Installing and hardening the built-in OpenSSH Server on Windows Server

Goal

Install the built-in Windows OpenSSH Server, put an administrator's public key where the server will actually trust it, and set a sane default shell.

Prerequisites

Administrator rights; Windows Server 2019 or later. On 2019 and 2022 OpenSSH Server is an optional capability to add; on Windows Server 2025 it is already installed and only needs to be enabled, so check before adding it.

Steps

1. Check availability and install: Get-WindowsCapability -Online -Name OpenSSH.Server*, then Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0.
2. Start it and set it to auto-start: Start-Service sshd; Set-Service -Name sshd -StartupType Automatic.
3. The server's configuration file, sshd_config, is created under %ProgramData%\ssh\ on first install — not under the client's .ssh folder.
4. For an administrator account, the client's own authorized_keys file is not consulted. If a user "belongs to the administrator group, %programdata%/ssh/administrators_authorized_keys is used instead" of the per-user file. Add the public key to that file.
5. Lock down its ACL exactly as documented, or the server will refuse to use it: administrators_authorized_keys "must only have permission entries for the NT Authority\SYSTEM account and BUILTIN\Administrators security group," with SYSTEM granted full control:

icacls "$env:ProgramData\ssh\administrators_authorized_keys" /inheritance:r
icacls "$env:ProgramData\ssh\administrators_authorized_keys" /grant "SYSTEM:F"
icacls "$env:ProgramData\ssh\administrators_authorized_keys" /grant "BUILTIN\Administrators:F"

6. Set an explicit default shell instead of relying on the built-in fallback, by adding a DefaultShell string value under HKLM:\SOFTWARE\OpenSSH:

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

This setting applies only to the OpenSSH Server, not the client.

Expected result

ssh administrator@SRV1 authenticates with the key from step 4 without a password prompt, and lands in the shell set in step 6.

Limits and test basis

If the ACL on administrators_authorized_keys includes any extra account, the server will not honour the file — verify with icacls after step 5, not just by assuming the commands succeeded. To undo: remove the DefaultShell value to fall back to the default, and Uninstall-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 removes the feature entirely; back up sshd_config and administrators_authorized_keys before either change if the box is already in production use. No reboot is required; Restart-Service sshd is enough after a config change.