How about getting the service to check what path the
command is going to run from so that you can still type
just 'sudo notepad' but the application will check that
windows is going to launch notepad from one of the
paths specified in the sudoers.xml
