Windows Server 2025 Full Base AMI: Sysprep fails on fresh instance with ProvPackageSysprepGeneralize 0x80070002, while Core succeeds

Hello, I am trying to build reusable Windows Server 2025 Golden AMIs for an Amazon EC2 Remote Desktop Services environment. My intended workflow is the standard AWS imaging workflow: AWS Windows Server Base AMI → install Windows/RDS roles → reboot and validate → run EC2Launch v2 Sysprep → wait for instance shutdown → create custom AMI

I am following the AWS-documented Sysprep procedure for Windows Server 2025 using EC2Launch v2. The command used is:

& "$env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" sysprep --shutdown=true

EC2Launch then invokes: C:\Windows\System32\Sysprep\Sysprep.exe /oobe /shutdown /generalize /unattend:C:\ProgramData\Amazon\EC2Launch\sysprep\unattend.xml

The problem is reproducible on a completely fresh Windows Server 2025 Full Base EC2 instance, before installing any RDS role, before joining Active Directory, and before applying any custom configuration. Failing image AMI Origin Name: Windows_Server-2025-English-Full-Base AMI Origin Version: 2026.09.17 EC2Launch: 2.5.2 Windows Server 2025 Datacenter Windows build: 26100 Architecture: 64-bit

Before running Sysprep, I verified that the machine had no pending reboot:

@{
    CBS = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\RebootPending"
    WindowsUpdate = Test-Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\RebootRequired"
    PendingFileRename = $null -ne (
        Get-ItemProperty `
          "HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager" `
          -Name PendingFileRenameOperations `
          -ErrorAction SilentlyContinue
    )
}

Sysprep starts normally and successfully processes many generalize providers, including AppX, PnP, WinRE, networking, RDP-related providers, etc. The failure always occurs at: SYSPRP ActionPlatform::LaunchModule: Executing method 'ProvPackageSysprepGeneralize' from C:\Windows\System32\ProvSysprep.dll SYSPRP Failed to remove package (null) with hr = 0x80070002 SYSPRP ActionPlatform::LaunchModule: Failure occurred while executing 'ProvPackageSysprepGeneralize' from C:\Windows\System32\ProvSysprep.dll; dwRet = 0x2 SYSPRP SysprepSession::ExecuteAction: Failed during sysprepModule operation; dwRet = 0x2 SYSPRP SysprepSession::ExecuteInternal: Error in executing action for Microsoft-Windows-Provisioning-Sysprep; dwRet = 0x2 SYSPRP SysprepSession::Execute: Error in executing actions from C:\Windows\System32\Sysprep\ActionFiles\Generalize.xml; dwRet = 0x2 SYSPRP RunPlatformActions:Failed while executing Sysprep session actions; dwRet = 0x2 SYSPRP RunDlls:An error occurred while running registry sysprep DLLs, halting sysprep execution. dwRet = 0x2 SYSPRP WinMain:Hit failure while processing sysprep generalize internal providers; hr = 0x80070002

On one of the failed runs, the log immediately before the failure showed: SYSPRP ActionPlatform::LaunchModule: Successfully executed 'WinRE_Generalize' SYSPRP ActionPlatform::LaunchModule: Executing method 'UtcSysprepGeneralize' SYSPRP ActionPlatform::LaunchModule: Successfully executed 'UtcSysprepGeneralize' SYSPRP ActionPlatform::LaunchModule: Executing method 'ClipCleanUpState' SYSPRP ActionPlatform::LaunchModule: Successfully executed 'ClipCleanUpState' SYSPRP ActionPlatform::LaunchModule: Executing method 'ProvPackageSysprepGeneralize' SYSPRP Failed to remove package (null) with hr = 0x80070002

The AppX generalization phase itself completes successfully before this failure. The failure is specifically in: Microsoft-Windows-Provisioning-Sysprep ProvSysprep.dll ProvPackageSysprepGeneralize

After the failed generalize operation, Windows reports:

Get-ItemProperty `
  "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" |
  Select-Object ImageState

Result: IMAGE_STATE_UNDEPLOYABLE

Provisioning package present on the untouched Full Base image On the fresh instance, before installing anything, the following provisioning package already exists:

Get-ChildItem `
  "C:\Windows\Provisioning\Packages" `
  -Filter *.ppkg

Result: C:\Windows\Provisioning\Packages\SecureStart.Settings.ppkg

File information: Length: 7421 bytes LastWriteTime: 2024-04-01 08:11

There is also a corresponding provisioning registry entry: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\Results{eb7d7f2f-3b77-4b87-b301-fd0d336f709a}

PackageFileName REG_SZ SecureStart.Settings.ppkg

I have not manually removed this provisioning package or modified its registry state because I want to stay within a supported AWS/Microsoft imaging workflow. Control test: Windows Server 2025 Core I then repeated the same test on the Windows Server 2025 Core Base AMI from the same AMI generation. Core image information: AMI Origin Version: 2026.09.17 AMI Origin Name: Windows_Server-2025-English-Core-Base EC2Launch: 2.5.2 Windows Server 2025 Datacenter Windows build: 26100 Architecture: 64-bit

Verified using:

Get-Content "C:\ProgramData\Amazon\EC2Launch\log\agent.log" |
Select-String "AMI Origin Version|AMI Origin Name|EC2 Launch"

Output: AMI Origin Version: 2026.09.17 AMI Origin Name: Windows_Server-2025-English-Core-Base Launch: EC2 Launch v2.5.2

Windows version:

Get-ComputerInfo |
Select-Object WindowsProductName,WindowsVersion,OsBuildNumber,OsArchitecture

Output: WindowsProductName : Windows Server 2025 Datacenter WindowsVersion : 2009 OsBuildNumber : 26100 OsArchitecture : 64-bit

EC2Launch version:

& "$env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" version

Result: 2.5.2

On this Core image, the exact same command:

& "$env:ProgramFiles\Amazon\EC2Launch\EC2Launch.exe" sysprep --shutdown=true

completes successfully and the instance shuts down normally. Reproducible comparison Windows_Server-2025-English-Full-Base AMI Origin Version: 2026.09.17 EC2Launch: 2.5.2 Windows build: 26100

Fresh EC2 instance No domain join No RDS roles No application installation No custom configuration

Sysprep result: FAIL → ProvPackageSysprepGeneralize → Failed to remove package (null) → HRESULT 0x80070002 → IMAGE_STATE_UNDEPLOYABLE

Compared with: Windows_Server-2025-English-Core-Base AMI Origin Version: 2026.09.17 EC2Launch: 2.5.2 Windows build: 26100

Same Sysprep command

Sysprep result: SUCCESS → generalize completes → instance shuts down normally

Why I need Sysprep I need to create reusable customized Windows Golden AMIs for an RDS deployment, particularly: RDS Session Host RD Connection Broker RD Web Access RD Licensing RD Gateway

Server Core cannot be used as a replacement for all of these roles. In particular, I need the Full/Desktop Experience image for the RDS Session Host and other GUI-dependent RDS roles. Therefore the Core image succeeding is useful as a control test, but it does not solve the deployment requirement. Questions Could AWS confirm:

1. Is this a known issue with Windows_Server-2025-English-Full-Base, AMI Origin Version 2026.09.17?
2. Is the failure in ProvPackageSysprepGeneralize related to SecureStart.Settings.ppkg or its provisioning metadata?
3. Is there a supported remediation for this issue?
4. Is manually removing SecureStart.Settings.ppkg or its registry state supported?
5. Is a corrected Windows Server 2025 Full Base AMI planned or already available?
6. Are there any known differences in the provisioning state between the Full and Core 2025 AMIs that would explain why Core Sysprep succeeds while Full fails? I can provide the complete files if useful: C:\Windows\System32\Sysprep\Panther\setupact.log C:\Windows\System32\Sysprep\Panther\setuperr.log C:\ProgramData\Amazon\EC2Launch\log\agent.log

The key point is that the issue is reproducible on a fresh AWS-provided Windows Server 2025 Full Base instance, before any RDS or domain configuration, while the equivalent Core Base image from the same AMI generation successfully completes the same Sysprep workflow. Thank you in advance !

Theo