If you need to provide a SFTP connection to a specific server, you can install and configure IIS. However, if your needs do not require dedicated home folders for each user or only require granting access to a small number of people, perhaps setting up the optional SFTP/SSH server available in Server 2022 will be just the ticket. To get started, Open an elevated PowerShell console and run the following command:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

If this is successful, you should see the phrase, “Online : True”. To make the startup of the service automatic, run the next command in the same PowerShell window.

If you receive an error similar to below, the computer is not set to get its updates directly from Microsoft. This would include most of our servers still pointed to WSUS.

Add-WindowsCapability : Add-WindowsCapability failed. Error code = 0x800f0954 At line:1 char:1

To resolve the problem for Server 2022 open the file “I:\SSH-WindowsServer2022-CustomBits\20348.1.210507-1500.fe_release_amd64fre_SERVER_LOF_PACKAGES_OEM.iso” and note to which drive letter the ISO is assigned. Then issue the modified command below to install. You can see the drive letter F: is where the ISO is registered.

dism /online /add-package /packagepath:"F:\LanguagesAndOptionalFeatures\OpenSSH-Server-Package~31bf3856ad364e35~amd64~~.cab"

In either case, If the install is successful, you should see the phrase, “Online : True”. To make the startup of the service automatic, run the next command in the same PowerShell window.

Get-Service -Name "sshd" | Set-Service -Startup "Automatic" -PassThru | Start-Service -PassThru

You can verify the installation by typing the command “services.msc” into the PowerShell window. This will launch the built-in services applet. The service is named, “OpenSSH SSH Server” and you should see that it now is running and set to auto start. Here you can stop, start, or restart the service. If you prefer using the command line, the same can be accomplished with these commands:

stop-service sshd
start-service sshd
restart-service sshd

Several customizations can be made to the SSH service to restrict who has access to the server and where a user will land when connecting. The configuration fille is found by default at “C:\ProgramData\ssh\sshd_config”. To edit the file, launch Notepad.exe as Administrator or use Notepad++ to open the file in the location below. NOTE: Any time you edit this file, the service must be restarted for the changes to take effect..

By default, all local and domain users have the ability to connect to the SSH instance. When each user connects, they will be dropped into their individual profile folder on the server. If the user did not already have a folder, it will be created on first logon. Since this may not be what you desire, you can modify the config so that every user will drop into a the same folder and or configure who will be allowed to connect.

To set the server to make all connections to the same folder, find this line in the config file, “ChrootDirectory none” and change it to read, “ChrootDirectory "DriveLetter:\Folder of your choice“

To control who can connect to the server, copy the following lines into the sshd_config file just above the line, “Match Group Administrators” at the end of the file.

#Allow or deny users and groups
  # Items must be in this order:
  # DenyUsers
  # AllowUsers
  # DenyGroups
  # AllowGroups
#AllowUsers domain\cooper.a
AllowGroups domain\SSH-Windows

All of the lines beginning with # symbol are comments and not used in the config except as reminders or placeholders. The user restrictions are processed in the order shown. In this config, I have commented an AllowUsers line while leaving the AllowGroups line as active. This is because only one of these options can be active at any one time. If you want to allow only your self to connect, use the AllowUsers version. In the example, this would allow the user cooper.a to connect and no one else. If you want more than one person to login, user the AllowGroups option.

Currently, the server does not support Entra ID accounts and cannot be protected with MFA. Test your config by connecting as an allowed user with WinSCP or your favorite SSH client.

Links to more info below

https://4sysops.com/archives/configure-an-sftp-server-on-windows/

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=gui#connect-to-openssh-server

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration#allowgroups-allowusers-denygroups-denyusers

https://woshub.com/connect-to-windows-via-ssh/

https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_keymanagement

To facilitate password changes for your Active Directory accounts, HCC provides the ADPasswordManager Plus server. Once enrolled you may change your password, even if the password has been forgotten. You may unlock your account and can edit some of your user information stored in Active Directory.

To login to the server visit https://password.hccanet.org. Note: you must enter https:// before the address. Once at the site you will see three options, each selectable by clicking. First is the sign in area then below, “Forgot your password?” and “Account locked out?” These last two will be covered later in this article.

To login, enter your username, your password and choose “HCCANET” from the domain drop down, then click “Login”. If you are a new user or if your password has been reset by a HCC staff member, you will enter your temporary password here.

If you’ve entered the correct information, you will be shown the Change Password page. Enter your old password or, if you are a new user, the temporary password you were given, in the blank provided. Then enter your new desired password in the two blanks below. As you enter your new password and meet the various complexity requirements, each will be marked with a green check mark. If every item has a green check mark, click “Change Password”.

If your new password is accepted you will see a notification like below. Click “Close” to move to the next step of enrollment.

To access all the benefits of the self-service password changing tools, you will need to complete enrollment. Hitting the “Click Here” button will take you to the next step.

By enrolling you will be able to reset your password, even if it’s been forgotten. By choosing two questions and providing answers that you can easily remember, you will be able to prove your identity. This will allow you to set a new password at your convenience rather than wait on assistance from the helpdesk.

You will be notified of a successful enrollment. You can now close this browser and log into your HCC application with your changed password.

Change Your Forgotten Password

Even the best of us can forget our password. Our support staff cannot read your password, so if it is forgotten, it will need to be reset. Rather than wait on assistance through our help desk, if you’ve completed your enrollment, you can reset the password yourself by following the steps illustrated below.

Connect once more to https://password.hccanet.org. Since you will be unable to log in, click instead “Forgot your password?” as shown.

Enter your username, select HCCANET as your domain. Enter the letters you see in the image in the provided blank and then click “Continue”.

Provide the answers to the two security questions you provided during enrollment, type the characters from the image in the box provided and then click “Continue”.

Now you can enter your desired new password. As you meet the various complexity requirements, each will be ticked with a green checkmark. Once again, enter the characters from the image in the box provided and then click “Reset Password”.

You should now get a notice that your password has been successfully changed. You can now return to your application and log in.

If you encounter any difficulty with the process, please send an email with details to the helpdesk.