How do I create an AMI from a domain-joined EC2 Windows instance?

Short description

Make sure that you properly prepare to create an AMI from a domain-joined EC2 Windows  instance. If you don't, then you might get Remote Desktop Protocol (RDP) login failures, Active Directory authentication issues, and domain trust relationship errors. This can occur when you launch multiple instances from your AMI. Each instance keeps the same computer Security Identifier (SID) and hostname, and it causes conflicts in Active Directory.

To create a reusable AMI from a domain-joined instance, you must run System Preparation (Sysprep) to generalize the Windows installation before you create the AMI. Sysprep removes system-specific information and prepares the instance for deployment as a template. For more information, see Sysprep (System Preparation) Overview on the Microsoft website.

Resolution

Prerequisites: Before you create an AMI from a domain-joined instance, verify the following:

• Make sure that you have the local administrator's password for the instance. If domain authentication becomes unavailable, then you need this password to access the instance.
• Verify that your System Status Checks and Instance Status Checks pass in the Amazon EC2 console. This confirms that the underlying infrastructure correctly functions.
• Confirm that you have the correct AWS Identity and Access Management (IAM) permissions to create AMIs and launch EC2 instances.

Create an AMI from a domain-joined instance

Complete the following steps:

1. Create an AMI from the original domain-joined instance.
2. Create a test security group with no outbound rules and inbound rules that allow RDP access.
3. Use the newly created AMI to launch a new instance with your newly created security group.
4. Use the local administrator account to connect to your instance.
5. Run Sysprep with EC2Config or EC2Launch v1 or v2.
6. Create a new AMI that you can distribute.
   Note: When you launch an instance from a sysprepped AMI, the instance boots with a new hostname and computer identity.