A Guide to Windows EC2 Password Recovery by EC2Rescue

Overview

Losing access to your Windows administrator password on an Amazon Elastic Compute Cloud (EC2) instance can be a frustrating experience. However, AWS provides a solution that allows you to reset the administrator password even when you don’t have the PEM key, and it involves using the EC2Launch service. In this guide, we will walk you through the steps to regain control of your Amazon EC2 instance.

Prerequisites

1. A Windows Server 2016 or later Amazon Machine Image (AMI).
2. Basic knowledge of Amazon Web Services (AWS) and Amazon EC2 instances.
3. Access to the AWS Management Console.

Step-by-Step Guide

Step 1: Detach the Root Volume

• Open the Amazon EC2 console.
• In the navigation pane, select “Instances.”
• Choose the instance for which you need to reset the password and click “Actions,” then “Instance State,” and finally “Stop Instance.” Wait until the Amazon EC2 instance is stopped.
• You can proceed if you have the private key you used when launching the instance. If not, follow these steps to replace the instance with a new key pair:

1. Create a new key pair with the same name as the lost one.
2. Create an image of the instance by choosing “Actions,” “Image and templates,” and then “Create image.” After the image is available, launch a new instance from it.
3. Choose the new key pair during the instance launch.
4. If the original instance has an Elastic IP address, transfer it to the new instance.
5. Terminate the stopped original instance.

• In the description panel of the original instance, please make a note of the ID of the Amazon EBS volume that is indicated as the root device.
• In the navigation pane, select “Volumes.”
• Choose the volume noted in the previous step, select “Actions,” and then “Detach Volume.” Wait until the volume status changes to “available.”

Step 2: Attach the volume to a temporary instance as described in the following steps.

• Launch a temporary instance with a different version of Windows in the same Availability Zone as the original instance.
• After launching the temporary instance, choose the same instance type, Amazon VPC, subnet, security group, and AWS IAM role as the original instance. Assign a new key pair to the temporary instance if necessary.
• In the navigation pane, select “Volumes,” choose the volume you detached from the original instance, select “Actions,” and then “Attach Volume.”
• In the Attach Volume dialog box, specify the temporary instance and set the device to “xvdf.” Click “Attach.”

Step 3: Reset the Administrator Password

• Access the temporary instance and use the EC2Rescue for Windows Server tool for further actions. Follow these steps:

1. Download and extract the EC2Rescue for Windows Server zip file and run EC2Rescue.exe.
2. Accept the license agreement.
3. Select “Offline instance” mode.

4. Choose the “xvdf” device.

5. Confirm the disk selection.

6. Select “Diagnose and Rescue.”

7. Choose “Reset Administrator Password.”

8. Confirm and complete the rescue process.

• Close the EC2Rescue tool, disconnect from the temporary instance, and return to the Amazon EC2 console.
• In the navigation pane, select “Instances” and choose the temporary instance. Note the ID of the Amazon EBS volume listed as “xvdf” on the Storage tab.
• In the navigation pane, select “Volumes,” choose the volume noted in the previous step, select “Actions,” and then “Detach Volume.” Wait until the volume status changes to “available.”

Step 4: Restart the Original Instance

• Reattach the volume to the original instance as its primary root volume. Select “Volumes,” choose the volume you detached from the temporary instance, select “Actions,” and then “Attach Volume.”
• In the Attach Volume dialog box, specify the original instance and set the device to “/dev/sda1.” Click “Attach.” After the volume status changes to “in-use,” select the original instance and select “Instance State,” followed by “Start instance”.
• Retrieve your fresh Windows administrator password by using the private key associated with the new key pair and establish a connection with the instance.
• If you have no further use for the temporary instance, you can terminate it by selecting it and choosing “Instance State” and then “Terminate instance.”

Conclusion

Drop a query if you have any questions regarding EC2Rescue and we will get back to you quickly.

About CloudThat

CloudThat is a leading provider of Cloud Training and Consulting services with a global presence in India, the USA, Asia, Europe, and Africa. Specializing in AWS, Microsoft Azure, GCP, VMware, Databricks, and more, the company serves mid-market and enterprise clients, offering comprehensive expertise in Cloud Migration, Data Platforms, DevOps, IoT, AI/ML, and more. CloudThat is recognized as a top-tier partner with AWS and Microsoft, including the prestigious ‘Think Big’ partner award from AWS and the Microsoft Superstars FY 2023 award in Asia & India. Having trained 650k+ professionals in 500+ cloud certifications and completed 300+ consulting projects globally, CloudThat is an official AWS Advanced Consulting Partner, AWS Training Partner, AWS Migration Partner, AWS Data and Analytics Partner, AWS DevOps Competency Partner, Amazon QuickSight Service Delivery Partner, Amazon EKS Service Delivery Partner, Microsoft Gold Partner, AWS Microsoft Workload Partners, Amazon EC2 Service Delivery Partner, and many more.

To get started, go through our Consultancy page and Managed Services Package, CloudThat’s offerings.