Configure the behavior of the sudo command
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows 11
Path in the GPO console
Computer Configuration\Administrative Templates\System Description
This policy setting controls use of the sudo.exe command line tool. If you enable this policy setting, then you may set a maximum allowed mode to run sudo in. This restricts the ways in which users may interact with command-line applications run with sudo. You may pick one of the following modes to allow sudo to run in: "Disabled": sudo is entirely disabled on this machine. When the user tries to run sudo, sudo will print an error message and exit. "Force new window": When sudo launches a command line application, it will launch that app in a new console window. "Disable input": When sudo launches a command line application, it will launch the app in the current console window, but the user will not be able to type input to the command line app. The user may also choose to run sudo in "Force new window" mode. "Normal": When sudo launches a command line application, it will launch the app in the current console window. The user may also choose to run sudo in "Force new window" or "Disable input" mode. If you disable this policy or do not configure it, the user will be able to run sudo.exe normally (after enabling the setting in the Settings app).
Registry
Software\Policies\Microsoft\Windows\Sudo MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/Sudo/EnableSudo Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
CSP values
-
0- Sudo is disabled. -
1- Sudo is allowed in 'force new window' mode. -
2- Sudo is allowed in 'disable input' mode. -
3 (Default)- Sudo is allowed in 'inline' mode.
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Configure the behavior of the sudo command
; State: Enabled
; Supported on: At least Windows 11
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Sudo]
"Enabled"=dword:00000000More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Sudo'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/Sudo/EnableSudo
Data type: String
Value:
<enabled/>
<data id="SudoModes" value="0"/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Sudo' -Name 'Enabled' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Sudo'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows\Sudo' -Name 'Enabled' -Expected 0 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Configure the behavior of the sudo command
# State: Enabled
# Supported on: At least Windows 11
$path = 'HKLM:\Software\Policies\Microsoft\Windows\Sudo'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'Enabled' -Value 0 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.