Correct answer:

The most close equivalent of chmod og-rwx server.key in Windows 10 is:

icacls server.key /reset
icacls server.key /inheritance:r /grant:r "CREATOR OWNER:F"

Note that the icacls command is also available in Windows Server 2003 SP2, Windows Vista and newer, but is not available in Windows XP.

The Linux command:

The chmod og-rwx server.key command mentioned in PostgreSQL documentation is using the symbolic mode of chmod:

According to the main page of chmod the format of symbolic mode is [ugoa...][[-+=][perms...]...].

In the command above letters og mean "Change access of all other users and groups except for the owner of the file".

The minus sign (-) after og is an operator and means "Remove the specified rights from the file".

So chmod og-rwx server.key effectively removes read, write and execute permissions (rwx) to the server.key file for all users except for the owner.

The Windows command:

The Windows command icacls server.key /reset removes explicitly set permissions on the file leaving only inherited permissions.

The command icacls server.key /inheritance:r /grant:r "CREATOR OWNER:F" gives full control only to the owner of the file and removes inherited permissions for all users/groups.

It accomplishes that with the:

• /inheritance:r option, which removes all permissions inherited from parent directories;
• /grant:r "CREATOR OWNER:F" option, which replaces explicit permissions for the owner with Full control (F stands for Full control).

Better explanations for these options can be found in the help of the icacls command:

PS> icacls /?
...
ICACLS name /reset [/T] [/C] [/L] [/Q]
    replaces ACLs with default inherited ACLs for all matching files.
...
/grant[:r] Sid:perm grants the specified user access rights. With :r,
    the permissions replace any previously granted explicit permissions.
    Without :r, the permissions are added to any previously granted
    explicit permissions.
...
/inheritance:e|d|r
    e - enables inheritance
    d - disables inheritance and copy the ACEs
    r - remove all inherited ACEs
...

Hint

Just for completeness you could achieve the same thing with the Windows GUI.

Proper permissions for a server.key file in Windows would look like that:

Before using this command, make sure that the owner of the file is set to the service account that is running the PostgreSQL server or the service won't be able to read the file.