Setting Up OpenSSH Server on Windows Server

OpenSSH Server is natively available on Windows Server (2019 and newer), providing a secure, lightweight way to manage Windows environments remotely using command-line tools like PowerShell over port 22.

In this post, we will walk through installing OpenSSH Server on Windows, configuring the service and firewall rules, and setting PowerShell as the default interactive shell.

Installing OpenSSH Server

Open an elevated PowerShell prompt (Run as Administrator) and check if the OpenSSH Server capability is available:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'

Install the OpenSSH Server feature:

Add-WindowsCapability -Online -Name OpenSSH.Server*

Verify installation:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'

Starting and Enabling Services

Start the sshd service and set it to start automatically on boot:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'

Optionally, start and enable the ssh-agent service if you plan to use key forwarding:

Start-Service 'ssh-agent'
Set-Service -Name 'ssh-agent' -StartupType 'Automatic'

Verify that the services are running:

Get-Service -Name *ssh*

Configuring Windows Firewall

To allow incoming SSH connections on port 22, create an inbound firewall rule using PowerShell:

New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

Alternatively, using legacy netsh:

netsh advfirewall firewall add rule name="SSHD service" dir=in action=allow protocol=TCP localport=22

Setting PowerShell as the Default Shell

By default, connecting to a Windows SSH server opens cmd.exe. To automatically launch PowerShell upon SSH login, set the DefaultShell registry key:

New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -PropertyType String -Force

SSH Configuration & Key Authentication

The OpenSSH configuration file on Windows is located at:

C:\ProgramData\ssh\sshd_config

After modifying sshd_config, restart the SSH service for changes to take effect:

Restart-Service sshd -Force

On Windows, public keys for standard users are stored in C:\Users\<username>\.ssh\authorized_keys. However, for members of the local Administrators group, OpenSSH reads authorized keys from C:\ProgramData\ssh\administrators_authorized_keys by default (controlled by Match Group administrators in sshd_config). Ensure strict file permissions on this file if using key-based authentication for admins.

Testing the Connection

From a client machine, connect to your Windows Server over SSH:

ssh username@windows-server-ip

If connecting with a domain account:

ssh domain\username@windows-server-ip