Logging and Preventing wsl -u root --exec commands from PowerShell and CMD

[vince-vibin]

Is your feature request related to a problem? Please describe.
We want to prevent the usage of root account in our WSL Setup. When a user is using wsl -u root --exec the command is not logged and can not be audited. As far as we know there is only a way to prevent this using eventmonitor triggers (log inspect).

Describe the solution you'd like
There should be a way to block these Commands either from Windows-Side or the WSL to prevent them from being executed. Also there should be a way to log these or audit them in any way. E.g.: With the windows Defender Plugin for WSL2

Describe alternatives you've considered
We have blocked these Commands using Powershell but this doesn't fix the CMD-Side (Using event monitor triggers). Also these Commands are only in the bash history of root if bash is executed with something like this wsl -u root --exec /bin/bash echo Hello World

Additional context
On an enterprise level this feature could be a real showstopper for rolling out to a lot of users. So for Cooperate deployments in restricted environments we would like to restrict those commands.

[github-actions]

Logs are required for review from WSL team

If this a feature request, please reply with '/feature'. If this is a question, reply with '/question'.
Otherwise please attach logs by following the instructions below, your issue will not be reviewed unless they are added. These logs will help us understand what is going on in your machine.

How to collect WSL logs

Download and execute collect-wsl-logs.ps1 in an administrative powershell prompt:

Invoke-WebRequest -UseBasicParsing "https://raw.githubusercontent.com/microsoft/WSL/master/diagnostics/collect-wsl-logs.ps1" -OutFile collect-wsl-logs.ps1
Set-ExecutionPolicy Bypass -Scope Process -Force
.\collect-wsl-logs.ps1

The script will output the path of the log file once done.

If this is a networking issue, please use collect-networking-logs.ps1, following the instructions here

Once completed please upload the output files to this Github issue.

Click here for more info on logging
If you choose to email these logs instead of attaching to the bug, please send them to wsl-gh-logs@microsoft.com with the number of the github issue in the subject, and in the message a link to your comment in the github issue and reply with '/emailed-logs'.

[vince-vibin]

/feature

[github-actions]

Diagnostic information

Found '/feature', adding tag 'feature'