How to Install and Configure OpenSSH Server on Windows 11 for Secure Remote Terminal Access

Administering Windows systems remotely has traditionally relied on Remote Desktop Protocol (RDP) or Windows Remote Management (WinRM). While effective for graphic desktop access and enterprise domain scripting, modern hybrid infrastructures often demand a lightweight, cross-platform terminal protocol. Windows 11 includes an optional, production-grade port of OpenSSH Server (sshd) developed directly by Microsoft. Installing and configuring this native component allows administrators and power users to establish encrypted command-line sessions, execute remote PowerShell scripts, and transfer files securely via SFTP without third-party utilities.

Installing OpenSSH Server via Windows Settings or PowerShell

While the OpenSSH Client is installed by default on Windows 11, the OpenSSH Server is an optional feature that must be added manually. You can install it using the graphical interface or via an elevated PowerShell prompt:

1. Via Windows Settings:
   • Open the Settings app (press Win + I).
   • Navigate to System > Optional features.
   • Click View features next to Add an optional feature.
   • Scroll down or type OpenSSH Server into the search field, select the checkbox, and click Next followed by Install.
2. Via Elevated PowerShell:

   Alternatively, open PowerShell as an Administrator and execute the following deployment command:

   Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*' | Add-WindowsCapability -Online

   The command will download the binaries from Windows Update and register the underlying sshd and ssh-agent system services.

Configuring and Starting the SSH Service

Once installation finishes, the service exists on disk but is set to manual startup by default. To ensure that the server starts automatically whenever Windows boots:

1. Open PowerShell with administrative privileges.
2. Configure the service to start automatically on system launch:

   Set-Service -Name sshd -StartupType 'Automatic'

3. Start the service immediately without restarting the machine:

   Start-Service sshd

4. Verify that the service is running and actively listening on port 22:

   Get-Service sshd

Configuring Windows Defender Firewall Rules

The OpenSSH Server installer creates a Windows Defender Firewall rule automatically. However, verifying the rule ensures that incoming connection attempts on TCP port 22 are not silently dropped by strict network profiles:

1. Check the active firewall configuration using PowerShell:

   Get-NetFirewallRule -Name *ssh*

2. If the rule is absent or disabled, create a dedicated inbound firewall rule for your private network:

   New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH SSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

3. For maximum network hygiene, restrict the firewall rule to the Private profile to prevent public Wi-Fi networks from exposing your SSH port.

Customising the Default Shell to PowerShell

By default, incoming SSH connections on Windows spawn the legacy Command Prompt (cmd.exe). To set PowerShell 7 or Windows PowerShell as your default remote login shell:

1. In an elevated PowerShell window, create a registry entry instructing OpenSSH to launch PowerShell upon authentication:

   New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

2. If you have PowerShell 7 (Core) installed via winget or MSI, adjust the value path accordingly:

   New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Program Files\PowerShell\7\pwsh.exe" -PropertyType String -Force

3. Restart the SSH service to apply the shell change:

   Restart-Service sshd

Securing Authentication with SSH Public Keys

While password authentication works immediately using your local Windows user credentials, configuring public key authentication offers superior protection against brute-force attacks:

1. On standard non-administrative Windows accounts, user keys are stored in:

   C:\Users\<username>\.ssh\authorized_keys

2. On Windows accounts belonging to the local Administrators group, Windows OpenSSH enforces a stricter security architecture. Key pairs for administrators must be placed in the global administrator file:

   C:\ProgramData\ssh\administrators_authorized_keys

3. Ensure that NTFS Access Control Lists (ACLs) on the administrators_authorized_keys file grant read permissions exclusively to SYSTEM and the Administrators group. If permissions are too open, the SSH daemon rejects key-based authentication.
4. To test your connection from a remote computer, run:

   ssh username@windows_ip_address