Install OpenSSH Server on Windows for SSH and SFTP

OpenSSH Server lets you open a PowerShell or command prompt on your Windows server over SSH, and copy files with SFTP or scp, without a full Remote Desktop session. It is built into Windows Server 2019 and later and Windows 10/11.

1. Install the server

Open PowerShell as Administrator.

On Windows Server 2025, OpenSSH Server is already installed; skip to step 2.

On Windows Server 2019/2022 and Windows 10/11:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

2. Start it and make it start at boot

Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" | Select-Object Name, Enabled

If the firewall rule does not exist, create it:

New-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -DisplayName "OpenSSH Server (sshd)" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow

3. Connect from your computer

macOS, Linux and Windows 10/11 all include an SSH client:

ssh Administrator@203.0.113.25

4. Make PowerShell the default shell (optional)

SSH opens Command Prompt by default. To get PowerShell instead:

New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force

5. Use SSH keys for administrators

For accounts in the Administrators group, Windows reads keys from one shared file, not the user's own folder. Paste your public key into it and lock down its permissions:

Add-Content -Path "C:\ProgramData\ssh\administrators_authorized_keys" -Value "ssh-ed25519 AAAA...your-public-key... you@laptop"
icacls.exe "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"

New to keys? Set up SSH keys explains how to create a key pair.

6. Copy files with SFTP

SFTP works as soon as sshd is running. Use scp from a terminal, or a graphical client such as WinSCP or FileZilla with protocol SFTP, port 22:

scp ./site.zip Administrator@203.0.113.25:C:/Users/Administrator/Desktop/

Troubleshooting

• Connection refused: Get-Service sshd must show Running.
• Key is ignored for an admin account: check the key is in administrators_authorized_keys and that the icacls command above was run.
• Timed out: the firewall rule is missing or restricted to another IP.

Next steps

• Transfer files to a Windows server
• Secure Remote Desktop on Windows Server