Installing Teleport on Windows

Report an issue with this page

Operating system support

Operating System	teleport Daemon	tctl Admin Tool	tsh and Teleport Connect User Clients [1]	Web UI (via the browser)	tbot Daemon
Windows 10+ (rev. 1607) [2]	no	yes	yes	yes	yes

[1] tsh is a Command Line Client (CLI) and Teleport Connect is a Graphical User Interface (GUI) desktop client. See Using Teleport Connect for usage and installation.

[2] Teleport server does not run on Windows yet, but tsh, tbot, tctl, and Teleport Connect (the Teleport desktop clients) support most features on Windows 10 and later.

For best results, Teleport clients (tsh, tctl, tbot) should be the same major version as the cluster they are connecting to. Teleport servers are compatible with clients that are on the same major version or one major version older. Teleport servers do not support clients that are on a newer major version. See our Upgrading guide for more information.

Installing Teleport CLI tooling

Most tsh features are supported for Windows 10 1607+. The tsh ssh command can be run under cmd.exe, PowerShell, and Windows Terminal.

To install tsh, tbot and tctl on Windows, run the following commands in PowerShell (these commands will not work in cmd.exe):

Teleport Enterprise (Managed)

Set the desired teleport version
$TELEPORT_VERSION="17.5.2"

Teleport Enterprise (Self-Hosted)

Set the desired teleport version
$TELEPORT_VERSION="17.5.4"

Teleport Community Edition

Set the desired teleport version
$TELEPORT_VERSION="17.5.4"

Set the TLS level to TLS 1.2 (required on Windows Server 2016 and lower)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Get the expected checksum for the Windows tsh package
$Resp = Invoke-WebRequest https://cdn.teleport.dev/teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip.sha256
PowerShell will return the binary representation of the response content
by default, so you need to convert it to a string
[System.Text.Encoding]::UTF8.getstring($Resp.Content)
<checksum> <filename>
Invoke-WebRequest -OutFile teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip -Uri https://cdn.teleport.dev/teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip
certUtil -hashfile teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip SHA256
SHA256 hash of teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip:
<checksum>
CertUtil: -hashfile command completed successfully.

After you have verified that the checksums match, you can extract the archive. The executables will be available at teleport-v$TELEPORT_VERSION-windows-amd64-bin\.

Expand-Archive teleport-v$TELEPORT_VERSION-windows-amd64-bin.zip
cd teleport-v$TELEPORT_VERSION-windows-amd64-bin
.\tsh.exe version
Teleport v$TELEPORT_VERSION git:v$TELEPORT_VERSION go1.23.10
.\tctl.exe version
Teleport v$TELEPORT_VERSION git:v$TELEPORT_VERSION go1.23.10
.\tbot.exe version
Teleport v$TELEPORT_VERSION git:v$TELEPORT_VERSION go1.23.10

Make sure to move tsh.exe, tbot.exe and tctl.exe into your PATH.

note

Do not place tsh.exe in the System32 directory, as this can cause issues when using WinSCP. You should use %SystemRoot% (e.g. C:\Windows) instead, which is already included in %PATH%.

If you do not have administrator rights on the Windows system you're using, you can use %USERPROFILE% (e.g. C:\Users\<username>) instead - but note that you will not be able to run tsh commands globally from the command line unless you are in the same directory as tsh.exe.