[Windows 11] Topgrade uses Sudo when run as administrator

[GideonBear]

I want to suggest some general feature

In Windows 11, Topgrade should not use Sudo when run as administrator, but run the command directly.

More information

In Windows 10 running as administrator worked fine, but in Windows 11 I have to press "Yes" on Sudo's prompt multiple times (Windows Update, Microsoft Store). In Windows 10 some steps would simply fail if not run as administrator, but this is no better.

[SteveLauC]

Emm, I am no Windows expert, so I try to mirror my UNIX knowledge here.

If sudo is needed, shouldn't Topgrade use it? I see "press "Yes" on Sudo's prompt" as a necessary step to make sudo work. On Linux, sudo privilege will be cached, wouldn't Windows sudo handle that?

[GideonBear]

Emm, I am no Windows expert, so I try to mirror my UNIX knowledge here.

If sudo is needed, shouldn't Topgrade use it? I see "press "Yes" on Sudo's prompt" as a necessary step to make sudo work. On Linux, sudo privilege will be cached, wouldn't Windows sudo handle that?

I don't see why Sudo is needed when Topgrade itself is ran as administrator, as it can just spawn processes with administrator permissions. What mostly confuses me is that Topgrade seemed to be supposed to be run as Administrator in Windows 10 (as that was the only way to get (IIRC) Windows Update to work), but in Windows 11 suddenly uses Sudo regardless of privilege state.
Anyway referencing #1015 as well (although that's on Linux), I think this behavior is unacceptable, regardless of the method to solve it. Winget installers sometimes ask me to press "Yes" as well, but that is more of a Winget problem and not really an issue; but having to do it every time, even when nothing is upgraded, is just annoying, and requires me to monitor my Topgrade run constantly.
Please don't interpret my “unacceptable” negatively though, I understand that you're not developing this for Windows primarily, and I still think Topgrade is an amazing tool, even (maybe even especially) on Windows :)

The best solution / optimal outcome that I can think of (both for Linux and Windows) is to support both running as root/administrator and running unprivileged. Then in the case of a privileged run, it should be able to run fully unattended (and hopefully still be able to upgrade tools that are not supposed to be run privileged, maybe by then switching back to the original user?), and when run unprivileged, it can sudo (and in the case of Linux, cache it).

Just throwing ideas here, lmk what you think!

[GideonBear]

Also no, Windows Sudo does no caching at all (by default anyway). I had to set it to "Inline" in the developer settings to properly work, and mirror what I saw in Windows 10 the best.

[SteveLauC]

I don't see why Sudo is needed when Topgrade itself is ran as administrator,

Sorry for missing that administrator mode, it feels indeed unnecessary to use sudo in that case.

So, under the administrator mode, sudo something still requires manual verification? To me, the intuitive behavior will be that verification will be skipped, I expect Windows sudo to handle this automatically. 🫠

[GideonBear]

I don't see why Sudo is needed when Topgrade itself is ran as administrator,

Sorry for missing that administrator mode, it feels indeed unnecessary to use sudo in that case.

So, under the administrator mode, sudo something still requires manual verification? To me, the intuitive behavior will be that verification will be skipped, I expect Windows sudo to handle this automatically. 🫠

Yes, it is certainly something that I would expect Windows sudo itself to do... Unfortunately it doesn't. I can try to implement this (skipping sudo on Windows when it is administrator) myself if I have time, would that be accepted?

[SteveLauC]

would that be accepted?

Yeah

---

Yes, it is certainly something that I would expect Windows sudo itself to do...

Which sudo are you using? Is it open-source? Maybe we can file an issue there if so

[soredake]

Run into the same problem, chocolatey step uses sudo even if topgrade already running as admin.

[GideonBear]

Yes, it is certainly something that I would expect Windows sudo itself to do...

Which sudo are you using? Is it open-source? Maybe we can file an issue there if so

This is the sudo that is built into Windows 11. When it is not enabled, some steps just crash with "enable sudo in the developer settings". It seems like Topgrade chooses to run sudo because it finds there is a sudo exe on PATH, even when sudo is disabled (in that case all the sudo exe does is crash); while in Windows 10 it was just not there. Does that seem correct?

I'm also considering looking for an alternative sudo implementation for Windows 11, but I'm somewhat expecting caching to be impossible on Windows...

[soredake]

I'm also considering looking for an alternative sudo implementation for Windows 11, but I'm somewhat expecting caching to be impossible on Windows...

https://github.com/gerardog/gsudo

[SteveLauC]

This is the sudo that is built into Windows 11.

https://github.com/microsoft/sudo this one? Could you please file an issue there(for this weird behavior)?

but I'm somewhat expecting caching to be impossible on Windows...

Well, I hope this can be implemented. If we need to fix this within Topgrade, then all the steps that involve sudo need a refactor 😪

When it is not enabled, some steps just crash with "enable sudo in the developer settings". It seems like Topgrade chooses to run sudo because it finds there is a sudo exe on PATH, even when sudo is disabled (in that case all the sudo exe does is crash); while in Windows 10 it was just not there. Does that seem correct?

Topgrade assumes as long as there is a sudo found in the $PATH, then it can be used. Frankly, I hate such Microsoft tricks, again, fixing this on the Topgrade side would be a big refactoring...

---

I'm also considering looking for an alternative sudo implementation for Windows 11, but I'm somewhat expecting caching to be impossible on Windows...

https://github.com/gerardog/gsudo

Does gsudo handle the administrator mode correctly? i.e., when in the administrator mode, sudo behaves like a no-op

[GideonBear]

Relevant issue already exists:
microsoft/sudo#1
Also: microsoft/sudo#119
When I'm home I'll test out the "opens UAC prompt even when run as administrator" behavior and open an issue for that as well.

I agree that this is something sudo should fix themselves. I will experiment a bit with gsudo as well (thx for the link @soredake!)

[GideonBear]

When I'm home I'll test out the "opens UAC prompt even when run as administrator" behavior and open an issue for that as well.

This is not actually the case. Running sudo echo hello in an elevated cmd does not prompt.
Also, upon testing again, running topgrade as administrator does indeed not prompt UAC for sudo... It appears I made a mistake, I was not actually running it as administrator, sorry! (looks like the "run as administrator" compatibility checkbox in my shortcut was reverted when I moved the executable...?) It does prompt twice when running unelevated, but that's still a sudo issue.

For me the issue is solved now; I will just keep running it as administrator for now, and if that ever causes an issue, I can always install gsudo.

Run into the same problem, chocolatey step uses sudo even if topgrade already running as admin.

Is this with the Windows 11 Sudo.exe or gsudo/something else? Can you check as well that topgrade is actually running as administrator? In any case I don't think the problem lies with Topgrade here; I think it is reasonable to expect of any sudo that they do nothing when ran as administrator.

[soredake]

Is this with the Windows 11 Sudo.exe

Yes.

Can you check as well that topgrade is actually running as administrator?

Yes, it is.

[SteveLauC]

It appears I made a mistake, I was not actually running it as administrator

For me the issue is solved now

Good to hear!

---

Can you check as well that topgrade is actually running as administrator?

Yes, it is.

So under administrator mode, sudo something will give you a prompt?

[soredake]

So under administrator mode, sudo something will give you a prompt?

No, command will just not execute when built-in sudo is disabled (which is default):

When sudo is enabled there will be no prompt when you run built-in sudo while topgrade launched with admin rights.

[SteveLauC]

No, command will just not execute when built-in sudo is disabled (which is default):

See issue microsoft/sudo#119, Microsoft should fix this