How to Set Up an Enterprise-Grade SFTP Server on Windows (Beyond OpenSSH)

Setting up SFTP on Windows has two very different answers depending on what happens after the first successful login. If you need a machine that a handful of technical people can push files to, the operating system already contains everything required and the work takes about fifteen minutes. If you need something that fifty external partners connect to, that auditors will ask questions about, and that a colleague has to administer while you are on leave, the same fifteen minutes buys you a server you will spend the next year maintaining by hand.

Both paths are covered below, in order, with the point at which the first one starts to hurt marked as clearly as we can mark it. We make an SFTP server for Windows, so we are not a neutral party, but the OpenSSH instructions are the real ones and there are situations where they are the right answer.

Three questions to answer before you install anything

The install is the easy part. The decisions that determine which install you should do are these.

How many users are there, and who creates them?

OpenSSH has no concept of a user store of its own. Every SFTP user is a Windows account, and every account needs a home folder, a public key placed in the right file with the right permissions, and a shell restriction if you do not want that person to have terminal access. At three users this is a pleasant afternoon. At thirty it is a spreadsheet, and at thirty users administered by someone who is not you, it is a spreadsheet plus a wiki page that has gone stale.

Does authentication have to come from Active Directory?

If accounts must be created, disabled and audited in one place, and that place is AD, then the SFTP server has to read from the directory rather than keep a parallel list. Any server that keeps its own copy of the user list creates a second offboarding step, and second offboarding steps get skipped.

One organization described the combination they settled on:

"we use a combination of Active Directory w/ Network Macro folders to auto-create a home folder virtual directory the first time a user logs in"
a US data and analytics organization (EnterpriseDT support archive)

Do you have to prove what happened?

There is a difference between logging and auditing. A connection log tells you the server was busy on Tuesday. An audit trail tells you which account uploaded which file at which time, and it is retained long enough for someone to ask about it six months later. If a compliance regime applies to the data moving through this server, decide now, because retrofitting an audit trail onto a deployment that never had one means going back to every user and every automated job.

The OpenSSH path

Windows 10, Windows 11 and current Windows Server releases ship the OpenSSH server as an optional feature. Its SFTP subsystem is a real SFTP server, it is maintained by Microsoft, and it costs nothing beyond the Windows licence you already hold.

Install the OpenSSH server component

From an elevated PowerShell prompt:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

The same component can be added through the Settings app, under Optional Features. On Windows Server it also appears in the Add Roles and Features wizard on recent builds. Note that OpenSSH Client is often present already and is a different capability; the server is the one that matters here.

Start the service and make it survive a reboot

Installing the capability does not start it, and the default startup type is manual, which produces a server that works perfectly until the first patch Tuesday.

Start-Service sshd
Set-Service -Name sshd -StartupType Automatic

Open port 22

The installer normally creates an inbound firewall rule, but on hardened builds and on machines with a managed firewall policy it frequently does not. Check for the rule before you assume it exists.

Get-NetFirewallRule -Name *ssh*
New-NetFirewallRule -Name sshd -DisplayName "OpenSSH Server (sshd)" `
    -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22

If the machine sits behind a router or a cloud security group, port 22 has to be permitted there as well.

Add users

SFTP users under OpenSSH are Windows users, created the ordinary way. Key-based authentication is configured per account by writing the client's public key into %USERPROFILE%\.ssh\authorized_keys on the server, with the file's ACL tightened so that only the owner and SYSTEM can read it. Accounts in the local Administrators group are a special case: their keys go into C:\ProgramData\ssh\administrators_authorized_keys instead, which is a detail that costs most people an hour the first time they meet it.

Server-wide behaviour lives in C:\ProgramData\ssh\sshd_config. Restricting users to a single directory means combining ChrootDirectory with the internal-sftp subsystem, and the Windows port of OpenSSH supports that arrangement less completely than the Unix implementation does. Disabling password authentication is a PasswordAuthentication no line in the same file, followed by a service restart.

Where the OpenSSH path runs out

Nothing above is difficult. The difficulty is cumulative, and it arrives in a recognisable order.

Administration is entirely file-based, so there is no view of who has access to what, and no way to hand the task to a colleague without also handing over a document explaining the conventions you invented. There is no directory integration, so a user disabled in AD keeps working over SFTP until someone remembers to remove the key. There is no audit interface, only text logs that you must ship somewhere and parse yourself. Key rotation is manual and per-user, which means it does not happen. Failed-login throttling has to be assembled from firewall rules and scheduled tasks, because there is no built-in equivalent to the ban-after-N-attempts behaviour commercial servers provide by default. And because SFTP is a subsystem of SSH, an account that can transfer files can often also open a shell unless you have explicitly stopped it.

If your answers to the three questions at the top were "few", "no" and "no", stop here. The OpenSSH server is a good piece of software and it will do this job. The rest of this article is for the other case.

Running SFTP as a managed service instead

The alternative is a file transfer server that treats users, folders, protocols and logging as first-class configuration rather than as files on disk. What follows uses CompleteFTP, which is ours, and the specifics are drawn from its documentation.

One thing to establish before you download anything: SFTP is not supported in CompleteFTP's Free Edition, which covers FTP and FTPS only. SFTP requires the Standard Edition or above, and SCP and SSH terminal access need Professional or Enterprise MFT. The trial installer starts as Enterprise MFT and lets you move between editions in the Licensing panel while the trial runs, so the practical approach is to install the trial, configure what you actually need, and then see which edition that corresponds to.

Install

CompleteFTP is a standard Windows installer, run with administrator rights. It installs as a Windows service running as the local SYSTEM account and starts automatically with the machine, so the startup-type problem described above does not arise. The installer places both the server and the CompleteFTP Manager, the administration application; the production installer can also install the Manager alone, which is how you administer a server on another machine.

The trial runs for 31 days. After that it converts to Developer Mode and continues to accept connections from localhost indefinitely, which is useful for a test rig you want to keep.

Add users

Run the CompleteFTP Manager and it prompts you to add a user. Each account needs a password, and the dialog has a Random button that generates one. You then choose the home directory, where the default is usually the right answer.

For an existing Windows environment, use the Add user link in the Users panel and choose Windows user(s). Local accounts are listed by clicking List server's local users. For domain accounts, enter the domain name and click List domain users, with a filter or a size limit if the directory is large. Domain users are not available in the Standard Edition. Select several users at once with shift or control, and home folders can be created automatically from the %HomeBaseFolder%/%UserName% template.

Directories other than AD are supported as well: LDAP is available for non-AD directory services, configured from the same Users panel. The point is that authentication can come from a directory you already run rather than a separate account list.

Scale is what turns directory-backed authentication from a preference into a requirement. One organization described the position it left them in:

"This makes it difficult when you need to add hundreds of users to separate groups and home folders. Im dealing with PCI DSS data and if I make one mistake adding a user to the wrong home folder Im going to be in bad shape."
a US organization handling PCI DSS data (EnterpriseDT support archive)

Enable SFTP and check the host keys

SFTP is switched on in the SFTP/SCP/SSH settings, along with SCP and SSH terminal access, which are separate checkboxes and should stay off unless something needs them. The same panel holds the port (22 by default, shared by all three protocols), the listening IP addresses, and the authentication methods the site will accept: Password, PublicKey, or PublicKeyAndPassword. Settings only take effect when you select Apply Changes.

Host keys are generated when CompleteFTP is installed, so there is no key-generation step to forget. RSA, DSA, ECDSA and Ed25519 keys are all supported, and each can be regenerated, imported or exported from the ellipsis button next to it under Advanced SFTP/SCP Settings. DSA is deprecated and should not be used.

User public keys are managed per account, from the ellipsis next to Public keys in the user details window. The Manage Public Keys dialog will generate a keypair for that user and prompt you to save the private half, or import a public key the user has generated themselves. Professional and Enterprise MFT allow multiple keys per user, which is what makes rotation possible without an outage: add the new key, confirm the client works, remove the old one.

Test the connection

Connect with an ordinary client before you tell anyone the server exists. WinSCP and FileZilla both have setup walkthroughs in the CompleteFTP documentation, and our own guide to client configuration covers the same ground. Test from outside the network as well as from the server itself, since a working localhost connection tells you nothing about the firewall.

Making it production-ready

Getting a client to connect is the halfway point.

Hardening

CompleteFTP's own hardening guidance is detailed, and most of it applies to any SFTP server on Windows:

  • Disable every protocol you are not using. Running SFTP only means turning off FTP, FTPS, HTTP, HTTPS and SCP.
  • Disable SSH terminal access. It is off by default in CompleteFTP, and it lets a Windows user with the feature enabled run almost any command.
  • Prefer public-key authentication and disable passwords for SFTP where the client population allows it.
  • Disable weak algorithms: 3DES and Blowfish ciphers, HMAC-MD5 and HMAC-SHA1 MACs.
  • Leave auto-banning at its defaults. All CompleteFTP editions ban an IP address after repeated failed logins, and the thresholds are customisable in Professional and Enterprise MFT.
  • Add IP filtering where the client addresses are known, with rules scoped to the whole site or to individual users.
  • Hide the product name and version in the Settings, Messages section, and replace the default welcome message.
  • Set password policies from the Users panel: at least eight characters, mixed case, and a digit are the recommended minimum.

If the server faces the internet, put a rate limit or an IP filter in front of port 22 before you publish the address rather than after.

Audit logging

Auditing is enabled from the Log Files tab of the Monitoring panel, through the Configure Auditing link. Once on, it records file transfer operations and logins and logouts to Audit.log, rolled daily into files named Audit.log.YYYYMMDD, with a configurable retention period or a Keep forever option.

Getting those records off the machine matters as much as producing them. CompleteFTP's logging is built on log4net, and the configuration can be overridden by placing a LogConfig.xml file in the Logs folder under C:\ProgramData\Enterprise Distributed Technologies\Complete FTP, which survives upgrades. Adding a RemoteSyslogAppender and restarting the service sends the log stream to syslog, and from there to whatever collector your security team runs. Our auditing feature page has more detail.

High availability

Clustering is an Enterprise MFT feature. CompleteFTP synchronises configuration across servers, with one primary distributing changes to secondaries in near real time, but it does not synchronise user files; that needs DFS or shared network storage. Traffic distribution and failover come from a load balancer in front of the cluster, hardware or Microsoft NLB. Cluster members communicate on port 14983, all servers must run the same version, and secondaries default to accepting connections only from localhost or LAN addresses, so their IP filters need adjusting to admit the primary.

Backup and recovery

Know where the configuration lives. On current versions the configuration database is config.db, in C:\ProgramData\Enterprise Distributed Technologies\Complete FTP, alongside the data directories. Backing up that folder captures users, folders, permissions and settings together, and restoring it onto a fresh install is also the documented route for moving the server to another machine.

Mistakes that surface in support tickets

Port 22 exposed to the internet with no filtering and no ban policy, which fills the log with credential-stuffing attempts within hours of the address becoming reachable.

Password authentication left enabled indefinitely after keys were rolled out, so the weakest credential on the server is still a password nobody has rotated.

SSH terminal access left on because SFTP appeared to need it. It does not, and leaving it on turns a file transfer account into a shell account.

Host keys accepted blindly by clients, which removes the protection the key was there to provide. Publish your server's host key fingerprint to partners at onboarding, and give the audit log a retention period at the same time you enable it.

Choosing between the two

OpenSSH moves files over SFTP correctly and securely, and for a small technical team with a handful of accounts it is a sensible choice that costs nothing. The difference is not only administrative convenience. A managed server such as CompleteFTP adds capabilities OpenSSH does not have at all: directory-backed accounts with group-to-permission mapping, an audit trail an auditor will accept, event-driven automation and triggers, encryption at rest, cloud storage backends, and active-active clustering. It also provides the interface that makes all of it usable by whoever inherits the server. The choice is between a protocol endpoint and a file transfer platform, not between more and less administrative work.

If you would rather see the difference on your own machine than take our description of it, the CompleteFTP trial installs as Enterprise MFT and lets you switch editions from the Licensing panel while you work out which one your requirements match. The edition comparison sets out where SFTP, domain users, IP filtering, per-user authentication methods and clustering each begin.

Other technical articles

Download Free Trial