Why can't I connect to my Amazon EC2 Windows instance that was launched from a custom AMI?

Short description

The default Administrator account password for EC2 Windows instances launched from a public Amazon Machine Image (AMI) is automatically generated by one of the following:

• EC2Launch service - Windows Server 2016 and after
• EC2Config service - Windows Server 2012 R2 and before

It's a best practice to change the Administrator password from its default value to your own password.

Instances launched from custom AMIs take the Administrator password from the source instance. If the default password for the Administrator account was changed in the source instance used to create the AMI, then the new instance takes the same password. Decrypting the password using a key pair file isn't possible, unless you configure EC2Launch or EC2Config to generate a new password on the next instance boot.

Resolution

For information on resetting the Administrator password on instances with lost or expired passwords, see How can I reset the administrator password on an EC2 Windows instance?

Resetting the password allows you to recover access to the new instance. However, you get the same error when you launch any other instance from that custom AMI. To avoid this issue, configure the initialization tasks from EC2Launch or EC2Config to enable auto-generated passwords.

Important:

This procedure requires a stop and start of the instance. Be aware of the following:

• If your instance is instance store-backed or has instance store volumes containing data, then the data is lost when the instance is stopped. For more information, see Determine the root device type of your instance.
• If your instance is part of an Amazon EC2 Auto Scaling group, then stopping the instance might terminate it. Instances launched with Amazon EMR, AWS CloudFormation, and AWS Elastic Beanstalk might be part of an AWS Auto Scaling group. Instance termination in this scenario depends on the instance scale-in protection settings for your Auto Scaling group. If your instance is part of an Auto Scaling group, temporarily remove it from the Auto Scaling group before starting the resolution steps.
• Stopping and starting the instance changes the public IP address of your instance. It's a best practice to use an Elastic IP address instead of a public IP address when routing external traffic to your instance.

For more information, see Overview: Stop and start your instance.

1. Open the Amazon EC2 console, and then connect to the original Windows EC2 instance using Remote Desktop Protocol (RDP).
2. From the Windows Start menu, do the following:
   For Windows Server 2008 through Windows Server 2012 R2, open EC2ConfigService Settings, and then choose the Image tab.
   For Windows Server 2016 or later, open EC2 Launch Settings.
3. For Administrator Password, choose Random.
4. Select Shutdown without Sysprep *.
5. Select Yes.
6. Open the Amazon EC2 console, and then select Instances.
7. Wait until the instance state changes to Stopped, and then choose your instance.
8. Select Actions, Image, Create image.
   For Image name, enter a name.
   (Optional) For Image description, enter a description.
9. Choose Create image.

All EC2 instances launched from this new AMI decrypts the password using a key pair.

Note: Shutting down with Sysprep standardizes your AMI by removing unique information, such as instance security identifiers (SID), computer name, and drivers. This allows you to launch multiple copies of your instances. For more information, see How can I use Sysprep to create and install custom reusable Windows AMIs in Amazon EC2?

Related information

Troubleshooting EC2 Windows instances: “Password is not available”

Configure initialization tasks (EC2Launch)