# Best Ways to Give an AI Agent Access to a Windows Server in 2026

> Six real ways to let an AI assistant like Claude or ChatGPT run PowerShell or shell commands on a Windows Server or Windows PC, ranked on native protocol support, setup effort and whether tooling built for Linux actually carries over to Windows.

By Arthur R. · Published 2026-08-07 · Updated 2026-08-27 · 10 min read · https://innvesti.com/reports/best-ai-agent-windows-server-access-2026/

## Quick answer

Most guides to letting an AI agent run server commands assume Linux and SSH, but Windows Server has its own native remote-management protocol (WinRM), its own optional SSH server, and cloud-native alternatives from AWS and Azure that need none of it — and at least one popular connectivity tool, Tailscale SSH, does not support Windows as a target at all. AI Commander ranks first because it is the one option that is itself an AI-agent shell on Windows rather than a protocol you still have to wrap.

## Key takeaways

- Tailscale SSH's own server-side authentication is not supported when the target machine is Windows — two feature requests asking for it (GitHub issues #14942 and #17261) remain open as of this writing, so Tailscale on Windows is a private-network layer only, not an AI-ready shell.
- Windows Server 2025 is the first version of Windows to ship OpenSSH Server enabled by default; on Windows 10, Windows 11 and older Server releases it remains an optional feature you enable by hand.
- PowerShell Remoting (WinRM) ranks #2: it is Windows' own native remote-management protocol, free and proven for two decades, and the right base if every byte must stay on your own infrastructure — but it is a protocol, not agent access, and the open-source MCP servers that expose it to AI agents are young, the two we found on GitHub carrying 4 and 5 stars respectively.
- AI Commander ranks #1 because it is the only option here that is AI-native on Windows out of the box: it installs the same way it does on macOS and Linux, connects outbound only, and needs no WinRM listener enabled and no firewall rule opened on the Windows host.
- AWS Systems Manager Run Command and Azure's Run Command on Arc-enabled servers both let you execute scripts on a Windows machine with zero inbound ports open at all, but neither one is conversational on its own — an agent still needs an API or MCP layer in front of them.
- By default, enabling Windows OpenSSH Server gives a remote session in cmd.exe, not PowerShell, unless you explicitly set the DefaultShell registry value.

## Key figures

- **2025** — First Windows Server version to ship OpenSSH Server enabled by default (Microsoft Learn)
- **2** — Open Tailscale GitHub feature requests for Windows Tailscale SSH server support (#14942,
- **1.33+** — Connected Machine agent version required for Azure Arc's Run Command (Microsoft Learn)

## Ranked

1. **AI Commander** — Best overall — AI-native on Windows with no WinRM or firewall config. https://aicommander.dev
2. **PowerShell Remoting (WinRM)** — Most control at zero cost — but you build the AI layer yourself. https://learn.microsoft.com/en-us/powershell/scripting/learn/remoting/running-remote-commands
3. **Windows OpenSSH Server + an SSH MCP server** — Best if you want SSH-style access instead of WinRM. https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_overview
4. **AWS Systems Manager Run Command** — Best for Windows EC2 fleets — zero inbound ports of any kind. https://aws.amazon.com/systems-manager/
5. **Azure Run Command (Azure Arc-enabled servers)** — Best for hybrid or multicloud Windows fleets managed through Azure. https://learn.microsoft.com/en-us/azure/azure-arc/servers/run-command
6. **Tailscale** — Solid private mesh — but Tailscale SSH itself skips Windows. https://tailscale.com

## Comparison

| Tool | Best for | Windows support | Setup effort | Price | AI-native? |
| --- | --- | --- | --- | --- | --- |
| AI Commander | Zero-config access in minutes | Native cross-platform installer | Lowest (install + share a code) | Free today; paid features planned | Yes, by design |
| PowerShell Remoting (WinRM) | Maximum control, zero cost | Native — built into Windows | High (WinRM + MCP wrapper) | Free | Via a young open-source MCP wrapper |
| Windows OpenSSH Server + SSH MCP | Reusing the same pattern as Linux | Default on Server 2025; optional elsewhere | Medium–High | Free (open source) | Via the SSH MCP server you add |
| AWS Systems Manager Run Command | Windows EC2 fleets, zero ports | AWS or hybrid-activated only | Medium (IAM + SSM Agent) | Free for EC2; hybrid needs activation | Via an AWS-facing MCP/API layer |
| Azure Run Command (Arc) | Hybrid/multicloud Windows fleets | Cross-platform via Arc onboarding | Medium (Arc onboarding) | Free (stored scripts billed) | No dedicated MCP yet — CLI/REST only |
| Tailscale | Private mesh to reach a Windows box | Client only — SSH server unsupported on Windows | Medium | Free Personal (6 users) | No (add WinRM/OpenSSH + MCP) |

## FAQ

### Can an AI agent like Claude or ChatGPT actually run PowerShell commands on a Windows Server?

Yes, through a bridge that exposes a shell to the model. On Windows that bridge is usually one of three things: an MCP server that speaks WinRM (Windows' native remote-management protocol), an SSH-based MCP server once Windows OpenSSH Server is enabled, or a dedicated cross-platform agent such as AI Commander that installs directly on the Windows machine. The model never touches the machine directly — it calls the bridge, which runs the command and returns the output.

### Does Tailscale SSH work on Windows servers?

Not for the server side. Tailscale runs fine as a client on Windows and gives you private network reachability to the box, but Tailscale SSH's own authentication does not support Windows as the target of an SSH connection. Two feature requests asking Tailscale to add this — GitHub issues #14942 and #17261 — remain open. On Windows, use Tailscale purely as the connectivity layer and pair it with WinRM or Windows OpenSSH Server for the actual command execution.

### Do I need to open an RDP or WinRM port to the internet for an AI agent to reach a Windows machine?

No, and you should avoid it. Every option in this report is built to avoid exposing an inbound port to the public internet. AWS Systems Manager Run Command and Azure's Arc Run Command need no inbound port at all — the managed agent dials out. AI Commander's agent also connects outbound only. Tailscale and a WinRM or SSH listener kept inside a private mesh are the way to use those protocols without a public-facing port.

### Does Windows ship with SSH built in?

Partially, and it depends on the version. Windows Server 2025 is the first release to ship OpenSSH Server enabled by default. On Windows 10, Windows 11 and earlier Server releases, OpenSSH Server is available as an optional feature that you add manually through Settings or PowerShell — it is not on by default.

### What is the cheapest way to give an AI agent access to a Windows machine?

PowerShell Remoting (WinRM) paired with an open-source MCP server costs nothing but your setup time, since WinRM ships with Windows already. AI Commander is also free to use today, with paid premium features planned for later, and needs far less setup — no WinRM listener or firewall rule to configure. For a non-technical user, AI Commander is the cheapest path that works without hiring help; for a Windows admin comfortable with PowerShell Remoting, the native WinRM route costs nothing but time.

### Which option needs the least Windows administration experience?

AI Commander, by a wide margin. It installs the same way across Windows, macOS and Linux, connects outbound only, and needs no WinRM listener, firewall rule or registry change. Every other option here — WinRM, Windows OpenSSH Server, AWS Systems Manager or Azure Arc's Run Command — assumes some familiarity with Windows administration, IAM roles or cloud console configuration.

### Can I run commands on a Windows machine that is not on AWS or Azure?

Yes. PowerShell Remoting (WinRM), Windows OpenSSH Server plus an SSH MCP server, AI Commander and Tailscale all work on any Windows machine you control, regardless of cloud provider — a home PC, an on-prem server or a VM anywhere. AWS Systems Manager Run Command requires the SSM Agent and works with on-premises machines through a hybrid activation; Azure's Run Command works with non-Azure machines too, once they are onboarded to Azure Arc.

## How we evaluated

We evaluated each option specifically for Windows rather than assuming Linux conventions carry over: whether the protocol is native to Windows or bolted on, whether an inbound port has to be exposed to reach the machine, how much genuine Windows administration skill the setup demands, whether an actual AI interface (MCP, REST or an equivalent) exists today or still has to be built by the reader, and cost. Where a tool's Windows behavior differs meaningfully from its Linux behavior — Tailscale SSH's unsupported Windows target, Windows OpenSSH Server's default cmd.exe shell, Windows Server 2025's default-on OpenSSH — we verified the claim against the vendor's own documentation or an open GitHub issue rather than repeating a generic cross-platform description. Pricing and feature details are mid-2026 snapshots and change frequently; re-confirm before committing production infrastructure.

- Native fit: whether the protocol is Windows-native (WinRM, OpenSSH-for-Windows) or a general tool retrofitted to it
- Network exposure: whether any inbound port must be opened to reach the Windows machine
- AI interface: a working MCP/REST bridge available today versus one the reader has to assemble
- Setup effort and cost, verified against vendor documentation or primary GitHub sources rather than generic claims

## Sources

- [Microsoft Learn — Get started with OpenSSH Server for Windows](https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse)
- [Microsoft Learn — Run command on Azure Arc-enabled servers](https://learn.microsoft.com/en-us/azure/azure-arc/servers/run-command)
- [AWS — Systems Manager Run Command](https://aws.amazon.com/systems-manager/)
- [Tailscale GitHub — FR: Tailscale SSH server supported on Windows (#14942)](https://github.com/tailscale/tailscale/issues/14942)
- [Tailscale GitHub — FR: Tailscale SSH to Windows machines (#17261)](https://github.com/tailscale/tailscale/issues/17261)
- [win-mcp-server — WinRM MCP server for AI agents (GitHub)](https://github.com/InfraMCP/win-mcp-server)
- [windows-admin-mcp — Windows admin MCP server (GitHub)](https://github.com/Cosmicjedi/windows-admin-mcp)
- [AI Commander — product and security model](https://aicommander.dev)