3y ago
runas doesn’t pass current directory, or environment (at least the last time I used runas on Windows 10). I vaguely recall that runas has a kinda low limit on command line length, too ( I’m possibly misremembering that one).

avidphantasm 3y ago

sudo deltree c:\

bigstrat2003 3y ago
Technically, powershell has a built-in alias of "rm" to the remove-item command. And Windows will happily accept / as the path separator. So you could do "sudo rm /" and it would be a legit command.

1970-01-01 3y ago

Can't wait for new malware to sudo-up the calculator && bitsadmin.

dm319 3y ago

Ironic, didn't we find out they had patented sudo a decade ago? https://arstechnica.com/information-technology/2009/11/microsofts-psuedo-sudo-patent-doesnt-really-cover-sudo/ https://arstechnica.com/information-technology/2009/11/micro...

seabass-labrax 3y ago
The article you linked answers your (presumably rhetorical?) question: no, but they probably did patent PolicyKit.

shortformblog 3y ago

Just pointing out that this is a really good tweet by the co-creator of sudo: https://twitter.com/BobCoggeshall/status/1755681410596192604 https://twitter.com/BobCoggeshall/status/1755681410596192604

deleted 3y ago
[deleted]
coggs 3y ago
I guess if we were on a conquest for universal adoption we can now say we've succeeded.. <pinches self>

deleted 3y ago

[deleted]

codeflo 3y ago

Sad that it's Windows 11 only. I can't upgrade. I have a normal, recent PC that I dual boot with Linux, and Microsoft wants me to keep Windows 10 in that constellation. Upgrading is prevented by a silly if statement, and there's nothing I can do. It's the first time a software vendor actively doesn't want me to to have their latest software, but it is what it is.

skeaker 3y ago
What do you mean? If it's the TPM requirement, Rufus can whip up a Win11 installer that bypasses that in like a minute.
- c-hendricks 3y ago
  Ventoy will also help them, there's absolutely something they could do.
  - yellowapple 3y ago
    You can also boot the normal installer, hit Shift+F10, run regedit, and set HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassTPMCheck to 1.
    - codeflo 3y ago
      Unless there's official documentation that this is officially supported, hacks like these can stop working at any moment. For an unimportant machine, sure, use whatever third-party tool to bypass the installer you want. For a production machine, I don't think that's wise.
zadjii 3y ago
We're working on backporting it to Windows 10. For updates, you can follow https://github.com/microsoft/sudo/issues/2 https://github.com/microsoft/sudo/issues/2
Sidneys1 3y ago

israrkhan 3y ago

When I was at Microsoft we did not use to consider UAC as a security boundary, since there were ways to bypass it. (I used to work on windows kernel security). I wonder how security team let this feature get shipped. Or perhaps now they consider UAC as a security boundary.

hugryhoop 3y ago
How can you bypass UAC set on the highest level?
nightowl_games 3y ago
Whats the purpose of UAC then?
withinrafael 3y ago
UAC still isn't a security boundary, but rather a defense-in-depth measure.
- soraminazuki 3y ago
  Shouldn't defense-in-depth be about putting multiple meaningful security measures in place?
  - SV_BubbleTime 3y ago
    Shallow is still a depth.

FergusArgyll 3y ago

Considering the way PowerShell commands go, I assume this will be: RunWithAllTheElevatedPermissionsPossible --YesEvenThose .\inthisfolder.folder\. grep : The term 'grep' is not recognized....

23jhiu23hui 3y ago
It's evident that you haven't used PowerShell. Almost all commands in PowerShell have short aliases. For instance, instead of typing 'Get-ChildItem', you can simply use 'gci', which stands for the first letters of each word. Unlike Bash and other shells, where you must learn various Domain-Specific Languages (DSLs) to handle XML, JSON, YAML, etc., PowerShell allows you to use its native language to work with any data type. This is because PowerShell operates on objects rather than plain text. Therefore, PowerShell is significantly more advanced than other shells.
- whoitwas 3y ago
  lol
- Woshiwuja 3y ago
  LOL
- cookiemonster9 3y ago
  Hiyo! Yep, aliases help. Also, verbs are standardized. That example was a bit hyperbolic. Most of my work is in Linux nowadays, but for me, jq, yq, and other text manipulation software and shell features in bash/zsh will always take a back seat to using the standard commands that ship with PowerShell. I wince every time I see a co-worker using a pipeline full of parse-and-pray greps and awks that is fancy af and amazing, but also, maybe not as nice or consistent as working with objects. I will say though, you might say "PowerShell is more convenient in many scenarios," not that it's more advanced.
- mbs159 3y ago
  powershell stan detected
- 3y ago

zcbenz 3y ago

I wrote a Node.js module that implemented similar feature years ago. https://github.com/atom-archive/node-runas https://github.com/atom-archive/node-runas (An updated fork can be found at https://www.npmjs.com/package/runas-redux https://www.npmjs.com/package/runas-redux)

squeaky-clean 3y ago

Why is Inline not the default option?

zadjii 3y ago
There are security implications for running elevated processes connected to unelevated console/terminal windows. "New window" mode avoids those security concerns. A secure-by-default posture seemed prudent.

practicemaths 3y ago

[dead]

MarkSweep 3y ago

Do caffeinate next! That reminds me, I have a half-written implementation here: https://github.com/AustinWise/caffeinate https://github.com/AustinWise/caffeinate

brandonfro 3y ago
I've been using this (https://learn.microsoft.com/en-us/windows/powertoys/awake#command-line-interface-cli https://learn.microsoft.com/en-us/windows/powertoys/awake#co...) on my work computer for a few months and it works similarly to caffeinate.

jimt1234 3y ago

Side note that I've always found interesting: sudo is almost entirely maintained by one dude: https://github.com/sudo-project/sudo/graphs/contributors https://github.com/sudo-project/sudo/graphs/contributors

bsimpson 3y ago
If he's in Nebraska, then it's literally https://xkcd.com/2347/ https://xkcd.com/2347/ According to his website, he's been the maintainer for 30+ years.
- dsalzman 3y ago
  Boulder,CO per his github
campbel 3y ago
https://www.sudo.ws/about/history/#quest-sponsorship https://www.sudo.ws/about/history/#quest-sponsorship and apparently he's no longer being paid to work on it as of this week
- campbel 3y ago
  not to completely stalk this guy, but for linkedin users, might be worth liking / sharing his looking for work post https://www.linkedin.com/posts/millert_after-over-13-years-with-quest-and-one-identity-activity-7161131657196969984-Agyf?utm_source=share&utm_medium=member_desktop https://www.linkedin.com/posts/millert_after-over-13-years-w...
udev4096 3y ago
Wow. I thought sudo was maintained by kernel devs. Kudos to the maintainer tho
M3t0r 3y ago
There's also https://www.memorysafety.org/initiative/sudo-su/ https://www.memorysafety.org/initiative/sudo-su/

jksmith 3y ago

If you'd like to use sudo, it's available in Linux.

jojobas 3y ago

After long 40+ years Windows has caught up.

broknbottle 3y ago

missed opportunity to call it suwoop

joshxyz 3y ago

sudo make me a sandwich!

slenk 3y ago

Scoop provides https://github.com/lukesampson/psutils https://github.com/lukesampson/psutils, which works really well, I am sure there are a million things people will tell me I am missing.

orev 3y ago

One of the most important aspects of ‘sudo’ is that it takes the password of the user who started it, not the admin password. Will this ‘sudo’ work like that, or does it need the user to know an administrator password? If it needs an admin password, it shouldn’t be called ‘sudo’ (it would be an analog of ‘su’)

shithub 3y ago

[flagged]

msravi 3y ago

Here's hoping that "Windows 12" will be just a Window manager + Desktop running on Linux, with all existing bugs meticulously replicated to maintain backwards compatibility with Windows 95/7/8/10/11.

herbst 3y ago
To be fair that would still make windows instantly so much better if you could actually run a less weird desktop environment AND run all the vendor locked software.
fransje26 3y ago
And you then get sudo for free! With all the command parameters you know and love. Win-win.
rollcat 3y ago
Stop dreaming. Won't happen. Windows is a purely additive effort. WSL is what happened, and when it couldn't do some things they built WSL2. As another commenter pointed out regarding the integration of this new "sudo" and UAC prompts, it will probably be done in a new, separate, different tool, because this new, freshly released "sudo" will now have to remain bug-for-bug compatible for the next four decades.
- oldgradstudent 3y ago
  > WSL is what happened, and when it couldn't do some things they built WSL2. I always wondered why it wasn't called WslEx.
soraminazuki 3y ago
If that ever happens, it'll bring Microsoft dependencies to the Linux ecosystem. In not sure that's a good thing anymore with the endless enshittification going on in Windows. Just imagine the poor distro maintainers constantly battling to disable spyware, ads, nag screens, and unwanted configuration changes caused by Microsoft packages. I feel sorry for them just by thinking about it.

bogota 3y ago

Windows tries to improve the developer experience… why not call it wudo or something funny since devex on windows is obviously a joke.

whoitwas 3y ago
I agree. Can pretty much generalize to Windows and not just Windows devex at this point. The OS is like a parody of itself.

teekert 3y ago

… Checking the date… Nope it’s probably real (and makes sense!)

forgotpwd16 3y ago

If anyone on older Windows version, `elevate` tool is similar. Also if it isn't the normal sudo command maybe call it something else as well.

lucidpare 3y ago

[dead]

r366y6 3y ago

Get over it, Microsoft and migrate to a Unix kernel ;)

oleg_antonyan 3y ago

One day they'll replace the kernel with Linux and nobody notices

alpb 3y ago
Unlikely. Windows is all about compatibility and that includes all the weird things accumulated in windows over the decades. There is not a real incentive to change this. Think of all the gamers, custom hardware like ATMs and commercial terminals that run on Windows. That’s a huge market.
- denysvitali 3y ago
  Linux + Wine
- herbst 3y ago
  Old windows software often runs better or only with Wine instead of recent windows versions. So if they want to keep their 'compatibility' long term, they have no choice but to to include (or worse, fork) wine.
  - TheLoafOfBread 3y ago
    Unless it touches hardware.
    - herbst 3y ago
      It depends. I would argue getting an old scanner or printer running with no current driver is definitely much easier on Linux as well. I am not into Windows enough to have any other examples :)

shmeeed 3y ago

Is it April 1st already?

vergessenmir 3y ago

How do you wax lyrical for an entire article about the excellently engaging ergonomics of sudo and not mention Linux/Unix family of OSes

whoitwas 3y ago

I've tried several times to code on Windows. It's nearly impossible for a person used to Unix based systems. Seems it's getting slightly better. Nice.

isoprophlex 3y ago
A chrome plated turd is, underneath the shiny veneer, still a turd.
- MikusR 3y ago
  But enough about MacOS.

gpvos 3y ago

Good. Although "elevate" from Nirsoft[0] generally worked well for me, it's nice to have something more integrated into the system. [0] http://nircmd.nirsoft.net/elevate.html http://nircmd.nirsoft.net/elevate.html

jaylittle 3y ago

I guess this is a thing on Windows now. However at the moment, it seems to be a very insecure thing. But hey it's early days... I predict they'll eventually get it right 125 patch Tuesdays from now. https://fosstodon.org/@serghei@mastodon.social/111900986825278831 https://fosstodon.org/@serghei@mastodon.social/1119009868252...

1970-01-01 3y ago
Yes! We all knew this was going to ripen into a massive security problem, however overnight was quicker than expected. MS in a nutshell: Ready, fire, aim! Users: "Immediately, there was a problem."
zadjii 3y ago
Happy to have the feedback! Most of those I've already fixed internally, there's just a 3-4 week delay between me checking in, and it flowing to Insiders. For the other few things I missed: Very happy for the feedback! I've filed bugs and those'll be the first things I look at come Monday morning.

jeffrallen 3y ago

I just hope Windows sudo is not as braindead as PowerShell's wget!

ChoGGi 3y ago

Eh, nothing wrong with psexec.exe -i -s Guess it's good to have more options though.

sebazzz 3y ago
psexec -i -s is more than sudo, it runs as SYSTEM. Basically with kernel level permissions, that is above admin. Still, doesn’t prevent antimalware software from blocking you if you try something naughty.

osigurdson 3y ago

Windows should just run Linux. For apps that really need the Windows OS, use something akin to macOS parallels. I really like WSL of course, but would prefer an inverted paradigm.

wongarsu 3y ago
The Windows kernel has a lot of features that Linux lacks. Dropping all those features would make a lot of people very angry, especially admins in big corporations.
- giancarlostoro 3y ago
  It also has the most insane backwards compatibility.

swamplander 3y ago

So Microsoft implicitly admits DOS sucks and creates a PowerShell prompt. Then Microsoft doubles down and introduces a better prompt called WSL - the Windows Subsystem for Linux because the Windows command prompt still sucks... and this is just a Ubuntu VM in Windows. And now they implement Sudo? Microsoft hasn't learned the first lesson of holes - when you find yourself in one, stop digging.

hu3 3y ago
Reducing WSL, which can virtualize multiple Linux in parallel, including Linux GUI programs, use GPU and run Docker at near-native speed, to a mere prompt seems dishonest.
ramijames 3y ago
This is a really good illustration for why I hate using Microsoft products. They don't commit to one vision long-term. They build a bunch of competing visions, and all feel half-assed. From a user's perspective this means that if I want to perform some task I likely either have a clunky experience, or worse, I end up having to use multiple similar tools to do it. Very bleh.
eska 3y ago
I wish they committed to implementing more of the POSIX standard instead. They only ever implemented an initial version, and then added tiny parts of it in incompatible ways.
a321neo 3y ago
This doesn't make any sense. PowerShell and WSL serve entirely different purposes. PowerShell is bash-but-better for Windows. WSL is a developer-oriented way of running Linux/Unix software on Windows.

ilovecurl 3y ago

"Those who do not understand Unix are condemned to reinvent it, poorly." -Henry Spencer

riffic 3y ago

reinventing Unix, poorly.

COMMENT___ 3y ago

The new command is named “sudo” because customer feedback and because MUSCLE MEMORY: I hear you! We thought about some of the options you’re calling out here. A lot of customers voiced having the muscle memory of doing similar flows on various operating systems was more important to them and that’s where we landed. I totally understand your perspective and I do really appreciate the feedback. I’m always trying to learn from people like you so I can help to build things that will make your life better. From https://devblogs.microsoft.com/commandline/introducing-sudo-for-windows/#comment-6032 https://devblogs.microsoft.com/commandline/introducing-sudo-...

lupire 3y ago

Should be ado (admin do), since superuser is a Linux thing

aargh_aargh 3y ago

alternative name suggestions: * asadmin * admindo * adminrun * admrun * elevate * privelev