Fwiw he wouldn’t get a public key password denied type error if he wasn’t able to at least reach the target, to my knowledge.

Check your logs /var/log/auth.log. You can pipe grep it to search by IP or just try to connect then quickly check. That might give you more insight that isn’t being provided to the remote client (windows).