Windows Server 2022

Prerequisites

Before you launch this AMI, make sure you have:

• An active AWS account.
• An active subscription to the Windows Server 2022 listing on AWS Marketplace.
• An EC2 key pair for decrypting the Administrator password.
• A Remote Desktop client, such as Microsoft Remote Desktop or mRemoteNG.

Recommended instance type: t3.large (2 vCPU, 8 GB RAM) for general workloads.

Minimum requirements: 1 vCPU, 512 MB RAM and 30 GB disk space.

Server Components

These components are installed at build time:

• AWS CLI: version 2.8.2, on the system PATH.
• AWS CloudWatch Agent: version 1.3.5, in C:\Program Files\Amazon\AmazonCloudWatchAgent.
• AWS Systems Manager Agent: version 3.1.1, in C:\Program Files\Amazon\SSM.

Note: Component versions reflect the build-time installation. Windows Update or manual upgrades may change them.

Filesystem Layout

C:\ is the system drive. It contains the Windows Server OS, installed programs and user data.

Tip: For production workloads, consider attaching additional EBS volumes (D:\, E:\ and so on) for application data, databases or log files. This separates them from the operating system drive.

Managing Services

You can manage Windows services from the Services management console or from PowerShell.

Open the Services console:

services.msc

List all running services in PowerShell:

Get-Service | Where-Object {$_.Status -eq 'Running'}

Start a service:

Start-Service -Name "ServiceName"

Stop a service:

Stop-Service -Name "ServiceName"

Restart a service:

Restart-Service -Name "ServiceName"

Using AWS CLI

The AWS CLI is available from any Command Prompt or PowerShell session. Verify it is working:

aws --help

To configure credentials for AWS CLI, either attach an IAM instance profile (recommended) or run:

aws configure

Configuring CloudWatch Agent

The CloudWatch Agent wizard lets you create a custom configuration for monitoring metrics and logs. To launch it:

cd "C:\Program Files\Amazon\AmazonCloudWatchAgent" amazon-cloudwatch-agent-config-wizard.exe

Follow the interactive prompts to select the metrics and logs you want to collect. After configuration, start the CloudWatch Agent in PowerShell:

& "C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1" -a fetch-config -m ec2 -s -c file:configuration-file-path

Replace configuration-file-path with the full path to your generated configuration file.

Scripts and Log Files

These are the main log locations:

• Windows Event Viewer: eventvwr.msc. It shows the system, application and security event logs.
• CloudWatch Agent logs: C:\ProgramData\Amazon\AmazonCloudWatchAgent\Logs. These are the CloudWatch Agent operational logs.
• SSM Agent logs: C:\ProgramData\Amazon\SSM\Logs. These are the Systems Manager Agent logs.

Troubleshooting

Cannot connect via RDP

• Wait for the EC2 instance to reach 2/2 status checks.
• Verify that your security group allows port 3389 from your IP.
• Wait at least 4 to 5 minutes after launch before you decrypt the password.
• Confirm that you are using the correct key pair for password decryption.
• Check that the instance has a public IP address, or connect through its private IP over a VPN.

Password decryption fails

• Make sure you are using the exact .pem key pair file that was selected at launch.
• Wait at least 4 minutes after instance launch, because the password is not available immediately.
• If you have changed the Administrator password, the AWS Console can no longer retrieve it.

RDP session disconnects or freezes

• Check the instance status in the EC2 Console for any impaired status checks.
• Verify that your internet connection is stable.
• Reduce the display resolution and colour depth in your RDP client settings.
• Consider using AWS Systems Manager Session Manager as an alternative connection method.

AWS CLI not recognised

• Open a new Command Prompt window, because the PATH may not be set in existing sessions.
• Verify the installation: where aws
• If the CLI is missing, reinstall it from https://aws.amazon.com/cli/.

High CPU or memory usage

• Open Task Manager (Ctrl+Shift+Esc) to identify processes that use many resources.
• Check that Windows Update is not running a large update cycle in the background.
• Review Windows Defender scan schedules, because scans can consume resources.
• Consider upgrading to a larger instance type if resources are consistently insufficient.

Security Recommendations

• Restrict RDP access. Allow port 3389 only from your specific IP or VPN CIDR range, and never from 0.0.0.0/0.
• Change the Administrator password. After first login, replace the decrypted password with a strong, unique password.
• Enable Network Level Authentication (NLA). Make sure NLA is enabled for RDP connections to provide an additional authentication layer.
• Use TLS 1.3. Windows Server 2022 enables TLS 1.3 by default. Make sure your applications take advantage of it for encrypted communications.
• Keep Windows updated. Apply Windows security updates and patches regularly.
• Use IAM instance profiles. Attach IAM roles to the instance instead of storing AWS access keys on the server.
• Enable Windows Firewall. Make sure Windows Firewall is enabled with appropriate rules.
• Use Windows Defender. Windows Server 2022 includes Windows Defender with enhanced threat protection. Make sure it remains enabled and up to date.
• Use secured-core server features. Windows Server 2022 supports secured-core capabilities. Enable Virtualization Based Security (VBS) and Credential Guard where supported.
• Configure CloudWatch monitoring. Set up the CloudWatch Agent to monitor CPU, memory and disk metrics, and to alert on anomalies.
• Enable AWS Systems Manager. Use SSM for patching, inventory and remote access without opening RDP to the internet.
• Use encrypted EBS volumes. Enable EBS encryption to protect data at rest.
• Configure backups. Set up AWS Backup or EBS snapshots for regular server backups.

Support

If you encounter any issues with this product, contact SecureAnyCloud support:

• Email: sales@secureanycloud.com
• Website: secureanycloud.com
• Support hours: 24/7 with a guaranteed 24 hour response SLA

Deploy on AWS

Launch Windows Server 2022 with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect with Remote Desktop as the Administrator user. This image is Windows Server 2022 Datacenter.

Launch from AWS Marketplace

• Open the listing on AWS Marketplace, choose View purchase options, then choose Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose Windows Server 2022 Datacenter as the software version, then choose your Region and an instance type. m5.large (2 vCPU, 8 GiB) is the recommended starting size.
• Choose a key pair. You need its private key to get the Administrator password. Without a key pair, there is no way to read the password.
• Use a security group that allows RDP (TCP 3389) from your own address only. Avoid 0.0.0.0/0 if you can. The listing's default security group opens 3389 to the internet so the instance is reachable straight away, so tighten it to your address range.
• Launch the instance, then wait about four minutes after it is running. Windows finishes its first boot and EC2Launch sets the Administrator password.

Get the Administrator password

In the EC2 console, select the instance and choose Actions, Security, Get Windows password. Upload the private key of the key pair you launched with, then choose Decrypt password. Or use the AWS CLI on your workstation:

aws ec2 get-password-data --region <region> --instance-id <instance-id> \
  --priv-launch-key ~/.ssh/my-key-pair.pem --query PasswordData --output text

An empty result means Windows has not finished setting the password yet. Try again a minute later. Every instance has a different password.

Connect over Remote Desktop

Connect to the instance's public DNS name or IP address on port 3389. Use any Remote Desktop client that supports Network Level Authentication, such as Microsoft Remote Desktop on Windows and macOS or FreeRDP on Linux. Sign in as user Administrator with the password from the previous step.

On first connection, your client shows the instance's self-signed Remote Desktop certificate. Each instance generates its own certificate on first boot, so the fingerprint is unique to your instance. To check it before you trust it, read the thumbprint from the instance (for example over AWS Systems Manager Session Manager) and compare it with what your client shows:

Get-ChildItem 'Cert:\LocalMachine\Remote Desktop' | Select-Object Subject, Thumbprint, NotAfter

If you will share the decrypted password with anyone, change the Administrator password after your first sign-in. Press Ctrl+Alt+End in the Remote Desktop session and choose Change a password. The baseline requires at least 14 characters with complexity, and it remembers the last 24 passwords.

View the baseline report

Everything the build measured ships in C:\ProgramData\SecureAnyCloud\baseline\:

• baseline-report.html: every rule audited, its result and the recommended value, with waived rules marked.
• hardeningkitty-report.csv: the raw HardeningKitty audit.
• baseline-summary.json: rules audited, waived, scored and passed, plus the pass rate and threshold.
• waivers.txt and waivers.json: the waived rules and why.
• tool-versions.json: the baseline, LGPO and HardeningKitty versions and SHA-256 values used.

Show the summary in PowerShell:

Get-Content C:\ProgramData\sac\baseline\baseline-summary.json | ConvertFrom-Json | Select-Object profile, audited, waived, scored, pass, fail, ratePct, thresholdPct, evaluatedAt

Open baseline-report.html in a browser on the instance, or copy it to your workstation.

Re-run the audit yourself

HardeningKitty v.0.9.4 stays in the image so you can measure the instance again at any time, for example after you install software or join a domain. Run it in an elevated PowerShell (Run as administrator). It only reads settings (Audit mode) and takes a minute or two:

$hk = 'C:\ProgramData\sac\tools\HardeningKitty-0.9.4' Import-Module "$hk\HardeningKitty.psm1" -Force $list = "$hk\lists\finding_list_msft_security_baseline_windows_server_2022_21h2_member_machine.csv" $csv = Join-Path $env:TEMP 'hardeningkitty-now.csv' Remove-Item $csv -ErrorAction SilentlyContinue $null = Invoke-HardeningKitty -Mode Audit -FileFindingList $list -Report -ReportFile $csv -SkipMachineInformation *>&1 $waived = (Get-Content -Raw C:\ProgramData\sac\baseline\waivers.json | ConvertFrom-Json).waivers.id $scored = @(Import-Csv $csv | Where-Object { $waived -notcontains $_.ID }) $pass = @($scored | Where-Object { $_.Severity -eq 'Passed' }).Count "{0} of {1} scored rules pass ({2:N1}%)" -f $pass, $scored.Count, (100 * $pass / $scored.Count) $scored | Where-Object { $_.Severity -ne 'Passed' } | Select-Object ID, Name, Result, Recommended

Waived rules

These rules from Microsoft's finding list are set differently on purpose. Each one is in waivers.txt with its reason:

• 10311, Deny access to this computer from the network (set to Guests): The baseline denies network logon to local administrators. Remote Desktop with Network Level Authentication checks the Administrator's password with a network logon first, so the EC2 Administrator could not sign in.
• 10312, Deny log on through Remote Desktop Services (set to Guests): The baseline denies Remote Desktop to every local account. On a stand-alone EC2 instance, the local Administrator is the only way in.
• 10672-10677, Device Guard: Virtualization Based Security and Credential Guard (6 rules, set to Not configured): Credential Guard needs UEFI Secure Boot. This image boots in legacy BIOS mode on EC2, so the policy could not run and a "pass" would be misleading.

If you join the instance to an Active Directory domain, Microsoft's domain-joined guidance applies. Once you sign in with domain accounts, you can deny local accounts network and Remote Desktop logon again.

Windows Firewall

Every firewall profile (Domain, Private, Public) is on with inbound traffic blocked unless a rule allows it. The only inbound rules enabled are Remote Desktop (3389, TCP and UDP) and core networking (ICMP, DHCP). List them:

Get-NetFirewallRule -Direction Inbound -Enabled True -Action Allow | Select-Object DisplayGroup, DisplayName, Profile | Sort-Object DisplayGroup, DisplayName Get-NetFirewallProfile | Select-Object Name, Enabled, DefaultInboundAction

To serve something else, for example HTTPS for IIS, open the port in the Windows Firewall and in the instance's security group:

New-NetFirewallRule -DisplayName 'HTTPS (TCP-In)' -Direction Inbound -Protocol TCP -LocalPort 443 -Action Allow

Windows Remote Management (WinRM, 5985) is closed by default. If you need PowerShell remoting, use AWS Systems Manager Session Manager, which needs no inbound port.

IMDSv2

The AMI is marked IMDSv2-only. A metadata request without a token is refused (HTTP 401), so request a token first:

try { Invoke-WebRequest -UseBasicParsing http://169.254.169.254/latest/meta-data/instance-id | Out-Null; 'tokenless call answered' } catch { 'tokenless call refused: HTTP ' + [int]$_.Exception.Response.StatusCode } $token = Invoke-RestMethod -Method Put -Uri http://169.254.169.254/latest/api/token -Headers @{ 'X-aws-ec2-metadata-token-ttl-seconds' = '300' } Invoke-RestMethod -Uri http://169.254.169.254/latest/meta-data/instance-id -Headers @{ 'X-aws-ec2-metadata-token' = $token }

The AWS tools and SDKs, EC2Launch v2 and the SSM agent in the image all use IMDSv2.

Per-instance identity

Sysprep runs at the end of the build, so no machine identity is shared between instances. The Administrator password, the machine SID, the computer name (EC2AMAZ-...) and the Remote Desktop certificate are all created on each instance's first boot. Check them:

$env:COMPUTERNAME (Get-LocalUser -Name Administrator).SID.Value Get-ChildItem 'Cert:\LocalMachine\Remote Desktop' | Select-Object -ExpandProperty Thumbprint

Services

Nothing beyond Windows Server itself is installed. The services that matter on EC2 are running. They are Remote Desktop Services (TermService), the AWS Systems Manager agent (AmazonSSMAgent), EC2Launch v2 (Amazon EC2Launch), Microsoft Defender Antivirus (WinDefend) and the Windows Firewall (mpssvc):

Get-Service TermService, AmazonSSMAgent, 'Amazon EC2Launch', WinDefend, mpssvc | Select-Object Name, Status, StartType

Patching

The image is fully patched when it is built. The build does not change Windows Update's own settings. To check for updates yourself:

$searcher = (New-Object -ComObject Microsoft.Update.Session).CreateUpdateSearcher() $searcher.Search("IsInstalled=0 and IsHidden=0 and Type='Software'").Updates | Select-Object Title

Then install them from Settings, Windows Update, or with sconfig option 6. Restart when Windows asks.

The page file is cleared at every shutdown (ClearPageFileAtShutdown). This keeps memory contents off the disk but makes shutdowns slower on large-memory instances. To turn it off:

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management' -Name ClearPageFileAtShutdown -Value 0

Emergency access

If you lose the Administrator password, connect with AWS Systems Manager Session Manager and set a new one. The instance needs an instance profile with the AmazonSSMManagedInstanceCore policy. Alternatively, follow the AWS guide "Reset the Windows administrator password for an Amazon EC2 instance" (EC2Launch v2 or EC2Rescue). If the instance does not answer on 3389, the EC2 serial console and the instance screenshot in the EC2 console can help.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com. Windows Server licensing is included in the AWS instance charge. Send licensing questions to AWS and Microsoft.

Microsoft and Windows Server are trademarks of the Microsoft group of companies. SecureAnyCloud is not affiliated with or endorsed by Microsoft.

Deploy on AWS

Launch Windows Server 2022 Datacenter on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com