SecureAnyCloud
Deployment guide

Windows Server 2019

Overview

Windows Server 2019 builds on Windows Server 2016 with improvements to hybrid cloud integration, security features including Windows Defender Advanced Threat Protection, and container support with smaller base images and better Linux container compatibility.

This guide covers deploying and configuring Windows Server 2019 from the SecureAnyCloud AMI on AWS Marketplace. What you get:

  • Windows Server 2019, preconfigured and patched
  • AWS CLI v2 for interacting with AWS services from the command line
  • AWS CloudWatch Agent for monitoring metrics and collecting logs
  • AWS Systems Manager Agent (SSM) for remote management and automation
  • Latest security patches applied at build time
  • 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA

Prerequisites

Before you launch the AMI, make sure you have:

  • An active AWS account
  • An active subscription to the Windows Server 2019 listing on AWS Marketplace
  • An EC2 key pair for decrypting the Administrator password
  • A Remote Desktop client (Microsoft Remote Desktop, mRemoteNG or similar)

Recommended instance type: t3.large (2 vCPU, 8 GB RAM) for general workloads.

Minimum requirements: 1 vCPU, 512 MB RAM and 30 GB of disk space.

1

Launch the AMI

  • Open AWS Marketplace and search for "Windows Server 2019 SecureAnyCloud".
  • Choose Continue to Subscribe, accept the terms, then choose Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Choose Continue to Launch.
  • Choose Launch through EC2 for full control over instance configuration.
  • Select your instance type (t3.large recommended).
  • Configure storage with at least 30 GB of gp3 for the C:\ drive. Add EBS volumes as needed for application data.
  • Configure your Security Group with an inbound rule for TCP 3389 from your IP address (Remote Desktop, RDP).
  • Select your EC2 key pair and launch the instance.

Important: Restrict RDP port 3389 to your specific IP address or corporate VPN range only. Never expose RDP to the public internet (0.0.0.0/0).

2

Retrieve the Administrator password

Once the instance has passed both status checks (2/2), retrieve the Administrator password. Allow 4 to 5 minutes after launch for the password to become available.

  • Open the EC2 Console and go to Instances.
  • Select your newly launched Windows Server instance.
  • Choose Actions > Security > Get Windows Password.
  • Choose Browse and upload the .pem key pair file you selected at launch.
  • Choose Decrypt Password.
  • Copy the decrypted Administrator password and store it securely.

Important: The password is not available immediately after launch. Wait for the instance to reach 2/2 status checks, and allow at least 4 minutes before you decrypt.

3

Connect via Remote Desktop (RDP)

  • Open your Remote Desktop client.
  • Create a new connection and enter the public IP address of your EC2 instance. Use the private IP address if you connect to your VPC over a VPN.
  • When prompted, enter the user name Administrator and the decrypted password from Step 2.
  • If you receive a certificate warning, choose Continue. This is expected for self-signed certificates on new instances.

You are now connected to your Windows Server 2019 instance.

4

Verify installed components

Open a Command Prompt or PowerShell window and verify the AWS tooling.

Check the AWS CLI version:

aws --version

Check the CloudWatch Agent status:

Get-Service AmazonCloudWatchAgent

Check the Systems Manager Agent status:

Get-Service AmazonSSMAgent

Server Components

  • AWS CLI 2.8.2: installed on the system PATH
  • AWS CloudWatch Agent 1.3.5: C:\Program Files\Amazon\AmazonCloudWatchAgent
  • AWS Systems Manager Agent 3.1.1: C:\Program Files\Amazon\SSM

Note: Component versions reflect the installation at build time. Windows Update or manual upgrades may change them.

Filesystem Layout

The C:\ drive is the system drive. It holds the Windows Server operating system, installed programs and user data.

Tip: For production workloads, consider attaching additional EBS volumes (D:\, E:\ and so on) for application data, databases or log files. This keeps them separate from the operating system drive.

Managing Services

You can manage Windows services from the Services management console or from PowerShell.

Open the Services console:

services.msc

List all running services in PowerShell:

Get-Service | Where-Object {$_.Status -eq 'Running'}

Start a service:

Start-Service -Name "ServiceName"

Stop a service:

Stop-Service -Name "ServiceName"

Restart a service:

Restart-Service -Name "ServiceName"

Using AWS CLI

The AWS CLI is available from any Command Prompt or PowerShell session. Verify that it works:

aws --help

To configure credentials for the AWS CLI, either attach an IAM instance profile (recommended) or run:

aws configure

Configuring CloudWatch Agent

The CloudWatch Agent wizard creates a custom configuration for monitoring metrics and logs. To launch it, run:

cd "C:\Program Files\Amazon\AmazonCloudWatchAgent" amazon-cloudwatch-agent-config-wizard.exe

Follow the interactive prompts to select the metrics and logs you want to collect. Then start the CloudWatch Agent from PowerShell:

& "C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1" -a fetch-config -m ec2 -s -c file:configuration-file-path

Replace configuration-file-path with the full path to your generated configuration file.

Scripts and Log Files

  • Windows Event Viewer (eventvwr.msc): system, application and security event logs
  • CloudWatch Agent logs (C:\ProgramData\Amazon\AmazonCloudWatchAgent\Logs): CloudWatch Agent operational logs
  • SSM Agent logs (C:\ProgramData\Amazon\SSM\Logs): Systems Manager Agent logs

Troubleshooting

Cannot connect via RDP

  • Wait for the EC2 instance to reach 2/2 status checks.
  • Verify that your security group allows port 3389 from your IP address.
  • Wait at least 4 to 5 minutes after launch before you decrypt the password.
  • Confirm that you are using the correct key pair for password decryption.
  • Check that the instance has a public IP address, or connect through its private IP address over a VPN.

Password decryption fails

  • Use the exact .pem key pair file that you selected at launch.
  • Wait at least 4 minutes after launch. The password is not available immediately.
  • If you have changed the Administrator password, the AWS Console can no longer retrieve it.

RDP session disconnects or freezes

  • Check the instance status in the EC2 Console for impaired status checks.
  • Verify that your internet connection is stable.
  • Reduce the display resolution and colour depth in your RDP client settings.
  • Consider AWS Systems Manager Session Manager as an alternative connection method.

AWS CLI not recognised

  • Open a new Command Prompt window. The PATH may not be set in existing sessions.
  • Verify the installation with where aws.
  • If the CLI is missing, reinstall it from https://aws.amazon.com/cli/.

High CPU or memory usage

  • Open Task Manager (Ctrl+Shift+Esc) to identify processes that use many resources.
  • Check that Windows Update is not running a large update cycle in the background.
  • Review the Windows Defender scan schedules, because scans can consume resources.
  • Consider moving to a larger instance type if resources are consistently insufficient.

Security Recommendations

  • Restrict RDP access. Allow port 3389 only from your specific IP address or VPN CIDR range, and never from 0.0.0.0/0.
  • Change the Administrator password. After your first login, replace the decrypted default password with a strong, unique one.
  • Enable Network Level Authentication (NLA). NLA adds an authentication layer to RDP connections.
  • Keep Windows updated. Apply Windows security updates and patches regularly.
  • Use IAM instance profiles. Attach IAM roles to the instance instead of storing AWS access keys on the server.
  • Enable Windows Firewall. Keep it enabled with appropriate rules.
  • Use Windows Defender. Windows Server 2019 includes Windows Defender Advanced Threat Protection. Keep it enabled and up to date.
  • Configure CloudWatch monitoring. Set up the CloudWatch Agent to monitor CPU, memory and disk metrics and to alert on anomalies.
  • Enable AWS Systems Manager. Use SSM for patching, inventory and remote access without opening RDP to the internet.
  • Use encrypted EBS volumes. EBS encryption protects data at rest.
  • Configure backups. Set up AWS Backup or EBS snapshots for regular server backups.

Support

If you run into any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7, with a guaranteed 24-hour response SLA

Deploy on AWS

Launch Windows Server 2019 with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com