SecureAnyCloud
Deployment guide

Windows Server 2016

Overview

Windows Server 2016 is a mature, widely supported server operating system from Microsoft. It provides a stable platform on AWS for running enterprise applications, Active Directory, file services, web hosting with IIS, and more.

This guide covers the deployment and configuration of Windows Server 2016 using SecureAnyCloud AMIs from the AWS Marketplace.

What you get:

  • Windows Server 2016, preconfigured and patched
  • AWS CLI v2 for interacting with AWS services from the command line
  • AWS CloudWatch Agent for monitoring metrics and collecting logs
  • AWS Systems Manager Agent (SSM) for remote management and automation
  • The latest security patches, applied at build time
  • 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account
  • An active subscription to the Windows Server 2016 listing on AWS Marketplace
  • An EC2 key pair for decrypting the Administrator password
  • A Remote Desktop client (Microsoft Remote Desktop, mRemoteNG or similar)

Recommended instance type: t3.large (2 vCPU, 8 GB RAM) for general workloads.

Minimum requirements: 1 vCPU, 512 MB RAM and 30 GB of disk space.

1

Launch the AMI

  • In the AWS Marketplace, search for "Windows Server 2016 SecureAnyCloud".
  • Select Continue to Subscribe, accept the terms, then select Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Select Continue to Launch.
  • Choose Launch through EC2 for full control over instance configuration.
  • Select your instance type (t3.large recommended).
  • Configure storage: 30 GB gp3 minimum for the C:\ drive. Add more EBS volumes as needed for application data.
  • Configure your Security Group with the following inbound rule: port 3389, protocol TCP, source your IP address, for Remote Desktop (RDP) access.

Important: Restrict RDP port 3389 to your specific IP address or corporate VPN range only. Never expose RDP to the public internet (0.0.0.0/0).

  • Select your EC2 key pair and launch the instance.
2

Retrieve the Administrator password

When the instance has passed both status checks (2/2), retrieve the Administrator password. Allow 4 to 5 minutes after launch for the password to become available.

  • Open the EC2 Console and go to Instances.
  • Select your newly launched Windows Server instance.
  • Select Actions > Security > Get Windows Password.
  • Select Browse and upload the .pem key pair file that you selected at launch.
  • Select Decrypt Password.
  • Copy the decrypted Administrator password and store it securely.

Important: The password is not available immediately after launch. Wait for the instance to reach 2/2 status checks and allow at least 4 minutes before you try to decrypt it.

3

Connect over Remote Desktop (RDP)

  • Open your Remote Desktop client.
  • Create a new connection and enter the public IP address of your EC2 instance. If you connect over VPN to your VPC, use the private IP address instead.
  • When prompted, enter the credentials. The username is Administrator, and the password is the decrypted value from Step 2.
  • If you receive a certificate warning, select Continue. The warning is expected for self-signed certificates on new instances.

You are now connected to your Windows Server 2016 instance.

4

Verify installed components

Open a Command Prompt or PowerShell window and verify the AWS tooling.

Check the AWS CLI version:

aws --version

Check the CloudWatch Agent status:

Get-Service AmazonCloudWatchAgent

Check the Systems Manager Agent status:

Get-Service AmazonSSMAgent

Server components

The image includes these components, listed with version and install path:

  • AWS CLI: version 2.8.2, on the system PATH
  • AWS CloudWatch Agent: version 1.3.5, in C:\Program Files\Amazon\AmazonCloudWatchAgent
  • AWS Systems Manager Agent: version 3.1.1, in C:\Program Files\Amazon\SSM

Note: These component versions reflect the installation at build time. Windows Update or manual upgrades may change them.

Filesystem layout

  • C:\ the system drive, containing the Windows Server OS, installed programs and user data

Tip: For production workloads, attach additional EBS volumes (D:\, E:\ and so on) for application data, databases or log files, to keep them separate from the operating system drive.

Managing services

You can manage Windows services from the Services management console or from PowerShell.

Open the Services console:

services.msc

List all running services in PowerShell:

Get-Service | Where-Object {$_.Status -eq 'Running'}

Start a service:

Start-Service -Name "ServiceName"

Stop a service:

Stop-Service -Name "ServiceName"

Restart a service:

Restart-Service -Name "ServiceName"

Using the AWS CLI

The AWS CLI is available from any Command Prompt or PowerShell session. Verify that it works:

aws --help

To configure credentials for the AWS CLI, either attach an IAM instance profile (recommended) or run:

aws configure

Configuring the CloudWatch Agent

The CloudWatch Agent wizard creates a custom configuration for monitoring metrics and logs. To launch it, run:

cd "C:\Program Files\Amazon\AmazonCloudWatchAgent" amazon-cloudwatch-agent-config-wizard.exe

Follow the interactive prompts to select the metrics and logs that you want to collect. When the configuration is complete, start the CloudWatch Agent from PowerShell:

& "C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1" -a fetch-config -m ec2 -s -c file:configuration-file-path

Replace configuration-file-path with the full path to your generated configuration file.

Scripts and log files

Use these log locations:

  • Windows Event Viewer (eventvwr.msc): system, application and security event logs
  • CloudWatch Agent logs (C:\ProgramData\Amazon\AmazonCloudWatchAgent\Logs): CloudWatch Agent operational logs
  • SSM Agent logs (C:\ProgramData\Amazon\SSM\Logs): Systems Manager Agent logs

Troubleshooting

Cannot connect over RDP

  • Wait for the EC2 instance to reach 2/2 status checks.
  • Verify that your security group allows port 3389 from your IP address.
  • Wait at least 4 to 5 minutes after launch before you decrypt the password.
  • Confirm that you are using the correct key pair for password decryption.
  • Check that the instance has a public IP address, or connect through the private IP address over VPN.

Password decryption fails

  • Make sure that you are using the exact .pem key pair file that you selected at launch.
  • Wait at least 4 minutes after instance launch. The password is not available immediately.
  • If you have changed the Administrator password, the AWS Console can no longer retrieve it.

RDP session disconnects or freezes

  • Check the instance status in the EC2 Console for any impaired status checks.
  • Verify that your internet connection is stable.
  • Reduce the display resolution and colour depth in your RDP client settings.
  • Consider using AWS Systems Manager Session Manager as an alternative connection method.

AWS CLI not recognised

  • Open a new Command Prompt window. The PATH may not be set in existing sessions.
  • Verify the installation: where aws
  • If the AWS CLI is missing, reinstall it from https://aws.amazon.com/cli/.

High CPU or memory usage

  • Open Task Manager (Ctrl+Shift+Esc) to identify processes that use many resources.
  • Check that Windows Update is not running a large update cycle in the background.
  • Consider upgrading to a larger instance type if resources are consistently insufficient.

Security recommendations

  • Restrict RDP access: allow port 3389 only from your specific IP address or VPN CIDR range, and never allow 0.0.0.0/0.
  • Change the Administrator password: replace the decrypted default password with a strong, unique password after your first login.
  • Enable Network Level Authentication (NLA): make sure NLA is enabled for RDP connections to provide an additional authentication layer.
  • Keep Windows updated: apply Windows security updates and patches regularly.
  • Use IAM instance profiles: attach IAM roles to the instance instead of storing AWS access keys on the server.
  • Enable Windows Firewall: make sure Windows Firewall is enabled with appropriate rules.
  • Configure CloudWatch monitoring: set up the CloudWatch Agent to monitor CPU, memory and disk metrics and to alert on anomalies.
  • Enable AWS Systems Manager: use SSM for patching, inventory and remote access without opening RDP to the internet.
  • Use encrypted EBS volumes: enable EBS encryption to protect data at rest.
  • Configure backups: set up AWS Backup or EBS snapshots for regular server backups.

Support

If you encounter any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7 with a guaranteed 24-hour response SLA

Deploy on AWS

Launch Windows Server 2016 with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com