Setting Up an SSH Server on Windows 10 and Windows 11

Windows 10 and Windows 11 include Microsoft's OpenSSH implementation, so you do not need third-party SSH server software.

1. Install OpenSSH Server

Open PowerShell as Administrator and check whether OpenSSH is installed:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

If OpenSSH.Server shows NotPresent, install it:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

The SSH client is normally already installed, but you can install it as well:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0

2. Start the SSH Server

Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Get-Service sshd

3. Check the Windows Firewall

The OpenSSH installation normally creates an inbound firewall rule for TCP port 22.

Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP"

If the rule does not exist:

New-NetFirewallRule `
    -Name "OpenSSH-Server-In-TCP" `
    -DisplayName "OpenSSH Server (sshd)" `
    -Enabled True `
    -Direction Inbound `
    -Protocol TCP `
    -Action Allow `
    -LocalPort 22

4. Find the Windows PC's IP Address

ipconfig

Look for the IPv4 address of your active network adapter.

5. Connect From Another Computer

ssh username@192.168.1.150

On the first connection, accept the host key and enter the Windows user's password.

6. Test SSH Locally

ssh localhost

7. SSH Server Configuration

The main SSH server configuration file is:

C:\ProgramData\ssh\sshd_config

After editing it:

Restart-Service sshd

Restrict SSH to particular users

AllowUsers edin
AllowGroups sshusers
DenyUsers guest

8. Use SSH Keys Instead of Passwords

Generate a key on the computer you are connecting from:

ssh-keygen

For a normal Windows user, place the public key in:

C:\Users\username\.ssh\authorized_keys

Administrator accounts

For accounts in the local Administrators group, authorized keys normally go in:

C:\ProgramData\ssh\administrators_authorized_keys

Set restrictive permissions:

icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" `
    /inheritance:r `
    /grant "Administrators:F" `
    /grant "SYSTEM:F"

Then restart SSH:

Restart-Service sshd

9. Make PowerShell the Default SSH Shell

New-ItemProperty `
    -Path "HKLM:\SOFTWARE\OpenSSH" `
    -Name DefaultShell `
    -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" `
    -PropertyType String `
    -Force

Restart-Service sshd

If PowerShell 7 is installed, you can point the shell to:

C:\Program Files\PowerShell\7\pwsh.exe

10. Change the SSH Port

Edit C:\ProgramData\ssh\sshd_config and set, for example:

Port 2222

Add a matching firewall rule:

New-NetFirewallRule `
    -DisplayName "OpenSSH Server Port 2222" `
    -Direction Inbound `
    -Protocol TCP `
    -LocalPort 2222 `
    -Action Allow

Connect with:

ssh -p 2222 username@192.168.1.150

11. Disable Password Authentication

Once SSH key authentication is working reliably, edit sshd_config:

PubkeyAuthentication yes
PasswordAuthentication no

12. Check Whether SSH Is Listening

Get-NetTCPConnection -LocalPort 22

or:

netstat -ano | findstr :22

13. Troubleshooting

Get-Service sshd
Restart-Service sshd
Test-NetConnection localhost -Port 22

From another Windows PC:

Test-NetConnection 192.168.1.150 -Port 22

For detailed SSH debugging:

ssh -vvv username@192.168.1.150

Useful Locations

C:\ProgramData\ssh\sshd_config
C:\Users\username\.ssh\authorized_keys
C:\ProgramData\ssh\administrators_authorized_keys
C:\Windows\System32\OpenSSH\

Minimal Setup

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic