Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm having some difficulties logging in to my Windows 2008 server (a DC) running Cygwin sshd. I can log in fine with an account that is a member of the Domain Admins group, but when I try with a regular user account, ssh says "Permission denied."

I have ran mkpasswd -l > /etc/passwd. In fact, if I add an account to the Admins group, it can login. However, after removing it from the Admins group, it is again unable to login.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

After way too much time spent stumbling around, I've finally discovered the cause of my problem. In short, I was getting "Permission denied" for my non-administrator users because on a DC, the Users group does not have the "Allow logon locally" user right. When sshd tried to switch context from the sshd service's account to a non-privileged user, the operation failed because the user didn't have the logon locally permission.

To fix, I had to edit the Default Domain Controller Policy to give the Users group the Allow logon locally right. This can be found in Group Policy Management > (your domain) > Group Policy Objects. Right-click, Edit. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Open Allow logon locally and add the Users group (or, you may want to create a 'SSH users' group and add that instead).

After editing the policy, run gpupdate in a command prompt to refresh the changes and you're good to go.

share|improve this answer

I was having the same problems myself (today) and think I've figured it out. Before you can ssh in as the other users, those other users must be fully set up in cygwin. so for me, i needed to actually log in to windows as each non-admin user, and then (in that same windows session) open up a cygwin terminal (still, as the non-admin user) and just mess around for a second (e.g. run "ls", then see if you can't ssh into localhost ("ssh localhost"). as soon as i opened up a cygwin terminal, it generated some initial config details or whatever, and from that moment onwards I could ssh in as the non-admin user. hope this helps.

share|improve this answer
I tried your suggestion (even running ssh-user-config under the user's account), but no dice. –  josh3736 Jul 12 '10 at 0:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.