A PowerShell User's Guide to Privilege Elevation: gsudo vs. Task Scheduler

For years, Linux and macOS users have enjoyed the convenience of the sudo command to run commands with administrative privileges. Now, the sudo experience has finally come to Windows in two popular forms: Microsoft’s official sudo, built into Windows 11, and the feature-rich, open-source gsudo.

But which one do I use? This guide puts them in a head-to-head showdown, comparing their features, security, and best use cases to help me choose the right tool for my workflow.

What are sudo and gsudo?

• Microsoft sudo: The official implementation of sudo for Windows, introduced in Windows 11 (24H2 and newer). It is open-source and designed to be a simple, secure way to elevate commands.
• gsudo: A popular, third-party sudo clone for Windows created by Gerardo Grignoli. It is known for its rich feature set, including credential caching and full support for I/O redirection, making it a favorite among power users and for automation.

Round 1: Availability and Installation

Microsoft sudo: To enable the official sudo, I must be on a supported version of Windows 11. I can then enable it in Settings → System → For Developers → Enable sudo.

gsudo: gsudo can be installed on any modern version of Windows with a single command:

winget install gerardog.gsudo

Winner: gsudo is the clear winner here due to its broad compatibility with all modern versions of Windows.

Round 2: Core Features and Usage

UAC Caching

• Microsoft sudo: Does not support UAC caching. I will get a UAC prompt every time I run a sudo command.
• gsudo: Supports credential caching. After the first UAC prompt, I can run subsequent gsudo commands without a prompt for a configurable period (default is 15 minutes).

Winner: gsudo, for its convenience and efficiency in interactive sessions.

Input/Output (I/O) Redirection

• Microsoft sudo: In its default “inline” mode, it has known issues with input redirection (piping). For example, echo "y" | sudo some-command will fail.
• gsudo: Fully supports I/O redirection, allowing me to pipe data to and from elevated commands seamlessly.

Winner: gsudo, for its superior support for standard shell operations.

Round 3: Security Model

Microsoft’s sudo is arguably safer by default, especially when configured in its forceNewWindow mode, which isolates the elevated process in a new window. gsudo’s credential caching, while convenient, can be a security risk if not managed properly.

Winner: Microsoft sudo, for its more conservative and security-focused default settings.

Round 4: Scripting and Automation

• Microsoft sudo: The requirement for a UAC prompt on every execution makes it unsuitable for non-interactive automation scripts (e.g., scheduled tasks, CI/CD pipelines).
• gsudo: Is designed with automation in mind. It can accept credentials in various ways (though this should be done with extreme care) and can be used in non-interactive scripts, making it the go-to choice for automation.

Winner: gsudo, by a large margin.

Part 1: The sudo Landscape: sudo vs. gsudo

This section provides a head-to-head showdown, comparing the features, security, and best use cases of Microsoft’s sudo and the open-source gsudo to help you choose the right tool for your workflow.

Round 1: Availability and Installation

Winner: gsudo is the clear winner here due to its broad compatibility.

Round 2: Core Features

UAC Caching: gsudo supports credential caching, saving you from repeated UAC prompts. Microsoft’s sudo does not. I/O Redirection: gsudo fully supports piping and redirection. Microsoft’s sudo has known issues in its default configuration.

Winner: gsudo, for convenience and superior shell integration.

Round 3: Security Model

Microsoft’s sudo is arguably safer by default due to its lack of caching and its forceNewWindow mode, which isolates the elevated process. gsudo’s caching is a trade-off between convenience and security.

Winner: Microsoft sudo, for its more conservative and security-focused defaults.

Round 4: Scripting

Microsoft sudo’s mandatory UAC prompt for every execution makes it unsuitable for non-interactive automation. gsudo is designed for scripting.

Winner: gsudo, by a large margin.

Part 2: Automation and Non-Interactive Elevation

The true power of these tools shines in automation. However, automating tasks that require administrator privileges on Windows presents a common challenge: how do you handle the UAC prompt in a non-interactive script, such as in a CI/CD pipeline?

The UAC prompt is a security feature that requires explicit user consent. Any attempt to programmatically bypass it is a security vulnerability. The correct approach is to use a mechanism that runs the script in an already elevated context. This section covers the two best methods for achieving this.

Method 1: Using gsudo for Scripted Elevation

As established, gsudo is the ideal tool for scripting. It is designed to run commands non-interactively, using provided credentials to bypass the UAC prompt when necessary.

Important Security Note: Never hardcode passwords in your scripts. The examples below use PowerShell’s PSCredential object. In a production environment, you should retrieve these credentials from a secure source like Azure Key Vault, HashiCorp Vault, or the Windows Credential Manager.

To make this process robust and reusable, we can create a PowerShell function that securely handles the credential’s password and ensures it’s cleared from memory immediately after use.

function Invoke-GsudoCommand {
    [CmdletBinding()]
    param (
        [Parameter(Mandatory = $true)]
        [string]$Command,
        [Parameter(Mandatory = $true)]
        [pscredential]$Credential
    )

    $ptr = [System.Runtime.InteropServices.Marshal]::SecureStringToCoTaskMemUnicode($Credential.Password)
    try {
        $plainPass = [System.Runtime.InteropServices.Marshal]::PtrToStringUni($ptr)
        
        # We pass the command and credentials to gsudo.
        # 'runas' ensures it runs as the specified user.
        & gsudo runas "/user:$($Credential.UserName)" "/password:$plainPass" -- PowerShell.exe -NoProfile -Command "$($Command)"
    }
    finally {
        # Always clear the plain text password from memory
        if ($ptr -ne [System.IntPtr]::Zero) {
            [System.Runtime.InteropServices.Marshal]::ZeroFreeCoTaskMemUnicode($ptr)
        }
    }
}

# --- Example Usage ---
# 1. First, get the credential for the admin user.
#    In a real script, this would come from a secure vault.
$cred = Get-Credential "MyAdminUser"

# 2. Define the command to execute.
$commandToRun = "Get-Service -Name 'WinRM' | Select-Object -Property Name, Status"

# 3. Execute the command using the function.
Invoke-GsudoCommand -Command $commandToRun -Credential $cred

This approach is perfect for CI/CD pipelines, deployment scripts, or any on-demand task that needs to elevate itself locally without user intervention.

Method 2: Using Windows Task Scheduler (The Most Secure Way)

For regularly scheduled tasks, the Windows Task Scheduler is the most secure and reliable method for running scripts with elevated privileges.

When you create a scheduled task, you can configure it to run under a specific user account (like NT AUTHORITY\SYSTEM) and check the “Run with highest privileges” option. When the task runs, the Task Scheduler service—which already runs in an elevated context—launches your script with a high-integrity token, completely bypassing the need for a UAC prompt.

How to Create an Elevated Scheduled Task

1. Open Task Scheduler.
2. Click Create Task…
3. On the General tab:
   • Give the task a name (e.g., “My Admin Script”).
   • Under “Security options,” click Change User or Group… and select the user account (SYSTEM is a common choice for full local authority).
   • Check the box for “Run with highest privileges”.
4. On the Triggers tab, define when you want the task to run (e.g., daily, at startup).
5. On the Actions tab, create a new action:
   • Action: Start a program
   • Program/script: powershell.exe
   • Add arguments (optional): -File "C:\Path\To\Your\Script.ps1"

This method is ideal for maintenance scripts, nightly jobs, or any task that runs on a predictable schedule.

Part 3: Conclusion: Choosing the Right Elevation Method

With a clear understanding of the tools available, you can now choose the right one for your specific needs.

• For quick, interactive elevation on Windows 11 24H2+: Use the built-in sudo. It’s simple, secure, and requires no setup.
• For frequent interactive elevation or on older Windows versions: Use gsudo. Its credential caching is a significant time-saver.
• For on-demand automation (e.g., CI/CD, deployment scripts): Use gsudo with a credential management system, wrapped in a function like Invoke-GsudoCommand.
• For regularly scheduled, unattended scripts: Use the Windows Task Scheduler. It is the most secure, set-and-forget solution.

By using the right tool for the job, you can build powerful, reliable, and secure automation for your Windows environment while adhering to security best practices.