Enable OpenSSH Server on Windows Server: SSH Login, Key Authentication and SCP/SFTP File Transfer

Windows Server includes Microsoft's port of OpenSSH Server, so you can manage a Windows machine the same way as Linux: run PowerShell commands over SSH, automate tasks from scripts, and copy files securely with scp or SFTP clients such as WinSCP and FileZilla, without opening a Remote Desktop session. This guide covers installing and starting the SSH server on Windows Server 2019, 2022 and 2025, making PowerShell the default shell, key-based login for administrators, changing the port and transferring files.

Step 1: Install OpenSSH Server

Open PowerShell as Administrator. The command below shows whether the client and server are installed; on Windows Server 2025 the server is usually present already and only needs to be enabled.

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

# Install the server if its State is NotPresent
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

On Windows Server 2016, which does not include it, install the Win32-OpenSSH MSI package from Microsoft's PowerShell/Win32-OpenSSH releases on GitHub.

Step 2: Start the Service and Check the Firewall

# Start sshd now and at every boot
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

# The installer normally creates an inbound rule for TCP 22; create it if it is missing
if (-not (Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue)) {
  New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' `
    -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
}

Get-Service sshd
netstat -ano | findstr ":22"

Now connect from your computer with ssh [email protected] (Windows 10/11, macOS and Linux all include an SSH client) and enter the Administrator password. By default you get a cmd.exe prompt.

Step 3: Make PowerShell the Default Shell

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell `
  -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

New SSH sessions now start in PowerShell. If you installed PowerShell 7, use the path to pwsh.exe instead.

Step 4: Log In with SSH Keys and Disable Passwords

For accounts in the Administrators group, Windows OpenSSH reads public keys from one shared file, C:\ProgramData\ssh\administrators_authorized_keys, not from the user's own .ssh folder. The file must be accessible only to Administrators and SYSTEM, or sshd ignores it.

# On your own computer: create a key pair if you do not have one yet
ssh-keygen -t ed25519

# On the server (PowerShell as Administrator): paste your PUBLIC key (id_ed25519.pub)
Add-Content -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Value "ssh-ed25519 AAAA...your-key... you@laptop"
icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

Test key login in a new window. When it works, open C:\ProgramData\ssh\sshd_config in Notepad and set:

PubkeyAuthentication yes
PasswordAuthentication no

Restart-Service sshd

Keep your current session open until you have confirmed that a new key-based login still works. For standard (non-administrator) users, put keys in C:\Users\USERNAME\.ssh\authorized_keys instead.

Step 5: Change the SSH Port (Optional)

# In C:\ProgramData\ssh\sshd_config set:  Port 2222
New-NetFirewallRule -Name 'OpenSSH-2222' -DisplayName 'OpenSSH Server 2222' `
  -Direction Inbound -Protocol TCP -LocalPort 2222 -Action Allow
Restart-Service sshd
Disable-NetFirewallRule -Name 'OpenSSH-Server-In-TCP'   # close 22 after testing 2222

To allow SSH only from your own addresses, add -RemoteAddress 198.51.100.20 to the firewall rule. More about Windows Firewall rules: opening and closing ports in Windows Firewall.

Step 6: Transfer Files with scp and SFTP

# Upload a file to the Administrator desktop (use forward slashes in Windows paths)
scp .\site-backup.zip [email protected]:C:/Users/Administrator/Desktop/

# Download a folder recursively
scp -r [email protected]:C:/inetpub/wwwroot ./wwwroot-copy

# Interactive SFTP session
sftp -P 2222 [email protected]

Graphical clients such as WinSCP and FileZilla work too: choose the SFTP protocol, the server IP and port, and your key or password. This is much faster and more reliable for large files than copying through the Remote Desktop clipboard.

FAQ

Key login still asks for a password

For administrator accounts the key must be in administrators_authorized_keys with the exact permissions from Step 4. Check the log in Event Viewer → Applications and Services Logs → OpenSSH → Operational; it usually names the problem, such as bad ownership or permissions.

The connection times out

The sshd service is not running, the firewall rule is missing, or you are connecting to the wrong port. Run Test-NetConnection 203.0.113.10 -Port 22 from your computer and Get-Service sshd on the server.

Can I still use Remote Desktop?

Yes. SSH and Remote Desktop run side by side. Many administrators use SSH for scripts and file transfers and keep Remote Desktop for graphical tools.

Still stuck after following these steps? Open a support ticket and the IMIDC 24/7 technical team will help. Include the server IP, the Windows Server version, the SSH command you ran and the full error output (run ssh -v for details) so we can pinpoint the issue faster.