Check and enable the service
Run PowerShell as administrator on the target server. Windows Server 2025 includes OpenSSH by default; check the installed state instead of reinstalling blindly. The conditional example installs only when absent, then starts sshd and enables automatic startup. Feature download failures may require checking your update policy.
$cap = Get-WindowsCapability -Online -Name 'OpenSSH.Server~~~~0.0.1.0'
if ($cap.State -ne 'Installed') {
Add-WindowsCapability -Online -Name 'OpenSSH.Server~~~~0.0.1.0'
}
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Get-Service sshdRestrict the firewall to your administration network
Replace the documentation subnet 192.0.2.0/24 with your real administration subnet before running the example. Inspect and restrict an existing OpenSSH rule, or create a scoped rule if absent. Keep console access. From another machine, test TCP port 22; a successful port test does not authenticate the server.
$AdminSubnet = '192.0.2.0/24'
$rule = Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
if ($rule) {
$rule | Set-NetFirewallRule -Enabled True -RemoteAddress $AdminSubnet
} else {
New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -RemoteAddress $AdminSubnet
}
Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' | Get-NetFirewallAddressFilter
Test-NetConnection -ComputerName windows-server.example -Port 22Verify identity and account access
Compare the server fingerprint from its console with the client prompt. Connect using the Windows account name. Administrator accounts use %ProgramData%/ssh/administrators_authorized_keys with special ACLs; other accounts normally use their profile’s .ssh/authorized_keys. Follow Microsoft’s key-management instructions. CH-J supports selected Windows tools; its Linux Disk Manager and NGINX workflows do not become Windows features.
ssh-keygen -lf "$env:ProgramData\ssh\ssh_host_ed25519_key.pub" -E sha256
ssh username@windows-server.example