10.4.0.0p1-Preview: SSH sessions no longer get the user's PATH (HKCU\Environment), only the machine PATH #2474

Activity

1. tgauth commented on Oct 21, 2026

   

   Tess Gauthier (tgauth)

   on Oct 21, 2026

   Last edited by tgauth

   Collaborator

   More actions

   Are you able to modify the setup to test the following and see what happens?

   1. Enable DEBUG3 logging in sshd_config, restart the service, and see if there is anything in logs regarding a LoadUserProfileW() failure.
   2. See if the issue persists in a non-interactive session, i.e. ssh user@host $env:Path
   3. See if the issue persists without PowerShell as the default shell

   edit: just read the "and as in an interactive logon" - can you clarify if this is only happening for non-interactive logins?
2. wasserja commented on Oct 22, 2026

   

   @wasserja (wasserja)

   on Oct 22, 2026

   Author

   More actions

   Thanks for looking at this. I ran all three on the same machine and account, A/B against 10.0.0.0p2-Preview with an in-place MSI upgrade between the two runs. Clarification first: by "as in an interactive logon" I meant a Windows console/RDP logon, not an interactive SSH session. It happens in every kind of SSH session.

   User PATH entries present in the session (10 expected):

   Session type	10.0, pwsh	10.0, cmd	10.4, pwsh	10.4, cmd
   Non-interactive, no pty (ssh user@host $env:Path / echo %PATH%)	10/10	10/10	0/10	0/10
   Non-interactive with pty (ssh -t user@host <cmd>)	10/10	10/10	0/10	0/10
   Interactive shell (ssh -tt user@host)	10/10	10/10	0/10	0/10

   The machine PATH is complete in every cell (16/16).

   1. DEBUG3: no LoadUserProfileW() message at all, from either version. No error-level lines in sshd-session.log during session setup, and nothing above Information in OpenSSH/Operational. None of the Failed to get the value for registry key ... errors that get_registry_key_value() (from Fix user environment block construction openssh-portable#813) would log appear either.
   2. Non-interactive: yes, same result (table above).
   3. Without PowerShell: yes, same result with DefaultShell set to C:\Windows\System32\cmd.exe.

   Other observations from inside the 10.4 sessions, in case they help narrow it down:

   • HKCU\Environment is readable, and every other variable defined there (TEMP, TMP, OneDrive, OneDriveConsumer, POSH_THEMES_PATH, POSH_INSTALLER, ChocolateyLastPathUpdate) is present with the user's values (TEMP is the per-user path). So the profile looks loaded and only PATH is affected.
   • The session PATH is exactly the HKLM Session Manager\Environment PATH, same entries in the same order. The user's Path value is REG_SZ.
   • It isn't picking up the SYSTEM hive either: HKU\S-1-5-18\Environment has its own Path value, and none of its entries appear.
   • The account also had an active RDP session at the time, so its profile hive was already loaded.

   10.4 DEBUG3 excerpt: ssh user@host "echo %PATH%" with cmd as DefaultShell (session start to spawn)

   09:38:37.875 user: <user>: Starting session: command for <user> from <client> port <n> id 0 [postauth]
   09:38:37.877 debug3: user: <user>: shell: "c:\\windows\\system32\\cmd.exe" [postauth]
   09:38:37.877 debug3: user: <user>: shell_option: /c [postauth]
   09:38:37.877 debug3: user: <user>: exec_command: echo %PATH% [postauth]
   09:38:37.877 debug3: user: <user>: arg escape option: TRUE [postauth]
   09:38:37.877 debug3: user: <user>: spawn_argv[0]: "c:\\windows\\system32\\cmd.exe" /c "echo %PATH%" [postauth]
   09:38:37.877 debug3: user: <user>: spawning "c:\\windows\\system32\\cmd.exe" /c "echo %PATH%" as subprocess [postauth]
   09:38:37.891 debug3: user: <user>: channel 0: classify type "session:command" (no TTY) as bulk [postauth]
   

   The 10.0 run of the same command logs the same sequence (apart from string escaping), with nothing about the profile or the environment in either.

   Environment: Windows 11 26H2 (26300.9711) x64; OpenSSH from the MSI (OpenSSH-Win64-v10.4.0.0.msi / OpenSSH-Win64-v10.0.0.0.msi); public key login as a local administrator (administrators_authorized_keys); default sshd_config plus SyslogFacility LOCAL0 and LogLevel DEBUG3 for this test. Happy to run anything else.
3. o-sdn-o commented on Oct 22, 2026

   

   Dmitry Sapozhnikov (o-sdn-o)

   on Oct 22, 2026 · Hidden as resolved

   Last edited by o-sdn-o

   show commentMore actions