By default, the PGP Encryption Server (Symantec Encryption Management Server) stores its system backups locally but allows you to upload backups using SCP to another host.
Clearly, it is far preferable to store backups on a different host. Both password and key based authentication is supported but key based authentication is considered more secure.
OpenSSH Client and Server is included in Windows 10, Windows 11, Windows Server 2019 and Windows Server 2022. OpenSSH server can be installed on Windows and the PGP Encryption Server can upload backups to it.
For more information about OpenSSH Server configuration please see this article from Microsoft.
New-ItemProperty -Path "HKLM:\SOFTWARE\OpenSSH" -Name DefaultShell -Value "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -PropertyType String -Force
icacls "C:\ProgramData\ssh\administrators_authorized_keys" /inheritance:r /grant "Administrators:F" /grant "SYSTEM:F"
Although PowerShell has a built-in alias for the bash ls command, it returns multi-column output whereas the Linux bash ls command only returns file names. This makes it incompatible with the PGP Encryption Server backup process. Therefore, the PowerShell ls alias needs to be modified. To do this, create a PowerShell profile that overrides the standard ls alias:
Function lsNameOnly {Get-ChildItem -Path $Args[0] -Name}
Set-Alias -Name ls -Value lsNameOnly -Option AllScope
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
If you do not wish to use a Windows account with local administrator permissions, you can use a standard user account (either a local or domain account):
If you do not wish to create keys for authentication, you can use SCP Password Authentication. Best practice is to use a standard user account (either a local or domain account) rather than a local admin account: