All Products
Search

This Product

    Elastic Compute Service:Use Cloud Assistant to install OpenSSH on a Windows instance

    Document Center

    Elastic Compute Service:Use Cloud Assistant to install OpenSSH on a Windows instance

    Last Updated:Jun 20, 2026

    The Cloud Assistant Agent runs Cloud Assistant commands on an ECS instance. This topic describes how to use the Cloud Assistant Agent to install OpenSSH on a Windows-based ECS instance.

    Prerequisites

    • The Cloud Assistant Agent is installed on the instance. For more information, see Install the Cloud Assistant Agent.

    • A public IP address is automatically assigned to the ECS instance. Alternatively, an elastic IP address (EIP) is associated with the ECS instance. For instructions on how to enable public bandwidth, see Enable public bandwidth.

    • The instance's security group must have a rule that allows inbound traffic on TCP port 22. For more information, see Add a security group rule.

      Note

      For the operating system versions supported by Cloud Assistant Agent, see the Usage Limits section of Cloud Assistant Overview.

    Procedure

    1. Go to ECS console - Cloud Assistant.

    2. In the upper-left corner of the page, select a region and resource group.地域

    3. In the upper-right corner, click Create/Run Command.

    4. On the Create Command page, configure the command, select target instances, and set other parameters.

      Parameter

      Description

      Command information

      Command Source

      Select Enter Command Content to create a new command.

      Command type

      Select the command type.

      Windows: Select PowerShell.

      Command content

      • Paste the following command into the command content box:

        $curDir = $PSScriptRoot
Set-Location $curDir
# Check the OS version
$OSversion = [Environment]::OSVersion.Version
if ($OSversion.Major -lt 6 -or ($OSversion.Major -eq 6 -and $OSversion.Minor -lt 1)) {
     throw "This script is not supported on Windows 2008 or lower"
}
$Arch =([Array](Get-WmiObject -Query "select AddressWidth from Win32_Processor"))[0].AddressWidth
if ($Arch -ne "64") {
    throw "Only 64-bit system architecture is supported"
}
function Check-Env() {
    $srv_status = (Get-WmiObject -Class win32_service -Filter "name= 'sshd'").Status
    if ( $srv_status -match "OK") {
        Write-Host "system already installed opensshd"
        exit
    }
}
function Download-File($file_url = "{{sshd_download_url}}", $file_path = "C:\Programdata\OpenSSH-Win64.zip") {
    if (Test-Path $file_path) { return; }
    [System.Net.ServicePointManager]::SecurityProtocol=[System.Net.SecurityProtocolType]::Tls12
    Invoke-WebRequest -Uri $file_url  -OutFile $file_path -UseBasicParsing
    if (! $?) { throw "$file_url download to $file_path error" }
}
function Unzip-File($src_file = "C:\Programdata\OpenSSH-Win64.zip", $dst_file = "C:\Programdata") {
    Expand-Archive -Path $src_file -DestinationPath $dst_file 
    if (! $?) { throw "Unzip $src_file to $dst_file error, please check" }
}
function Install-Ssh() {
    powershell.exe -ExecutionPolicy Bypass -File C:\Programdata\OpenSSH-Win64\install-sshd.ps1
    if (! $?) {
        throw "Install openssh error, please check"
    }
    Start-Service sshd
    Set-Service -Name "sshd" -StartupType Automatic; Start-Service sshd
    if (! $?) {
        throw "set sshd enable auto start or start sshd error , please check"
    }
}
Check-Env
Download-File
Unzip-File
Install-Ssh

      • Use Parameters: Enable this option. You must then specify a value for the {{sshd_download_url}} parameter in the command. Get the download URL for the desired OpenSSH version from the official OpenSSH website. Example: https://github.com/PowerShell/Win32-OpenSSH/releases/download/v9.5.0.0p1-Beta/OpenSSH-Win64.zip.

      Execution plan

      Click Immediate Execution.

      Command name

      Enter a name for the command.

      Command description

      Enter a description for the command. A clear description, such as the command's purpose, helps with future maintenance.

      Username

      Specifies the user who runs the command on the ECS instance.

      As a security best practice, we recommend that you run Cloud Assistant commands as a regular user with the minimum required permissions. For more information, see Run Cloud Assistant commands as a regular user.

      Note

      By default, Cloud Assistant runs commands as the root user on Linux instances and as the System user on Windows instances.

      Execution path

      For Windows, the default path is the Cloud Assistant Agent process directory: C:\ProgramData\aliyun\assist\$(version).

      Timeout Period

      Set the Timeout Period for the command on the instance. If the command execution times out, Cloud Assistant forcibly terminates the command process.

      Unit: seconds. The default value is 60. A value of 300 is recommended. You can adjust the value based on network conditions.

      Select instance

      Select the target instances for the command.

      Select Managed Instances

      Select the target managed instances for the command.

      Note

      Managed instances are non-Alibaba Cloud servers that are managed by Cloud Assistant. For more information, see Alibaba Cloud managed instances.

    5. Click Run and Save and verify that the command executed successfully.

      An execution status of Succeeded, along with an ExitCode of 0 and output containing sshd and ssh-agent services successfully installed, indicates a successful OpenSSH installation.

    6. Verify the OpenSSH installation.

      1. Connect to the Windows instance by using VNC.

        For more information, see Connect to an instance by using VNC.

      2. Click Dingtalk_20210510142550.jpg > Windows PowerShell to open the Windows PowerShell terminal.

      3. Run the following command to check the network status: 

        NETSTAT.EXE -ano

        If an entry shows that port 22 is in the LISTENING state, the service is running correctly.

        PS C:\Users\Administrator> NETSTAT.EXE -ano
Active Connections
  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:22             0.0.0.0:0              LISTENING       2880
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       892
  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:3389           0.0.0.0:0              LISTENING       136
  TCP    0.0.0.0:47001          0.0.0.0:0              LISTENING       4
  TCP    0.0.0.0:49664          0.0.0.0:0              LISTENING       580
  TCP    0.0.0.0:49665          0.0.0.0:0              LISTENING       524
  TCP    0.0.0.0:49666          0.0.0.0:0              LISTENING       1116
  TCP    0.0.0.0:49667          0.0.0.0:0              LISTENING       1908
  TCP    0.0.0.0:49668          0.0.0.0:0              LISTENING       1824

    7. Verify that you can connect to the Windows instance remotely by using an SSH client.

      Note

      Use the Windows instance's current username and password to log on.