November 2026

Recipe to set the correct file permissions of a SSH-Key in windows

A ssh-key is a text file but the file permissions need to be set properly otherwise the ssh command (openssh) will refuse to use it. The key is in the .ssh folder under your user. In linux it's one command to set the permissions:

chmod 600 id_rsa

Windows file permissions are messy and complicated. I have seen many people struggle with that. If you just copy your ssh key to C:\Users\YourUserId\.ssh\id_rsa then you will get this message:

@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
Permissions for 'C:\\Users\\YourUserId/.ssh/id_rsa' are too open.
It is required that your private key files are NOT accessible by others.
This private key will be ignored.
Load key "C:\\Users\\YourUserId/.ssh/id_rsa": bad permissions

To fix the file permissions open powershell and run these commands:

cd .ssh
icacls .\id_rsa /reset
icacls .\id_rsa /inheritance:r
icacls .\id_rsa /grant:r "YourDomain\YourUserId:F"

after the above commands it should then look like this:

PS C:\Users\YourUserId\.ssh< icacls .\id_rsa
.\id_rsa YourDomain\YourUserId:(F)

Substitute YourUserId with your user id. Don't know your user id? Run:

echo $env:username

and replace
YourDomain with your windows domain. To print your domain name type:

Get-ADDomain | Select-Object Name  
   or  
Get-ADDomain | Select-Object NetBIOSName

Select-Object is a kind of a "grep" command in powershell.