cannot join remote windows 10 pro desktop to newly created aws simple ad domain

Question

I followed all the instructions from AWS.  Created a VPC, created a Directory Service (simple AD) and created a EC2 Windows Server instance that is joined to the simple AD.  I can remote in to the EC2 instance via RDC and I setup a new user and a new computer in the active directory.  When i try to connect a computer to the domain it says it cannot be contacted.  I cannot ping the public IP of the instance although I am RDC to it.  I cannot ping it from either the computer(1) that is RDC to it nor from the computer(2) that i am trying to add to the domain.  I added the public IP of the EC2 as the primary DNS server for computer2.  I am setting the computer name and user name to what I setup in the active directory and the domain to "MYDOMAIN.COM" which is what AWS lists as my domain name.  
I checked the security groups for the EC2 and the "AWS created security group for directory controllers"  seems to allow ICMP from 0.0.0.0/0 which is anywhere.  So not sure why I cannot ping.  I have checked the IP address 5 ways from Sunday.  Any suggestions greatly appreciated.
**UPDATE**:  I have tried numerous things to ping the domain controller.  The public IP does not respond.  And of course windows cannot contact the DNS server.  I checked the security group several times and the DNS port is open as is the ICMP.  Don't know where to turn next.  ????

Answer

Could you please verify if you have configured these rules in your Security Group (SG) and Network Access Control List (ACL)?

#### Security Group Inbound Rules:
- ICMP - IPv4 - All
- TCP - Ports 53, 88, 389, 445, 139 - Source: 0.0.0.0/0
- UDP - Ports 53, 88, 389, 137, 138 - Source: 0.0.0.0/0

#### Security Group Outbound Rules:
- All traffic - Destination: 0.0.0.0/0

#### Network ACL Inbound Rules:
- Rule #100 - ICMP - IPv4 - All - Source: 0.0.0.0/0
- Rule #110 - TCP - Ports 53, 88, 389, 445, 139 - Source: 0.0.0.0/0 
- Rule #120 - UDP - Ports 53, 88, 389, 137, 138 - Source: 0.0.0.0/0

#### Network ACL Outbound Rules:
- Rule #100 - All traffic - Destination: 0.0.0.0/0

> 💡 These rules should allow the necessary inbound and outbound traffic for Active Directory and DNS communication between the local Windows 10 Pro desktops and the AWS Simple AD domain controller.

> ℹ️ [Enhance your AWS Managed Microsoft AD network security configuration](https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_network_security.html#aws_apps_support)

Answer

Hi,

So if I understand correctly, 
- You were able to successfully join the first EC2 instance (EC2-1) to the Simple AD Domain, but you are not able to join another instance (EC2-2) to the same domain. 
- You are able to remote desktop into EC2-1 using the public IP but you cannot ping the same IP 
- You are also not able to ping the Public IP of EC2-2
- Security Groups attached to both EC2 instances allow ICMP from anywhere

Assuming the configuration is correct, and it looks like it, the ping failure could be the local windows firewall blocking the traffic, I would check that to rule it out.

For the domain join issue, it looks like it may be DNS related. 
I assume you are performing a manual join of the instance to the AD domain - see https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_join_windows_instance.html - and in this case you need to add the Simple AD's IP addresses as the DNS IP address of the EC2 instance, so the instance can perform a lookup your AD domain. 
It looks like you are using the EC2-1's public IP address instead, can you share more why you are doing that?

cannot join remote windows 10 pro desktop to newly created aws simple ad domain

Security Group Inbound Rules:

Security Group Outbound Rules:

Network ACL Inbound Rules:

Network ACL Outbound Rules:

Relevant content