How to Install OpenSSH Server on Windows Server and Change the Default Port
Learn how to install OpenSSH Server, configure the sshd service, change the default SSH port from TCP 22, update Windows Defender Firewall, and verify secure remote access using PowerShell.
sshd service, edit C:\ProgramData\ssh\sshd_config to use port 2222, allow TCP 2222 through Windows Firewall, validate the configuration, restart the service, and test a new connection before disabling access to port 22.
Manage Windows Server Remotely with SSH
OpenSSH enables encrypted command-line administration from Linux, macOS, and Windows clients. Changing the listening port can reduce routine scan noise, but secure authentication, restricted network access, and regular patching remain essential.
Install OpenSSH
Use PowerShell or the optional-features interface to install the server component.
Change the Port
Update the active Port directive and validate the configuration.
Secure Access
Update the firewall and verify the new listener and remote connection.
What Is OpenSSH Server?
OpenSSH is a suite of tools that supports encrypted remote connections using the Secure Shell (SSH) protocol. On Windows Server, the OpenSSH Server component runs as the sshd service and accepts incoming SSH connections from authorized clients.
It is useful for administrators who manage Windows Server systems in enterprise environments, virtualization labs, and hybrid infrastructure. SSH provides command-line access and supports public-key authentication, which can be preferable to relying exclusively on passwords.
| Component | Purpose |
|---|---|
| OpenSSH Server | Accepts incoming SSH connections. |
sshd service | Runs the SSH server process on Windows. |
sshd_config | Contains server-side SSH configuration directives. |
| Windows Defender Firewall | Controls inbound access to the configured TCP port. |
| OpenSSH Client | Connects to an SSH server from a client computer. |
Prerequisites
- Administrative access to the Windows Server.
- Network connectivity between the server and the client computer.
- PowerShell running as Administrator for installation and configuration.
- Permission to create or modify Windows Defender Firewall rules.
- A permitted Windows account and the server’s IP address or DNS name.
- Console or recovery access in case a configuration change prevents remote access.
The examples below use TCP port 2222. You can use another approved, unused port, but the server configuration, firewall rules, and client command must all agree.
Step 1: Install OpenSSH Server
Check the OpenSSH Server capability
Open PowerShell as Administrator and run:
Get-WindowsCapability -Online |
Where-Object Name -like 'OpenSSH.Server*'Review the result to determine whether the capability is already installed. Windows Server releases and installation images can differ, so verify the actual state instead of assuming the component is absent.
Install using PowerShell
If the capability is not installed, run:
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0Wait for the command to complete. If installation fails, record the full error and check Windows Update, the component store, and the configured feature installation source.
Alternative: Install through the graphical interface
- Open the optional-features or capabilities interface available for your Windows Server release.
- Search for OpenSSH Server.
- If it is available and not installed, select it and choose Install.
- Wait for installation to finish.
The exact graphical path differs by release. If the feature is not exposed in your interface, use PowerShell or Microsoft’s installation guidance.
Official reference: Microsoft Learn — Install OpenSSH for Windows.
Step 2: Start and Enable the SSH Service
After installation, start the OpenSSH Server service. Its service name is sshd.
Start-Service sshdConfigure the service to start automatically after a server reboot:
Set-Service -Name sshd -StartupType AutomaticCheck its current state:
Get-Service sshdThe expected service status is Running. If the service does not start, review the error and configuration before proceeding.
Step 3: Verify the Default SSH Listener
Before changing the port, check whether the server is listening on the default TCP port 22:
Get-NetTCPConnection -LocalPort 22 -State ListenAlternatively, use:
netstat -ano | findstr :22If no listener is shown, confirm that sshd is running and inspect its configuration. A running service does not necessarily mean the expected port is listening.
Step 4: Change the Default SSH Port
The standard OpenSSH Server configuration file is:
C:\ProgramData\ssh\sshd_configBack up the configuration file
Use elevated PowerShell to make a backup before editing:
Copy-Item "$env:ProgramData\ssh\sshd_config" `
"$env:ProgramData\ssh\sshd_config.backup"Open the configuration file
Run Notepad from the elevated PowerShell session:
notepad "$env:ProgramData\ssh\sshd_config"Find the port directive. It may appear as a commented line:
#Port 22Set the active port directive to:
Port 2222Ensure that the intended directive is active and that there are no conflicting active port directives unless you deliberately intend to configure multiple listening ports.
# are comments. Edit the server configuration at C:\ProgramData\ssh\sshd_config, not the client configuration. Save the file before validating it.
Validate the configuration
Before restarting the service, run the OpenSSH syntax test:
& "$env:WINDIR\System32\OpenSSH\sshd.exe" `
-t -f "$env:ProgramData\ssh\sshd_config"If the command reports an error, correct the configuration before restarting. A successful syntax check normally produces no output.
For additional settings, see Microsoft’s OpenSSH Server configuration documentation.
Step 5: Configure Windows Defender Firewall
Allow inbound TCP traffic on port 2222. The following command creates a rule for the Domain and Private profiles:
New-NetFirewallRule `
-Name "OpenSSH-Server-TCP-2222" `
-DisplayName "OpenSSH Server TCP 2222" `
-Enabled True `
-Direction Inbound `
-Protocol TCP `
-Action Allow `
-LocalPort 2222 `
-Profile Domain,PrivateConfirm that the rule exists:
Get-NetFirewallRule -Name "OpenSSH-Server-TCP-2222"Restrict access to trusted management systems
For a production server, consider limiting the rule to approved management IP addresses or subnets using the -RemoteAddress parameter. Select firewall profiles according to your environment and security policy.
Step 6: Restart and Verify the New Listener
Once the configuration has passed the syntax test, restart the SSH service:
Restart-Service sshdConfirm the service is running:
Get-Service sshdThen check for a listener on TCP port 2222:
Get-NetTCPConnection -LocalPort 2222 -State Listensshd service is running and Windows reports a TCP listener on port 2222.
Step 7: Test the SSH Connection
Test the network port from a client
From a different Windows computer, run PowerShell and replace the sample address with your server’s address:
Test-NetConnection -ComputerName 192.168.1.10 -Port 2222Look for TcpTestSucceeded : True. If it is false, check the listener, firewall, routing, and upstream network controls.
Connect with the SSH client
Run the following command, substituting the correct username and server address:
ssh -p 2222 username@192.168.1.10The -p option tells the client to connect to TCP port 2222 instead of the default port 22. Use an account that is permitted to sign in over SSH.
Step 8: Review Access to Port 22
After confirming that a new SSH session works through port 2222, review the existing firewall rules and remove or disable the old inbound TCP 22 rule if it is no longer required.
Do not disable the old rule until you have successfully tested the new port from the management network you actually use. Keep an established administrative session or alternative console access available during the change.
Troubleshooting Common Problems
OpenSSH Server will not install
Verify the capability name and installation state. Check Windows Update, component-store health, and the configured feature installation source. See Microsoft’s OpenSSH installation troubleshooting guide.
The sshd service will not start
Run the configuration syntax test, inspect the service error, and check for invalid directives, conflicting settings, or configuration-file permission problems.
The connection times out
Verify the listener on port 2222. Check Windows Defender Firewall, routing, network firewalls, and any cloud security rules between the client and server.
The connection is refused
Confirm that sshd is running and listening on the port specified in the client command. Check for a port mismatch.
Authentication fails
Verify the username, account permissions, authentication method, and applicable account policies. Inspect the server-side OpenSSH logs for further details.
Port 22 still appears open
Inspect active configuration directives and actual listeners. Check firewall rules separately: a firewall allow rule does not prove that a service is listening.
For Windows-specific firewall guidance, read Microsoft’s OpenSSH firewall and port troubleshooting documentation.
Security Best Practices for OpenSSH Server
- Prefer key-based authentication where appropriate. Protect private keys and manage them securely.
- Restrict inbound access. Allow SSH only from approved management systems or subnets wherever possible.
- Keep Windows Server updated. Apply supported security updates and maintain a patching schedule.
- Apply least privilege. Limit SSH access to accounts that require it.
- Monitor authentication activity. Review OpenSSH operational logs and investigate unexpected attempts.
- Maintain a recovery path. Keep console access and a tested configuration backup available.
- Do not treat port changing as complete security. A custom port may reduce routine scan noise but is not a substitute for strong authentication and access controls.
For key-management guidance, consult Microsoft’s OpenSSH key management documentation.
Frequently Asked Questions
1. What is the default SSH port on Windows Server?
OpenSSH Server normally uses TCP port 22 by default unless its server configuration has been changed.
2. Where is the OpenSSH Server configuration file?
The standard server configuration file is C:\ProgramData\ssh\sshd_config.
3. Do I need to restart OpenSSH after changing the port?
Yes. After validating and saving the configuration, restart the sshd service so the new settings can take effect.
4. Can I use a port other than 2222?
Yes. Select an available port approved for your environment, update the server configuration and firewall rules, restart the service, and specify the selected port when connecting.
5. Is changing the SSH port enough to secure my server?
No. Use strong authentication, restrict network access, keep the server patched, and monitor access. A custom port is not a replacement for these controls.
6. How do I connect to a custom SSH port?
Use ssh -p 2222 username@SERVER_IP, replacing the example port, username, and address with your actual settings.
7. What should I do if I lose SSH access after changing the port?
Use your approved console or recovery method to inspect the sshd_config file, validate the configuration, check the listener and firewall rules, and restore the backup if needed.
Conclusion
OpenSSH Server gives Windows Server administrators an encrypted method for remote command-line access. To change the default port, install and start the server component, update the active Port directive, validate the configuration, create a matching firewall rule, restart the service, and test a new connection before removing access to port 22.
sshd service is running, the server is listening on the intended port, the firewall permits approved clients, and an actual SSH login succeeds. Keep a recovery path available.
Keep Learning with VMoreCloud
Explore practical tutorials on Windows Server, Linux, cloud computing, networking, cybersecurity, and virtualization.
Official Sources and Further Reading
Technical note: Windows Server versions, OpenSSH defaults, and configuration behavior can vary. Verify the settings on your own server and test changes with an approved recovery method before applying them to production systems.