{"id":7366,"date":"2026-06-08T13:09:24","date_gmt":"2026-06-08T10:09:24","guid":{"rendered":"https:\/\/support.withsecure.com\/?post_type=announcement&#038;p=7366"},"modified":"2026-10-19T13:11:53","modified_gmt":"2026-10-19T10:11:53","slug":"xm-authenticated-scanning-using-ssh-on-microsoft-windows","status":"publish","type":"announcement","link":"https:\/\/support.withsecure.com\/jp-ja\/announcements\/xm-authenticated-scanning-using-ssh-on-microsoft-windows\/","title":{"rendered":"XM Authenticated scanning using SSH on Microsoft Windows"},"content":{"rendered":"<p>We <a href=\"https:\/\/community.withsecure.com\/changelogs-en\/kb\/articles\/32957-exposure-management-2026-06-05-update\" rel=\"nofollow noopener ugc\" target=\"_blank\">recently released<\/a> support for Exposure Management Authenticated Scanning on Windows, using SSH.<\/p>\n<p>Here we will explain the steps needed to ensure your Windows host can be connected to via SSH.<\/p>\n<p>This article applies to the following:<\/p>\n<ul>\n<li>Windows Server 2019<\/li>\n<li>Windows Server 2022<\/li>\n<li>Windows Server 2025<\/li>\n<li>Windows 10 \/ Windows 11 (optional)<\/li>\n<\/ul>\n<h2 data-id=\"enabling-ssh\"><strong>Enabling SSH<\/strong><\/h2>\n<p>To allow secure remote access to a windows device, the SSH service must be enabled.<\/p>\n<p>Windows Server supports SSH through the built-in <strong>OpenSSH Server<\/strong> feature, which allows encrypted remote connections and command-line access. <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Flearn.microsoft.com%2Fen-us%2Fwindows-server%2Fadministration%2Fopenssh%2Fopenssh_install_firstuse\" target=\"_blank\" rel=\"nofollow noopener ugc\">[learn.microsoft.com]<\/a><\/p>\n<p>Follow the steps below to install and enable SSH on Windows Server.<\/p>\n<p><strong>1. Verify OpenSSH Server availability<\/strong><\/p>\n<p>Open <strong>PowerShell as Administrator<\/strong> and run:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">Get-WindowsCapability -Online | Where-Object Name -like 'OpenSSH.Server*'<\/code><\/p>\n<ul>\n<li>If the state is &#8220;Installed&#8221;, skip to step 3.<\/li>\n<li>If the state is &#8220;NotPresent&#8221;, proceed with installation.<\/li>\n<\/ul>\n<p><strong>2. Install OpenSSH Server<\/strong><\/p>\n<p>Run the following PowerShell command:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0<\/code><\/p>\n<p>This installs the built-in OpenSSH Server component available in modern Windows versions. <\/p>\n<p><strong>3. Start and enable the SSH service<\/strong><\/p>\n<p>After installation, start the SSH service from PowerShell:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">Start-Service sshd<\/code><\/p>\n<p>Set it to start automatically at system startup:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">Set-Service -Name sshd -StartupType Automatic<\/code><\/p>\n<p>This ensures SSH remains available after reboot.<\/p>\n<h2 data-id=\"allow-ssh-traffic-in-windows-firewall\"><strong>Allow SSH traffic in Windows Firewall<\/strong><\/h2>\n<p>To allow inbound SSH connections (default port 22), create a firewall rule using PowerShell:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">New-NetFirewallRule -Name \"OpenSSH-Server\" `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-DisplayName \"OpenSSH Server (sshd)\" `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-Enabled True `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-Direction Inbound `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-Protocol TCP `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-Action Allow `<\/code><\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">-LocalPort 22<\/code><\/p>\n<p>This enables remote systems to connect via SSH.<\/p>\n<h2 data-id=\"verify-the-ssh-service\"><strong>Verify the SSH service<\/strong><\/h2>\n<p>Check the service status from PowerShell:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">Get-Service -Name sshd<\/code><\/p>\n<ul>\n<li>Status should be <strong>Running<\/strong><\/li>\n<\/ul>\n<p><strong><\/strong><\/p>\n<h2 data-id=\"test-ssh-connectivity\"><strong>Test SSH connectivity<\/strong><\/h2>\n<p>From a remote machine, connect using the following from a command prompt:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">ssh &lt;username&gt;@&lt;server-ip&gt;<\/code><\/p>\n<p>Example:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">ssh administrator@192.168.1.10<\/code><\/p>\n<h2 data-id=\"key-based-authentication-recommended\"><strong>Key-based authentication (recommended)<\/strong><\/h2>\n<p>It is strongly recommended to use Key-based authentication instead of passwords, this is more secure in the long term.<\/p>\n<p>Generate your private\/public key pair as usual or by using instructions in step 1 <a href=\"https:\/\/community.withsecure.com\/home\/leaving?allowTrusted=1&amp;target=https%3A%2F%2Fsupport.withsecure.com%2Fuserguides%2Fproduct.html%23business%2Fradar%2F4.0%2Fen%2Ftask_E8B6320224864E2BACE58C50834A2294-4.0-en\" target=\"_blank\" rel=\"nofollow noopener ugc\">Key-based authentication (recommended) | Radar | 4.0 | WithSecure User Guides<\/a><\/p>\n<p>Append your public key to <em>C:\\ProgramData\\ssh\\administrators_authorized_keys<\/em> file.<\/p>\n<p>Note: standard users use personal <em>C:\\Users\\username\\.ssh\\authorized_keys<\/em> file, but for administrator permissions, global <em>administrators_authorized_keys<\/em> file is used.<\/p>\n<p>Verify that the correct key is present, and the file is formatted correctly.<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\"><em>ssh-keygen -l -f \"C:\\ProgramData\\ssh\\administrators_authorized_keys\"<\/em><\/code><\/p>\n<p>Note: A very common mistake is using invalid line ending characters. Please make sure only Linux line endings \u201c\\n\u201d are used.<\/p>\n<p>Make sure file has correct permissions set<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\"><em>icacls \"C:\\ProgramData\\ssh\\administrators_authorized_keys\"<\/em><\/code><\/p>\n<p>Should only show two entries:<\/p>\n<p><em>NT AUTHORITY\\SYSTEM:(F)BUILTIN\\Administrators:(F)<\/em><\/p>\n<p>Verify that key authentication works<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">ssh \u2013i &lt;private_key&gt; &lt;username&gt;@&lt;server-ip&gt;<\/code><\/p>\n<p>Example:<\/p>\n<p><code class=\"code codeInline\" spellcheck=\"false\" tabindex=\"0\">ssh \u2013i .ssh\/id_ecdsa administrator@192.168.1.10<\/code><\/p>\n<h2 data-id=\"additional-notes\"><strong>Additional notes<\/strong><\/h2>\n<ul>\n<li>OpenSSH Server is included as a built-in feature starting from Windows Server 2019 and later.<\/li>\n<li>SSH uses encrypted communication to protect data integrity and prevent eavesdropping.<\/li>\n<li>The default SSH port is <strong>TCP 22<\/strong>, which must be allowed through firewall configuration.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>We recently released support f&hellip;<\/p>\n","protected":false},"template":"","announcement_category":[142],"class_list":["post-7366","announcement","type-announcement","status-publish","hentry"],"acf":{"source_system":"vanilla-import","import_hash":"c4230c7bd9abeae1af55167e7e96e9b680c00ecd","vanilla_article_id":32960,"legacy_author":"AndyF_WS","vanilla_url":"https:\/\/community.withsecure.com\/announcements-en\/kb\/articles\/32960-xm-authenticated-scanning-using-ssh-on-microsoft-windows","vanilla_category_id":142,"machine_translated":false},"_links":{"self":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7366","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement"}],"about":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/types\/announcement"}],"version-history":[{"count":1,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7366\/revisions"}],"predecessor-version":[{"id":8875,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement\/7366\/revisions\/8875"}],"wp:attachment":[{"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/media?parent=7366"}],"wp:term":[{"taxonomy":"announcement_category","embeddable":true,"href":"https:\/\/support.withsecure.com\/jp-ja\/wp-json\/wp\/v2\/announcement_category?post=7366"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}