Policy

Configure the behavior of the sudo command

Windows 11 25H2

Back to categoryOpen picker

Policy overview

Key metadata and intent for this policy.

ClassComputer
CategorySystem
Supported onAt least Windows 11

Supported OS tags: Windows11

This policy setting controls use of the sudo.exe command line tool. If you enable this policy setting, then you may set a maximum allowed mode to run sudo in. This restricts the ways in which users may interact with command-line applications run with sudo. You may pick one of the following modes to allow sudo to run in: "Disabled": sudo is entirely disabled on this machine. When the user tries to run sudo, sudo will print an error message and exit. "Force new window": When sudo launches a command line application, it will launch that app in a new console window. "Disable input": When sudo launches a command line application, it will launch the app in the current console window, but the user will not be able to type input to the command line app. The user may also choose to run sudo in "Force new window" mode. "Normal": When sudo launches a command line application, it will launch the app in the current console window. The user may also choose to run sudo in "Force new window" or "Disable input" mode. If you disable this policy or do not configure it, the user will be able to run sudo.exe normally (after enabling the setting in the Settings app).

Internal name
EnableSudo
Policy ID
176b4a2dd81e
Elements
1

Registry values

How enabled and disabled states update the registry.

No explicit registry values are set for enabled or disabled states.

Policy elements

Inputs and configuration options exposed by this policy.

ElementTypeRegistry mappingConstraints & behavior
Maximum allowed sudo mode
ID SudoModes
enum
HKLM\Software\Policies\Microsoft\Windows\Sudo\Enabled
Type REG_DWORD
Options: Disabled (0), Force new window (1), Disable input (2), Normal (3)

Other policies in this category

Explore related policies at the same level.

View all policies in this category