Set Up SSH on Windows and Keep It on Your Local Network

SSH lets you open a command-line session on another computer. Windows includes an optional OpenSSH server: the sshd service waits for connections, and an SSH client connects to it. The connection is encrypted, but turning on a server still makes your PC reachable to other devices. This walkthrough keeps access on a trusted local network and does not set up access from the internet. Microsoft’s Windows OpenSSH overview describes the client/server roles and Windows components.

SSH is for command-line work; it does not show your Windows desktop. If you need a graphical screen, use a remote-desktop tool instead. For occasional commands or file administration from another PC, OpenSSH is already included as an optional feature in Windows 10 (build 1809 and later) and Windows 11.

Before you start

You need:

• Windows 10 version 1809 or later, or Windows 11, on the PC you want to reach.
• An administrator account to install the feature and configure the firewall.
• A second device on the same trusted home network. Keep both devices awake and connected while you test.
• A Windows account on the host PC that you can sign in to remotely. The SSH password prompt uses the account password; a Windows Hello PIN is not a substitute.

Do not use this setup on a public or shared Wi-Fi network. Do not forward port 22 on your router. This guide limits the Windows firewall rule to a private profile and the local subnet; it is meant for devices on the same home network.

Install OpenSSH Server

Open PowerShell as administrator on the PC you want to reach. First check whether the OpenSSH features are present:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

If the server's state is NotPresent, install it:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

You can also search Windows Settings for Optional features, choose Add a feature or View features, and install OpenSSH Server. The OpenSSH Client is a separate feature; install it on the computer you will connect from if the ssh command is missing. Microsoft's OpenSSH installation guide documents the PowerShell and Settings routes for Windows 10 and 11.

Start the service

Still in elevated PowerShell, start sshd and set it to start after a restart:

Start-Service sshd
Set-Service -Name sshd -StartupType Automatic
Get-Service sshd

The last command should show Running. The installer normally creates an inbound Windows Firewall rule named OpenSSH-Server-In-TCP for TCP port 22. Check that rule before connecting:

Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" |
    Select-Object Name, Enabled, Profile

Keep SSH on your private network

First confirm Windows has classified your trusted home network as Private. In Settings, open Network & internet, select the connected Wi-Fi or Ethernet network, and check Network profile type. Choose Private only for a network you trust; don't change a coffee-shop or guest network to Private just to make SSH work.

Then scope the OpenSSH rule to that profile and to devices on the local subnet:

Set-NetFirewallRule -Name "OpenSSH-Server-In-TCP" -Profile Private -RemoteAddress LocalSubnet

Private limits the rule to that Windows network profile. LocalSubnet limits the remote addresses to the host's subnet. The PowerShell reference for Set-NetFirewallRule documents those rule filters; Microsoft's New-NetFirewallRule reference uses LocalSubnet for devices on the same subnet.

Confirm the address scope:

Get-NetFirewallRule -Name "OpenSSH-Server-In-TCP" |
    Get-NetFirewallAddressFilter

The result should list LocalSubnet as the remote address. If the rule is missing or managed by your organization, don't create a broader replacement; check the OpenSSH installation or ask your administrator.

Connect from another computer

On the host PC, run ipconfig and note the IPv4 address under the active Wi-Fi or Ethernet adapter. On the second Windows PC, open PowerShell and test port 22, replacing the example address with the host's address:

Test-NetConnection -ComputerName 192.168.1.25 -Port 22

Look for TcpTestSucceeded : True. Then connect with an account that exists on the host:

ssh [email protected]

Replace alex with the Windows account name on the host. For a domain account, use the domain form shown in Microsoft's connection instructions . The first connection displays the server's host-key fingerprint and asks whether to trust it. To check the fingerprint on the host, open elevated PowerShell there and run:

Get-ChildItem "$env:ProgramData\ssh\ssh_host_*_key.pub" |
    ForEach-Object { ssh-keygen -lf $_.FullName }

Compare the SHA256 fingerprint for the key type named in the prompt, then type yes only if it matches. A later, unexpected fingerprint change deserves investigation. After the key prompt, enter the host account's password. PowerShell won't display the characters as you type.

A successful login opens the Windows command shell for that account. Windows OpenSSH uses cmd.exe by default; the shell and server configuration are documented in Microsoft's Windows OpenSSH configuration guide . Commands still run with that account's permissions, so a standard account limits what a remote login can change.

For repeated use, consider public-key authentication. Keep the private key on the client and protect it like a password. Windows uses a different authorized-keys location and file permissions for administrator accounts, so follow Microsoft's Windows-specific key-management guide rather than copying Linux instructions.

If the connection fails

• Connection refused: On the host, check Get-Service sshd. If it is stopped, run Start-Service sshd in elevated PowerShell. Confirm the firewall rule is enabled.
• Connection times out: Check that both devices are on the same non-guest network, that the host is awake, and that its network profile is Private. Guest Wi-Fi and some access points block devices from reaching one another.
• The password is rejected: Confirm the username belongs to an account on the host and use that account's password, not its PIN. If the computer is managed by work or school, a policy may restrict SSH sign-in.
• It works at home but not elsewhere: That is expected with this firewall scope. Do not open the router to the internet; use a properly configured VPN if you need remote access away from home.

Avoid disabling Windows Firewall as a test. Check the service, profile, rule, address, and network path instead.

Turn SSH off

If you no longer need remote access, stop and disable the service in elevated PowerShell:

Stop-Service sshd
Set-Service -Name sshd -StartupType Disabled

You can also remove OpenSSH Server from Optional features. Disabling the service makes the PC unavailable for new SSH connections. Leave the client feature installed if you still use it to connect to other devices.