DEV Community

dpm_bush
dpm_bush

Posted on Originally published at sshflow.com

Host an SFTP Server on Windows with OpenSSH

#productivity #tutorial #devops #beginners

Need another machine to upload files to your Windows PC or server? Windows OpenSSH Server includes an SFTP subsystem, so you usually don’t need to install a separate SFTP server.

The important distinction: OpenSSH Client lets your Windows machine connect out; OpenSSH Server lets other machines connect in. To host files, install the server feature on the Windows machine that will receive connections.

Install the server feature

On Windows 10 or 11, you can install OpenSSH Server from Settings → System → Optional Features → Add a feature. Or use an elevated PowerShell prompt:

Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH*'

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Enter fullscreen mode Exit fullscreen mode

If you also want to test connections from this machine, install the client feature too:

Add-WindowsCapability -Online -Name OpenSSH.Client~~~~0.0.1.0
Enter fullscreen mode Exit fullscreen mode

On Windows Server 2019 and 2022, the same capability command can install the server. If the server can’t reach Windows Update, Add-WindowsCapability may need a local Features on Demand source:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 -Source D:\
Enter fullscreen mode Exit fullscreen mode

Here, D:\ is an example drive containing the mounted feature media. OpenSSH is installed by default on Windows Server 2025, but still needs to be enabled or started.

Start sshd and allow connections

Installing the feature doesn’t necessarily start its service. In elevated PowerShell, run:

Start-Service sshd
Set-Service -Name sshd -StartupType 'Automatic'
Enter fullscreen mode Exit fullscreen mode

The first command starts the service now; the second configures it to start after a reboot.

OpenSSH Server installation normally creates an inbound firewall rule named OpenSSH-Server-In-TCP. Check for an enabled rule:

Get-NetFirewallRule -Name *ssh* |
  Select-Object Name, DisplayName, Enabled, Direction
Enter fullscreen mode Exit fullscreen mode

If there isn’t a suitable rule, allow the default SSH port, TCP 22:

New-NetFirewallRule -Name sshd `
  -DisplayName 'OpenSSH Server (sshd)' `
  -Enabled True `
  -Direction Inbound `
  -Protocol TCP `
  -Action Allow `
  -LocalPort 22
Enter fullscreen mode Exit fullscreen mode

SFTP doesn’t need a second firewall port: it runs inside the SSH connection. If you change the port used by sshd, update the firewall rule to match.

Check the SFTP subsystem

The SFTP subsystem is normally configured already. Open the server configuration file as an administrator:

%ProgramData%\ssh\sshd_config
Enter fullscreen mode Exit fullscreen mode

Look for a line like this:

Subsystem sftp sftp-server.exe
Enter fullscreen mode Exit fullscreen mode

OpenSSH also supports internal-sftp, which handles transfers inside the sshd process. It’s mainly useful for configurations such as SFTP-only accounts or chroot restrictions. For a standard setup, keep the existing subsystem line unless you have a specific reason to change it.

If you edit sshd_config, restart the service for the change to take effect:

Restart-Service sshd
Enter fullscreen mode Exit fullscreen mode

For other server-side settings and a safer edit-and-validate workflow, see this guide to configuring sshd_config.

Test it from another machine

Check the connection in layers, so you can tell a service problem from a network problem.

First, on the Windows server, confirm that the service is running and that the local port responds:

Get-Service sshd
Test-NetConnection -ComputerName localhost -Port 22
Enter fullscreen mode Exit fullscreen mode

Then, from another computer on the network, test the server’s address:

Test-NetConnection -ComputerName SERVER_IP -Port 22
Enter fullscreen mode Exit fullscreen mode

Replace SERVER_IP with the Windows machine’s IP address. A successful local test doesn’t prove that a remote computer can get through the firewall or network.

Finally, connect with an SFTP client:

sftp username@SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Reaching the sftp> prompt confirms that you established an SFTP session. At the prompt, ls lists remote files, pwd shows the remote directory, get filename downloads a file, and put filename uploads one. Use exit to close the session.

If the server uses a custom port, use uppercase -P with the OpenSSH client:

sftp -P 2222 username@SERVER_IP
Enter fullscreen mode Exit fullscreen mode

Passwords, keys, and SFTP-only accounts

Windows OpenSSH supports password and public-key authentication, subject to the server configuration. For ongoing access, public-key authentication is often preferable. There’s a Windows-specific detail for administrator accounts: members of the local Administrators group use %ProgramData%\ssh\administrators_authorized_keys, while regular users use C:\Users\<username>\.ssh\authorized_keys.

You can also restrict a user to file transfer instead of allowing an interactive shell. That requires extra server configuration, typically using ForceCommand internal-sftp and a ChrootDirectory. Windows chroot setups have important path and NTFS permission requirements; the chroot directory and the writable directory inside it need different permissions. Review the relevant SFTP permission troubleshooting notes if users can connect but can’t write files.

A few common failure clues

  • Connection refused: Check that sshd is running and that the client is using the configured port.
  • Connection times out remotely: Check the inbound firewall rule, its port and scope, and the network path.
  • SFTP protocol won’t initialize: Check that the Subsystem sftp line exists and points to a usable implementation; restart sshd after changes.
  • Key login fails only for an administrator: Check the administrators’ keys file and its permissions.
  • A chrooted user can connect but cannot upload: Check the NTFS permissions on the writable subdirectory.

Windows File Explorer doesn’t natively browse SFTP locations as a standard network drive. Use the command-line client or an SFTP-capable file browser instead.

I originally published a more detailed version of this guide on the SSHFlow blog.

I'm also building SSHFlow — an SSH client where every server gets its own workspace for terminals, SFTP, code, and databases.

Top comments (0)