diff --git a/README.md b/README.md
index 56cace4..e9ae16f 100644
--- a/README.md
+++ b/README.md
@@ -271,6 +271,31 @@ In vSphere configure the following Inventory Objects permissions:
 For more information see the [vSphere Virtual Machine Administration/Required Privileges for Common Tasks document](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.vm_admin.doc/GUID-4D0F8E63-2961-4B71-B365-BBFA24673FDB.html) in the [vSphere Virtual Machine Administration manual](https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.vm_admin.doc/GUID-55238059-912E-411F-A0E9-A7A536972A91.html).
 
 
+## SSH access
+
+You can connect to this machine through SSH to run a remote command, e.g.:
+
+```batch
+ssh -p 2222 vagrant@localhost "whoami /all"
+```
+
+**NB** the exact SSH address and port can be obtained with `vagrant ssh-config`.
+
+**NB** we cannot use the vagrant SMB shared folder type when using the `winssh`
+communicator; it will fail to mount the shared folder with the error:
+
+  ```
+  cmdkey /add:192.168.1.xxx /user:xxx /pass:"*****"
+  CMDKEY: Credentials cannot be saved from this logon session.
+  ```
+
+**NB** this is a [Windows design restriction](https://github.com/PowerShell/Win32-OpenSSH/issues/996#issuecomment-610635377)
+that prevents remote network logon sessions from accessing certain parts of the
+system.
+
+**NB** this is why the default vagrant box communicator is `winrm`.
+
+
 ## WinRM access
 
 You can connect to this machine through WinRM to run a remote command, e.g.:
diff --git a/windows-10-1809-vsphere.pkr.hcl b/windows-10-1809-vsphere.pkr.hcl
index 616e428..5c5c726 100644
--- a/windows-10-1809-vsphere.pkr.hcl
+++ b/windows-10-1809-vsphere.pkr.hcl
@@ -50,7 +50,6 @@ variable "vsphere_network" {
 }
 
 source "vsphere-iso" "windows-10-1809-amd64" {
-  communicator  = "winrm"
   CPUs          = 4
   RAM           = 4096
   guest_os_type = "windows9_64Guest"
@@ -58,6 +57,7 @@ source "vsphere-iso" "windows-10-1809-amd64" {
     "tmp/windows-10-1809-vsphere/autounattend.xml",
     "vmtools.ps1",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   iso_paths = [
     "[${var.vsphere_datastore}] iso/windows-10-1809-17763.107.101029-1455.rs5_release_svc_refresh_CLIENT_LTSC_EVAL_x64FRE_en-us.iso",
@@ -84,9 +84,10 @@ source "vsphere-iso" "windows-10-1809-amd64" {
   folder              = var.vsphere_folder
   vm_name             = "windows-10-1809-amd64-vsphere"
   shutdown_command    = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  winrm_password      = "vagrant"
-  winrm_username      = "vagrant"
-  winrm_timeout       = "4h"
+  communicator        = "ssh"
+  ssh_password        = "vagrant"
+  ssh_username        = "vagrant"
+  ssh_timeout         = "4h"
 }
 
 build {
@@ -118,13 +119,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-10-1809.pkr.hcl b/windows-10-1809.pkr.hcl
index 0d3fd48..7db0408 100644
--- a/windows-10-1809.pkr.hcl
+++ b/windows-10-1809.pkr.hcl
@@ -49,6 +49,7 @@ source "qemu" "windows-10-1809-amd64" {
   floppy_files = [
     "windows-10/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/vioserial/w10/amd64/*.cat",
     "drivers/vioserial/w10/amd64/*.inf",
     "drivers/vioserial/w10/amd64/*.sys",
@@ -68,10 +69,10 @@ source "qemu" "windows-10-1809-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-10-1809-amd64" {
@@ -81,6 +82,7 @@ source "virtualbox-iso" "windows-10-1809-amd64" {
   floppy_files = [
     "windows-10/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -105,10 +107,10 @@ source "virtualbox-iso" "windows-10-1809-amd64" {
     ["modifyvm", "{{ .Name }}", "--nictype3", "82540EM"],
     ["modifyvm", "{{ .Name }}", "--nictype4", "82540EM"],
   ]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator = "ssh"
+  ssh_username = "vagrant"
+  ssh_password = "vagrant"
+  ssh_timeout  = "4h"
 }
 
 source "hyperv-iso" "windows-10-1809-amd64" {
@@ -121,6 +123,7 @@ source "hyperv-iso" "windows-10-1809-amd64" {
   cd_files = [
     "windows-10-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   disk_size         = var.disk_size
   first_boot_device = "DVD"
@@ -131,10 +134,10 @@ source "hyperv-iso" "windows-10-1809-amd64" {
   temp_path         = "tmp"
   vlan_id           = var.hyperv_vlan_id
   shutdown_command  = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator      = "winrm"
-  winrm_username    = "vagrant"
-  winrm_password    = "vagrant"
-  winrm_timeout     = "4h"
+  communicator      = "ssh"
+  ssh_username      = "vagrant"
+  ssh_password      = "vagrant"
+  ssh_timeout       = "4h"
 }
 
 build {
@@ -185,13 +188,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-10-20h2.pkr.hcl b/windows-10-20h2.pkr.hcl
index dd015a4..b04e444 100644
--- a/windows-10-20h2.pkr.hcl
+++ b/windows-10-20h2.pkr.hcl
@@ -49,6 +49,7 @@ source "qemu" "windows-10-20h2-amd64" {
   floppy_files = [
     "windows-10/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/vioserial/w10/amd64/*.cat",
     "drivers/vioserial/w10/amd64/*.inf",
     "drivers/vioserial/w10/amd64/*.sys",
@@ -68,10 +69,10 @@ source "qemu" "windows-10-20h2-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-10-20h2-amd64" {
@@ -81,6 +82,7 @@ source "virtualbox-iso" "windows-10-20h2-amd64" {
   floppy_files = [
     "windows-10/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -105,10 +107,10 @@ source "virtualbox-iso" "windows-10-20h2-amd64" {
     ["modifyvm", "{{ .Name }}", "--nictype3", "82540EM"],
     ["modifyvm", "{{ .Name }}", "--nictype4", "82540EM"],
   ]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator = "ssh"
+  ssh_username = "vagrant"
+  ssh_password = "vagrant"
+  ssh_timeout  = "4h"
 }
 
 source "hyperv-iso" "windows-10-20h2-amd64" {
@@ -121,6 +123,7 @@ source "hyperv-iso" "windows-10-20h2-amd64" {
   cd_files = [
     "windows-10-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   disk_size         = var.disk_size
   first_boot_device = "DVD"
@@ -131,10 +134,10 @@ source "hyperv-iso" "windows-10-20h2-amd64" {
   temp_path         = "tmp"
   vlan_id           = var.hyperv_vlan_id
   shutdown_command  = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator      = "winrm"
-  winrm_username    = "vagrant"
-  winrm_password    = "vagrant"
-  winrm_timeout     = "4h"
+  communicator      = "ssh"
+  ssh_username      = "vagrant"
+  ssh_password      = "vagrant"
+  ssh_timeout       = "4h"
 }
 
 build {
@@ -189,13 +192,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-10-uefi/autounattend.xml b/windows-10-uefi/autounattend.xml
index 2bf083d..61ea407 100644
--- a/windows-10-uefi/autounattend.xml
+++ b/windows-10-uefi/autounattend.xml
@@ -149,6 +149,10 @@
                     <Order>4</Order>
                     <CommandLine>PowerShell "Get-PSDRive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root winrm.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>5</Order>
+                    <CommandLine>PowerShell "Get-PSDRive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-openssh.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-10/autounattend.xml b/windows-10/autounattend.xml
index ba602df..75e291a 100755
--- a/windows-10/autounattend.xml
+++ b/windows-10/autounattend.xml
@@ -130,6 +130,10 @@
                     <Order>4</Order>
                     <CommandLine>PowerShell -File a:\winrm.ps1</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>5</Order>
+                    <CommandLine>PowerShell -File a:\provision-openssh.ps1</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2012-r2-uefi/autounattend.xml b/windows-2012-r2-uefi/autounattend.xml
index 8db0533..d0dd7ee 100644
--- a/windows-2012-r2-uefi/autounattend.xml
+++ b/windows-2012-r2-uefi/autounattend.xml
@@ -137,6 +137,10 @@
                     <Order>3</Order>
                     <CommandLine>PowerShell "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root winrm.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>4</Order>
+                    <CommandLine>PowerShell "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-openssh.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2012-r2.pkr.hcl b/windows-2012-r2.pkr.hcl
index d617dbb..20596cb 100644
--- a/windows-2012-r2.pkr.hcl
+++ b/windows-2012-r2.pkr.hcl
@@ -49,6 +49,7 @@ source "qemu" "windows-2012-r2-amd64" {
   floppy_files = [
     "windows-2012-r2/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/viostor/2k12R2/amd64/*.cat",
     "drivers/viostor/2k12R2/amd64/*.inf",
     "drivers/viostor/2k12R2/amd64/*.sys",
@@ -65,10 +66,10 @@ source "qemu" "windows-2012-r2-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-2012-r2-amd64" {
@@ -78,6 +79,7 @@ source "virtualbox-iso" "windows-2012-r2-amd64" {
   floppy_files = [
     "windows-2012-r2/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -102,10 +104,10 @@ source "virtualbox-iso" "windows-2012-r2-amd64" {
     ["modifyvm", "{{ .Name }}", "--nictype3", "82540EM"],
     ["modifyvm", "{{ .Name }}", "--nictype4", "82540EM"],
   ]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator = "ssh"
+  ssh_username = "vagrant"
+  ssh_password = "vagrant"
+  ssh_timeout  = "4h"
 }
 
 source "hyperv-iso" "windows-2012-r2-amd64" {
@@ -118,6 +120,7 @@ source "hyperv-iso" "windows-2012-r2-amd64" {
   cd_files = [
     "windows-2012-r2-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   disk_size         = var.disk_size
   first_boot_device = "DVD"
@@ -128,10 +131,10 @@ source "hyperv-iso" "windows-2012-r2-amd64" {
   temp_path         = "tmp"
   vlan_id           = var.hyperv_vlan_id
   shutdown_command  = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator      = "winrm"
-  winrm_username    = "vagrant"
-  winrm_password    = "vagrant"
-  winrm_timeout     = "4h"
+  communicator      = "ssh"
+  ssh_username      = "vagrant"
+  ssh_password      = "vagrant"
+  ssh_timeout       = "4h"
 }
 
 build {
@@ -188,13 +191,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2012-r2/autounattend.xml b/windows-2012-r2/autounattend.xml
index 6264a45..ace8f8e 100644
--- a/windows-2012-r2/autounattend.xml
+++ b/windows-2012-r2/autounattend.xml
@@ -118,6 +118,10 @@
                     <Order>3</Order>
                     <CommandLine>PowerShell -File a:\winrm.ps1</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>4</Order>
+                    <CommandLine>PowerShell -File a:\provision-openssh.ps1</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2016-uefi/autounattend.xml b/windows-2016-uefi/autounattend.xml
index bffe82e..f41ebae 100644
--- a/windows-2016-uefi/autounattend.xml
+++ b/windows-2016-uefi/autounattend.xml
@@ -141,6 +141,10 @@
                     <Order>4</Order>
                     <CommandLine>PowerShell "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root winrm.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>5</Order>
+                    <CommandLine>PowerShell "Get-PSDrive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-openssh.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2016-vsphere.pkr.hcl b/windows-2016-vsphere.pkr.hcl
index 39f763d..8251b35 100644
--- a/windows-2016-vsphere.pkr.hcl
+++ b/windows-2016-vsphere.pkr.hcl
@@ -50,7 +50,6 @@ variable "vsphere_network" {
 }
 
 source "vsphere-iso" "windows-2016-amd64" {
-  communicator  = "winrm"
   CPUs          = 2
   RAM           = 6144
   guest_os_type = "windows9Server64Guest"
@@ -58,6 +57,7 @@ source "vsphere-iso" "windows-2016-amd64" {
     "tmp/windows-2016-vsphere/autounattend.xml",
     "vmtools.ps1",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   iso_paths = [
     "[${var.vsphere_datastore}] iso/windows-2016-Windows_Server_2016_Datacenter_EVAL_en-us_14393_refresh.ISO",
@@ -84,9 +84,10 @@ source "vsphere-iso" "windows-2016-amd64" {
   folder              = var.vsphere_folder
   vm_name             = "windows-2016-amd64-vsphere"
   shutdown_command    = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  winrm_password      = "vagrant"
-  winrm_username      = "vagrant"
-  winrm_timeout       = "4h"
+  communicator        = "ssh"
+  ssh_password        = "vagrant"
+  ssh_username        = "vagrant"
+  ssh_timeout         = "4h"
 }
 
 build {
@@ -124,13 +125,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2016.pkr.hcl b/windows-2016.pkr.hcl
index eb50ede..c07e609 100644
--- a/windows-2016.pkr.hcl
+++ b/windows-2016.pkr.hcl
@@ -49,6 +49,7 @@ source "qemu" "windows-2016-amd64" {
   floppy_files = [
     "windows-2016/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/vioserial/2k16/amd64/*.cat",
     "drivers/vioserial/2k16/amd64/*.inf",
     "drivers/vioserial/2k16/amd64/*.sys",
@@ -68,10 +69,10 @@ source "qemu" "windows-2016-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-2016-amd64" {
@@ -81,6 +82,7 @@ source "virtualbox-iso" "windows-2016-amd64" {
   floppy_files = [
     "windows-2016/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -105,10 +107,10 @@ source "virtualbox-iso" "windows-2016-amd64" {
     ["modifyvm", "{{ .Name }}", "--nictype3", "82540EM"],
     ["modifyvm", "{{ .Name }}", "--nictype4", "82540EM"],
   ]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator = "ssh"
+  ssh_username = "vagrant"
+  ssh_password = "vagrant"
+  ssh_timeout  = "4h"
 }
 
 source "hyperv-iso" "windows-2016-amd64" {
@@ -121,6 +123,7 @@ source "hyperv-iso" "windows-2016-amd64" {
   cd_files = [
     "windows-2016-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   disk_size         = var.disk_size
   first_boot_device = "DVD"
@@ -131,10 +134,10 @@ source "hyperv-iso" "windows-2016-amd64" {
   temp_path         = "tmp"
   vlan_id           = var.hyperv_vlan_id
   shutdown_command  = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator      = "winrm"
-  winrm_username    = "vagrant"
-  winrm_password    = "vagrant"
-  winrm_timeout     = "4h"
+  communicator      = "ssh"
+  ssh_username      = "vagrant"
+  ssh_password      = "vagrant"
+  ssh_timeout       = "4h"
 }
 
 build {
@@ -191,13 +194,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2016/autounattend.xml b/windows-2016/autounattend.xml
index 58cffa6..dda813c 100644
--- a/windows-2016/autounattend.xml
+++ b/windows-2016/autounattend.xml
@@ -122,6 +122,10 @@
                     <Order>4</Order>
                     <CommandLine>PowerShell -File a:\winrm.ps1</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>5</Order>
+                    <CommandLine>PowerShell -File a:\provision-openssh.ps1</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2019-uefi.pkr.hcl b/windows-2019-uefi.pkr.hcl
index 3eab315..e5067f2 100644
--- a/windows-2019-uefi.pkr.hcl
+++ b/windows-2019-uefi.pkr.hcl
@@ -42,6 +42,7 @@ source "qemu" "windows-2019-uefi-amd64" {
   floppy_files = [
     "windows-2019-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/vioserial/2k19/amd64/*.cat",
     "drivers/vioserial/2k19/amd64/*.inf",
     "drivers/vioserial/2k19/amd64/*.sys",
@@ -61,10 +62,10 @@ source "qemu" "windows-2019-uefi-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-2019-uefi-amd64" {
@@ -74,6 +75,7 @@ source "virtualbox-iso" "windows-2019-uefi-amd64" {
   cd_files = [
     "windows-2019-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -101,10 +103,10 @@ source "virtualbox-iso" "windows-2019-uefi-amd64" {
   ]
   boot_wait      = "3s"
   boot_command   = ["<up><wait><up><wait><up><wait><up><wait><up><wait><up><wait><up><wait><up><wait><up><wait><up><wait>"]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator   = "ssh"
+  ssh_username   = "vagrant"
+  ssh_password   = "vagrant"
+  ssh_timeout    = "4h"
 }
 
 build {
@@ -145,13 +147,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2019-uefi/autounattend.xml b/windows-2019-uefi/autounattend.xml
index d06f252..b8a13a0 100644
--- a/windows-2019-uefi/autounattend.xml
+++ b/windows-2019-uefi/autounattend.xml
@@ -138,6 +138,10 @@
                     <Order>3</Order>
                     <CommandLine>PowerShell "Get-PSDRive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root winrm.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>4</Order>
+                    <CommandLine>PowerShell "Get-PSDRive -PSProvider FileSystem | ForEach-Object {$p = Join-Path $_.Root provision-openssh.ps1; if (Test-Path $p) {&amp;$p}}"</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>
diff --git a/windows-2019-vsphere.pkr.hcl b/windows-2019-vsphere.pkr.hcl
index bece91e..bb0e60d 100644
--- a/windows-2019-vsphere.pkr.hcl
+++ b/windows-2019-vsphere.pkr.hcl
@@ -50,7 +50,6 @@ variable "vsphere_network" {
 }
 
 source "vsphere-iso" "windows-2019-amd64" {
-  communicator  = "winrm"
   CPUs          = 4
   RAM           = 4096
   guest_os_type = "windows9Server64Guest"
@@ -58,6 +57,7 @@ source "vsphere-iso" "windows-2019-amd64" {
     "tmp/windows-2019-vsphere/autounattend.xml",
     "vmtools.ps1",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   iso_paths = [
     "[${var.vsphere_datastore}] iso/windows-2019-17763.737.190906-2324.rs5_release_svc_refresh_SERVER_EVAL_x64FRE_en-us_1.iso",
@@ -84,9 +84,10 @@ source "vsphere-iso" "windows-2019-amd64" {
   folder              = var.vsphere_folder
   vm_name             = "windows-2019-amd64-vsphere"
   shutdown_command    = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  winrm_password      = "vagrant"
-  winrm_username      = "vagrant"
-  winrm_timeout       = "4h"
+  communicator        = "ssh"
+  ssh_password        = "vagrant"
+  ssh_username        = "vagrant"
+  ssh_timeout         = "4h"
 }
 
 build {
@@ -114,13 +115,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2019.pkr.hcl b/windows-2019.pkr.hcl
index 2eb3cf3..7aa46ab 100644
--- a/windows-2019.pkr.hcl
+++ b/windows-2019.pkr.hcl
@@ -49,6 +49,7 @@ source "qemu" "windows-2019-amd64" {
   floppy_files = [
     "windows-2019/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
     "drivers/vioserial/2k19/amd64/*.cat",
     "drivers/vioserial/2k19/amd64/*.inf",
     "drivers/vioserial/2k19/amd64/*.sys",
@@ -68,10 +69,10 @@ source "qemu" "windows-2019-amd64" {
   iso_url          = var.iso_url
   iso_checksum     = var.iso_checksum
   shutdown_command = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator     = "winrm"
-  winrm_username   = "vagrant"
-  winrm_password   = "vagrant"
-  winrm_timeout    = "4h"
+  communicator     = "ssh"
+  ssh_username     = "vagrant"
+  ssh_password     = "vagrant"
+  ssh_timeout      = "4h"
 }
 
 source "virtualbox-iso" "windows-2019-amd64" {
@@ -81,6 +82,7 @@ source "virtualbox-iso" "windows-2019-amd64" {
   floppy_files = [
     "windows-2019/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   guest_additions_interface = "sata"
   guest_additions_mode      = "attach"
@@ -105,10 +107,10 @@ source "virtualbox-iso" "windows-2019-amd64" {
     ["modifyvm", "{{ .Name }}", "--nictype3", "82540EM"],
     ["modifyvm", "{{ .Name }}", "--nictype4", "82540EM"],
   ]
-  communicator   = "winrm"
-  winrm_username = "vagrant"
-  winrm_password = "vagrant"
-  winrm_timeout  = "4h"
+  communicator = "ssh"
+  ssh_username = "vagrant"
+  ssh_password = "vagrant"
+  ssh_timeout  = "4h"
 }
 
 source "hyperv-iso" "windows-2019-amd64" {
@@ -121,6 +123,7 @@ source "hyperv-iso" "windows-2019-amd64" {
   cd_files = [
     "windows-2019-uefi/autounattend.xml",
     "winrm.ps1",
+    "provision-openssh.ps1",
   ]
   disk_size         = var.disk_size
   first_boot_device = "DVD"
@@ -131,10 +134,10 @@ source "hyperv-iso" "windows-2019-amd64" {
   temp_path         = "tmp"
   vlan_id           = var.hyperv_vlan_id
   shutdown_command  = "shutdown /s /t 0 /f /d p:4:1 /c \"Packer Shutdown\""
-  communicator      = "winrm"
-  winrm_username    = "vagrant"
-  winrm_password    = "vagrant"
-  winrm_timeout     = "4h"
+  communicator      = "ssh"
+  ssh_username      = "vagrant"
+  ssh_password      = "vagrant"
+  ssh_timeout       = "4h"
 }
 
 build {
@@ -176,13 +179,6 @@ build {
     script = "enable-remote-desktop.ps1"
   }
 
-  provisioner "powershell" {
-    script = "provision-openssh.ps1"
-  }
-
-  provisioner "windows-restart" {
-  }
-
   provisioner "powershell" {
     script = "provision-cloudbase-init.ps1"
   }
diff --git a/windows-2019/autounattend.xml b/windows-2019/autounattend.xml
index 1e03107..08e6e4c 100644
--- a/windows-2019/autounattend.xml
+++ b/windows-2019/autounattend.xml
@@ -123,6 +123,10 @@
                     <Order>4</Order>
                     <CommandLine>PowerShell -File a:\winrm.ps1</CommandLine>
                 </SynchronousCommand>
+                <SynchronousCommand wcm:action="add">
+                    <Order>5</Order>
+                    <CommandLine>PowerShell -File a:\provision-openssh.ps1</CommandLine>
+                </SynchronousCommand>
             </FirstLogonCommands>
         </component>
     </settings>