You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: support/windows-server/system-management-components/troubleshoot-sftp-issues-using-openssh.md
+18-18Lines changed: 18 additions & 18 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
-
title: Troubleshoot Common SFTP issues
3
-
description: Explains how to resolve common SFTP issues when using OpenSSH for Windows.
2
+
title: Troubleshoot Common SFTP Issues
3
+
description: Explains how to resolve common SFTP issues when you use OpenSSH for Windows.
4
4
ms.date: 11/05/2025
5
5
manager: dcscontentpm
6
6
audience: itpro
@@ -15,7 +15,7 @@ appliesto:
15
15
---
16
16
# Troubleshoot common SFTP issues when using OpenSSH
17
17
18
-
OpenSSH on Windows provides secure file transfer (SFTP) capabilities. This article describes how to resolve the most common issues that you might encounter while using SFTP and OpenSSH to administer Windows Server and Windows Client.
18
+
OpenSSH on Windows provides secure file transfer protocol (SFTP) capabilities. This article describes how to resolve the most common issues that you might encounter when you use SFTP and OpenSSH to administer Windows Server and Windows Client.
19
19
20
20
## Best practices and additional resources
21
21
@@ -24,14 +24,14 @@ OpenSSH on Windows provides secure file transfer (SFTP) capabilities. This artic
24
24
- Every time that you change the OpenSSH Server configuration, validate the change by running `sshd -t`.
25
25
- When you start troubleshooting, check Event Viewer for relevant events.
26
26
27
-
For more information about configuring OpenSSH on Windows and Windows Server, see the following articles:
27
+
For more information about how to configure OpenSSH on Windows and Windows Server, see the following articles:
28
28
29
29
-[Get started with OpenSSH for Windows](/windows-server/administration/openssh/openssh_install_firstuse)
30
30
-[OpenSSH Server configuration for Windows Server and Windows](/windows-server/administration/openssh/openssh-server-configuration)
31
31
32
32
### How to enable SFTP logging
33
33
34
-
To enable SFTP logging for the OpenSSH Server service, modify the sshd_config file, and restart the OpenSSH Server service. Follow these steps:
34
+
To enable SFTP logging for the OpenSSH Server service, modify the sshd_config file, and then restart the OpenSSH Server service. Follow these steps:
35
35
36
36
1. Use an administrator-level account to open a text editor, and then open **%ProgramData%\ssh\sshd_config**. The default text of the "Logging" section should resemble the following excerpt:
37
37
@@ -65,7 +65,7 @@ To enable SFTP logging for the OpenSSH Server service, modify the sshd_config fi
65
65
66
66
After the service restarts, it generates SFTP log data in %ProgramData%\ssh\logs. For more information about OpenSSH logging, see [How to enable OpenSSH verbose logging](enable-openssh-verbose-logging.md).
67
67
68
-
## Common SFTP Issues on Windows and Windows Server
68
+
## Common SFTP issues on Windows and Windows Server
69
69
70
70
### SFTP users land in the wrong directory or outside the chroot jail
71
71
@@ -75,29 +75,29 @@ Check the following settings:
75
75
76
76
- In the sshd_config file, make sure that `ChrootDirectory` points to a local directory and doesn't use a UNC path.
77
77
- Make sure that SYSTEM/Administrators has owner permissions on the chroot directory.
78
-
- Make sure that each user has a writeable directory within the chroot directory, and make sure that the directory has the correct permissions. Secure the /.ssh/authorized_keys files.
78
+
- Make sure that each user has a writeable directory within the chroot directory, and that the directory has the correct permissions. Secure the /.ssh/authorized_keys files.
79
79
80
80
> [!NOTE]
81
-
> To verify and fix NTFS permissions, use [icacls](/windows-server/administration/windows-commands/icacls) command at an administrative Command Prompt window.
81
+
> To verify and fix NTFS permissions, use the [icacls](/windows-server/administration/windows-commands/icacls) command in an administrative Command Prompt window.
82
82
83
-
- In the sshd_config file, use`ForceCommand internal-sftp`, and use the `-d` switch with the `Subsystem sftp sftp-server.exe` command to set an upload directory. You can use these settings in `Match` blocks to specify users.
83
+
- In the sshd_config file, use`ForceCommand internal-sftp`, and use the `-d` switch together with the `Subsystem sftp sftp-server.exe` command to set an upload directory. You can use these settings in `Match` blocks to specify users.
84
84
85
-
### Particular users can't use SFTP or receive "Access denied" errors
85
+
### Specific users can't use SFTP or they receive "Access denied" errors
86
86
87
87
This behavior indicates ownership or permissions issues. Check the following settings:
88
88
89
89
- Make sure that SYSTEM/Administrators has owner permissions on the chroot directory.
90
-
- Make sure that each user has a writeable directory within the chroot directory, and make sure that the directory has the correct permissions. Secure the /.ssh/authorized_keys files.
90
+
- Make sure that each user has a writeable directory within the chroot directory, and that the directory has the correct permissions. Secure the /.ssh/authorized_keys files.
91
91
92
92
> [!NOTE]
93
-
> To verify and fix NTFS permissions, use [icacls](/windows-server/administration/windows-commands/icacls) command at an administrative Command Prompt window.
93
+
> To verify and fix NTFS permissions, use the [icacls](/windows-server/administration/windows-commands/icacls) command in an administrative Command Prompt window.
94
94
95
-
### Users can't sign in or receive "Authentication failed," or "Server refused our key" errors
95
+
### Users can't sign in or they receive "Authentication failed" or "Server refused our key"
96
96
97
97
This behavior indicates public key or password issues. Check the following configurations:
98
98
99
99
- Use C:\ProgramData\ssh\administrators_authorized_keys to store keys, and use `icacles` to check the file and folder permissions.
100
-
- If the server refused the key, add the following lines to sshd_config:
100
+
- If the server refuses the key, add the following lines to sshd_config:
101
101
102
102
```console
103
103
PubkeyAcceptedKeyTypes +ssh-rsa
@@ -113,20 +113,20 @@ To resolve these issues, try the following actions:
113
113
114
114
- To validate the sshd_config settings, run the `sshd -t` command.
115
115
- Review Event Viewer for any relevant events.
116
-
- To check and repair ACLs on the chroot directory tree, run the `icacles` command.
116
+
- To check and repair Access Control Lists (ACLs) on the chroot directory tree, run the `icacles` command.
117
117
- Review the sshd_config settings. Make sure that the entries don't have any trailing spaces, and make sure that the `Subsystem sftp sftp-server.exe` command is present.
118
118
119
-
If none of these actions resolve the issue, uninstall OpenSSH Server and then reinstall it.
119
+
If none of these actions resolve the issue, uninstall and reinstall OpenSSH Server.
120
120
121
121
### SFTP logs are missing or incomplete
122
122
123
-
Review the log settings in ssdh_config. As described in [How to enable SFTP logging](#how-to-enable-sftp-logging), SFTP log data is stored in %ProgramData%\ssh\logs.
123
+
Review the log settings in ssdh_config. SFTP log data is stored in %ProgramData%\ssh\logs.
124
124
125
125
To check and repair ACLs on the log folder, run the `icacles` command.
126
126
127
127
### Users can't upload or download files
128
128
129
129
- In the sshd_config file, make sure that `ChrootDirectory` points to a local directory and doesn't use a UNC path.
130
130
- Make sure that SYSTEM/Administrators has owner permissions on the chroot directory.
131
-
- Make sure that each user has a writeable directory within the chroot directory, and make sure that the directory has the correct permissions. To check and repair ACLs, run the `icacles` command.
131
+
- Make sure that each user has a writeable directory within the chroot directory, and that the directory has the correct permissions. To check and repair ACLs, run the `icacles` command.
132
132
- Make sure that users don't have writer permission on the chroot directory.
0 commit comments