Windows Server administration from a Mac

Windows Server has shipped an OpenSSH server since 2019, which gives you PowerShell over SSH next to the classic RDP desktop. The split works well from a Mac: SSH for scripted work and quick checks, RDP for what really needs the graphical session, such as Server Manager, IIS Manager or the Active Directory tools. SSHive does both, in tabs of the same window, with a profile per server. Its RDP client signs in with Network Level Authentication and Active Directory accounts; it is part of Pro, as is RDP in the iPhone and iPad app.

On Windows Server 2025, OpenSSH is already installed: enable it in Server Manager > Local Server > Remote SSH Access. On 2019 and 2022, install it from an elevated PowerShell with Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0, then run Start-Service sshd and Set-Service -Name sshd -StartupType Automatic. Setup creates the OpenSSH-Server-In-TCP firewall rule for port 22. The default shell is cmd. To land in PowerShell instead: New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force For key logins with an administrator account, the public key goes in C:\ProgramData\ssh\administrators_authorized_keys, not in the user's own .ssh folder.

Create an RDP profile with the server name, the user and the password, and for a domain account the domain in the Domain field (leave it empty for a local account). The session opens in a tab. The resolution fits the window or a size you choose, a quality setting trades sharpness for bandwidth and lowers itself on a slow link, text copied on either side pastes on the other, and a button sends Ctrl+Alt+Del. SSHive also remembers the server's certificate and stops if it changes, telling you whether it looks like a routine renewal or a different machine. Over the internet, do not expose port 3389. Since the server runs OpenSSH, tunnel RDP through it: a local tunnel from 13389 to localhost:3389 on the SSH profile, and the RDP profile pointed at localhost:13389. The RDP guide has the details.