A file server without logs is a rumour. The good news: the Windows OpenSSH Server already records every connection attempt and login in Event Viewer. This page shows where those records live and how to turn them into a five-minute weekly habit.
SFTP accounts are only accountable if somebody can answer the question: who connected, when, from which address - and did they get in? Windows OpenSSH writes its events to a dedicated channel in Event Viewer. You do not need extra software for the basics. What you need is to know the channel's name, recognise a successful login among the noise of failed ones, and glance at it on a schedule instead of only after an incident.
Open Event Viewer (eventvwr.msc), expand Applications and Services Logs, then OpenSSH, and open Operational. Each connection produces a small run of events: the connection arriving from an IP address, the authentication attempt, and - the line you care about - an Accepted entry naming the user, the source IP and whether a password or a key was used. Failed attempts appear as failures with the username that was tried, which on an internet-facing server will include many names that are not yours.
If you need to know which key signed in, raise the detail level. In C:\ProgramData\ssh\sshd_config set LogLevel VERBOSE and restart the service with Restart-Service sshd. Verbose events include the key fingerprint for key logins, tying a session to one person's exact key. Be honest about the limit, though: OpenSSH logs connections and logins well, but a detailed record of every file each user moved is limited - for strict file-level auditing, add NTFS auditing on the data folders as a second layer.
Logs only protect you if they are read while they are fresh. Put five minutes in the weekly routine next to the disk-space check: filter the Operational log for the last seven days, scan the Accepted lines, and confirm each one. Save a filtered copy monthly if your office keeps records. The day something genuinely goes wrong, this habit is the difference between answering questions in minutes and guessing for a week.
See the complete SFTP server setup on screen, step by step, in the Technical Anshu video.
Watch Full VideoIn Event Viewer under Applications and Services Logs, in the OpenSSH channel - Operational for connections and authentication events, Admin for service-level problems. There is no plain text log file by default.
Not in useful detail by default. The log proves who connected, from where, when and how they authenticated. For per-file records, enable NTFS auditing on the SFTP folders as an additional Windows layer.
That is the standard signature of port 22 being reachable from the internet - automated bots trying common names. With key-only login and jailed non-admin accounts it is noise. With password login still enabled, treat it as your prompt to finish the hardening steps.