SSH connections fail after upgrading from Windows 10 to Windows 11 because the OpenSSH Server service often fails to start automatically or loses its firewall rules during the major version transition. This guide provides immediate steps to restore remote access by verifying service status, re-registering firewall exceptions, and ensuring the correct authentication methods are enabled for your specific client requirements.
Verify the OpenSSH Server Service Status
The most common reason for connectivity loss is that the
OpenSSH.Server service did not successfully migrate its startup configuration from the previous operating system. You must first determine if the service is installed and running on your Windows 11 machine. Press
Win + R, type
services.msc, and hit Enter to open the Services console. Scroll down to locate
OpenSSH SSH Server. If the service is missing entirely, you need to reinstall it via PowerShell as an optional feature. Run
Get-WindowsCapability -Online | Where-Name Like 'OpenSSH*' to check availability, then use
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 to install it if it was uninstalled during the upgrade process.
If the service exists but shows a status of "Stopped" or "Disabled," right-click it and select
Properties. Change the Startup Type to
Automatic to ensure it launches at boot. Click
Start to bring the service online immediately. Check the "Log On" tab to confirm it is using the Local System account, which is standard for this service. If the service starts but stops shortly after, check the Event Viewer under Applications and Services Logs > OpenSSH for error details regarding permission denials or missing host keys.
Reconfigure Windows Defender Firewall Rules
Major OS upgrades frequently reset or invalidate existing firewall configurations, blocking inbound traffic on port 22 even when the service is active. To resolve this, you must explicitly allow incoming SSH connections through Windows Defender Firewall. Open PowerShell as Administrator and execute the command
New-NetFirewallRule -DisplayName "OpenSSH-Server-In-TCP" -Direction Inbound -Protocol TCP -LocalPort 22 -Action Allow. This creates a new rule that permits traffic specifically for the SSH daemon.
Alternatively, navigate to
Control Panel >
Windows Defender Firewall >
Allow an app or feature through Windows Defender Firewall. Ensure that
OpenSSH Server is checked for both Private and Public networks. If the entry is grayed out or missing, it indicates the service registration is incomplete, requiring you to restart the service again or reinstall the OpenSSH capability. It is crucial to verify this step because many users assume the firewall remains unchanged after an upgrade, leading to silent connection drops. For more context on managing SSH hosts in Windows environments, see our article on
Configuring Windows SSH Host with ConEMU.
Check Authentication and Key Configuration
Windows 11 may enforce stricter security policies regarding how users authenticate via SSH. By default, OpenSSH on Windows supports password authentication and public key authentication. However, if your clients rely on specific key types or if the
sshd_config file was corrupted, connections will be rejected. Locate the configuration file at
C:\ProgramData\ssh\sshd_config. Note that
ProgramData is a hidden folder. Open this file with a text editor running as Administrator.
Ensure that the line
PasswordAuthentication yes is present and uncommented if you intend to use passwords. For key-based authentication, verify that the user's
authorized_keys file exists in
C:\Users\\.ssh\ and has correct permissions. The file should only be readable by the owner. Incorrect permissions here cause the SSH server to ignore the keys silently. Additionally, check if the
PubkeyAuthentication directive is set to
yes. Restart the OpenSSH service after making any changes to apply them.
Validate Network Adapter and IP Changes
Upgrading Windows can sometimes trigger network adapter resets or DHCP renewals that change your local IP address. If you are connecting using a static IP address recorded before the upgrade, you might be targeting the wrong machine. Verify your current IP by running
ipconfig in Command Prompt. Look for the IPv4 Address under your active network adapter. If you are connecting over the internet, ensure your router's port forwarding rules still point to this new IP address.
Furthermore, some network adapters disable legacy protocols or require updated drivers post-upgrade. Right-click your network adapter in Device Manager and select
Update Driver. Outdated network stack components can interfere with the low-level socket bindings required by SSH. If you recently switched Wi-Fi networks or Ethernet cables, ensure that the network profile is set to
Private rather than
Public, as Public profiles block discovery and related services more aggressively.
Test Connectivity and Debugging
Once the service is running and firewall rules are applied, test the connection locally first. Open a new terminal and run
ssh localhost. If this succeeds, the server is functioning correctly. Then attempt the connection from your remote machine. Use verbose mode on the client side by adding the
-v flag (e.g.,
ssh -v user@host) to see exactly where the handshake fails. Common failure points include hostname resolution issues or DNS mismatches. If you encounter specific errors like "Connection refused," it confirms the service is not listening. If you get "Permission denied (publickey)," review the authentication settings discussed earlier. For troubleshooting other upgrade-related anomalies, such as offline errors, refer to
Windows 10 Offline Upgrade Stuck at 21% with Error 0xC1900101-0x2000D.
Frequently Asked Questions
Why does my SSH connection time out instead of being refused?
A timeout usually indicates that a firewall is dropping packets rather than actively rejecting them. Check your router's external firewall and ensure port 22 is forwarded correctly to your PC's internal IP address. Also, verify that Windows Defender Firewall allows inbound traffic on port 22 for both private and public networks.
Can I use PuTTY with the native Windows OpenSSH server?
Yes, PuTTY is fully compatible with the native OpenSSH server provided by Microsoft. You simply need to configure PuTTY to connect to the same IP address and port 22. Ensure that the key format matches; PuTTY uses
.ppk files, while Windows OpenSSH expects
id_rsa or similar formats in the
.ssh directory.
What should I do if the OpenSSH service keeps crashing on startup?
Check the Event Viewer for detailed error logs under Applications and Services Logs > OpenSSH. Common causes include incorrect file permissions on the
sshd_config file or missing host keys. Re-running the installation command or resetting the permissions on the
C:\ProgramData\ssh folder often resolves persistent crashes.
Does Windows 11 support SSH agent for storing passphrases?
Yes, Windows 11 includes the OpenSSH Agent service which can store unlocked private keys in memory. Enable this service in
services.msc and set it to Automatic. You can add keys using the
ssh-add command in PowerShell, allowing you to connect without re-entering passphrases repeatedly.
How do I reset SSH host keys if they are causing conflicts?
Delete the files located in
C:\ProgramData\ssh\ssh_host_*_key and their corresponding public key files. After deletion, restart the OpenSSH SSH Server service. The service will automatically generate new host keys upon next startup, resolving any fingerprint mismatch errors clients might display.