# Disable OpenSSH on Windows servers

> Use OneFuse Scripting to uninstall OpenSSH from Windows servers via a bastion host

---

Site [llms.txt](/llms.txt)

---

Currently, SSH is the only supported connection method in OneFuse. Trying to uninstall OpenSSH while connected using it is problematic. This method uses WinRM to connect to the target server to uninstall OpenSSH.

This article assumes you have a bastion/jump server configured with OpenSSH, and that your Windows templates already have OpenSSH installed. This has only been tested on Windows 2016 and 2019, but may work on other versions of Windows with modification.

<div class="alert alert-warning" role="alert">


The code provided in this walkthrough is a sample only. It should be thoroughly reviewed and tested before use in your environment.
</div>


**Goal:** Provide a sample framework that can be modified based on environmental requirements.

## Create a Scripting Policy in OneFuse

1. In the [OneFuse Scripting Module](/docs/onefuse/configure/modules/scripting/), paste the following into the **Launch Command** field:

   ```powershell
   powershell -ExecutionPolicy Bypass -File {{ scriptName }}
   ```

2. Paste the following script into the **Script Template** field.

   This uses basic PowerShell Remoting to the target server (assumes passthrough authorization).

   ```powershell
   Invoke-Command -ComputerName {{OneFuse_VmNic0.hostname}} -ScriptBlock {
       # Initial Variables
       $OSVersion = (Get-WmiObject -class Win32_OperatingSystem).Caption
       # Logging
       $Log = "C:\SovLabs\Uninstall.txt"
       if ($OSVersion -match 2019) {
           Remove-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
           # Rebooting Server
           shutdown /r /f /t 60
       } else {
           Start-Process powershell -ArgumentList "C:\OpenSSH\OpenSSH-Win64\uninstall-sshd.ps1" -Wait -Verbose -RedirectStandardOutput $Log
           $Service = Get-Service -Name sshd -ErrorAction SilentlyContinue
           if ($Service) {
               throw "Failed to uninstall SSH"
           }
           # Checking if Firewall exists
           $FirewallRule = Get-NetFirewallRule -Name sshd -ErrorAction SilentlyContinue
           if ($FirewallRule) {Remove-NetFirewallRule -Name sshd -ErrorAction SilentlyContinue}
           # Removing Directory
           $OpenSSHDir = Get-Item -Path "C:\OpenSSH" -ErrorAction SilentlyContinue
           if ($OpenSSHDir) {Remove-Item "C:\OpenSSH" -Recurse -Force -ErrorAction SilentlyContinue}
       }
   }
   ```

## Add Scripting Policy to vRealize Automation Blueprint

1. Go to your vRealize Automation instance.
2. Open the blueprint you use for Scripting.
3. Add the `OneFuse_ScriptingPolicy_ComputeProvisionPostLate_001OpenSSHUninstall` property to your blueprint with the value `'OneFuse:SSHUninstall'`.
4. Once the property is added, you are ready to test the SSH uninstall. For more information, see the links in the [Resources](#resources) section.

## Resources

- [Microsoft Docs: Enable-PSRemoting](https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enable-psremoting?view=powershell-7.1)
- [OneFuse Scripting for vRealize Automation 7](/docs/onefuse/consume/vmware-aria-automation/vrealize-automation-76/modules/scripting/)
- [OneFuse Scripting for Aria Automation 8](/docs/onefuse/consume/vmware-aria-automation/aria-automation-8x/modules/scripting/)
- [OneFuse Scripting for Terraform](/docs/onefuse/consume/hashicorp-terraform/modules/scripting/)