Performed EC2Rescue on a volume multiple times successfully, yet unable to establish RDP connection when mounted as root on the original EC2 windows instance.
I have an instance that is not able to decrypt the password using the newly configured .pem key. It's giving error
- stop and dismount the root volume of "no password" EC2 instance
- attach it as a secondary volume in a helper EC2 instance
- perform diagnosis and rescue on the volume through this instance using EC2Rescue.
- reset the administrator password
- dismount the volume after you finish with the EC2Rescue operations. Which ran successfully FYI.
- attach it as root volume to the "no password" EC2 instance.
- start the instance and yet I see the error above when I go for password decryption.
Few details about this "no password" EC2 instance:
- An AMI(windows server) was migrated from another region
- An instance was created from this AMI. Once all the work was done on it another AMI was created again.
- Now image from this second AMI is giving me this trouble.
Please guide me on how I can create an RDP connection to this AMI? EC2Rescue doesn't seem to work at all.
- Newest
- Most votes
- Most comments
In my case, the Windows Administrator password was never generated after I created a new AMI and launched an instance using a different key pair. When I tried to decrypt the password from the EC2 console, it stayed in the “waiting for password” state indefinitely.
I initially attempted the offline EC2Rescue approach by stopping the instance, attaching the root volume to a helper instance, and running EC2Rescue there. Although the rescue operation completed successfully, it did not resolve the issue. The instance still did not generate a new Windows password, and RDP access continued to fail.
The key point I discovered is that offline EC2Rescue does not regenerate the EC2 Windows password metadata that is required for key-pair decryption. Because of this, the password never becomes available in the EC2 console.
What worked for me
The password had to be reset from inside the instance itself using EC2Rescue via AWS Systems Manager (SSM).
Prerequisites
The instance must be SSM-managed
An IAM role attached with AmazonSSMManagedInstanceCore
SSM Agent running on the instance
Network access to SSM endpoints
Command used
aws ssm send-command
--instance-ids <instance-id>
--document-name "AWSSupport-RunEC2RescueForWindowsTool"
--parameters "Command=ResetAccess"
--output text
This command completed successfully and returned a reference to AWS Systems Manager Parameter Store, where the new local Administrator password was securely stored.
After retrieving the password from Parameter Store, I was able to connect to the instance using RDP without any issues.
Once I confirmed this worked, I ran the same SSM EC2Rescue command on the original instance, and that resolved the problem there as well.
Summary
Waiting for the password after launching from a new AMI did not work
Offline EC2Rescue (volume attach method) did not help
Running EC2Rescue via SSM regenerated the password and restored RDP access
📘 AWS documentation: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-ssm.html
answered 10 months ago
Relevant content
asked 4 years ago
