Windows Server 2019 and later include OpenSSH Server as an optional feature. With it, you can SSH into Windows from any terminal, run PowerShell remotely, copy files with scp or SFTP, and automate deployments with the same tools you use for Linux. It’s lighter than RDP for command-line work.

Install and start

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

(On Windows Server 2025, OpenSSH Server is preinstalled, and you only need to enable and start it.)

Firewall

The installer usually creates the rule OpenSSH-Server-In-TCP. Check it, and restrict it to your IPs:

Get-NetFirewallRule -Name *OpenSSH*
Set-NetFirewallRule -Name OpenSSH-Server-In-TCP -RemoteAddress 203.0.113.50

See Windows Server firewall with PowerShell.

Connect

ssh [email protected]
ssh .\\[email protected]        # local account, from some shells you need the .\ prefix

You land in cmd.exe by default. Type powershell (or pwsh) to switch.

Make PowerShell the default shell

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell `
  -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

Use C:\Program Files\PowerShell\7\pwsh.exe if you installed PowerShell 7.

Key-based authentication

Generate a key on your computer (ssh-keygen -t ed25519). See SSH keys.

For a standard (non-admin) user: put the public key in C:\Users\alice\.ssh\authorized_keys.

For members of the Administrators group: Windows OpenSSH uses a separate file: C:\ProgramData\ssh\administrators_authorized_keys. It must have strict permissions:

$key = "ssh-ed25519 AAAA... you@laptop"
Add-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value $key
icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

This is the most common reason key login “doesn’t work” for admin accounts on Windows.

Hardening sshd_config

Edit C:\ProgramData\ssh\sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes
PermitEmptyPasswords no
AllowGroups administrators "openssh users"
# Port 22   (change if you like, and update the firewall rule)

Then Restart-Service sshd. Test a new session before closing your current one. Keep the VNC console from your VPS control panel as a fallback. See VPS VNC console.

File transfer: SCP and SFTP

scp ./app.zip [email protected]:C:/Deploy/
sftp [email protected]

GUI clients such as WinSCP, FileZilla and Cyberduck work with SFTP too. See file transfer over RDP for alternatives.

PowerShell remoting over SSH

With PowerShell 7 on both sides, Enter-PSSession -HostName server -UserName admin uses SSH instead of WinRM. That’s useful when you don’t want to expose WinRM ports. See PowerShell remoting.

Logs and troubleshooting

  • Event Viewer → Applications and Services Logs → OpenSSH → Operational.
  • Debug: stop the service and run sshd -d in an elevated console, to see detailed messages.
  • “Permission denied (publickey)” for admins: check administrators_authorized_keys and its permissions (above).

SSH or RDP?

They complement each other. RDP gives you the full desktop: GUI tools, trading terminals, browsers. SSH is better for anything scriptable: running PowerShell commands, copying files, restarting services, and automated deployments from CI pipelines. SSH also works well over slow or high-latency connections, where an RDP desktop feels sluggish. Many admins keep RDP restricted to a VPN, and use SSH with keys for day-to-day automation.

Security notes

An SSH server is another way into the machine, so treat it like RDP: keys instead of passwords, firewall restrictions to known IPs, and regular updates (OpenSSH updates arrive through Windows Update on recent versions). Watch the OpenSSH Operational log for repeated failed logins, the same way you watch RDP logon failures. See RDP brute-force protection.

Quick reference

Task Command
Install Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start + autostart Start-Service sshd; Set-Service sshd -StartupType Automatic
Admin keys C:\ProgramData\ssh\administrators_authorized_keys
Config C:\ProgramData\ssh\sshd_config
Default shell HKLM:\SOFTWARE\OpenSSH → DefaultShell

Related: PowerShell basics and Windows VPS.

  • Windows Server
  • SSH
  • Remote Access