Hello,

If an instance cannot be reached via RDP after a patch operation:

1. Verify system and instance status checks

Review both status check types in the EC2 console

2. Check the instance screenshot if status checks are passing

Navigate to: EC2 Console → Actions → Monitor and troubleshoot → Get Instance screenshot

This will show the current operating system status

3. Investigate failed status checks

Use Get Instance screenshot to identify the error code

Analyze instance logs using the EC2Rescue tool

Reference: https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2rw-gui.html#ec2rescue-offline

Additional resource: https://learn.microsoft.com/en-us/answers/questions/5555278/unable-to-connect-windows-vm-via-rdp-post-patching

4. Troubleshoot RDP connectivity if all checks pass

If status checks and OS status appear normal, proceed with standard RDP troubleshooting procedures

example: Consider your Instance Private ip: 192.168.0.20 Public ip: 58.12.0.0

Troubleshooting Steps for RDP Issue:

1. Check the connectivity of the instance using the ping command. Note: Please allow ICMP port on the security group attached to the affected instance.

   click start-> cmd-> ping 192.168.0.20 ping 58.12.0.0

2. Check the 3389 port is open on the instance

   Click Start-> Powershell(run as administrator) -> Test-NetConnection -ComputerName 192.168.0.20 -Port 3389 Test-NetConnection -ComputerName 58.12.0.0 -Port 3389

3. If above test fails, Please try the ping command from another instance in the same subnet.

   Note: Please allow the ICMP port on the security group

                Ex: ping  192.168.0.20
   

4. Please try to take RDP of the instance from another instance in the same subnet

5. Open a PowerShell window on a instance which is launched in the same subnet, and then run the following command:

    Test-NetConnection -ComputerName  192.168.0.20 -Port 3389
   

The possible cause for this issue can be the below reasons:

1. The Windows Firewall, or other firewall software, is blocking RDP traffic to the instance.

2. Check Network Level Authentication is disabled on instance.

If the instance is successfully reporting to the AWS Systems Manager service (showing as a managed instance), complete the following troubleshooting steps:

In the system manager console -> select Documents -> search for AWSSupport-TroubleshootRDP -> Select Execute Automation-> Select the affected instance

Submit the values as mentioned in the attached screenshot (AWSSupport-TroubleshootRDP.png) -> Click Execute.

Wait for few minutes to complete the execution. You can also the find the results in the output. Once overall status is success. Please reboot the instance, this is required for the settings to take effect.

References:

[1] AWSSupport-TroubleshootRDP - https://docs.aws.amazon.com/systems-manager-automation-runbooks/latest/userguide/automation-awssupport-troubleshootrdp.html

[2] Troubleshoot connecting to your Windows instance - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/troubleshoot-connect-windows-instance.html

[3] Troubleshoot RDP - https://repost.aws/knowledge-center/troubleshoot-remote-desktop-connection-ec2-windows