SecureAnyCloud
Deployment guide

Windows Server 2025

Overview

Windows Server 2025 is Microsoft's latest Long Term Servicing Channel (LTSC) release, built on the 24H2 platform (build 26100). Mainstream support runs until November 2029 and extended support until November 2034. It introduces hotpatching for many security updates without a reboot (on-premises this requires Azure Arc and VBS), GPU partitioning with live migration, a more scalable Active Directory, SMB security hardening (SMB signing required by default and configurable SMB over QUIC), and TLS 1.3 support for LDAP over TLS.

This guide covers deploying and configuring Windows Server 2025 from the SecureAnyCloud AMI on AWS Marketplace.

What you get:

  • Windows Server 2025 Datacenter, preconfigured and patched.
  • AWS CLI v2, for interacting with AWS services from the command line.
  • AWS CloudWatch Agent, for monitoring metrics and collecting logs.
  • AWS Systems Manager Agent (SSM), for remote management and automation.
  • EC2Launch v2 with ENA networking and NVMe storage drivers.
  • The latest security patches, applied at build time.
  • 24/7 SecureAnyCloud support with a guaranteed 24-hour response SLA.

Prerequisites

Before you launch this AMI, make sure you have:

  • An active AWS account.
  • An active subscription to the Windows Server 2025 listing on AWS Marketplace.
  • An EC2 key pair, for decrypting the Administrator password.
  • A Remote Desktop client (Microsoft Remote Desktop, mRemoteNG or similar).

Recommended instance type: t3.large (2 vCPU, 8 GB RAM) for general workloads.

Minimum requirements: 1 vCPU, 512 MB RAM and 30 GB disk space.

1

Launch the AMI

  • Go to AWS Marketplace and search for "Windows Server 2025 SecureAnyCloud".
  • Click Continue to Subscribe, accept the terms, then click Continue to Configuration.
  • Select your preferred Region and Software Version.
  • Click Continue to Launch.
  • Choose Launch through EC2 for full control over instance configuration.
  • Select your instance type (t3.large is recommended).
  • Configure storage with a minimum of 30 GB gp3 for the C:\ drive. Add more EBS volumes as needed for application data.
  • Configure your Security Group with one inbound rule: port 3389, protocol TCP, source your IP, for Remote Desktop (RDP) access.

Important: Restrict RDP port 3389 to your specific IP address or corporate VPN range only. Never expose RDP to the public internet (0.0.0.0/0).

  • Select your EC2 key pair and launch the instance.
2

Retrieve the Administrator Password

When the instance has passed both status checks (2/2), retrieve the Administrator password. Allow 4 to 5 minutes after launch for the password to become available.

  • Open the EC2 Console and go to Instances.
  • Select your newly launched Windows Server instance.
  • Click Actions > Security > Get Windows Password.
  • Click Browse and upload the .pem key pair file you selected at launch.
  • Click Decrypt Password.
  • Copy the decrypted Administrator password and store it securely.

Important: The password is not available immediately after launch. Wait for the instance to reach 2/2 status checks, and allow at least 4 minutes before you try to decrypt it.

3

Connect via Remote Desktop (RDP)

  • Open your Remote Desktop client application.
  • Create a new connection and enter the public IP address of your EC2 instance. Use the private IP if you connect through a VPN to your VPC.
  • When prompted, enter Administrator as the username and the decrypted password from Step 2.
  • If you receive a certificate warning, click Continue. This warning is expected for self-signed certificates on new instances.

You are now connected to your Windows Server 2025 instance.

4

Verify Installed Components

Open a Command Prompt or PowerShell window and verify the AWS tooling.

Check the AWS CLI version:

aws --version

Check the CloudWatch Agent status:

Get-Service AmazonCloudWatchAgent

Check the Systems Manager Agent status:

Get-Service AmazonSSMAgent

Server Components

  • AWS CLI: version 2.34.62, installed on the system PATH.
  • AWS CloudWatch Agent: version 1.300067.0, installed in C:\Program Files\Amazon\AmazonCloudWatchAgent.
  • AWS Systems Manager Agent: preinstalled and auto-updating, installed in C:\Program Files\Amazon\SSM.

Note: Component versions reflect the build-time installation. Windows Update or manual upgrades may change them.

Filesystem Layout

C:\ is the system drive. It contains the Windows Server OS, installed programs and user data.

Tip: For production workloads, consider attaching additional EBS volumes (D:\, E:\ and so on) for application data, databases or log files. This keeps them separate from the operating system drive.

Managing Services

You can manage Windows services with the Services management console or with PowerShell.

Open the Services console:

services.msc

List all running services in PowerShell:

Get-Service | Where-Object {$_.Status -eq 'Running'}

Start a service:

Start-Service -Name "ServiceName"

Stop a service:

Stop-Service -Name "ServiceName"

Restart a service:

Restart-Service -Name "ServiceName"

Using AWS CLI

The AWS CLI is available from any Command Prompt or PowerShell session. Verify that it works:

aws --help

To configure credentials for the AWS CLI, attach an IAM instance profile (recommended) or run:

aws configure

Configuring CloudWatch Agent

The CloudWatch Agent wizard creates a custom configuration for monitoring metrics and logs. To launch it:

cd "C:\Program Files\Amazon\AmazonCloudWatchAgent" amazon-cloudwatch-agent-config-wizard.exe

Follow the interactive prompts to select the metrics and logs you want to collect. Then start the CloudWatch Agent from PowerShell:

& "C:\Program Files\Amazon\AmazonCloudWatchAgent\amazon-cloudwatch-agent-ctl.ps1" -a fetch-config -m ec2 -s -c file:configuration-file-path

Replace configuration-file-path with the full path to your generated configuration file.

Scripts and Log Files

  • Windows Event Viewer: open eventvwr.msc for the system, application and security event logs.
  • CloudWatch Agent logs: C:\ProgramData\Amazon\AmazonCloudWatchAgent\Logs holds the CloudWatch Agent operational logs.
  • SSM Agent logs: C:\ProgramData\Amazon\SSM\Logs holds the Systems Manager Agent logs.

Troubleshooting

Cannot connect via RDP

  • Wait for the EC2 instance to reach 2/2 status checks.
  • Verify that your security group allows port 3389 from your IP.
  • Wait at least 4 to 5 minutes after launch before you decrypt the password.
  • Confirm that you use the correct key pair for password decryption.
  • Check that the instance has a public IP address, or connect through the private IP over a VPN.

Password decryption fails

  • Make sure you use the exact .pem key pair file that you selected at launch.
  • Wait at least 4 minutes after instance launch, because the password is not available immediately.
  • If you have changed the Administrator password, the AWS Console can no longer retrieve it.

RDP session disconnects or freezes

  • Check the instance status in the EC2 Console for any impaired status checks.
  • Verify that your internet connection is stable.
  • Reduce the display resolution and colour depth in your RDP client settings.
  • Consider using AWS Systems Manager Session Manager as an alternative connection method.

AWS CLI not recognised

  • Open a new Command Prompt window, because the PATH may not be set in existing sessions.
  • Verify the installation: where aws
  • If the CLI is missing, reinstall it from https://aws.amazon.com/cli/.

High CPU or memory usage

  • Open Task Manager (Ctrl+Shift+Esc) to identify resource-consuming processes.
  • Check that Windows Update is not running a large update cycle in the background.
  • Review Windows Defender scan schedules, which may consume resources during scans.
  • Consider upgrading to a larger instance type if resources are consistently insufficient.

Security Recommendations

  • Restrict RDP access. Allow port 3389 only from your specific IP or VPN CIDR range, and never from 0.0.0.0/0.
  • Change the Administrator password. After your first login, replace the decrypted default password with a strong, unique one.
  • Enable Network Level Authentication (NLA). NLA adds an authentication layer to RDP connections.
  • Use TLS 1.3. Windows Server 2025 supports TLS 1.3, including TLS 1.3 for LDAP over TLS. Make sure your applications use it for encrypted communications.
  • Apply hotpatching. Windows Server 2025 supports hotpatching to apply many security updates without a reboot. On-premises this requires Azure Arc and VBS. A quarterly baseline cumulative update still requires a reboot, and non-security, .NET and driver updates are not hotpatchable. Evaluate hotpatching to reduce maintenance windows.
  • Keep Windows updated. Apply Windows security updates and patches regularly.
  • Use IAM instance profiles. Attach IAM roles to the instance instead of storing AWS access keys on the server.
  • Enable Windows Firewall. Keep Windows Firewall enabled with appropriate rules.
  • Use Windows Defender. Windows Server 2025 includes Windows Defender with enhanced threat protection. Keep it enabled and up to date.
  • Enable Credential Guard. Windows Server 2025 supports Virtualization Based Security (VBS) and Credential Guard. Enable them where supported to protect credentials.
  • Harden SMB. Windows Server 2025 requires SMB signing by default and supports configurable SMB over QUIC. Keep these protections enabled for secure file access.
  • Configure CloudWatch monitoring. Set up the CloudWatch Agent to monitor CPU, memory and disk metrics, and alert on anomalies.
  • Enable AWS Systems Manager. Use SSM for patching, inventory and remote access without opening RDP to the internet.
  • Use encrypted EBS volumes. Enable EBS encryption to protect data at rest.
  • Configure backups. Set up AWS Backup or EBS snapshots for regular server backups.

Support

If you have any issues with this product, contact SecureAnyCloud support:

  • Email: sales@secureanycloud.com
  • Website: secureanycloud.com
  • Support hours: 24/7, with a guaranteed 24-hour response SLA.

Deploy on AWS

Launch Windows Server 2025 with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com