Repository navigation
You are not allowed to run sudo #95
Description
Sudo for Windows version
1.0.0
Windows build number
10.0.20348.2582
Other Software
No response
Steps to reproduce
On Windows Server 2022, in an Administrator cmd.exe window,
sudo c:\windows\system32\cmd.exe
Expected Behavior
Expect cmd to run
Actual Behavior
Got "You are not allowed to run sudo" instead.
Activity
zadjii-msft commentedon Jul 31, 2024
That error message is specific to when the user is not a member of the admins group:
sudo/sudo/src/helpers.rs
Lines 181 to 185 in 5fd6a79
sudo/sudo/src/main.rs
Lines 343 to 347 in 5fd6a79
sudo/sudo/src/main.rs
Lines 311 to 313 in 5fd6a79
Are you either:
cmdas another admin user)?chuacw commentedon Aug 1, 2024
As mentioned, this was the "Administrator" account, and it's a member of Administrators.
UAC is totally disabled, set at "Never notify"
zadjii-msft commentedon Aug 1, 2024
I'm betting that's what it is. I'd guess what's happening here is the same thing Terminal had to deal with - there's a difference between running elevated with a split token, vs the "UAC entirely disabled" scenario. Heck, right above that, there's even:
sudo/sudo/src/helpers.rs
Lines 116 to 124 in 5fd6a79
Looks like that check doesn't happen till after the
can_current_user_elevateone. That should be easy enough for someone to rearrange the ordering of.riverar commentedon Aug 17, 2024
Mike Griese (@zadjii-msft) Is this a supported OS target?
zadjii-msft commentedon Aug 19, 2024
I dunno if I can comment on the big-picture "is UAC disabled supported". I suppose it should be, at least from the perspective of
sudo. Seems like it'd be easy enough for us to just shortcut the "can you elevate" and just do the thing (even tho you don't need sudo at all at that point)riverar commentedon Aug 19, 2024
Mike Griese (@zadjii-msft) Was referring to sudo running on Windows Server 2022. I thought sudo was only targeting newer versions.
zadjii-msft commentedon Aug 20, 2024
Oh yea I don't see why not. Sudo might be "targeting" newer versions, but it should work all the way back to, like, windows 7:
All it really needs is ConDrv, and that's been there for a loooong time now. Only reason we haven't backported it to win10 yet is because backporting takes a lot of paperwork to fill out 🤷
riverar commentedon Aug 20, 2024
Cool thanks! I was looking to pitch in a fix here but wanted to verify running in this config was supported before I spun my wheels.
CberYellowstone commentedon Dec 12, 2024
Is there any progress on this issue?
trueuto commentedon Dec 17, 2024
riverar commentedon Dec 17, 2024
That discussion was had in #23 and is unrelated to this issue.
kndxhz commentedon Jun 2, 2025
I encountered the same situation:
I used the administrator account created when installing Windows to open PowerShell (even if it was an administrator's PowerShell)
Still prompting that you are not allowed to run sudo
gabsoftware commentedon Apr 20, 2026
Really, what's the point of running sudo if your user must be in the local admins group?
In most environments there is an unprivileged user and running elevated commands necessitate an admin account.
This is what we have in my case. Unprivileged Azure AD user, and a admin Azure AD user.
Typing sudo from unprivileged user should show UAC prompt. It doesn't. It just shows "You are not allowed to run sudo". Completely useless in current state!
robang74 commentedon Apr 20, 2026
This is the expected behaviour for sudo. If you are not the admin of your own laptop/PC, that's entirely your problem. Instead, for a corporate laptop/PC, you are just an unprivileged user. The advantage of sudo is that an user that has the admin credential can execute commands as admin (or another user, if allowed) without log-out from the current session and log-in as 'admin`. It is also useful for hackers that should not anymore disclose to you that they are moving your mouse but using a ssh text-terminal console in the background. Now, you can be hacked without stopping to work or any distraction... :-D
fxc223 commentedon Jun 20, 2026
hi i know how to fix this react with a rocket and an eye emoji so i could give it to chall
xmha97 commentedon Sep 24, 2026
I enabled the built-in Administrator account in Windows and used it to change my main user account from Administrator to Standard User.
As a result, my main account is no longer a member of the Administrators group and now runs with standard user privileges. Therefore, when I launch an application or perform an operation that requires administrative privileges, User Account Control (UAC) asks for the credentials of an Administrator account instead of simply asking me to approve the elevation.
This means that my main account is used for everyday tasks with standard user privileges, and the password for the separate Administrator account is only entered when administrative privileges are required.
In this configuration, running the
sudocommand from the standard user account is also not permitted, and it displays the message “You are not allowed to run sudo.”xmha97 commentedon Sep 24, 2026
I also found gsudo, which provides a
sudo-like experience on Windows.In this setup, where my main account is a Standard User and administrative credentials are required for elevation, gsudo works correctly and provides the expected behavior.