Windows Server · SSH · PowerShell

Windows Server over SSH and PowerShell — with no port open.

Q: Is port 22 opened on the Windows server?

No. When the installer adds the OpenSSH Server, it sets sshd to listen on 127.0.0.1 and ::1 only and switches the "OpenSSH SSH Server (sshd)" firewall rule off, so nothing is open to the network. The Connector reaches sshd on localhost over its own outbound tunnel. If OpenSSH was already installed, its network settings are left exactly as they were.

Q: Can I keep my existing OpenSSH configuration?

Yes. The installer only touches sshd when it installs the feature itself. An OpenSSH Server that was already present is left as it is — the Connector still reaches it on localhost. Enrollment adds Termalin’s SSH certificate authority to sshd_config so logins use a short-lived certificate for your account only.

Q: Can I use cmd.exe instead of PowerShell?

Enrollment sets PowerShell as the SSH login shell only if no default shell is already configured. If you have set DefaultShell for OpenSSH yourself, that is left in place.

Q: How do I remove it?

Run & "$env:ProgramFiles\Termalin\termalin-agent.exe" uninstall in an elevated PowerShell. That removes the TermalinAgent service and the Connector; an OpenSSH Server you had before is untouched.

One line in PowerShell turns a Windows Server into a Connector host. You get a PowerShell terminal in the browser or the app, files, a remote desktop, monitoring and alerts, and AI apps that run PowerShell under your rules — all over an outbound tunnel, so port 22 stays closed.

Add a Windows server How the Connector works →

No inbound port · PowerShell login shell · Pro (or 14-day trial)

01 / one line in PowerShell

Install it from PowerShell.

Sign in at termal.in/account, click Get install command, pick the Windows tab, and run the line it shows in PowerShell on the server:

irm https://termal.in/i/<token>.ps1 | iex

Windows asks for administrator rights — approve it. The install link is single-use and valid for an hour. That is the whole setup: no router changes, no security-group edits, no inbound port.

02 / what it sets up

OpenSSH, PowerShell, and a service that stays up.

▸OpenSSH Server — installs the optional feature if it is missing and sets sshd to start automatically.
▸PowerShell as the SSH login shell — set on enrollment, unless you already configured a default shell.
▸Port 22 stays closed. When the installer added OpenSSH, sshd listens on 127.0.0.1 and ::1 only and its firewall rule is switched off. An OpenSSH Server that was already there is left exactly as it was.
▸The TermalinAgent service — runs the Connector, reconnects after a reboot, and moves opaque SSH bytes to sshd on localhost. Uninstall with & "$env:ProgramFiles\Termalin\termalin-agent.exe" uninstall.

03 / what you get

A terminal, files, a desktop, and monitoring.

▸A PowerShell terminal in the web cabinet or the desktop app — a real session, from a phone, a tablet or a machine that isn’t yours.
▸Files over SFTP. Browse, edit and transfer files through the same link, with Windows drive paths like C:\Users\….
▸A remote desktop. Open RDP to the machine at 127.0.0.1 through the Connector — port 3389 stays closed — with a Files panel beside it. See RDP without port forwarding.
▸Monitoring and alerts. CPU, memory, page file, drives, network, disk traffic, processes and uptime, charted every minute, with alerts for a drive filling or the server going offline. See Windows Server monitoring.

04 / AI apps on Windows

Let an AI run PowerShell — under your rules.

Through the hosted MCP endpoint, Claude and ChatGPT can run commands on the server: ssh_exec runs each command in PowerShell. The per-Connector policy What AI may run here applies — full access, only listed commands, or read-only — on top of each app’s own setting, and the stricter one wins.

The background job tools need a Unix shell, so they don’t run on Windows; the file and database tools, and server backups, are for Linux servers for now.

05 / requirements and limits

What it needs.

Item	Detail
Windows	Windows 10 and 11, and Windows Server. The Connector binary is a small static `.exe` for x64 and ARM64.
Account	SSH sessions sign in as a local Windows account.
Plan	Pro or the 14-day trial, same as any Connector. Free has no Connectors.

Questions

Is port 22 opened on the Windows server?

No. When the installer adds the OpenSSH Server, it sets sshd to listen on 127.0.0.1 and ::1 only and switches the "OpenSSH SSH Server (sshd)" firewall rule off, so nothing is open to the network. The Connector reaches sshd on localhost over its own outbound tunnel. If OpenSSH was already installed, its network settings are left exactly as they were.

Can I keep my existing OpenSSH configuration?

Yes. The installer only touches sshd when it installs the feature itself. An OpenSSH Server that was already present is left as it is — the Connector still reaches it on localhost. Enrollment adds Termalin’s SSH certificate authority to sshd_config so logins use a short-lived certificate for your account only.

Can I use cmd.exe instead of PowerShell?

Enrollment sets PowerShell as the SSH login shell only if no default shell is already configured. If you have set DefaultShell for OpenSSH yourself, that is left in place.

How do I remove it?

Run & "$env:ProgramFiles\Termalin\termalin-agent.exe" uninstall in an elevated PowerShell. That removes the TermalinAgent service and the Connector; an OpenSSH Server you had before is untouched.

Can I RDP to it without opening port 3389?

Yes. With the Connector on the machine, a remote desktop opens to 127.0.0.1 through the same outbound tunnel — no port forwarding, port 3389 stays closed. See remote desktop without port forwarding.

Which Windows versions work?

Windows 10 and 11, and Windows Server, on x64 or ARM64. SSH sessions sign in as a local Windows account.

Reach a Windows server, keyless, in a minute.

One PowerShell line, no inbound port, PowerShell at your fingertips in the browser. New accounts get Pro free for 14 days.

Add a Windows server See pricing →

Pro (or 14-day trial) · Connector · monitoring · MCP for AI agents