I mistakenly disabled RDP in one of my EC2 windows instances through Group Policy Editor. Now I cannot RDP to that instance even with administrator account. I get this message in the login screen now.

I did not enable WinRM in those instances, but not sure if they come enabled by default.

How can I re-enable RDP access in that EC2 instance?

  • Sounds like a tough problem. I'd look at installing another windows machine on the same VPC and try to use administration tools on that new server to administer the other server. – vjones Feb 6 '17 at 19:06

Yes, You can able to re-enable RDP using the AWSSupport-ExecuteEC2Rescue Automation (AWS Systems Manager)

Please follow below steps carefully:

  1. Open the AWS Systems Manager console at https://console.aws.amazon.com/systems-manager/.

  2. In the navigation pane, choose Automation.

  3. Choose Execute automation.

  4. In the documents list, choose AWSSupport-ExecuteEC2Rescue. The document owner is Amazon.

  5. In the Document details section verify that Document version is set to the highest default version. For example, 13 (default).

  6. In the Execution mode section, choose Simple execution. Leave the Targets and Rate Control option disabled.

  7. In the Input parameters section, specify the following parameters:

    For UnreachableInstanceId, specify the ID of the unreachable instance.

    For LogDestination, specify an Amazon S3 bucket if you want to collect operating system-level logs while troubleshooting your instance. Logs are automatically uploaded to the specified bucket.

    For EC2RescueInstanceType, specify an instance type for the EC2Rescue instance. The default instance type is t2.small.(Please leave as it is if you are confused and go ahead)

    For SubnetId, specify a subnet in an existing VPC in the same availability zone as the unreachable instance. By default, Systems Manager creates a new VPC, but you can specify a subnet in an existing VPC if you want. (Please leave as it is if you are confused and go ahead)


If you don't see the option to specify a bucket or a subnet ID, verify that you are using the latest Default version of the document.

For Assume Role, if you created roles for this Automation by using the CloudFormation procedure described earlier in this topic, then specify the AssumeRole ARN that you copied from the CloudFormation console.

  1. Choose Execute automation.

It takes sometimes (5-10 minutes) and you are able to access your old instance with new IP.

Here is the official AWS documentation for this issue: https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-remote-desktop-connection-ec2-windows/

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.