Can't SSH into Windows — ping works but port 22 is closed

The Windows box pinged fine and was clearly on the network, but ssh user@host just hung or was refused. Port 22 was closed because Windows doesn’t ship with an SSH server enabled — the OpenSSH client is present by default, but sshd is an optional capability that’s off until you install it, and even after install the firewall has no inbound rule for it.

The fix

Run all of this in an elevated PowerShell on the Windows machine:

# 1. Install the OpenSSH Server capability
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

# 2. Start it now and on every boot
Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

# 3. Open the inbound firewall rule on port 22
New-NetFirewallRule -Name sshd -DisplayName 'OpenSSH Server (sshd)' `
  -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

After that, SSH connects.

The gotcha that wastes an hour: where the key goes

Key-based auth works, but the authorized_keys location differs for admin vs regular accounts, and this is the single most common reason “I added my key and it still asks for a password”:

• Regular user: C:\Users\<user>\.ssh\authorized_keys (the normal per-user location).
• Administrator account: C:\ProgramData\ssh\administrators_authorized_keys — a single shared file for all admins, with strict ACLs. A key in an admin’s home-dir .ssh\authorized_keys is ignored.

Put the public key in the right file for the account type and key auth works without a password prompt. Verify the end-to-end path from the client: ssh -v user@host and confirm it offers and accepts the key.