Thessley computer installation
Windows 11 — install on this PC
Use these steps at the Windows computer you are setting up. The install is local; it does not require sending an SSH key to another computer.
1. Install and verify Windows OpenSSH on this PC
Open PowerShell as Administrator on this Windows PC, then run this block. Keep the window open while Windows installs the optional feature; it may take several minutes.
$ErrorActionPreference = 'Stop'
$cap = Get-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
if ($cap.State -ne 'Installed') {
Write-Host 'Installing OpenSSH Server. Keep this PowerShell window open.'
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 | Out-Null
}
$cap = Get-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
if ($cap.State -ne 'Installed') { throw "OpenSSH Server is not installed (state: $($cap.State))." }
$service = Get-Service -Name sshd -ErrorAction SilentlyContinue
$sshd = Join-Path $env:WINDIR 'System32\OpenSSH\sshd.exe'
if (-not $service -or -not (Test-Path $sshd)) { throw 'OpenSSH is reported installed but sshd is missing. Stop and see the FAQ.' }
Set-Service -Name sshd -StartupType Automatic
Start-Service sshd
Get-Service sshd
$rule = Get-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -ErrorAction SilentlyContinue
if ($rule) {
Set-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -Enabled True -RemoteAddress LocalSubnet
} else {
New-NetFirewallRule -Name 'OpenSSH-Server-In-TCP' -DisplayName 'OpenSSH Server (sshd)' -Enabled True -Direction Inbound -Protocol TCP -Action Allow -LocalPort 22 -RemoteAddress LocalSubnet
}Success means the final command reports Status: Running and StartType: Automatic. This step installs OpenSSH only; the Thessley installer separately configures phone and web access.
Optional: test SSH locally on this PC (no key transfer)
This optional check creates a separate test key on this PC, adds its public half to this PC’s Windows SSH administrator key file, and connects only to localhost. The private key stays in this Windows user’s profile. Skip this if you do not need a localhost SSH test; it is not required to install Thessley.
Run in the same Administrator PowerShell on this PC:
$ErrorActionPreference = 'Stop'
$sshKeygen = Join-Path $env:WINDIR 'System32\OpenSSH\ssh-keygen.exe'
$ssh = Join-Path $env:WINDIR 'System32\OpenSSH\ssh.exe'
if (-not (Test-Path $sshKeygen) -or -not (Test-Path $ssh)) { throw 'OpenSSH client tools are missing.' }
$sshDir = Join-Path $HOME '.ssh'
New-Item -ItemType Directory -Path $sshDir -Force | Out-Null
$privateKey = Join-Path $sshDir 'thessley-localhost'
if (-not (Test-Path -LiteralPath $privateKey)) {
& $sshKeygen -t ed25519 -a 64 -f $privateKey -C 'thessley-localhost'
if ($LASTEXITCODE -ne 0) { throw 'Local test key generation failed.' }
}
$publicKey = (Get-Content -Raw -LiteralPath "${privateKey}.pub").Trim()
$authorizedKeys = Join-Path $env:ProgramData 'ssh\administrators_authorized_keys'
$sshConfigDir = Join-Path $env:ProgramData 'ssh'
New-Item -ItemType Directory -Path $sshConfigDir -Force | Out-Null
if (-not (Test-Path -LiteralPath $authorizedKeys)) { New-Item -ItemType File -Path $authorizedKeys -Force | Out-Null }
if ($publicKey -notin @(Get-Content -LiteralPath $authorizedKeys)) { Add-Content -LiteralPath $authorizedKeys -Value $publicKey -Encoding ascii }
icacls.exe $authorizedKeys /inheritance:r /grant '*S-1-5-32-544:F' /grant '*S-1-5-18:F'
if ($LASTEXITCODE -ne 0) { throw 'Could not set the local SSH key file permissions.' }
& $ssh -i $privateKey "$env:USERNAME@localhost" exit
if ($LASTEXITCODE -ne 0) { throw 'The local SSH key login failed.' }
Write-Host 'Local SSH key login succeeded; the remote session exited cleanly.'Accept the host fingerprint for localhost. The test logs in, runs exit remotely, and returns to PowerShell automatically. The test key is not used by any remote computer.
2. Install Thessley on this PC
Still in Administrator PowerShell on the Windows PC, run the guided installer:
irm https://wp-opsec.eagleeye-intelligence.com/wp-content/uploads/thessley-windows-downloads/install.ps1 | iexFollow its prompts for the phone approval listener, optional web admin, firewall source networks, and SSH account policy. If your administrator account needs its first phone, the installer prints a one-time enrollment link and code. Open that link on the phone; no SSH key is involved in phone enrollment.
Automatic SSH recovery: before enabling SSH QR access, the installer saves the original SSH configuration and verifies a 30-minute recovery timer. The optional Windows QR sign-in tile creates its own timer when installed. Both appear under Admin → Setup rollback, labelled by the login method they protect.
Keep the current SSH session open and test a new SSH login. If you installed the Windows sign-in tile, test that too while keeping PIN/password recovery available. Once every enabled login method works, choose Keep setup and stop rollback in Admin and approve on your phone. The page verifies cancellation. If you leave SSH recovery active, expiry restores the original SSH configuration; your enrolled phones are retained.
After those tests succeed, this administrator PowerShell command is an alternative way to keep the setup:
powershell.exe -NoProfile -ExecutionPolicy Bypass -File "$env:ProgramData\ThessleyPamWin\confirm-setup.ps1"The installer enables verified automatic updates for Sundays at 03:00 local time. Admin → Settings can turn the schedule off. Updates verify the package hash and use the installer’s rollback path; SSH policy and firewall rules are preserved.
There is no installer clock check. Signed phone-approval requests have a freshness check, so keep the Windows and phone clocks synchronized; their time-zone settings may differ.
3. Finish setup and test
Open the local Admin page shown by the installer, enroll the phone, then manage QR approval for Windows SSH accounts under Admin → Users. Test a new SSH login while keeping the local console available. The optional localhost test above is separate from remote SSH clients.
For issues installing the Windows optional feature, see the Microsoft OpenSSH Server guide. Do not remove or reinstall OpenSSH while an installation command is still running.
Other operating systems and downloads
All Thessley downloads
Windows helper apps, Android app, Linux packages, and checksums.
Browse downloads