Amazon WorkSpaces - How long can I keep individual workspaces in Maintenance Mode

Question

We are in the process of replacing our Win 10 workspaces with Windows 11.

We need to be able to "lock out" a user from their Windows 10 machine if they haven't agreed to an upgrade. We can't just Delete their VDI out of fear of losing data.

I believe that putting a workspace in Maintenance Mode prevents a user from logging in. Is there a time limit for how long we can keep a workspace in maint mode?

Is there a better way to do this, prevent a user from logging into their VDI without deleting it?

Manvitha Potluri · Accepted Answer

Yes, you can keep an Amazon WorkSpace in Maintenance Mode indefinitely. There is no AWS-enforced time limit for how long a WorkSpace can remain in Maintenance Mode.
It’s a reliable way to block access without deleting the environment or losing user data. Alternatively, you could also revoke access at the Active Directory level or change the user's password temporarily. Maintenance Mode is the simplest and safest option during transition periods like OS upgrades.

**What Maintenance Mode Does**
When you place a WorkSpace in Maintenance Mode:
The WorkSpace becomes inaccessible to the user (they can't log in).
Billing continues, but only for storage and basic compute (depending on the bundle).
The instance remains intact; data, profile, and disk contents are preserved.

**This makes it a safe option if:**

You want to temporarily restrict access,
But need to preserve the environment and user data for a future decision (e.g., upgrade to Windows 11 or data backup).

**Better Alternative?**
If your goal is to block access without losing data, here are a few secure options:

**Option 1: Use Maintenance Mode (Safe & Simple)**
No login allowed
Data preserved
No AWS time limit

**Option 2: Revoke Directory Access**
Remove the user from the Active Directory group or OU associated with the WorkSpace.
This blocks login at the directory level, but requires AD management skills.

**Option 3: Change the AD password**
Set a strong random password for the user temporarily.
User won’t be able to log in, but the WorkSpace remains running and data is intact.

**Avoid**
Deleting the WorkSpace unless you have a recent snapshot or backup.
AWS does not offer automatic backup unless configured (e.g., via snapshots, FSLogix, or roaming profiles).

re:Post Agent · Answer

Yes, putting a WorkSpace in Maintenance Mode (also called ADMIN_MAINTENANCE state) will prevent users from logging in to their WorkSpace. When a WorkSpace is in this state:

1. Users cannot log in to the WorkSpace
2. The WorkSpace does not respond to requests to reboot, stop, start, rebuild, or restore
3. An AutoStop WorkSpace in this state will not be hibernated

There is no documented time limit for how long you can keep a WorkSpace in Maintenance Mode. You can maintain your WorkSpaces on your own schedule by changing the state to Maintenance and then back to Available when you're ready to allow access again.

This approach is appropriate for your use case of preventing users from accessing their Windows 10 WorkSpaces until they agree to an upgrade, while still preserving their data. When you're ready to perform the upgrade or when the user agrees, you can simply change the state back to Available to proceed with the upgrade process.

Another option to consider is configuring idle disconnect timeout policies, but this would only disconnect inactive sessions rather than preventing login entirely, so Maintenance Mode is better suited for your specific requirement.  
**Sources**  
[Maintenance in WorkSpaces Personal - Amazon WorkSpaces](https://docs.aws.amazon.com/workspaces/latest/adminguide/workspace-maintenance.html)  
[ModifyWorkspaceState - Amazon WorkSpaces Service](https://docs.aws.amazon.com/workspaces/latest/api/API_ModifyWorkspaceState.html)

Amazon WorkSpaces - How long can I keep individual workspaces in Maintenance Mode

Add your answer

Relevant content