WardtermSSH client
EN
Download

How to install OpenSSH Server on Windows 11

In PowerShell as administrator, run Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0, then Start-Service sshd and Set-Service -Name sshd -StartupType Automatic. Setup creates the firewall rule OpenSSH-Server-In-TCP for port 22. Keys for administrator accounts go in C:\ProgramData\ssh\administrators_authorized_keys, not in the user's folder.

Updated .

Install

Open PowerShell with Run as administrator. Check whether it is already there:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

If OpenSSH.Server~~~~0.0.1.0 shows State : NotPresent, install it:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Microsoft's minimum is Windows 10 build 1809 or Windows Server 2019, with PowerShell 5.1.

You can also use Settings: search for Optional features in Start, choose View features, and add OpenSSH Server. Then open the Services app, set OpenSSH SSH Server to Automatic and start it.

Start the service

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
Get-Service sshd

Without the second line the service does not come back after a restart.

Check the firewall rule

Setup should create and enable a rule for port 22. This is Microsoft's check, which also creates the rule if it is missing:

if (!(Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
}

Test it from another Windows machine:

Test-NetConnection -ComputerName server -Port 22

Connect

ssh user@server

For a domain account the form is ssh domain\user@server. You get cmd.exe by default. To get PowerShell instead, run this on the server:

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

Key login needs a key pair on your computer first. See how to generate an SSH key on Windows.

Keys: which file is read

This is where most setups fail. The default sshd_config on Windows ends with:

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

So the file depends on the account:

AccountFile
Standard userC:\Users\user\.ssh\authorized_keys
Member of AdministratorsC:\ProgramData\ssh\administrators_authorized_keys

A key placed in the user's own folder is ignored for an administrator, and the login falls back to asking for a password. To check whether the account is an administrator:

Get-LocalGroupMember Administrators

Add a key for an administrator

Run this on the server in an elevated PowerShell, with your own public key in place of the example:

Add-Content -Force -Path $env:ProgramData\ssh\administrators_authorized_keys -Value 'ssh-ed25519 AAAA... you@laptop'
icacls.exe "$env:ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

The second line matters: the file must have permission entries only for Administrators and SYSTEM. On a non-English Windows the group name differs, so use its SID: /grant "*S-1-5-32-544:F".

Add a key for a standard user

Run this on the server as that user:

New-Item -Force -ItemType Directory -Path $env:USERPROFILE\.ssh
Add-Content -Force -Path $env:USERPROFILE\.ssh\authorized_keys -Value 'ssh-ed25519 AAAA... you@laptop'

Do not use > or >> for these files. In Windows PowerShell 5.1 they write UTF-16, which is not what the server expects. To copy a key from another computer, see ssh-copy-id on Windows.

Changing settings and reading logs

The configuration file is C:\ProgramData\ssh\sshd_config. Restart the service after any change:

Restart-Service sshd

Logs go to Event Viewer, under Applications and Services Logs, OpenSSH, Operational. Look there first when a login fails, since the client only says Permission denied.

Note that PermitRootLogin does nothing on Windows. To stop administrators logging in, use DenyGroups administrators.

Questions

Can I log in with a Microsoft Entra ID account?

No. Microsoft's documentation says key-based authentication works with local and Active Directory accounts, and Entra accounts are not supported by OpenSSH on Windows.

Is this the same on Windows Server 2025?

OpenSSH is already installed there. You only need Start-Service sshd and Set-Service -Name sshd -StartupType Automatic, or the Remote SSH Access setting in Server Manager.

Sources

More in SSH on each system

All guides