diff --git a/enterprise/troubleshooting.mdx b/enterprise/troubleshooting.mdx
index ed46e227..c34d8310 100644
--- a/enterprise/troubleshooting.mdx
+++ b/enterprise/troubleshooting.mdx
@@ -212,3 +212,44 @@ short investigation:
     Send VM installation logs to your own observability platform.
   </Card>
 </CardGroup>
+
+### SSH port forwarding fails on Windows with "bind: Permission denied"
+
+When you access the UI on a remote host, the browser connects to the sandbox on a
+randomly assigned high port, so that port has to be forwarded as well:
+
+```bash
+ssh -N -L 3100:127.0.0.1:3100 -L 41549:127.0.0.1:41549 user@host
+```
+
+On Windows this can fail with:
+
+```
+bind [127.0.0.1]:41549: Permission denied
+channel_setup_fwd_listener_tcpip: cannot listen to port: 41549
+```
+
+WinNAT, Hyper-V and WSL dynamically reserve blocks of ports inside the same
+32768–60999 range Docker allocates from, and no process can bind inside them.
+The port looks free but cannot be used.
+
+To list the reserved ranges, in an Administrator PowerShell:
+
+```powershell
+netsh interface ipv4 show excludedportrange protocol=tcp
+```
+
+Dynamic reservations do not always appear in this table, so a port outside every
+listed range can still be blocked.
+
+To release them, in an Administrator PowerShell:
+
+```powershell
+net stop winnat
+```
+
+Start the SSH tunnel, then restore normal networking:
+
+```powershell
+net start winnat
+```