OpenSSH on Windows 10 and 11 is an optional feature available directly through the Settings app or PowerShell. It allows secure remote administration via SSH without third-party software. This guide details the correct installation steps for client and server components, ensuring you can connect securely while avoiding common configuration pitfalls like incorrect firewall rules or missing service dependencies.
Prerequisites and System Requirements
Before attempting to install OpenSSH, verify that your operating system meets the minimum requirements. The OpenSSH client and server are supported on Windows 10 version 1809 and later, as well as Windows Server 2019 and newer. Older versions of Windows do not include native OpenSSH support in the same integrated manner. Ensure you have administrative privileges, as installing features requires elevated permissions. If you are managing a domain environment, group policy settings might restrict feature installation, so coordinate with your IT department if necessary.
Installing the OpenSSH Client
Most users only need the OpenSSH client to connect to remote Linux or Unix servers. You can install this component using the modern Settings interface or PowerShell. Using the Settings app is often more intuitive for general users. Navigate to
Settings > Apps > Optional Features. Click on
Add a feature and search for "OpenSSH Client". Select it from the list and click
Install. Windows will download and install the necessary binaries automatically.
Alternatively, you can use PowerShell for a faster, scriptable approach. Open PowerShell as Administrator and run the following command:
Get-WindowsCapability -Online | ? Name -like 'OpenSSH.Client*'
If the state is
NotPresent, install it with:
Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
Once installed, you can verify the client by running
ssh -V in any terminal. This should return the version number, confirming the binary is in your PATH.
Installing the OpenSSH Server
To allow incoming SSH connections to your Windows machine, you must install the OpenSSH Server feature. This is critical for remote administration scenarios. Similar to the client, you can use the Settings app or PowerShell. In PowerShell (Admin), check the status first:
Get-WindowsCapability -Online | ? Name -like 'OpenSSH.Server*'
If the state is
NotPresent, install it using:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Note that this command differs significantly from the deprecated
Install-WindowsFeature cmdlet, which is exclusively for Windows Server core installations and does not work on standard Windows 10/11 desktop editions. Using the wrong cmdlet will result in an error. After installation, the SSH service is present but not yet started or configured for automatic startup.
Configuring the SSH Service
Installation alone does not enable remote access. You must start the service and set it to start automatically. Open PowerShell as Administrator and execute:
Start-Service sshd
To ensure the service starts after reboots, configure the startup type:
Set-Service -Name sshd -StartupType 'Automatic'
You may also want to configure the SSH daemon itself by editing the configuration file located at
C:\ProgramData\ssh\sshd_config. By default, Windows OpenSSH uses the local user accounts for authentication. Ensure that password authentication is enabled if you plan to use passwords, although key-based authentication is recommended for security. Restart the service after making any changes to the config file:
Restart-Service sshd
Firewall Configuration
A common point of failure is network connectivity due to firewall blocks. Modern versions of Windows OpenSSH typically create the necessary firewall rule automatically upon starting the service. However, if you cannot connect, verify the rule exists. Run the following command to check for the inbound rule:
Get-NetFirewallRule -Name *ssh*
Look for a rule named
OpenSSH-Server-In-TCP with the action
Allow. If it is missing or disabled, create it manually:
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22
Do not rely on manual log file paths for diagnostics, as the logging behavior has changed in recent updates. Instead, use the Event Viewer to check for errors under
Applications and Services Logs > OpenSSH. This provides real-time feedback on connection attempts and authentication failures. For further troubleshooting on system integrity, see our guide on
Where are my system files located in Windows? to ensure no critical components are corrupted.
Testing the Connection
From a remote machine, test the connection using the IP address or hostname of your Windows PC. Use the following command structure:
ssh username@your_windows_ip
Replace
username with a valid local user account on the Windows machine. If you encounter issues, ensure that the user account has a password set, as empty passwords are generally rejected by SSH for security reasons. If you need to reset credentials, refer to
How to Change Windows Password: A Step-by-Step Guide to ensure your account is properly secured and accessible. Successful connection indicates that the client, server, and firewall are correctly configured.
Frequently Asked Questions
Why does SSH fail even after installation?
The most common cause is that the sshd service is not running or is set to manual startup. Always verify the service status using
Get-Service sshd and start it if it is stopped. Additionally, check the Event Viewer for specific error codes related to permission denied or configuration syntax errors.
Can I use OpenSSH on Windows 7?
No, native OpenSSH is not available on Windows 7. Microsoft introduced this feature starting with Windows 10 version 1809. For older systems, you must use third-party SSH servers like PuTTY or Cygwin, which require separate installation and maintenance.
Is it safe to leave the SSH port open?
Opening port 22 exposes your system to brute-force attacks. It is highly recommended to use key-based authentication instead of passwords. Consider changing the default port to a non-standard number or using a VPN to limit access to trusted networks only.
How do I remove OpenSSH if I made a mistake?
You can uninstall the features just as easily as installing them. Use the command
Remove-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0 for the client or the corresponding server name. This removes the binaries but does not delete user configurations or keys stored in the home directory.
Does OpenSSH replace Remote Desktop Protocol (RDP)?
No, they serve different purposes. RDP provides a full graphical interface, while SSH provides a secure command-line interface. SSH is lighter and works better over low-bandwidth connections, whereas RDP offers richer multimedia support but consumes more resources.