Why run Ubuntu on Windows? It’s about getting the best of both worlds. Many organizations rely on Windows applications, enterprise software, and policy configurations; but for developers and system administrators, Ubuntu’s native command-line tools, package managers, and server environments are invaluable. Likewise, with its broad ecosystem of machine learning tools and libraries, and silicon optimizations, Ubuntu is ideally suited for AI workloads.To drill down into a more specific example: for developers in regulated industries with tightly brokered elevated privileges, building applications with Node.js, Python, and other toolchains can lead to development hurdles on Windows. Navigating privilege and access control discrepancies requires specialized skillsets, and may change development timelines. By installing Ubuntu within Windows, organizations can avoid this complexity. Microsoft and Canonical’s management tooling complement one another, providing a comprehensive suite of turnkey compliance, auditing, hardening, and security capabilities.The beauty of this ecosystem is that there is no single “right” way to do it, because different users have different needs: from simple script execution to locally simulating production environments, there are multiple ways to bridge Windows and Ubuntu. Each virtualization solution for Ubuntu in Windows comes with varying degrees of centralized management, and risk mitigation capabilities. In this article, I will explore the best ways to run Ubuntu on Windows, breaking down how each method works, so you can choose the exact right setup for your workflow.Building reproducible environmentsManually reconfiguring a new virtual machine is time consuming: run commands to install packages, wait for the packages to install, and then configure them when the installation completes. Virtual machines used for development purposes need additional configurations, such as SSH keys for interacting with git repositories and access to other Linux environments, configuring AI assistants, and setting up workspaces where coding and prototyping happens. All of these time consuming activities can be automated through cloud-init, which is supported by all the virtualization solutions mentioned in this article. Building reproducible environments with cloud-init is the industry standard practice for configuring virtual machines. Multipass and Ubuntu on WSL support cloud-init natively, and Hyper-V and VirtualBox support cloud-init through the NoCloud method.The NoCloud method entails creating an ISO which includes cloud-init configuration files. Follow these steps to generate a NoCloud ISO image if you are on Ubuntu:Create two runtime configuration files: user-data and meta-data. The contents of the user-data file must be valid cloud-init YAML. The meta-data file can be empty.In Ubuntu on WSL install the genoisoimage package:apt install genoisoimageCreate a small ISO file (labeled cidata) containing the user-data and meta-data runtime configuration files:mkisofs -output seed.iso -volid cidata -joliet -rock user-data meta-dataUbuntu on Hyper-VHyper-V is Microsoft’s native hypervisor technology that enables hardware virtualization, enabling you to create and manage multiple virtual machines (VMs) on a single Windows physical host. It is a Type 1 hypervisor – meaning that it runs directly on bare metal hardware – commonly used for server virtualization in data centers and running isolated virtual environments on Windows 10 or 11. Hyper-V is included in Windows Pro and Enterprise editions. If you need deep separation between the Linux environment and the Windows file system, and also want to run Canonical’s Ubuntu kernels in your virtual machines, Hyper-V is the native Windows solution. Virtual machines can be installed on Hyper-V from an Ubuntu ISO. Alternatively, a vhdx disk image can be used, and Ubuntu can be configured with cloud-init:Go to Canonical’s official repository: cloud-images.ubuntu.com and download the file ending in .img for your architecture (e.g., ubuntu-26.04-server-cloudimg-amd64.vmdk).In Ubuntu install the qemu-utils package:apt install qemu-utilsUse qemu-utils to convert the vmdk image to the vhdx format, for Hyper-V:qemu-img convert -f vmdk -O vhdx ubuntu-26.04-server-cloudimg-amd64.vmdk ubuntu-26.04-server-cloudimg-amd64.vhdxCreate a new virtual machine in Hyper-V and choose the resulting vhdx file under “Connect a Virtual Disk”.Attach this ISO to the VM’s virtual DVD drive before the first boot.The Ubuntu virtual machine in Hyper-V will detect the ISO file in the virtual DVD drive as it turns on, and will run your configuration.Ubuntu on VirtualBoxOracle VirtualBox is a general-purpose full virtualization software which works on computers powered by x86_64 and arm chips. It’s commonly used in laptops, desktops, and servers. VirtualBox is an application that runs on top of Windows, which makes it a Type 2 hypervisor. It relies on Windows to manage hardware resources like the CPU, RAM, and networking. VirtualBox provides passthrough USB support, but can have limited performance for disk I/O or CPU-bound tasks, and has no high performance GPU capabilities. This means that VirtualBox is not optimized for AI workloads. There is a feature called PCI passthrough which allows a VirtualBox VM to assume complete control of a physical GPU, but the GPU access would then be limited to a single virtual machine.Virtual machines can be installed on VirtualBox from an Ubuntu ISO. Alternatively, a vmdk disk image can be used, and Ubuntu can be configured with cloud-init using the NoCloud method, and the seed.iso as described above.While it is possible to use either Hyper-V or VirtualBox as standalone solutions for running Ubuntu on Windows, you can also use WSL or Canonical’s Multipass to make virtualized instances more accessible and manageable.MultipassMultipass is a mini-cloud for your Windows, macOS, or Linux workstation. On Windows, it can use either VirtualBox or Hyper-V behind the scenes. You can manage everything through a simple Multipass CLI and UI, making it the fastest way to spin up ephemeral or long-running Ubuntu instances that can run as background services. The Multipass daemon (multipassd) is set to start automatically at system boot and will restore persistent Ubuntu instances after a restart. This happens at the service/daemon level, not requiring a user login.When launching a Multipass VM, user-data can be passed by adding the --cloud-init flag with an appropriate YAML file containing the user-data. Multipass supports cloud-init natively, and does not require the NoCloud method.Ubuntu on WSLAll Windows editions (except Windows 10 and 11 S Mode or certain legacy IoT builds) include WSL, which utilizes a specialized Hyper-V subset to host a high-performance Linux VM.WSL is a feature of the Windows operating system that enables you to run a Linux file system, along with Linux command-line tools and GUI apps, directly on Windows, alongside your traditional Windows desktop and apps. WSL uses the Virtual Machine Platform component in Hyper-V to run the Linux kernel. It provides full Linux system call compatibility, with high performance. A system call (syscall) is the way a program asks the operating system’s kernel to do something, like opening a file or starting a network connection. This means your Linux binaries no longer rely on a translation layer to talk to Windows; it’s the difference between using a translator and speaking the native language. With the Linux kernel available inside a lightweight utility VM, when an app makes a syscall, it’s talking to a real Linux engine, resulting in near 100% compatibility with Linux software. Because the Linux kernel manages its own virtual hard disk (ext4), operations like git clone, npm install, or compiling large codebases happen at speeds comparable to a native Linux machine.WSL uses a technology called GPU Paravirtualization (vGPU). Instead of the Linux kernel competing with Windows for control of the graphics card, Windows shares the GPU. The dxgkrnl driver projects a virtual abstraction of the GPU into the WSL instance. For tasks using NVIDIA CUDA, performance on WSL2 can be comparable to native Linux (within 1%) for large, long-running workloads. This compatibility enables you to run Linux GUI apps via Windows Subsystem for Linux GUI (WSLg) with hardware acceleration, meaning they feel smooth rather than laggy. While GPU access is excellent, direct hardware access to things like proprietary USB devices or specialized serial ports may require troubleshooting compared to native Linux.Ubuntu on WSL supports cloud-init natively:Create a directory at %USERPROFILE%\.cloud-init\Create a file named .user-data (e.g., Ubuntu-26.04.user-data).When you first run wsl --install Ubuntu-26.04, WSL will pick up this file and automate your setup.Enable Ubuntu Pro for WSL with Microsoft IntuneMicrosoft Intune is a cloud-based endpoint management solution that can manage configurations of Windows computers. Microsoft Intune can execute commands within a WSL instance by leveraging PowerShell scripts that interact with the wsl.exe executable. You can enable and manage WSL using Microsoft Intune by using the “Settings Catalog” to configure settings or by deploying the WSL MSI app. CTA: Canonical Landscape goes beyond arbitrary command execution in WSL instances, and provides enterprise features for configuration, compliance, hardening, auditing, patching, reporting, and inventory of users and software. Pairing Microsoft Intune with Ubuntu, and using Landscape for managing WSL at scale enables developers to accelerate their workflows in even the most tightly regulated environments.Ubuntu Pro for WSL is Windows software that provides turnkey security maintenance and enterprise support for Ubuntu 24.04 LTS and Ubuntu 26.04 LTS WSL instances in Windows. The Ubuntu Pro for WSL Windows software works with free and paid Ubuntu Pro subscriptions. Installing Ubuntu Pro for WSL ensures that anyone using Ubuntu on WSL is always security maintained, in addition to enabling comprehensive management and insights through Landscape, Canonical’s systems management solution for Ubuntu.The Ubuntu Pro for WSL software is packaged as an MSI application. Installing and configuring MSI packages is natively supported by Microsoft Intune and Active Directory. The simplest method for installing Ubuntu Pro for WSL using Microsoft Intune is to deploy it as a line-of-business (LOB) app. In a regulated environment where WSL is enabled, the Ubuntu Pro for WSL .msi file should be chosen as a Required (automatically installed) package in Microsoft Intune. The most secure location to store the Ubuntu Pro for WSL agent configurations is the Windows Registry. Remediation scripts can be used in Microsoft Intune, where a detection script checks for the necessary keys and values, and a remediation script can set missing or deviated values, ensuring continuous compliance.This video shows how the Ubuntu Pro for WSL software can be installed on a Windows machineNavigate to your Microsoft Intune admin center portal, and then select: Devices > Configuration Profiles > Create > New Policy > Windows 10 and later > Settings Catalog. Create a name for the new policy and search for “Windows Subsystem for Linux” to see and add the full list of available settings. Important WSL-specific settings include:Allow the Inbox version of the Windows Subsystem for Linux: Enabled if you want to self-host the WSL images internally, instead of downloading them from the Microsoft Store.Allow WSL1: Disabled because Landscape’s enterprise management capabilities for WSL are only available in WSL2.Ubuntu Pro for WSL in controlled environmentsUbuntu Pro for Windows contains the user configurations that define root (sudo and su) privileges in cloud-init.yaml. Microsoft recently built native Entra ID integration directly into WSL to secure the launching of WSL instances, and this integration is managed via Microsoft Intune. This combination provides control over who can use Ubuntu on WSL, and if root privileges are granted in Ubuntu on WSL. When you use the Entra ID login for Linux VMs extension in Azure, Entra ID controls who can launch Ubuntu on WSL. It does this via Azure Role-Based Access Control (RBAC). Entra ID’s sign-in logs will tell you when a user authenticated to the Linux machine, but it stops there. It will not log the commands they type after a successful session begins.The actual tracking of sudo and su is done by the Linux operating system itself. Whenever a user escalates privileges, Ubuntu logs this activity to its local system logs at /var/log/auth.log. To track this activity centrally, you need to bridge the gap between the local Linux logs and your cloud environment. Install the Azure Monitor Agent (AMA), configure a Data Collection Rule (DCR) in Azure to instruct the AMA to collect the authpriv syslog facility (which contains the sudo and su events and send these logs to an Azure Log Analytics Workspace. Connect your Log Analytics Workspace to Microsoft Sentinel (Microsoft’s SIEM). You can now write KQL (Kusto Query Language) queries to alert your security team every time someone successfully or unsuccessfully executes sudo or su.Between the controls available in Microsoft Intune and Landscape, it is possible to centrally provision WSL instances for users. Users are able to self-service the creation of new, compliant instances, and administrators are able to survey a Windows estate for compliance within the WSL instances. Ubuntu Pro for WSL ensures Expanded Security Maintenance (ESM) is enabled, providing CVE security updates that can be applied subject to administrative policy. Canonical provides up to 15 years of CVE security patching for software packaged and published through Ubuntu’s repositories. Ubuntu Pro subscriptions also cover security maintenance for popular toolchains on WSL, such as Python, Go, Rust, and more. This turnkey solution ensures security vulnerabilities are patched quickly and reliably, making WSL a viable, compliant option for enterprise environments.This video shows how you can use Landscape to provision and manage WSL instances on Windows workstationsNext stepsWatch the webinar: Ubuntu on WSL in the enterpriseDownload Ubuntu Pro for WSLRead the Ubuntu Pro for WSL documentation