Sample one-time startup script to perform base Windows configuration.

windows-setup.ps1

# Ensuring FW is disabled
Set-NetFirewallProfile -All -Enabled False

# Installing OpenSSH
Add-WindowsCapability -Online -Name 'OpenSSH.Server~~~~0.0.1.0'
Get-Service sshd | Set-Service -StartupType Automatic
Start-Service sshd

# Setting default SSH shell
while (-not (Get-Item -Path 'HKLM:\SOFTWARE\OpenSSH')){Start-Sleep -Seconds 5}
New-ItemProperty -Path 'HKLM:\SOFTWARE\OpenSSH' -Name DefaultShell -Value $((Get-Command powershell.exe).Source) -PropertyType String -Force
Get-Service sshd | Set-Service -StartupType Automatic

# Configuring authorized keys
New-Item 'C:\ProgramData\ssh\administrators_authorized_keys' -ItemType File -Value 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDF7+s+hAGIr2/KXOcbe6Qx8epl4xmyvaeKDiCDzeZJHZMeYuKf8KBmLTvvcSSC5T1LfzguEsEOCQo9ahm/qtxmTP2OFq/gRD0E160W0T6tPOREslaCgYwiwN3F4xReSdwR6HMn+uHYYtAFTx3PjSOk+DiNkFVRiShvkxXqxKNNO6JVFHHUFhlmWyqJ8gqcJEdPaFPRHYVKMYxRCEf5hoXltCDa83q7HVBzr7aYu2XYDhT/kn2oXQxM2itGNdfVD5ru2cIZI9AYcWQqrB8rk4Ci5307nO1Jc88IpXz0elpv4uVtKHwi5o1Bwq94AqRjoqVLir+lqC6IAFay8ziP6m3D [email protected]' 
$acl = Get-Acl C:\ProgramData\ssh\administrators_authorized_keys
$acl.SetAccessRuleProtection($true, $false)
$administratorsRule = New-Object system.security.accesscontrol.filesystemaccessrule('Administrators','FullControl','Allow')
$systemRule = New-Object system.security.accesscontrol.filesystemaccessrule('SYSTEM','FullControl','Allow')
$acl.SetAccessRule($administratorsRule)
$acl.SetAccessRule($systemRule)
$acl | Set-Acl
Restart-Service sshd