I'm having some difficulties logging in to my Windows 2008 server (a DC) running Cygwin sshd. I can log in fine with an account that is a member of the Domain Admins group, but when I try with a regular user account, ssh says "Permission denied."

I have ran mkpasswd -l > /etc/passwd. In fact, if I add an account to the Admins group, it can login. However, after removing it from the Admins group, it is again unable to login.


After way too much time spent stumbling around, I've finally discovered the cause of my problem. In short, I was getting "Permission denied" for my non-administrator users because on a DC, the Users group does not have the "Allow logon locally" user right. When sshd tried to switch context from the sshd service's account to a non-privileged user, the operation failed because the user didn't have the logon locally permission.

To fix, I had to edit the Default Domain Controller Policy to give the Users group the Allow logon locally right. This can be found in Group Policy Management > (your domain) > Group Policy Objects. Right-click, Edit. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Open Allow logon locally and add the Users group (or, you may want to create a 'SSH users' group and add that instead).

After editing the policy, run gpupdate in a command prompt to refresh the changes and you're good to go.

  • how to access GPM on Windows7? I don't have it. – Steve Yakovenko Aug 18 '18 at 13:26

It was hard but I finally figured it out.

  1. Run "mkpasswd -l > /etc/passwd".
  2. Go to the file and open it in notepad++ (c:\cygwin\etc...).
  3. There, you will notice that the account listings is similar to (for a local account) machine-name+username. (eg- xyz+joe:*:...)
  4. To be sure, open PuTTY and try to connect with this entire username. i.e. +. You should be able to get in.
  5. Now remove from passwd file, text till machine-name+ and let it be username only. (eg - joe:*:...).
  6. Now save and again try to connect.

Even though this worked for me, it may not for others. I will list down additional things that I did which may have also added to the success.
1. chmod'ing passwd and group file to rw.
2. Users should be in admin group.
3. Cygwin installation directory allowed rw access to the users.

  • Your additional steps don't sound like anything that was related to the issue - but they do sound like highly unnecessary security risks. – underscore_d Oct 12 '15 at 13:51
  • Additional steps were just for reference of what I did apart from the steps that I have mentioned. You are free to choose. – user2683109 Oct 13 '15 at 14:45
  • Yeah, I was getting "invalid user" for every combination I tried: <user>, <machine>+<user>, <machine>\<user> (obviously) and <machine>\\<user>. Removing <machine>+ from /etc/passwd did it. – simlev Mar 1 '19 at 11:08

I was having the same problems myself (today) and think I've figured it out. Before you can ssh in as the other users, those other users must be fully set up in cygwin. so for me, i needed to actually log in to windows as each non-admin user, and then (in that same windows session) open up a cygwin terminal (still, as the non-admin user) and just mess around for a second (e.g. run "ls", then see if you can't ssh into localhost ("ssh localhost"). as soon as i opened up a cygwin terminal, it generated some initial config details or whatever, and from that moment onwards I could ssh in as the non-admin user. hope this helps.

  • I tried your suggestion (even running ssh-user-config under the user's account), but no dice. – josh3736 Jul 12 '10 at 0:09
  • Thank you! This worked for me exactly as described. Furthermore, I had to do this after a system reboot even when the non-admin login was working fine before the reboot – user9399 Apr 28 '19 at 20:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.