OpenSSH on Windows Server: sshd setup steps and commands

OpenSSH on Windows Server is enabled from an elevated PowerShell prompt. Add-WindowsCapability installs OpenSSH.Server, Start-Service sshd starts the service and Set-Service makes it automatic. One detail matters for key logins from a phone: admin accounts read C:\ProgramData\ssh\administrators_authorized_keys, not their profile's authorized_keys. The default port is TCP 22.

Installing OpenSSH.Server on Windows Server with Add-WindowsCapability

The Windows OpenSSH server ships as an optional system capability. Two cmdlets, run from an administrator PowerShell console, check its state and install it:

# Check client and server state
Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

# Install the server
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

The first command reports State : Installed or State : NotPresent for OpenSSH.Client and OpenSSH.Server. If the server already shows as installed, skip to the next step. Installation creates the sshd service and the C:\ProgramData\ssh folder. That folder holds the host keys and sshd_config.

Starting the Windows sshd service and opening port 22

After installation, sshd exists but is stopped and set to manual start. These commands start it, make it automatic and check the firewall:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
Get-Service sshd

# Check for an inbound SSH rule
Get-NetFirewallRule -Name *ssh*

# If missing, create one for TCP 22
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

C:\ProgramData\ssh\sshd_config takes the same directives as on Unix, such as PasswordAuthentication, Port or AllowGroups. The full reference is the sshd_config manual page. Run Restart-Service sshd after every change. If the server has no public IP, or you would rather not expose port 22, a private mesh network without open ports such as Prialo, or Tailscale, lets you reach it without touching the router.

administrators_authorized_keys: why your SSH key fails on Windows Server

For members of the local administrators group, sshd ignores %USERPROFILE%\.ssh\authorized_keys. The default sshd_config ends with this block:

Match Group administrators
       AuthorizedKeysFile __PROGRAMDATA__/ssh/administrators_authorized_keys

The phone's public key therefore goes into that shared file. The file must also be accessible only to Administrators and SYSTEM; if it inherits permissions for other users, sshd refuses it. This is the ACL equivalent of 700 on ~/.ssh and 600 on authorized_keys in Linux. Using SIDs avoids trouble with localized group names:

$key = 'ssh-ed25519 AAAA...your-key... phone'
Add-Content -Path 'C:\ProgramData\ssh\administrators_authorized_keys' -Value $key

# Remove inheritance, keep only Administrators (S-1-5-32-544) and SYSTEM (S-1-5-18)
icacls.exe 'C:\ProgramData\ssh\administrators_authorized_keys' /inheritance:r /grant '*S-1-5-32-544:F' /grant '*S-1-5-18:F'

Use an Ed25519 key, which OpenSSH has supported since version 6.5. From OpenSSH 8.8 on, the SHA-1 ssh-rsa signature is disabled by default, so old RSA keys produce confusing failures. In termi1 the key is generated on the phone itself and stored in the system's secure keystore. You copy only the public half; the private key never leaves the device.

PowerShell as the default sshd shell on Windows Server

Without further configuration, a Windows SSH session opens cmd.exe. The DefaultShell registry value under HKLM:\SOFTWARE\OpenSSH changes that:

New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value 'C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe' -PropertyType String -Force
Restart-Service sshd

If PowerShell 7 is installed, point the value at C:\Program Files\PowerShell\7\pwsh.exe instead. With PowerShell as the login shell, you can run Get-Service, Get-EventLog or Restart-Service from your phone without typing powershell first.

Connecting to Windows Server over SSH from a phone versus a desktop

The connection details are the same in any client: user, server IP or hostname, port 22 and the Ed25519 key. What differs is the working environment:

PowerShell relies heavily on Tab to complete cmdlets and parameters, so the keyboard in the termi1 SSH terminal saves a lot of typing. Its AI turns a phrase like "restart the print spooler" into the command and types it at the prompt without pressing Enter. On a server tagged as production, Production Guard holds back any Stop-Service or deletion before it reaches the prompt.

4 mistakes when enabling OpenSSH on Windows Server

1. Putting the key in the admin's profile. For the administrators group, administrators_authorized_keys wins.
2. Leaving permission inheritance on. If other users can access the file, sshd silently ignores it.
3. Skipping automatic startup. Without Set-Service -StartupType 'Automatic', SSH stops working after a reboot.
4. Expecting Mosh or tmux. Both are Unix-side tools; a Windows session is plain SSH.

Frequently asked questions

How do I install OpenSSH Server on Windows Server?

OpenSSH Server on Windows Server is installed from elevated PowerShell with Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0. Next, start the service with Start-Service sshd, set it to automatic with Set-Service, and confirm that a firewall rule allows inbound TCP 22.

Where does an administrator's public key go in OpenSSH for Windows?

An administrator's public key in OpenSSH for Windows goes in C:\ProgramData\ssh\administrators_authorized_keys, not in the user profile. Only Administrators and SYSTEM should have access to the file. Set this with icacls and remove inheritance; if other permissions remain, sshd rejects the key.

Can I use Mosh to connect to a Windows Server?

Mosh needs mosh-server running on the remote machine, launched through an initial SSH connection. OpenSSH for Windows does not include it. From a phone, a Windows Server session is therefore standard SSH, so switching from wifi to mobile data means reconnecting.

How do I set PowerShell as the SSH shell on Windows?

PowerShell becomes the SSH shell on Windows when you create the DefaultShell value under HKLM:\SOFTWARE\OpenSSH pointing to powershell.exe or pwsh.exe. Create the value with New-ItemProperty, then restart the service with Restart-Service sshd so new sessions pick it up.