How to install OpenSSH Server on Windows Server 2022 (key login, PowerShell shell)

Windows Server 2022 ships OpenSSH Server as an optional feature: no third-party installer, updated through Windows Update. Once it's on, you can run PowerShell over SSH, copy files with scp, and point scripts or CI at the server like any Linux box.

Everything below was done on our Windows Server 2022 image, in an elevated PowerShell over RDP (how to connect).

First, the network. On a NAT Windows plan the only inbound forward goes to RDP, so SSH isn't reachable from the internet. For SSH from outside you need a plan with its own IPv4, such as Windows Small-IP. With the port reachable, the steps below take about five minutes.

1. Install OpenSSH Server

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

The client is already installed; the server shows NotPresent until you add it. On our server the install took 28 seconds.

2. Start it and make it start on boot

Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Get-NetFirewallRule -Name *OpenSSH*

Installing the feature creates the firewall rule OpenSSH-Server-In-TCP (port 22, inbound, allowed), so you don't add one yourself.

3. Make PowerShell the default shell

By default an SSH session lands in cmd.exe. Switch it to PowerShell:

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

New connections get PowerShell 5.1 straight away; no restart needed.

4. Add your key for Administrator: the file that trips everyone

This is the first Windows-specific trap. For accounts in the Administrators group, sshd doesn't read C:\Users\<name>\.ssh\authorized_keys. It reads one shared file, C:\ProgramData\ssh\administrators_authorized_keys, and only if nobody but Administrators and SYSTEM can write to it:

$pub = 'ssh-ed25519 AAAA...your-public-key... you@laptop'
Set-Content -Path C:\ProgramData\ssh\administrators_authorized_keys -Value $pub -Encoding ascii
icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

-Encoding ascii matters too. In our test the same key saved with Out-File (UTF-16, the PowerShell 5.1 default) was refused with Permission denied (publickey). From your machine:

ssh Administrator@YOUR.SERVER.IP

You should get a PowerShell prompt without a password. For non-admin users the usual C:\Users\<name>\.ssh\authorized_keys works.

5. Turn off password login: the second trap

The obvious edit, PasswordAuthentication no, isn't enough on this version. OpenSSH 8.1 still offers keyboard-interactive, which asks for the same Windows password. In our test, login with only those two methods still showed keyboard-interactive until we turned it off too. The setting must also come before the Match Group administrators block at the end of the file, or it applies to admins only. This puts both lines at the top:

$cfg = 'C:\ProgramData\ssh\sshd_config'
$lines = Get-Content $cfg | Where-Object { $_ -notmatch '^#?\s*(PasswordAuthentication|KbdInteractiveAuthentication|ChallengeResponseAuthentication)\s' }
Set-Content $cfg -Value (@('PasswordAuthentication no', 'ChallengeResponseAuthentication no') + $lines) -Encoding ascii
Restart-Service sshd

Keep your current SSH session open and test from a second terminal. A password-only attempt should now get:

Permission denied (publickey).

That was the result in our test for both Administrator and a normal user, while key login kept working.

What you can do with it

• Run a command from anywhere: ssh Administrator@IP 'Get-Service sshd'.
• Copy files: scp .\app.zip Administrator@IP:C:/apps/.
• Restrict the port to your address with the same allowlist method as for RDP: Set-NetFirewallRule -Name OpenSSH-Server-In-TCP -RemoteAddress 203.0.113.10.

Which plan

SSH from outside needs a public IPv4: Windows Small-IP (4 vCPU, 4 GB, 50 GB) is $28/mo, Windows Medium-IP (6 vCPU, 6 GB) $36/mo. Windows is Server 2022 with your own licence (BYOL explained). See all four plans on the Windows VPS page. To keep a program running after you disconnect, see run a script 24/7 on Windows Server.