SSH is not just for Linux.

01

The server side as one script

Capability, service, firewall, the administrator key with the correct ACL, PowerShell as the default shell, and a switch that turns password authentication off, as one script you run elevated on a fresh box. Password authentication stays on until you have confirmed key login and turn it off yourself.

02

A verification checklist

The commands that prove the setup took, and the output to expect.

Verification checklist

Service running and automatic. Status Running, StartType Automatic.

Get-Service -Name sshd | Format-Table Name, Status, StartType

Administrator key file has the right ACL. Exactly BUILTIN\Administrators:(F) and NT AUTHORITY\SYSTEM:(F).

icacls.exe "$env:ProgramData\ssh\administrators_authorized_keys"

Key login works (client). Output, no password prompt.

ssh -o BatchMode=yes -i ~/.ssh/id_ed25519 Administrator@server-address 'whoami'

03

Server 2025 differences in one page

The stock AllowGroups line, the OpenSSH Users group, the Server Manager toggle, and what a 2022 procedure breaks on 2025.

Contents

1. What SSH gives you that RDP does not
2. Before you start
3. Install or confirm the OpenSSH server capability
4. Start the service and set startup type
5. Firewall rule
6. First connection from a client
7. Keys: what they are and how to make one
8. Key authentication for a standard user
9. Key authentication for an administrator
10. Set PowerShell as the default shell
11. Restrict who may sign in
12. Doing work over SSH
13. Server 2025 differences in one page
14. Verification checklist
15. Troubleshooting
16. Appendix A: sshd_config reference
17. Appendix B: the server side as one script

One searchable PDF that works offline and can be handed to a colleague.