I'm having some difficulties logging in to my Windows 2008 server (a DC) running Cygwin sshd. I can log in fine with an account that is a member of the Domain Admins group, but when I try with a regular user account, ssh says "Permission denied."

I have ran mkpasswd -l > /etc/passwd. In fact, if I add an account to the Admins group, it can login. However, after removing it from the Admins group, it is again unable to login.

3 Answers 3


After way too much time spent stumbling around, I've finally discovered the cause of my problem. In short, I was getting "Permission denied" for my non-administrator users because on a DC, the Users group does not have the "Allow logon locally" user right. When sshd tried to switch context from the sshd service's account to a non-privileged user, the operation failed because the user didn't have the logon locally permission.

To fix, I had to edit the Default Domain Controller Policy to give the Users group the Allow logon locally right. This can be found in Group Policy Management > (your domain) > Group Policy Objects. Right-click, Edit. Go to Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment. Open Allow logon locally and add the Users group (or, you may want to create a 'SSH users' group and add that instead).

After editing the policy, run gpupdate in a command prompt to refresh the changes and you're good to go.

  • how to access GPM on Windows7? I don't have it. Aug 18, 2018 at 13:26

It was hard but I finally figured it out.

  1. Run "mkpasswd -l > /etc/passwd".
  2. Go to the file and open it in notepad++ (c:\cygwin\etc...).
  3. There, you will notice that the account listings is similar to (for a local account) machine-name+username. (eg- xyz+joe:*:...)
  4. To be sure, open PuTTY and try to connect with this entire username. i.e. +. You should be able to get in.
  5. Now remove from passwd file, text till machine-name+ and let it be username only. (eg - joe:*:...).
  6. Now save and again try to connect.

Even though this worked for me, it may not for others. I will list down additional things that I did which may have also added to the success.
1. chmod'ing passwd and group file to rw.
2. Users should be in admin group.
3. Cygwin installation directory allowed rw access to the users.

  • Your additional steps don't sound like anything that was related to the issue - but they do sound like highly unnecessary security risks. Oct 12, 2015 at 13:51
  • Additional steps were just for reference of what I did apart from the steps that I have mentioned. You are free to choose. Oct 13, 2015 at 14:45
  • Yeah, I was getting "invalid user" for every combination I tried: <user>, <machine>+<user>, <machine>\<user> (obviously) and <machine>\\<user>. Removing <machine>+ from /etc/passwd did it.
    – simlev
    Mar 1, 2019 at 11:08

I was having the same problems myself (today) and think I've figured it out. Before you can ssh in as the other users, those other users must be fully set up in cygwin. so for me, i needed to actually log in to windows as each non-admin user, and then (in that same windows session) open up a cygwin terminal (still, as the non-admin user) and just mess around for a second (e.g. run "ls", then see if you can't ssh into localhost ("ssh localhost"). as soon as i opened up a cygwin terminal, it generated some initial config details or whatever, and from that moment onwards I could ssh in as the non-admin user. hope this helps.

  • I tried your suggestion (even running ssh-user-config under the user's account), but no dice.
    – josh3736
    Jul 12, 2010 at 0:09
  • Thank you! This worked for me exactly as described. Furthermore, I had to do this after a system reboot even when the non-admin login was working fine before the reboot
    – user9399
    Apr 28, 2019 at 20:05

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .