I'm experiencing certain issues with the built-in OpenSSH client that, according to the Win32-OpenSSH Github page, seem resolved in newer versions. The newest version is v7.9 while the preinstalled client is in version 7.6p1.

PS C:\> ssh -V
OpenSSH_for_Windows_7.6p1, LibreSSL 2.6.4

I understand it's possible to install OpenSSH both as an optional feature in the "apps & features" settings page, or using Powershell. That seems futile in my situation as the client clearly already is installed.

PS C:\>  Get-WindowsCapability -Online | ? Name -like 'OpenSSH*'

Name  : OpenSSH.Client~~~~
State : Installed

Name  : OpenSSH.Server~~~~
State : NotPresent

Unfortunately, it doesn't seem possible to update the client this way and the Github page doesn't seem to publish binaries. Does this mean I have to make the binaries myself if I want to use newer versions, and would they even work as a replacement not being signed or anything? Is there maybe a simpler way?


This page gives the steps to follow using Powershell to install the latest packages.

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$url = 'https://github.com/PowerShell/Win32-OpenSSH/releases/latest/'
$request = [System.Net.WebRequest]::Create($url)
$([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win64.zip'  
$([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win32.zip'

If you use Chocolatey, then type the following in the command prompt as shown here:

choco upgrade openssh
  • 4
    You will likely want to use the instructions on this page to install the update. However, I would perform test within a virtual machine, to verify what actually happens. Unless there is a vulnerability you are specifically worried about, you might not want to attempt to manually update the install, and instead, remove the built-in version and use the above installation instructions.
    – Ramhound
    Jan 19 '19 at 0:54
  • I needed to change $request.AllowAutoRedirect=$false to $request.AllowAutoRedirect=$true
    – JPvRiel
    Dec 11 '20 at 11:46
  • Both don't do much, at least don't give any output and afterwards (even after opening a new shell) ssh -V just gives me the same output: OpenSSH_for_Windows_7.7p1, LibreSSL 2.6.5
    – DrumM
    Jul 8 at 7:40

The answer to overwrite the files works:

Download the latest and update them in C:\Windows\System32.

However, this is easier said than done due to how Windows restricts permissions to modify/write files in System32. Running PowerShell as Administrator was not sufficient to modify files. I had to change ownership and add full control permissions to get it done as follows:

# Download upstream bins
$url = 'https://github.com/PowerShell/Win32-OpenSSH/releases/latest/'
$request = [System.Net.WebRequest]::Create($url)
$source = $([String]$response.GetResponseHeader("Location")).Replace('tag','download') + '/OpenSSH-Win64.zip'
(New-Object System.Net.WebClient).DownloadFile($source, 'OpenSSH-Win64.zip')

# Overwrite windows installed bins
$openSshBins = (Get-ChildItem 'C:\WINDOWS\System32\OpenSSH\').Name
Expand-Archive -Path .\OpenSSH-Win64.zip -DestinationPath .
takeown.exe /a /r /f C:\Windows\System32\OpenSSH\
icacls.exe 'C:\Windows\System32\OpenSSH' /grant 'BUILTIN\Administrators:(OI)(CI)F'
icacls.exe 'C:\Windows\System32\OpenSSH' /grant 'BUILTIN\Administrators:F' /t
Stop-Service ssh-agent
$openSshBins | %{ Copy-Item -Path .\OpenSSH-Win64\$_ -Destination C:\Windows\System32\OpenSSH\ }
Start-Service ssh-agent

Note, to auotmate the download, you need to permit redirects.

  • 1
    download automation is broken again :( Mar 2 at 22:15
  • Thanks, corrected and disabled redirects again. Not sure why, could swear that last time I had to have redirects enabled for it to work for me.
    – JPvRiel
    Mar 4 at 18:21
  • I got the following on the last command: Start-Service : Service 'OpenSSH Authentication Agent (ssh-agent)' cannot be started due to the following error: Cannot start service ssh-agent on computer '.'. At line:1 char:1 + Start-Service ssh-agent + ~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : OpenError: (System.ServiceProcess.ServiceController:ServiceController) [Start-Service], ServiceCommandException + FullyQualifiedErrorId : CouldNotStartService,Microsoft.PowerShell.Commands.StartServiceCommand
    – Steven Lu
    Apr 18 at 7:16

The binaries are now on GitHub. Download the latest and update them in C:\Windows\System32.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.