windows server 2025 unreachable after kB5048667

Thank you for reporting this issue with Windows Server 2025 becoming unreachable after installing KB5048667. This is a known issue related to Device Guard being enabled by default in Windows Server 2025.Our internal teams are actively working on resolving this issue. In the meantime Here are some workarounds you can try:

1. Group Policy Method:

   • Launch Local Group Policy Editor (gpedit.msc)
   • Navigate to Computer Configuration\Administrative Templates\System\Device Guard
   • Configure "Turn On Virtualization Based Security"
   • Set Radio button to Disabled
   • Apply changes
   • Try joining the domain again

2. Registry Method: Open an elevated cmd or PowerShell prompt and run:

   • reg add HKLM\System\CurrentControlSet\Control\Lsa /v LsaCfgFlags /d 0 /t REG_DWORD
   • reg add HKLM\SOFTWARE\Policies\Microsoft\Windows\DeviceGuard /v LsaCfgFlags /d 0 /t REG_DWORD
   • Ensure "The operation completed successfully." is returned from both commands
   • Try joining the domain again

3. Use BIOS boot mode: This issue doesn't occur when using BIOS boot mode. You can use the BIOS image for Windows Server 2025: BIOS-Windows_Server-2025-English-Full-Base (ami-043539cbdc18a470d) as an interim solution.

4. Switch to an AMD instance type: This issue only affects instance types where VBS/CG is available. AMD-backed instance types don't support VBS features, so they're not impacted. You can recover a failing instance by switching to an AMD instance type (e.g., from t3.xlarge to t3a.xlarge).

The EC2 team is actively working on resolving this issue.

dear AWS support, any update about this issue?

more information, we deployed recent 2025 server amazon/Windows_Server-2025-English-Full-Base-2025.03.12, it was working fine at t3.2xlarge. later, after updating, it is able to boot, and then Full Stop -> Start and server is becoming non bootable (just black screen).

What is interesting, we have couple of 2025 outside of domain, and they are able to start fine. What domain specific setting or policy can make it unbootable? Do we have any tshoot manualy?